A Fix for Checkpoint SecureClient VPN on Mac OS X 10.

6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Sysadmin's World
Harald's Blog for System Administrators.
Home
mail
whoami

A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow

Leopard
Posted on 03 September 2009

We all remember, once Leopard was out it took Checkpoint quite a long time to update their VPN client.
Now Snow Leopard is out and it begins …

After installing Snow Leopard, Checkpoints SecureClient refuses to install and if already installed (through
an upgrade) it won’t start at all.

I did some investigation and I finaly made it working since Apple hasn’t changed too much.

1. The Checkpoint installer refuses to install

The installer checks up for the Darwin Kernel version 9. In Snow Leopard we have version 10. So two files
need to be edit within the installer package.

1. just right click on the installer and select Show Package Contents. This opens finder within the
package.
2. go to Contents/Resources.
3. open TextEdit, use vi in a shell or whatever you prefer to edit a simple file
4. on file “InstallationCheck” change the number 9 in line 8 to number 10: if [ "$MAJOR" != "10" ];
then
5. same on file “postinstall “ change the number 9 in line 84 to number 10

That’s it. Just install it and reboot. Changes need to make afterwards in order to have it starting.

2. SecureClient fails to start

http://www.sysadmins-world.com/?p=1&cpage=1 Page 1 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Now this gets just a bit more tricky. Apple has moved some options of kextload to kextutil in 10.6.
Checkpoint hardcoded such an option -s in two binary files. This option is to create the symbol files in the
Checkpoint directory. It does not exist anymore in kextload, and is now provided in kextutil. But creating
the symbol files is only needed for debug reasons, so not really necessary. Therefore I only replaced the
option -s with option -r to fill up the space, because the binary file should not change in size. Two binary
files have to be changed with an hexeditor.

Preparation:

Download and install a hexeditor. 0xED is one of it.

After inserting the first command, it will ask you for your local user password (User needs
Administrator permission)

1. Open the terminal application from Utilities folder and type:.

sudo cp /opt/CPsrsc-50/bin/StartupItemsMgr $HOME/Desktop
sudo cp /opt/CPsrsc-50/boot/SecureClient/SecureClientStarter /$HOME/Desktop
sudo chown $USER /$HOME/Desktop/StartupItemsMgr
sudo chown $USER /$HOME/Desktop/SecureClientStarter

2. Now run 0xED and choose File/Open Files from the Menu to load the StartupItemsMgr and
SecureClientStarter from your Desktop in it.
3. From Menu Edit choose Find/Find or just press Apple-F and type in to find: “kextload -s” and type in
replace “kextload -r”
Click on Replace All

Save and close …

4. Now once you succeeded editing copy those back by typing in the terminal window:
sudo cp $HOME/Desktop/StartupItemsMgr /opt/CPsrsc-50/bin/
sudo cp $HOME/Desktop/SecureClientStarter /opt/CPsrsc-50/boot/SecureClient/
rm $HOME/Desktop/StartupItemsMgr
rm $HOME/Desktop/SecureClientStarter
5. Reboot and you should have SecureClient starting …

http://www.sysadmins-world.com/?p=1&cpage=1 Page 2 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

I also succeeded by doing all the changes on the installer package. Probably only interesting if you have a
few Macs to install. As soon as I have a bit more time I could write it down here.

Please let me know if this did help.

CPVPN

Category: Apple Mac OS X, Snow Leopard

Tags: Checkpoint, SecureClient, Snow Leopard

226 responses to A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard

Newer Comments »
Rasers says:
September 6, 2009 at 6:11 am

Hi KK,

To know your username, open up a new Terminal window and type

whoami

That should be the username to use for the below commands

chown [short_username] /tmp/StartupItemsMgr

http://www.sysadmins-world.com/?p=1&cpage=1 Page 3 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

chown [short_username] /tmp/SecureClientStarter

Hope that helps!

Reply
Rasers says:
September 6, 2009 at 6:09 am

Hi Harald,

Thanks for the tip to remove the 2 files before installing. I have managed to get it installed and running :)

Thanks!

This tip below works !

Before running the installer just delete the followig files with:
Open Terminal (in Utilities folder) and type:
sudo -s
rm -rf /private/var/db/receipts/com.checkpoint.secureclient.R56.bom
rm -rf /private/var/db/receipts/com.checkpoint.secureclient.R56.plist

Reply
Mo says:
September 6, 2009 at 5:12 am

Sorry Harald…I am very needy!

I am asked for passwords…I leave blank, I type in my name, I type on my VPN user name and nothing….

Reply
Mo says:
September 6, 2009 at 4:56 am

Hi

I type in sudo and get a password request?

Is that right?

Reply
Typhon666 says:
September 6, 2009 at 1:12 am

I was working with a XP VM in Virtual box (arrrgg) to connect to my work since last friday. Now no VM
anymore, Very big thanks !

Reply
KK says:
September 6, 2009 at 12:05 am

http://www.sysadmins-world.com/?p=1&cpage=1 Page 4 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Herald when I run

chown [short_username] /tmp/StartupItemsMgr

chown [short_username] /tmp/SecureClientStarter

I am getting :

chown: [short_username]: Invalid argument

Thanks!

Reply
Louis24x7 says:
September 6, 2009 at 12:01 am

Very good information.

Instead of modifying the binary, I renamed /sbin/kextload and created a script called kextload that allows -s.

Thanks.

Reply
Harald Haentsch says:
September 5, 2009 at 11:31 pm

As Mo realized before, there is also an issue deinstalling SecureClient. It seems it leaves 2 files which then
cause the reinstalling not to install the SecureClient. It looks like its installing, but the install performs an
upgrade instead and the Files won’t just be there.

Before running the installer just delete the followig files with:
Open Terminal (in Utilities folder) and type:
sudo -s
rm -rf /private/var/db/receipts/com.checkpoint.secureclient.R56.bom
rm -rf /private/var/db/receipts/com.checkpoint.secureclient.R56.plist

Reply
Patrick Nielsen Hayden says:
September 5, 2009 at 11:13 pm

This worked perfectly. Thank you so much for going to the trouble — this has been torturing me since I
upgraded to Snow Leopard on day zero. Not being a professional VPN administrator, and faced with a
corporate IT department that tolerates but refuses to support connections from employees’ personal Macs, I
was driving myself nuts trying to make IPSecuritas work.

All is again right with the world. Whew.

Reply
Harald Haentsch says:
September 5, 2009 at 8:49 pm

http://www.sysadmins-world.com/?p=1&cpage=1 Page 5 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

The password is your user password. Once I have time I will come up with a more friendly manual.

Reply
Rich says:
September 5, 2009 at 5:09 pm

Hi – Ok, so I am the new boy here to Mac’s.

I have installed the Checkpoint software after modding the two files – THANKS :-)

But…I am stuck on

only root can write the concerning files, so open terminal and type: sudo -s

Basically when I type this it asks for a password – but I do not have a password set?

Also – I am slightly nervous about this Hex editing business too!!!!

Yours….slightly worried…..

Rich

Reply
Marco says:
September 5, 2009 at 3:01 pm

Ciao Harald,
now Secure Client is OK.

But I noticed that once it is started to work, showing its icon on menu bar at computer start, without having
any VPN configured, Iphone tethering stop working. In network preference I see ethernet IPHONE not
connect.
SO I tried to remove secure client again and tethering restarted to work fine. Tryng to stop secure client do
not reable tethering.

Ciao
Marco

Reply
Harald Haentsch says:
September 5, 2009 at 9:16 am

Hi Mo,

The terminal app is in Utilities folder. Once opened, you type the following:
sudo -s
cp /opt/CPsrsc-50/bin/StartupItemsMgr /tmp
cp /opt/CPsrsc-50/boot/SecureClient/SecureClientStarter /tmp
chown [short_username] /tmp/StartupItemsMgr

http://www.sysadmins-world.com/?p=1&cpage=1 Page 6 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

chown [short_username] /tmp/SecureClientStarter

Now run 0xED (link above) and open the files (Open File Path) “/tmp/StartupItemsMgr” and
“/tmp/SecureClientStarter”
In Menu Edit/Use Find and type “kextload -s” to find and type “kextload -d” to replace. Now Replace all
Do that for both files.
Save and close …

In terminal window type:

cp /tmp/StartupItemsMgr /opt/CPsrsc-50/bin/
cp /tmp/SecureClientStarter /opt/CPsrsc-50/boot/SecureClient/

Reboot and you should have SecureClient starting …

Reply
Mo says:
September 5, 2009 at 8:55 am

Hi Harald.

I’m not very computer technical…

Which file do I go to to try and change binary? Where do I find ‘terminal’ to type sudo -s?

Reply
Mo says:
September 5, 2009 at 8:46 am

Hi Harald!

I have now got it installed, had to go into time machine to get the old copy uninstalled.

I didn’t change the files in text edit as instructed…but have now!

Now to try and get it started with the next steps…

Will keep you posted

Reply
Harald Haentsch says:
September 5, 2009 at 7:35 am

Bob,
I haven’t tried it on 64bit mode. What if you try deinstall it, and reinstall in 32bit mode.

Reply
Harald Haentsch says:
September 5, 2009 at 7:34 am

Rasers,

http://www.sysadmins-world.com/?p=1&cpage=1 Page 7 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

How did you look for it. In the finder?

Open terminal and check if directory /opt/CPsrsc-50 exists: “ls /opt”
If it shows CPsrsc-50, it has not been successfully installed. Then follow the second section above.

Reply
Harald Haentsch says:
September 5, 2009 at 7:31 am

Mo!
Did you really follow the first section and changed the two files (InstallationCheck and postinstall) inside
the installer package?

Reply
Rasers says:
September 5, 2009 at 4:43 am

Sorry, need some help in installing. I downloaded a fresh copy of SecureClient from Checkpoint’s website –
http://www.checkpoint.com/downloads/quicklinks/downloads_sr.html

I followed the instructions to change the 2 files and installed it. The installation finished successfully and I
restarted but could not find this folder /opt/CPsrsc-50/

It seems that even though the installation seems to be successful, nothing was installed.

Anyone has this problem?

Reply

wong says:
September 11, 2009 at 5:28 pm

having the same problem as well … downloaded a fresh copy of checkpoint, did the modification of
the 2 files … installed without errors and rebooted but the folder “CPsrsc-50ʺ″ is not in /opt at all.

I looked at my other mac which is running leopard, i can see the CPsrsc-50 folder correctly, so for
sure I’m looking at the right place …

any idea?

Reply
Harald Haentsch says:
September 11, 2009 at 5:36 pm

Uninstall of SecureClient still leaves 2 files. This cause the installer not to install it, even if it
says so. Have a look on this post to clean SecureClient out. And the install it again:
http://www.sysadmins-world.com/?p=57

Reply
wong says:

http://www.sysadmins-world.com/?p=1&cpage=1 Page 8 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

September 11, 2009 at 5:56 pm

yes! finally got it to work by removing the files … thank you very much :)

Reply

Bob says:
September 5, 2009 at 2:28 am

I did the install while in 64 bit mode – rebooted in 64 bit mode, failed to start services. Rebooted in 32 bit
mode, failed to start services.

Double checked the files… everything seems to be in order.

Has anyone gotten this to work on 64 bit.

Thanks for any assistance.

Reply
Mo says:
September 5, 2009 at 1:19 am

Hi. I uninstalled Secure Client and then tried to reinstall after SL.
When I open the file “Installation Check” it says

Last login: Sat Sep 5 11:11:27 on ttys000

/Users/Manoja/Downloads/SecureClient_B634000031_1.pkg/Contents/Resources/InstallationCheck ; exit;
Macintosh:~ Manoja$
/Users/Manoja/Downloads/SecureClient_B634000031_1.pkg/Contents/Resources/InstallationCheck ; exit;
Unsupported kernel version.
logout

[Process completed]

How can I get around this?

Reply
Running Snow Leopard — Lavaconsult says:
September 5, 2009 at 12:52 am

[...] challenge is to get third party VPN software working again. I had issues with Checkpoint SecureClient
not working on Snow Leopard. But I got it working by following the hint on the Sysadmin’s World page.
Now [...]

Reply
Nate says:
September 4, 2009 at 8:42 pm

Carl, don’t worry about what “use VI in a shell” means… just use TextEdit, which is like Notepad for OSX

http://www.sysadmins-world.com/?p=1&cpage=1 Page 9 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

;) I’m sure you’ve probably seen that before? Use spotlight to search for “TextEdit” and it’ll open a window
just like Notepad does from the windows start menu.

All you’re doing is opening the files as he outlined in the steps, finding the line that he’s talking about and
changing “9ʺ″ to “10ʺ″. It’s really… really simple.

Good luck!

-nate

Reply

Namaste says:
October 1, 2009 at 2:00 am

I was never able to work Secure Client (downloaded version B634000031_1) with my Leopard, but I
just got Snow Leopard and am newly motivated seeing these posts. Two questions, as I’m not very
computer savvy:

1 Do I have to delete all previous Secure Clients before getting started on Snow Leopard?

2 Pls explain what exactly I’m supposed to do with Text Edit.

Thanks from Canada.

Reply
Harald Haentsch says:
October 1, 2009 at 9:27 am

1. To be on the safe side, just deinstall and follow the precedure to clean it up on my other post.

2. With TextEdit you can do the changes described in step 4 and 5.

Reply
Namaste says:
October 18, 2009 at 4:25 am

Harald,

I am no further ahead and am making myself crazy with this. I cannot get rid of my
previous (non-functioning) versions from Tiger days, and I really need to load on my
new Snow Leopard.

I am by no means a system administrator, and I imagine I’m doing something very simple
wrong. Is there any chance I can chat (msn, skype, etc) with you real time to get this
sorted out? I would be incredibly grateful.

Thanks,
Namaste

http://www.sysadmins-world.com/?p=1&cpage=1 Page 10 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Reply

Constantine Katevas says:

September 4, 2009 at 6:20 pm

Thank You Dude….. Great Help…

Reply
Carl Cooley says:
September 4, 2009 at 5:57 pm

I’m not a system administrator, but mac user in a windows world. Our system administrators are not likely
to help me with this fix of the Checkpoint VPN Client. I tried getting ipsecuritas to work, but had no
success. I am reasonable adept at tinkering, but not familiar with process for what seem like simple changes,
e.g. don’t know what “use vi in a shell” means or how to do it. Is this simply to complicated or time
consuming to explain in detail, or can you blow it out into more steps that I can follow (or direct me to a
source for that). Thanks.

Reply
harald says:
September 4, 2009 at 3:54 pm

I doubt it could break with 10.6.1. The changes are made on Checkpoint VPN Client, not on Snow Leopard
OS.
I think they will deploy a Snow Leopard client in a few months. But I guess they don’t do much more as
here. Checkpoint treats Mac OS X stepmotherly.

Reply
sergio says:
September 4, 2009 at 3:43 pm

Thank you, it works!

I hope:
- this doesn’t break with 10.6.1
- CheckPoint will work on an official, real Mac style release of SecureClient for Snow Leopard

Cheers!

Reply
Kam says:
September 4, 2009 at 2:09 pm

Hi there,

I upgraded to Snow Leopard yesterday and was pretty shocked to see the VPN client not working. I tried
out modifying the files you mentioned in the procedure above and it worked well.

Thanks a lot, it was pretty useful info!!

http://www.sysadmins-world.com/?p=1&cpage=1 Page 11 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Reply
harald says:
September 4, 2009 at 1:26 pm

open a terminal and check if directory /opt/CPsrsc-50 exists: “ls /opt”

If it shows CPsrsc-50, it has not been successfully installed, and you must have seen some error during the
uninstall.
Just try to remove the folder with “rm -rf /opt/CPsrsc-50ʺ″. And start the installer again.

Reply
Marco says:
September 4, 2009 at 1:16 pm

my installation fails reporting error:

Check Point VPN-1 SecureClient R56 HFA1 B634000031 can’t be installed on this computer.
SecureClient is already installed on this machine. Please remove the previous installation of SecureClient.

I’ve already uninstalled the previous version

Any help will be appreciated

Ciao
Marco

Reply
harald says:
September 4, 2009 at 11:27 am

? This is what you still type in a shell. Nothing to run so far ;-)

Reply
KK says:
September 4, 2009 at 11:10 am

chown [short_username] /tmp/StartupItemsMgr

chown [short_username] /tmp/SecureClientStarter

Please provide steps on how to run.. Thanks!

Reply
PhoneBoy says:
September 4, 2009 at 10:07 am

Props for extreme cleverness and sharing it with the Internet. That said, I must do my put on my corporate
hat for the following comment: “Check Point doesn’t support this.”

Reply
Rasers says:
September 4, 2009 at 9:43 am

http://www.sysadmins-world.com/?p=1&cpage=1 Page 12 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Thanks! I missed that, I will try again. Appreciate your help :) cheers

Reply
harald says:
September 4, 2009 at 8:16 am

Rasers,

if you install fails with such an error, it seems you didn’t change the files inside the package. Could you
please follow my first instruction. So the files “InstallationCheck” and “postinstall“ have to be changed. See
above!

Reply
Marco says:
September 4, 2009 at 7:51 am

Worked perfect!!! thanks very very very much!!

Reply
Rasers says:
September 4, 2009 at 7:51 am

It was installed and working properly in leopard. I upgraded to snow leopard and tried to change the binary
file as suggested. But I could only find /opt/CPsrsc-50/bin/StartupItemsMgr, the file /opt/CPsrsc-
50/boot/SecureClient/SecureClientStarter is missing.

I then uninstalled the application and tried to install it again. But I could not install the application anymore.
It says I’m using an unknown version of mac OS X and it only supports Tiger and above. But I’m using
snow leopard! heh

Any help is greatly appreciated. Thanks in advance

Reply
harald says:
September 4, 2009 at 6:54 am

Did your installation completed?

Does the folder /opt/CPsrc-50 exist?
Did you also type sudo -s (Step 1) first?

Reply
Rasers says:
September 4, 2009 at 6:28 am

I cant find /opt/CPsrsc-50/boot/SecureClient/SecureClientStarter. Any help?

Reply
Anthony says:
September 4, 2009 at 5:21 am

http://www.sysadmins-world.com/?p=1&cpage=1 Page 13 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

This worked perfectly on my Macbook! Thanks!

Reply
Nate says:
September 4, 2009 at 1:10 am

Fix worked perfectly for my existing installation, I added this URL to http://snowleopard.wikidot.com/,
which is where I first discovered that it was an issue (before my own osx10.6 installation) in the first place!

Genius!

-nate

Reply
Gabriel says:
September 3, 2009 at 10:24 pm

Thanks man….

I was trying since 2 days ago to set up IPsecuritas to connect to my work’s network….

Cheers…..from Switzerland too ;)

gabe

Reply
Patrick R. says:
September 3, 2009 at 9:55 pm

OMG this works!!!

1000 x thank you.

Your site will be promoted all over the world with this guide. I will post this site to a known swiss apple
site!

Best regards from Switzerland

Patrick

Reply
fred says:
September 3, 2009 at 9:22 pm

Thanks for the tip, it work perfectly !!

Reply
JU says:
September 3, 2009 at 9:07 pm

http://www.sysadmins-world.com/?p=1&cpage=1 Page 14 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Perfect – thanks!

Reply
harald says:
September 3, 2009 at 8:35 pm

Did you check the permissions. If your user in action is not member of group wheel, just change the file
owner by:
chown short_username /tmp/StartupItemsMgr
chown short_username /tmp/SecureClientStarter

To copy these files back, you dont need to reset permission since it will use the same as the file to be
overwritten.

Reply
JU says:
September 3, 2009 at 8:30 pm

I’m following your steps, but OxED won’t open the files. The error reads “The document
“StartupItemsMgr” could not be opened. ”

Any suggestions? Thanks.

Reply
harald says:
September 3, 2009 at 7:49 pm

Sorry, that was copy & paste, you are right. It is on line 84. What error do you get?

Reply
Jon says:
September 3, 2009 at 7:37 pm

Hi, This a very welcome fix but It fails for me on install after changing the 2 files. In postinstall that line is
much further down the script. It isn’t on line 8?

Reply
b3r says:
September 3, 2009 at 6:54 pm

It’s works 100%

Thanks!!!!
Thanks!!!!
Thanks!!!!
Thanks!!!!
Thanks!!!!
Thanks!!!!

Reply

http://www.sysadmins-world.com/?p=1&cpage=1 Page 15 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Newer Comments »

Leave a Response

Name (required)

Mail (will not be published) (required)

Website

Submit Response

Comment Spam Protection by WP-SpamFree

Search for: Search

Recent Posts
Joining a NetApp Filer to a PDC on OS X 10.5/10.6 – Unsolved
Accessing CIFS Share on NetApp Filer gives Error -36
Changing the Installer package Checkpoint’s SecureClient R56 to work with Snow Leopard
Clean uninstall of Checkpoint SecureClient on Snow Leopard
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard

Recent Comments
SANJAY SHUKLA on A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow
Leopard
Harald Haentsch on A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard
Tom Myers on A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard

http://www.sysadmins-world.com/?p=1&cpage=1 Page 16 of 17
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard | Sysadmin's World 12/2/09 2:42 PM

Archives
Select Month

coffee kitty

Recent Posts
Joining a NetApp Filer to a PDC on OS X 10.5/10.6 – Unsolved
Accessing CIFS Share on NetApp Filer gives Error -36
Changing the Installer package Checkpoint’s SecureClient R56 to work with Snow Leopard
Clean uninstall of Checkpoint SecureClient on Snow Leopard
A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard

Tag Cloud

Checkpoint FAS 3020c Join Mac OS X Server NetApp OS X 10.6 R56 SecureClient Snow Leopard
Meta
Sysadmin's World is proudly powered by WordPress and the SubtleFlux theme.

Copyright © Sysadmin's World

Log in
Valid XHTML
XFN

http://www.sysadmins-world.com/?p=1&cpage=1 Page 17 of 17