Tunnelblick starts each time I login, no option to disable this.

[Joseph Erlewein]

I'm a (very) occasional TunnelBlick user. Since outbound IPSEC and SSL VPNs are blocked on most networks I use, I only use TunnelBlick when on alien networks to connect to my home services.

That said, Tunnelblick ALWAYS starts when I log into or restart my mac. There's no dialog in Preferences / Users / Login Items to adjust, and it seems that there used to be a setting within TunnelBlick to adjust this, but it's been removed.

Is there a .plist file I can edit to stop the darn thing from running all the time? I'd hate to uninstall it.

But I use it rarely enough that a manual launch is just fine, in fact preferred.

If it can't be done, I'll just completely remove the program and keep the installer .dmg around.

If it's my only recourse, although a silly one, I'm fine with (re-) installing it, using it, then uninstalling it until I need it again.

Silly, but also silly to remove the auto-start control option from the program, IMO.

Thanks,

Joe

[Tunnelblick developer]

Tunnelblick should start when you log in if it was running when you last logged out (or restarted or shut down your computer, either of which causes a logout). It's always done that; it isn't new behavior.

So to get Tunnelblick to NOT start when you log in, just be sure to quit Tunnelblick before you log out (or restart or shut down your computer).

Notes:

1. It is possible (but unlikely from the behavior you describe), that you have manually set Tunnelblick as a "Login item" in System Preferences | Users & Groups. That should not be done, and if you have such a login item you should remove it so Tunnelblick behaves as intended. The usual symptom of this is that, if you don't quit Tunnelblick when you log out, Tunnelblick will be launched twice when you log in: once by itself and once as a login item. The second launch will cause Tunnelblick to display the "VPN Details" window. You haven't described that behavior, so I don't think this applies to you.
   
   
2. Although it doesn't apply to you, Tunnelblick will also start when you log in if there is a process named "openvpn" running when you log in. (That would be the situation if you have Tunnelblick set up to connect to a VPN when the computer starts.)

[jre]

Hi,

I disagree.

There's an option in Preferences to not launch applications you had open when you log in.

I do not use this - I like starting my machine "Fresh" with nothing running from my last session.

Currently, TunnelBlick is the only thing I've been unable to stop from auto-starting when I login to my mac.

The only "Login Items" I use are the Speech Synthesis Server (voice announcements) and the VMWare Fusion one. (I even disabled iTunesHelper because .. I don't use iTunes). I've manually disabled all else.

I don't have Tunnelblick set to connect to anything when my computer starts, or automatically. I use it to connect to a server when on untrusted networks, and that is it. So, naturally, I'm annoyed that I can't disable it from starting with my mac. I don't want this. I want it to just sit there, unused, like any of the other hundreds of apps, until I call for it to start.

Is anyone aware of a .plist or other way that TunnelBlick is invoked so that I can shut this thing off? 

I've gone back to uninstalling the app, and when I need it just reinstalling from the .dmg file.

IMHO, not having a way to disable auto-start is pretty shady.

joe

[Tunnelblick developer]

@jre -- why not just quit Tunnelblick when you've finished using it?

Then it won't be launched when log in. It can be done with two clicks, which is a lot easier than re-installing Tunnelblick, which requires many clicks and the entry of your admin password (and perhaps an admin username if you normally run as a standard user).

That said, there is a preference you can set so that Tunnelblick is not launched at login because it was running when you logged out. Enter the following all on one line in Terminal (it is best to copy/paste it):

defaults  write  net.tunnelblick.tunnelblick  doNotLaunchOnLogin  -bool  yes

To restore the original functionality:

defaults delete net.tunnelblick.tunnelblick doNotLaunchOnLogin

Even with this preference set, Tunnelblick will launch at login if there is a process named "openvpn" or "tunnelblick-helper" running (indicating that a configuration was set up to connect when your computer starts).

And note that Tunnelblick's LaunchAtLogin.sh script will always run (briefly) at login unless Tunnelblick is uninstalled (using the instructions at Uninstalling Tunnelblick). I have just (commit #0b4ab41b) updated the comments at the start of the script to clarify how it works.

[jre]

> why not just quit Tunnelblick when you've finished using it?

I do. But each time I start my mac, it auto-launches. This is what I'd like top stop. As discussed previously, I've already disabled applications from re-starting after logout/login (and restarts) and have been manually quitting it each time beforehand anyway, so it is something to do with the way TunnelBlick gets installed. There's a wedge that enables a launch-at-boot flag or something. 

Thank you for the preferences outline; I'll try this now and report back shortly. 

Cheers!

Joe

[Tunnelblick developer]

If Tunnelblick launches when you log on after having quit Tunnelblick before you logged off, then something else is launching Tunnelblick.

Look on the "Login Items" tab in System Preferences | Users & Groups and make sure Tunnelblick is not present.

If it is, remove it as follows:

1. Click to select the line with Tunnelblick -- ignoring the check box, which is for something else;
2. Click the little "-" (minus sign) sign below the list.

[jre]

> defaults  write  net.tunnelblick.tunnelblick  doNotLaunchOnLogin  -bool  yes

Update: this does not work. Tunnelblick launches anyway.

I ran it again, checked it to be sure it was set, and it still launches:

jre@Mac:~ $ defaults write  net.tunnelblick.tunnelblick  doNotLaunchOnLogin  -bool  yes

jre@Mac:~ $ defaults read net.tunnelblick.tunnelblick | grep -i launch

    SUHasLaunchedBefore = 1;

    doNotLaunchOnLogin = 1;

    lastLanguageAtLaunchWasRTL = 0;

    lastLaunchTime = "522259551.496262";

    launchAtNextLogin = 0;

I did a little investigating the third time I rebooted, running a series of "ps" commands looking for "tun" while my mac was in the process of booting, as soon as the GUI was responsive:

jre@Mac:~ $ ps waux | grep -i tun

jre         483  12.0  0.0  2470520   2888   ??  R    12:08PM   0:00.13 defaults read net.tunnelblick.tunnelblick launchAtNextLogin

jre         479   0.1  0.0  2443632   1020   ??  S    12:08PM   0:00.00 /bin/bash /Applications/Tunnelblick.app/Contents/Resources/launchAtLogin.sh

jre         496   0.0  0.0  2442020    796 s000  S+   12:08PM   0:00.00 grep -i tun

jre         482   0.0  0.0  2452848    624   ??  S    12:08PM   0:00.00 /bin/bash /Applications/Tunnelblick.app/Contents/Resources/launchAtLogin.sh

jre         418   0.0  0.2  2498196  13584   ??  Ss   12:08PM   0:00.06 /Applications/iTunes.app/Contents/PlugIns/iTunesCacheExtension.appex/Contents/MacOS/iTunesCacheExtension

jre@Mac:~ $ ps waux | grep -i tun

jre         535   0.0  0.0  2433828    640 s000  R+   12:08PM   0:00.00 grep -i tun

jre         503   0.0  0.4  2594772  32476   ??  S    12:08PM   0:00.97 /Applications/Tunnelblick.app/Contents/MacOS/Tunnelblick

jre         418   0.0  0.2  2498196  13660   ??  Ss   12:08PM   0:00.06 /Applications/iTunes.app/Contents/PlugIns/iTunesCacheExtension.appex/Contents/MacOS/iTunesCacheExtension

jre@Mac:~ $ ps waux | grep -i tun

jre         503   0.0  0.4  2584472  30972   ??  S    12:08PM   0:00.98 /Applications/Tunnelblick.app/Contents/MacOS/Tunnelblick

jre         564   0.0  0.0  2432804    776 s000  S+   12:08PM   0:00.00 grep -i tun

The nuclear approach to working around the inconvenience of this starting that I chose, was the following:

jre@Mac:~ $ sudo mv /Applications/Tunnelblick.app/Contents/Resources/launchAtLogin.sh /Applications/Tunnelblick.app/Contents/Resources/hell-no.sh

This retains a copy of whatever this script needs to be here for that I have yet to discover, but also pooches whatever process is calling it to execute that we've been unable to locate.

I'm happy now, but it'd be cool to make this a checkbox in the UI somewhere.

I like a "clean machine" when I reboot. Absolutely no TSRs, cloud drives, remote viewers, itunes helpers - I often do wireshark captures for my profession, and when I restart, I like as close to "nothing" as possible to be running, unless I specifically invoke it.

Hope this helps anyone else with the same issue.

Thanks for the space/airtime :)

Joe

On Thursday, July 20, 2017 at 11:55:14 AM UTC-4, jre wrote:

[Tunnelblick developer]

Our emails crossed. Is there a Login Item for Tunnelblick?

[jre]

Nope.

[Tunnelblick developer]

Please try the replacement LaunchAtLogin.sh attached as a .zip. It creates a text file on the Desktop containing information about why it is launching Tunnelblick (or that it is not launching Tunnelblick). The text file is named "TunnelblickLaunchAtLoginLog.txt".

That will help determine why Tunnelblick is being launched.

[Tunnelblick developer]

Sorry for the noise; the earlier .zip was an old version that will not work. Attached is one that will.

[jre]

Thanks.

Finally made it back to this.

New mac. Same issue. Fresh install, Tunnelblick launches each time I reboot/logout-in.

There are no associated programs in the System Preferences pane for Startup Items.

There's no config option within Tunnelblick to disable start-at-login.

When logging out or rebooting, I am leaving "Reopen windows when logging back in" unchecked.

Tunnelblick *always* starts when I reboot/login.

This is undesired; when I start up my mac I want almost nothing loaded, nothing running, a clean system.

Should I wish to launch a VPN tunnel, the Launcher provides a quick easy way to launch Tunnelblick (and any other app) so I don't need it running full-time when I don't need access to a VPN tunnel full-time.

user@host~ $ defaults read net.tunnelblick.tunnelblick | grep -i launch

    SUHasLaunchedBefore = 1;

    lastLanguageAtLaunchWasRTL = 0;

    lastLaunchTime = "537207401.936425";

    launchAtNextLogin = 1;

no values set. initially.

From previous troubleshooting:

user@host~ $ defaults write  net.tunnelblick.tunnelblick  doNotLaunchOnLogin  -bool yes

now, reading the values again:

user@host~ $ defaults read net.tunnelblick.tunnelblick | grep -i launch

    SUHasLaunchedBefore = 1;

    doNotLaunchOnLogin = 1;

    lastLanguageAtLaunchWasRTL = 0;

    lastLaunchTime = "537207401.936425";

    launchAtNextLogin = 1;

New value is there, but see there's still "launchAtNextLogin" set.

Rebooting, this results in Tunnelblick launching...

Rebooting *again*, however, results in this:

user@host~ $ defaults read net.tunnelblick.tunnelblick | grep -i launch

    SUHasLaunchedBefore = 1;

    doNotLaunchOnLogin = 1;

    lastLanguageAtLaunchWasRTL = 0;

    lastLaunchTime = "537281926.606948";

    launchAtNextLogin = 0;

Now, rebooting a third time, Tunnelblick does not launch. Perfect. Just took some reboots to clear out the residual "launchAtNextLogin" boolean value.

I didn't have to use the above attached script, but here is how it differs from stock:

user@host:~ $ diff Downloads/launchAtLogin.sh /Applications/Tunnelblick.app/Contents/Resources/launchAtLogin.sh

7,15d6

< lal_log() {

<   if [  "$2" = "" ] ; then

<     msg="$1"

<   else

<     msg="$(printf "%s\n%s\n", "$1", "$2")"

<   fi

<   echo "$msg" > ~/Desktop/TunnelblickLaunchAtLoginLog.txt

< }

<

23d13

<   lal_log "Launching Tunnelblick because 'launchAtNextLogin' was set"

30c20

< openvpn_is_running="$( echo "${processes}" | grep -w openvpn | grep -v grep )"

---

> openvpn_is_running="$( echo "${processes}" | grep -w /openvpn | grep -v grep )"

32d21

<   lal_log "Launching Tunnelblick because one or more 'openvpn' processes were running" "${openvpn_is_running}"

37c26

< helper_is_running="$( echo "${processes}" | grep -w tunnelblick-helper | grep -v grep )"

---

> helper_is_running="$( echo "${processes}" | grep -w /tunnelblick-helper | grep -v grep )"

39d27

<   lal_log "Launching Tunnelblick because one or more 'tunnelblick-helper' processes were running" "${helper_is_running}"

43,44d30

<

< lal_log "Not launching Tunnelblick"

I suppose I could try placing this new script into place to see if behavior changes, but for now I am going to leave things as-is since it seems to be working right. 

"don't fix it until it's broken"  :)

Thanks-

Joe