OpenVPN GUI on Linux

linux-category-inverted

So having made the leap to Linux, one of the key items I need to get up and going was my OpenVPN connection.

I hadn’t expected it to be much of an issue really, after all, OpenVPN is Linux based!

But that didn’t turn out to be the case.  At first I figured I’d just use the CLI to run OpenVPN, but two things turned me off of that plan:

  1. OpenVPN’s CLI needs to run as root, so it’s a pain having to sudo it all the time.
  2. If your on an unstable connection and the tunnel drops, the CLI exists without trying to reconnect (there may be an option for this, but I didn’t spend much time looking honestly).

So I started to look for a GUI like there is for Windows and came up empty, but then I found that there is a built in VPN GUI in Gnome (which Zorin uses) and so I tried that.

Which failed as the required packages were not installed, to resolve that you have:

apt-get install network-manager-openvpn-gnome

Once that is done you can go to Settings->Network and add a new VPN connection, then select import (I don’t suggest trying to configure it manually, there are way to may settings).

After you’ve downloaded your OpenVPN profile of course.

Well, not quite…

There is another small issue, it seems that the network manager has a bug in it and when you import your OpenVPN profile it will display an error message:

Error: configuration error: invalid 1th argument to 'reneg-sec' where number expected (line 86).

Editing the your profile and commenting out line 86 resolves the issue and you can then go ahead and import it again.

There is one additional setting you have to make before you connect to your VPN though.  After the import is complete, click on the “Advanced” button and enable “Use LZO data compression”, otherwise when you try and connect it will fail.

After that, everything should be good to go.

Zorin Linux

linux-category-inverted

Recently, I’ve been thinking more and more about the data collection that OS’s do on behalf of the companies that create them.

Companies like Google live off of data and so their implementation of Android tracks and reports on a host of things you do.

But Microsoft isn’t much better these days, as is clear from a blog post from a little while ago, they collect piles of information in the name of improving the “user experience”.

To that end, I started to look around and see what desktop Linux looked like these days, which is where Zorin Linux come in.

I’ve used Liinux on servers for years, everything from Slackware to Ubuntu, but the GUI always left me wanting to rip my hair out (and I don’t have that much left so I need all of it 😉 ).

Ubuntu’s folly in to the Unity desktop was clear from the first time I tried it.  Other looked like they were stuck in the 1990’s.

So I poked around a bit and found Zorin.  Zorin has several flavours of GUI that each are inspired by an existing OS; Windows, Mac, Gnome or Unity.

Versions

Of course Zorin is in business to make money and so there are several versions of the OS, each with varying features included.

The “Core” version, which is free/pay what you like, basically comes with the Windows inspired look and then from there you upgrade to the “Ultimate” edition which includes everything for 19€, including e-mail support.

I started with Core, but after a week or two or playing around I upgraded, more to support the project than anything else.

Installation

Initially I installed Zorin in a VM, which worked fine but video performance was a little laggy so once I was sure it was something worth doing, I shrunk my Windows partition and installed it as a dual boot system.o

Installation was easy and the boot loaded picked up both Zorin and Windows so there was no problem from there.

In fact one nice thing about GRUB (the boot loader on most Linux installs) is that it detects the UEFI bios and creates an entry to allow you to get in to the settings ithout having to actually boot an OS like Windows does.

There was one gotcha with the install, most modern PC’s have SecureBoot enabled and that blocks some Linux drivers from loading properly.  For my initial run at Zorin, I lived with the compromise, but when I did my final install I did disable SecureBoot.

The GUI

Zorin’s “Windows” GUI is pretty familiar to anyone who runs Windows, but there are some differences.

The first thing that you notice is that is uses a very dark colour scheme, which is not too bad, doesn’t have an easy way to change it (you can, if your adventurous, alter the theme files, but that is well beyond the average user).

Otherwise you have a pretty standard start menu, task bar and notification tray.

Stability

The current version of Zorin (12) is pretty stable, but there are some strange crashes once in a while when your doing some uncommon tasks.

For example, installing applications sometimes hangs the start menu and it needs a reboot get to it running again (probably a logout/in would work too).

But these’s aren’t deal breakers, just things to keep in mind and be ready for.

Updates

As for updates, Zorin seems to be on top of things and be actively supporting the OS, providing updates every few days.  Some of these are of course from the upstream Ubuntu project that Zorin uses as it’s base.

HiDPI Displays

My ZenBook 3 has a full HD display, but at 12″, it almost acts like a HiDPI display and as such in Windows I’d set the scale factor to 1.2.

Linux, unfortunately, isn’t nearly as good as Windows on HiDPI support.  There is a scale factor setting in Zorin, but it only goes in integer units, so you can do 1 or 2, but not 1.2.

You can set a scaling factor for fonts, which allows for non-integer values, but it breaks the Start menu pretty well.

The best is to change the font sizes, which seems to work well, but some applications need to be configured individually (I’m looking at you web browsers).

Bluetooth

I’ve used a Logitech Bluetooth mouse for many users and connecting it to Linux wasn’t an issue, however power management options seem to be a little lacking (or at least I haven’t found the right place yet).

Specifically, whenever I lock Zorin, it puts Bluetooth in to sleep mode, which in turns means it takes a few seconds to reconnect when unlocked.

Not a big deal, just an annoyance if you tend to lock/unlock your PC quite a bit.

Applications

I’m going to go in to software in another post, but there is one item I want to point out here, I recently migrated my Exchange E-Mail server (a post for another time) over to Unix and in doing so also installed NextCloud (yet another post, I seem to be falling behind) for Calendar and Contacts.

Zorin includes support for connecting to NextCloud right out of the box which is kind of nice.

Final Thoughts

Overall the migration to Linux on my notebook was pretty smooth, with a single implosion when I did something as root that reset the permissions of one of the system directories.  To say the least it wasn’t very happy after that, but it was completely my own fault 🙂

Desktop Linux has come a long way and Zorin is a pretty good distro that I’d recommend to try out if your thinking of switching.

Of course there are a few bumps along the way but in my view those are minor in comparison to the significant amount of freedom gained.

Upgrading OpenVPN Access Server to Ubuntu 14

[sc:linux-category ]In my last post I talked about my OpenVPN Access Servers and a problem I was having, while working on that I also noticed that they were still running Ubuntu 12.

A while ago I upgraded my Ubuntu server through the in place upgrade process and so I was reasonably comfortable with it.  However as this was the a VM I hadn’t built but instead downloaded from OpenVPN, I decided to take a look around and see if there were any gotcha’s with it.

A search didn’t turn up anything and overall there was a real lack of information on the OpenVPN site.  In the end I decided to simply take a snapshot of my backup node and go through with the upgrade process.

I won’t go in to detail of the upgrade process, you can read my previous post for that, but it went smoothly and after I restarted the server, OpenVPN came up as well.

Of course I needed to test the backup node, which means taking down the primary node.  My first instinct (which in the case was wrong) was to simply shutdown the OpenVPN service on the primary node.  That doesn’t work because UCARP doesn’t actually monitor the service on the primary node, but instead just the IP address.  I decided the simpler way to just shutdown the whole server.

Once down, the backup node took over the services and everything was fine.

I simply repeated the process on the primary node and both functioned as expected.

OpenVPN Failover Failing

[sc:internet-category ]I setup OpenVPN clustering a while ago (ok more than a while) and it’s been working pretty well.  I have noticed though that when I did a failover I wouldn’t be able to connect to the secondary node sometimes.  Which kind of defeated the purpose of the clustering 🙁

Of course I don’t fail over very often, but I had a BSOD on my VM host server a few weeks ago which forced the failover to happen and I noticed it as I was out-of-town for a few days.  I tracked the problem down to how OpenVPN (or more precisely UCARP) handles the failover.

When the primary node goes down, UCARP transfers the IP address to the secondary node.  However my switch/router doesn’t see the change right away as it’s ARP cache still thinks the IP address is associated with the MAC address of the primary node.  If you wait long enough, the router/switch expires the ARP cache and things work again, but that’s kind of annoying when you really need something remotely.

Doing a bit of searching around I found arping, which does an ARP level ping to a device.  Adding a quick call to arping in the activation script (/etc/local/openvpn_as/scripts/) seems to have cleared up the problem.

ClamAV on Ubuntu 14.04

[sc:linux-category ]I recently upgraded my Ubuntu box to 14.04 which went smoothly, but one nagging message has been showing up in my daily logs since then; ClamAV is out of date.

ClamAV often pushes out minor point releases and that has been the case with the current 0.98 release cycle.  There have been four releases so far, 0.98.0-0.98.4 which have been minor updates and security fixes.

Ubuntu 14.04 has 0.98.1 but nothing later in its default package repository so each day when I get my status e-mail from the box, right at the top is ClamAV’s warning that it’s out of date.  0.98.4 isn’t a big update and no security issues with it so I left it for a while expecting Ubuntu to do an update automatically, but it’s been months now and I no longer want to see the warning so I did a bit of digging around.

Apparently it has been a known issue since May and it’s still not fixed, I found a thread about it and you can use the backports repository to get 0.98.4 installed with the following command:

 apt-get install -t trusty-backports clamav-freshclam clamav clamav-daemon

It seems weird they haven’t resolved it on the long-term support version of Ubuntu, but at least I won’t see the warning message anymore.