Fedora Account System
Red Hat Associate
Red Hat Customer
After upgrading to FC42 I cannot run vpnc (0.5.3^20241114.git11e15a1-1.fc42) Doing either sudo vpnc vpnc.conf or sudo vpnc vpnc.conf just gives "Unknown error." Error code is 255. Downgraded to 0.5.3-48.svn550.fc41 and vpnc works again. vpnc.conf worked as expected in FC40, with this content: IPSec gateway vpnaccess.impa.br IPSec ID vpnaccess Xauth username XXXXX Xauth password XXXXXXXXXXXXXX Reproducible: Always Steps to Reproduce: 1. Just do sudo vpnc vpnc.conf Actual Results: Vpnc exists with error code 255 printing "Unknown error." Expected Results: To perform the connection. Additional Information: vpnc version: 0.5.3^20241114.git11e15a1-1.fc42 working version: 0.5.3-48.svn550.fc41
Not much to go on. Try stracing the program to see if you can isolate what it's doing.
(In reply to Richard W.M. Jones from comment #1) > Not much to go on. Try stracing the program to see if you can isolate what > it's doing. Attaching the output of strace -o vpnc.strace -f vpnc vpnc.conf to the original post.
Created attachment 2088017 [details] output of strace -o vpnc.strace -f vpnc vpnc.conf
Unclear .. I'm going to guess this is from a library as the source of vpnc does not contain the string "Unknown error" (with capital). You might want to try 'gdb' to see if you can grab a stack trace where it's calling exit(255).
I don't get anything useful with gdb either. Yet, it seems that there is some problem related with sbin being now a symlink. The command rpm -ql vpnc | grep '/vpnc$' gives: /usr/bin/vpnc /usr/share/doc/vpnc /usr/share/licenses/vpnc Yet, /usr/bin/vpnc is just a symlink to /user/bin/consolehelper, and just executing either /usr/bin/vpnc or /usr/bin/consolehelper by themselves, with no arguments, already give "Unknown error." Maybe consolehelper from usermode-1.114-12.fc42 is broken?
In fact, in the working downgraded vpnc for FC41, /usr/sbin/vpnc points to /usr/bin/vpnc, but /usr/bin/vpnc is a true executable, and not a symlink to consolehelper.
...and there is no other link on the system pointing to /usr/bin/consolehelper
I just noticed there's another similar bug: https://bugzilla.redhat.com/show_bug.cgi?id=2362815
Yes, I realized that one. But I think it just says that vpnc requires consolehelper (usermode package), which is not in the dependencies. In FC42, vpnc is just a symlink. I installed usermode, and the problem persists.
Please see pull request https://src.fedoraproject.org/rpms/vpnc/pull-request/4 regarding a possible solution. The current idea is to use separate file names for starting/stopping vpnc via consolehelper. An unprivileged user would need to run "vpnc-user" / "vpnc-disconnect-user".
*** Bug 2362815 has been marked as a duplicate of this bug. ***
FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-827423d3dd
FEDORA-2025-827423d3dd has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-827423d3dd` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-827423d3dd See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.
(In reply to Fedora Update System from comment #14) > FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been > pushed to the Fedora 42 stable repository. > If problem still persists, please make note of it in this bug report. Just to confirm that it appears to be working fine. (I cannot remember when was the last time that I reported a Fedora bug that was actually solved! Maybe... never before??). Thanks!!
(In reply to Fedora Update System from comment #14) > FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been > pushed to the Fedora 42 stable repository. > If problem still persists, please make note of it in this bug report. It isn't working for me. I tested it on two Fedora 42 Workstation PCs. The same error occurred on both machines. Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> [1747317418.4014] vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: starting vpnc Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> [1747317418.4017] audit: op="connection-activate" uuid="af85ab7d-77f0-4ef9-97f8-1b9854e72961" name="UBT" pid=2567 uid=1000 result="success" Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <warn> [1747317418.4681] vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: failed to connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine Berechtigung)' Sorry for the German output. Basically, the network manager can't start the child process. The executable seems to be in the right place. > sudo ls -la /usr/sbin/vpnc -rwxr-xr-x. 1 root root 170080 20. Jul 2024 /usr/sbin/vpnc Thanks for your help! Regards, Danny
(In reply to Danny Schellnock from comment #16) > (In reply to Fedora Update System from comment #14) > > FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been > > pushed to the Fedora 42 stable repository. > > If problem still persists, please make note of it in this bug report. > > It isn't working for me. I tested it on two Fedora 42 Workstation PCs. The > same error occurred on both machines. > > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> > [1747317418.4014] > vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: starting vpnc > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> > [1747317418.4017] audit: op="connection-activate" > uuid="af85ab7d-77f0-4ef9-97f8-1b9854e72961" name="UBT" pid=2567 uid=1000 > result="success" > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <warn> > [1747317418.4681] > vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: failed to > connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine > Berechtigung)' > > Sorry for the German output. Basically, the network manager can't start the > child process. The executable seems to be in the right place. > > > sudo ls -la /usr/sbin/vpnc > -rwxr-xr-x. 1 root root 170080 20. Jul 2024 /usr/sbin/vpnc > > Thanks for your help! > > Regards, > Danny Sorry, there was a mistake in my last comment. After the update to version 0.5.3^20241114.git11e15a1-2.fc42, the executable file is no longer in the right place, but is replaced by symlinks. sudo ls -la /usr/sbin/vpnc lrwxrwxrwx. 1 root root 11 15. Mai 17:42 /usr/sbin/vpnc -> ../bin/vpnc sudo ls -la /usr/bin/vpnc lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc -> consolehelper Regards, Danny
(In reply to Danny Schellnock from comment #17) > (In reply to Danny Schellnock from comment #16) > > (In reply to Fedora Update System from comment #14) > > > FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been > > > pushed to the Fedora 42 stable repository. > > > If problem still persists, please make note of it in this bug report. > > > > It isn't working for me. I tested it on two Fedora 42 Workstation PCs. The > > same error occurred on both machines. > > > > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> > > [1747317418.4014] > > vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: starting vpnc > > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> > > [1747317418.4017] audit: op="connection-activate" > > uuid="af85ab7d-77f0-4ef9-97f8-1b9854e72961" name="UBT" pid=2567 uid=1000 > > result="success" > > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <warn> > > [1747317418.4681] > > vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: failed to > > connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine > > Berechtigung)' > > > > Sorry for the German output. Basically, the network manager can't start the > > child process. The executable seems to be in the right place. > > > > > sudo ls -la /usr/sbin/vpnc > > -rwxr-xr-x. 1 root root 170080 20. Jul 2024 /usr/sbin/vpnc > > > > Thanks for your help! > > > > Regards, > > Danny > > Sorry, there was a mistake in my last comment. After the update to version > 0.5.3^20241114.git11e15a1-2.fc42, the executable file is no longer in the > right place, but is replaced by symlinks. > > sudo ls -la /usr/sbin/vpnc > lrwxrwxrwx. 1 root root 11 15. Mai 17:42 /usr/sbin/vpnc -> ../bin/vpnc > sudo ls -la /usr/bin/vpnc > lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc -> consolehelper > > Regards, > Danny I had a similar problem. I upgraded from FC40 to FC42 with dnf, so not a clean upgrade. My problem was that FC40 used /usr/sbin as a folder, and in FC42 /usr/sbin is a symlink to /usr/bin. The upgrade did not make this symlink, so everything was a mess. My solution was to analyze /usr/sbin and check that the only non-link was precisely vpnc - related. So I removed /usr/sbin, created the symlink manually /usr/sbin --> /usr/bin (as it should be in FC42), and reinstalled vpnc. L.
(In reply to Luis A. Florit from comment #18) > > I had a similar problem. I upgraded from FC40 to FC42 with dnf, so not a > clean upgrade. My problem was that FC40 used /usr/sbin as a folder, and in > FC42 /usr/sbin is a symlink to /usr/bin. The upgrade did not make this > symlink, so everything was a mess. > > My solution was to analyze /usr/sbin and check that the only non-link was > precisely vpnc - related. So I removed /usr/sbin, created the symlink > manually /usr/sbin --> /usr/bin (as it should be in FC42), and reinstalled > vpnc. > > L. Hey Luis, thanks for your help. I'm having the same problem with FC42 /usr/sbin as you are. I analysed and deleted /usr/sbin, created the symlink, and then reinstalled all the vpnc-related packages. But the problem persists. What is the consolehelper program for? ls -la /usr/sbin lrwxrwxrwx. 1 root root 8 15. Mai 18:35 sbin -> /usr/bin ls -la /usr/bin/vpn* lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc -> consolehelper lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc-disconnect -> consolehelper journalctl -f -u NetworkManager.service Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <info> [1747327411.5980] audit: op="connection-activate" uuid="4e2ceb1b-39af-45df-8169-64cbbcae7d28" name="UBT" pid=2535 uid=1000 result="success" Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <warn> [1747327411.6807] vpn[0x5612e1cce590,4e2ceb1b-39af-45df-8169-64cbbcae7d28,"UBT"]: failed to connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine Berechtigung)' Danny
(In reply to Danny Schellnock from comment #19) > (In reply to Luis A. Florit from comment #18) > thanks for your help. I'm having the same problem with FC42 /usr/sbin as you > are. I analysed and deleted /usr/sbin, created the symlink, and then > reinstalled all the vpnc-related packages. But the problem persists. What is > the consolehelper program for? > > ls -la /usr/sbin > lrwxrwxrwx. 1 root root 8 15. Mai 18:35 sbin -> /usr/bin > > ls -la /usr/bin/vpn* > lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc -> consolehelper > lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc-disconnect -> > consolehelper - consolehelper is a tool a to allow an unprivileged user to start vpnc with its default config (authentication and authorization handled via PAM) - due to the /usr/bin /usr/sbin merge, the vpnc package us now using consolehelper even when root starts vpnc - in my setup, starting vpnc in all variants work (including starting via NetworkManager), so we need to check, why it is not working for you > journalctl -f -u NetworkManager.service > Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <info> > [1747327411.5980] audit: op="connection-activate" > uuid="4e2ceb1b-39af-45df-8169-64cbbcae7d28" name="UBT" pid=2535 uid=1000 > result="success" > Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <warn> > [1747327411.6807] > vpn[0x5612e1cce590,4e2ceb1b-39af-45df-8169-64cbbcae7d28,"UBT"]: failed to > connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine > Berechtigung)' a) check, that vpnc is installed in the correct version (please provide the output of "rpm -q vpnc") b) check, that all needed packages are correctly installed ("sudo rpm -V vpnc usermode NetworkManager-vpnc") c) check, that root can run vpnc ("sudo vpnc --help") d) do you have SELinux enabled? (please provide the output of "sudo getenforce")
(In reply to Christian Krause from comment #20) > (In reply to Danny Schellnock from comment #19) > > (In reply to Luis A. Florit from comment #18) > > thanks for your help. I'm having the same problem with FC42 /usr/sbin as you > > are. I analysed and deleted /usr/sbin, created the symlink, and then > > reinstalled all the vpnc-related packages. But the problem persists. What is > > the consolehelper program for? > > > > ls -la /usr/sbin > > lrwxrwxrwx. 1 root root 8 15. Mai 18:35 sbin -> /usr/bin > > > > ls -la /usr/bin/vpn* > > lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc -> consolehelper > > lrwxrwxrwx. 1 root root 13 7. Mai 02:00 /usr/bin/vpnc-disconnect -> > > consolehelper > > - consolehelper is a tool a to allow an unprivileged user to start vpnc with > its default config (authentication and authorization handled via PAM) > - due to the /usr/bin /usr/sbin merge, the vpnc package us now using > consolehelper even when root starts vpnc > - in my setup, starting vpnc in all variants work (including starting via > NetworkManager), so we need to check, why it is not working for you Thanks again! In the meantime, I read the proposal to move /usr/sbin to /usr/bin in Fedora 42, and I found out what this has to do with the ConsoleHelper command. > > journalctl -f -u NetworkManager.service > > Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <info> > > [1747327411.5980] audit: op="connection-activate" > > uuid="4e2ceb1b-39af-45df-8169-64cbbcae7d28" name="UBT" pid=2535 uid=1000 > > result="success" > > Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <warn> > > [1747327411.6807] > > vpn[0x5612e1cce590,4e2ceb1b-39af-45df-8169-64cbbcae7d28,"UBT"]: failed to > > connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine > > Berechtigung)' > > a) check, that vpnc is installed in the correct version (please provide the > output of "rpm -q vpnc") rpm -q vpnc vpnc-0.5.3^20241114.git11e15a1-2.fc42.x86_64 > b) check, that all needed packages are correctly installed ("sudo rpm -V > vpnc usermode NetworkManager-vpnc") sudo rpm -V vpnc usermode NetworkManager-vpnc Does no output mean no error? > c) check, that root can run vpnc ("sudo vpnc --help") sudo vpnc --help Usage: /usr/libexec/vpnc [--version] [--print-config] [--help] [--long-help] [options] [config files] .. Looks good. > d) do you have SELinux enabled? (please provide the output of "sudo > getenforce") sudo getenforce Enforcing SELinux is enabled. Danny
Thanks for providing all information. (In reply to Danny Schellnock from comment #21) > (In reply to Christian Krause from comment #20) > > (In reply to Danny Schellnock from comment #19) > > > (In reply to Luis A. Florit from comment #18) > > a) check, that vpnc is installed in the correct version (please provide the > > output of "rpm -q vpnc") > rpm -q vpnc > vpnc-0.5.3^20241114.git11e15a1-2.fc42.x86_64 > > > b) check, that all needed packages are correctly installed ("sudo rpm -V > > vpnc usermode NetworkManager-vpnc") > sudo rpm -V vpnc usermode NetworkManager-vpnc > Does no output mean no error? Yes, correct. > > > c) check, that root can run vpnc ("sudo vpnc --help") > sudo vpnc --help > Usage: /usr/libexec/vpnc [--version] [--print-config] [--help] [--long-help] > [options] [config files] > .. > Looks good. Good! > > d) do you have SELinux enabled? (please provide the output of "sudo > > getenforce") > sudo getenforce > Enforcing Ok, that's the problem! The changes to vpnc for the /usr/(s)bin merge are causing now trouble with SELinux. That problem got already reported and will be handled in https://bugzilla.redhat.com/show_bug.cgi?id=2366041. Please subscribe to that bug report for updates.
(In reply to Christian Krause from comment #22) > Thanks for providing all information. > > (In reply to Danny Schellnock from comment #21) > > (In reply to Christian Krause from comment #20) > > > (In reply to Danny Schellnock from comment #19) > > > > (In reply to Luis A. Florit from comment #18) > > > a) check, that vpnc is installed in the correct version (please provide the > > > output of "rpm -q vpnc") > > rpm -q vpnc > > vpnc-0.5.3^20241114.git11e15a1-2.fc42.x86_64 > > > > > b) check, that all needed packages are correctly installed ("sudo rpm -V > > > vpnc usermode NetworkManager-vpnc") > > sudo rpm -V vpnc usermode NetworkManager-vpnc > > Does no output mean no error? > > Yes, correct. > > > > > > c) check, that root can run vpnc ("sudo vpnc --help") > > sudo vpnc --help > > Usage: /usr/libexec/vpnc [--version] [--print-config] [--help] [--long-help] > > [options] [config files] > > .. > > Looks good. > > Good! > > > > d) do you have SELinux enabled? (please provide the output of "sudo > > > getenforce") > > sudo getenforce > > Enforcing > > Ok, that's the problem! The changes to vpnc for the /usr/(s)bin merge are > causing now trouble with SELinux. > > That problem got already reported and will be handled in > https://bugzilla.redhat.com/show_bug.cgi?id=2366041. Please subscribe to > that bug report for updates. Thanks. I will do.