A broken rpm-plugin-selinux package on Oracle Linux 8 will cause SELinux based package updates to fail. This package was on the Oracle Linux 8 repositories for a short period of time before being fixed. If this broken package was installed during this time frame any future updates of packages that include SELinux policies will fail during unpacking. This issue is most likely to have occurred on systems with automatic updates enabled. If the Pritunl package is updated in this state the old files will be removed from the system and the new files will fail to unpack. The Pritunl server will continue to run but will show the error OSError: Could not find a suitable TLS CA certificate bundle, invalid path:
when attempting to load this file that will be removed. The issue must be fixed manually by running the commands below to fix this package, once fixed updates can be completed and the software will resume working. This issue is fully documented on the Oracle Support Knowledge Doc ID 3002168.1.
If automatic updates are enabled the openssh-server package will get updated and fail to unpack. This will cause the error Connection closed by remote host and Connection reset by. Once this occurs a startup script must be run to fix the package. Below is a Cloud Init script to fix the issue.
To fix this on AWS after the SSH server is inaccessible stop the instance. Then click Instance settings → Edit user data and add the script below.
MongoDB 7 has known issues with the capped collections. The messages capped collection is used for host to host messaging and will typically result in the error Server start timed out when not functioning.
This can be fixed by running the command sudo pritunl destroy-secondary this command will clear all the database collections used for temporary cache. The latest release has the command sudo pritunl clear-message-cache to drop only this collection.
MongoDB 4.4 Downgrade
sudo yum install mongodb-org-4.4.18 mongodb-org-server-4.4.18
MongoDB 5.0 Downgrade
sudo yum install mongodb-org-5.0.14 mongodb-org-database-5.0.14 mongodb-org-server-5.0.14
The issue can easily be avoided by clicking Download Profiles on the profile page then importing the tar file into the Pritunl Client by click Import Profile, this is the same profile data that would be imported with a URI. The issue can also be avoided by replacing the domain name in the URI with the IP address of the server. The client will ignore certificate validation for URI's containing an IP address.
The pritunl-openvpn package is only available on the Oracle Linux 7 and Oracle Linux 8 repositories and will provide the latest version of OpenVPN. These repositories can be used on any RHEL Linux distribution including CentOS.
Pritunl OpenVPN Install RHEL 7
Pritunl OpenVPN Install RHEL 8
This can be reverted by running the command below.
Add the DNS server to the server routes. The default DNS server used is 8.8.8.8 add the route 8.8.8.8/32 to the server routes for this configuration.
Remove the DNS server from the settings. This will instruct the client to use their current DNS configuration. This could cause problems with some clients if that DNS configuration becomes unroutable due to the VPN routes.
Enable VPN Client DNS Mapping in the advanced server settings. This will start a DNS server on the Pritunl server that will proxy all DNS requests and will always be available to the client.
Код:
/usr/lib/pritunl/lib/python3.6/site-packages/certifi/cacert.pem
Код:
Oracle Linux RPM Fix
sudo rpm -e --nodeps rpm-plugin-selinux
sudo dnf -y install rpm-plugin-selinux
sudo dnf -y updateIf automatic updates are enabled the openssh-server package will get updated and fail to unpack. This will cause the error Connection closed by remote host and Connection reset by. Once this occurs a startup script must be run to fix the package. Below is a Cloud Init script to fix the issue.
To fix this on AWS after the SSH server is inaccessible stop the instance. Then click Instance settings → Edit user data and add the script below.
Код:
Cloud Init Fix
while ! ping -c1 google.com &>/dev/null; do echo "Waiting for network..."; sleep 1; done
rpm -e --nodeps rpm-plugin-selinux
dnf -y install rpm-plugin-selinux
dnf -y update
Downgrading Client
Previous versions of the client are available on the Pritunl GitHub Releases click Assets to expand the available packages. Information on debugging the client is available in the Client Debugging documentation.
MongoDB 7 Issues
There are multiple known issues with MongoDB 7, it is currently recommended to continue using MongoDB 6 and avoid upgrading to MongoDB 7.MongoDB 7 has known issues with the capped collections. The messages capped collection is used for host to host messaging and will typically result in the error Server start timed out when not functioning.
This can be fixed by running the command sudo pritunl destroy-secondary this command will clear all the database collections used for temporary cache. The latest release has the command sudo pritunl clear-message-cache to drop only this collection.
MongoDB Server Not Starting
A recent 4.4 and 5.0 update prevents the MongoDB database from starting. MongoDB 6.0 is not effected. If this occurs downgrade the MongoDB release using the commands below.MongoDB 4.4 Downgrade
sudo yum install mongodb-org-4.4.18 mongodb-org-server-4.4.18
MongoDB 5.0 Downgrade
sudo yum install mongodb-org-5.0.14 mongodb-org-database-5.0.14 mongodb-org-server-5.0.14
CentOS 8 Discontinued
CentOS 8 was discontinued on December 31st, 2021 the operating system will no longer be updated. The Pritunl repositories for CentOS 8 were also discontinued. The Oracle Linux 8 repository is fully compatible with any RHEL8 distribution including CentOS 8 and AlmaLinux 8. The Oracle Linux 8 Pritunl repository can be used on CentOS 8 but in order for the system to receive updates it must be switched to Oracle Linux 8. Oracle providers a script to upgrade to Oracle Linux 8 that will convert an existing CentOS 8 system to Oracle Linux 8.
Lets Encrypt Root Certificate Issue
Due to the Oct 1st expiration of the Lets Encrypt root certificate all v1.29 versions of Pritunl containing the expired certificate will no longer produce a valid certificate. Having an invalid certificate will not disrupt VPN service. The primary issue will occur when a user attempts to import a new profile to the Pritunl Client. Both the Pritunl Client and Pritunl Server need to be updating to the latest releases containing the new root certificates to fix this issue.The issue can easily be avoided by clicking Download Profiles on the profile page then importing the tar file into the Pritunl Client by click Import Profile, this is the same profile data that would be imported with a URI. The issue can also be avoided by replacing the domain name in the URI with the IP address of the server. The client will ignore certificate validation for URI's containing an IP address.
Ubuntu Update Issue
If Ubuntu 20.04 is configured with the Ubuntu 18.04 Pritunl repository the error ModuleNotFoundError: No module named 'encodings' will be shown when attempting to start Pritunl. This can be fixed by running the commands below to update the repository files to the correct distribution.
Код:
Ubuntu 20.04 Repository
sudo tee /etc/apt/sources.list.d/pritunl.list << EOF
deb http://repo.pritunl.com/stable/apt focal main
EOF
sudo tee /etc/apt/sources.list.d/mongodb-org-4.4.list << EOF
deb https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/4.4 multiverse
EOF
wget -qO - https://www.mongodb.org/static/pgp/server-4.4.asc | sudo apt-key add -
sudo apt update
sudo apt upgrade
EPEL OpenVPN Issue
There is currently an issue with the compilation options used on the OpenVPN package in the EPEL repository. This issue will cause routing issues on some connections. To fix this issue run the command below to install the newer OpenVPN package from the Pritunl repository. This issue will only occur on UDP servers, TCP can also be used as a workaround.The pritunl-openvpn package is only available on the Oracle Linux 7 and Oracle Linux 8 repositories and will provide the latest version of OpenVPN. These repositories can be used on any RHEL Linux distribution including CentOS.
Pritunl OpenVPN Install RHEL 7
Код:
sudo yum swap openvpn pritunl-openvpn
Код:
sudo yum --allowerasing install pritunl-openvpn
Код:
OpenVPN Install
sudo yum --allowerasing install openvpn
Connection MTU Issues
Some connections may have MTU issues this can be fixed by entering a lower MSS Fix value in the server settings. First test 1200 or lower to confirm that it is an MTU issue. If this fixes the connection increase the MTU in a range of 1200-1400 to find a working MTU.
Carrier-Grade NAT
Carrier-grade NATs are becoming more common to mitigate IPv4 address exhaustion. These are common with all cellular connections and wired ISP connections in foreign countries with limited IPv4 address space. These can cause issues with MTU detection and UDP VPN servers. Switching the server protocol to TCP with a lower MTU may fix issues when a carrier-grade NAT is present.
iOS DNS Issue
There are currently three fixes for the DNS issue on iOS.Add the DNS server to the server routes. The default DNS server used is 8.8.8.8 add the route 8.8.8.8/32 to the server routes for this configuration.
Remove the DNS server from the settings. This will instruct the client to use their current DNS configuration. This could cause problems with some clients if that DNS configuration becomes unroutable due to the VPN routes.
Enable VPN Client DNS Mapping in the advanced server settings. This will start a DNS server on the Pritunl server that will proxy all DNS requests and will always be available to the client.
