Arch Linux User Repository

The problems connecting to openvpn are unrelated to the kernel version. They occur if one uses the updated default /etc/sudoers content.

There has been an update recently: https://gitlab.archlinux.org/archlinux/packaging/packages/sudo/-/commit/4791df5c3deb6355e6a1fe0b40a13ef27ad060b0

that changes

# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

to

Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

Activating the secure_path setting will prevent cyberghostvpn from running the /usr/local/cyberghost/openvpn wrapper. This means the original /usr/bin/openvpn wrapper gets called with the unsupported --ncp-disable parameter again - and fails.

To make cyberghostvpn work again with openvpn

a) either comment out the Defaults secure_path=... line in /etc/sudoers again

b) or add /usr/local/cyberghost to the beginning of that line

/etc/sudoers

Defaults secure_path="/usr/local/cyberghost:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

c) or downgrade openvpn to <2.6 - that makes it support the --ncp-disable command line parameter again

This works for me:

$ rm -rf ~/.cyberghost
$ sudo cyberghostvpn --setup
Setup account ...
Enter CyberGhost username and press [ENTER]: 
Enter CyberGhost password and press [ENTER]: 
Perform authentication ...
Creating a new device ...
Install completed ...
$ sudo cyberghostvpn --country-code US --connect
Prepare OpenVPN connection ...
Select server ... lasvegas-s412-i06
Connecting ... 
VPN connection established.

Your console looks like you have killed the sudo cyberghostvpn --setup process when it was asking you if it should overwrite the (empty) config.ini. Pressing 'Y' and hitting enter should have gotten you to the next question of the setup. What exactly did not work for you?

Package built for me, I'm using Endeavour as my fist experience with an Arch distro. While it did build, seems that it may have skilled the install.sh where I am assuming that the configuration .ini was populated

$ mkdir ~/.cyberghost; touch ~/.cyberghost/config.ini # This was pointless
$ sudo cyberghostvpn --setup
> Do you want to override the original configuration file? [Y/n]: Y^C # This also did not work
$ rm -fr ~/.cyberghost; sudo /usr/local/cyberghost/wrapper/cyberghostvpn_wrapper --setup
> Enter CyberGhost username and press [ENTER]: GeorgeWBush@onlyfans.live
> Enter CyberGhost password and press [ENTER]: DickCheneyIsSexy696969
> Perform authentication ...
> Creating a new device ...
> Install completed ...

Not extremely annoying to fix.

CLI is pulling endpoints, I haven't set a connection yet though.

$ cyberghostvpn --country-code
> +-----+----------------------+--------------+
> | No. |     Country Name     | Country Code |
> +-----+----------------------+--------------+
> |  1  |       Andorra        |      AD      |
> |  2  | United Arab Emirates |      AE      |
> |  3  |       Albania        |      AL      |
>  . . .   .   . . .   .   . . .   .   . . .   

i am now in Uruguay. Great success.

Package builds again.

Its still impossible to estabilish wireguard with linux client of cyberghostvpn since the wireguard servers only provide a self signed certificate which still is not accepted by the http client library in the python script.

Last regular check happened on 29.11. The maintainer will look after this as soon has is working life leaves room for it.

7504245f5d63b74a1e8a4dd34ff1c2a4eece363bfd423abc8286951455c4fd4 /home/x/.cache/yay/cyberghostvpn/src/cg-dialup-net.pem /home/x/.cache/yay/cyberghostvpn/src/cg-dialup-net.pem: FAILED sha256sum: WARNING: 1 computed checksum did NOT match

Is it too much to expect that the package maintainer regularly checks for such problems?

The cyberghost linux client does not seem to be usable at all anymore since the dns entries for the servers it tries to connect to have vanished. (i.e. washington-s403-i01.cg-dialup.net)

$ nslookup washington-s403-i01.cg-dialup.net 8.8.8.8
Server:     8.8.8.8
Address:    8.8.8.8#53

** server can't find washington-s403-i01.cg-dialup.net: NXDOMAIN

If I take a look into wireshark while trying to connect to a VPN only the linux client tries to connect using a domain name - the windows client seems to directly connect to the desired vpn server ip and succeeds to do so. So currently we must wait for cyberghostvpn to release an update for their linux client to make this work under linux again.

Update: According to cyberghost this issue has already been escalated to the developers.

Update: The dns entries for the cyberghostvpn hosts seems to be fixed again - connecting to openvpn hosts is possible again. Wireguard hosts still do not work due to the outdated ssl certificate on the hosts.

Ok, thanks for the explanation, I understand now.

The SSL certificate on their wireguard servers is out of date. This does not have anything to do with the client software or the client operating system used.

wHas anyone found a workaround? I do not have the Windows or macos version. Maybe it is possible to get ssl certificate from these versions?

Their ssl certificate expired on 2023 07 06 - nothing I could do about it.