topic Re: Global Protect new Linux UI in General Topics

Global Protect new Linux UI

hshawn — Thu, 19 Dec 2019 20:01:46 GMT

I have the GP Linux CLI client working without any issues, however I wanted to test the UI client that just came out (5.1.0) Does anyone know how to actually use this? The PAN documentation has not been updated to mention this new version or the Linux UI yet. Installing it goes fine but I do not see anything installed to my desktop and when attempting to launch it from a command shell all I see is:

"Unable to run GlobalProtect CLI while GlobalProtect UI is running. Please consider installing the CLI only install package."

Which is great... but how do I find and launch the UI from my desktop? *confused*

Re: Global Protect new Linux UI

LeoSimon — Thu, 19 Dec 2019 22:05:51 GMT

I *can* get the UI to work, but I have to uninstall and reinstall the entire package. Once I connect from the UI, it disappears. There's a file called PanGPUI in /opt/paloaltonetworks/globalprotect which I *think* is supposed to open the UI, but for me it just hangs. Would love to hear if anybody can get this to work.

Re: Global Protect new Linux UI

BPry — Thu, 19 Dec 2019 22:27:58 GMT

@hshawn,

So a quick question for you and @LeoSimon, were either of you running the betas? I can confirm that it's broken on the final production release, but it has been working fine within the beta releases so it broke between the last beta release and the final production release.

Re: Global Protect new Linux UI

hshawn — Thu, 19 Dec 2019 23:55:33 GMT

I was not on the beta.

My main issue with this UI version is there seems to be no way of actually running it (no icon, no menu entry, the binary just complains about CLI mode).

Maybe its just a fresh bug.

Re: Global Protect new Linux UI

BPry — Fri, 20 Dec 2019 15:06:04 GMT

@hshawn,

It's a fresh bug. The betas displayed as you would have expected without much of an issue; it appears that the production release managed to break something. I would expect that this is fixed relatively quickly.

Re: Global Protect new Linux UI

LeoSimon — Fri, 20 Dec 2019 16:12:55 GMT

I was not on the beta either. I downloaded the 5.1.0 release

Re: Global Protect new Linux UI

Stephen_Dowdy — Sat, 21 Dec 2019 21:49:46 GMT

I'm using 5.1.0-101 and here's my perception:

The UI is started by an XDG (FreeDesktop) .desktop file that gets installed to /etc/xdg/autostart/PanGPUI.desktop)

The Exec for this is: Exec=/opt/paloaltonetworks/globalprotect/PanGPUI

The running app is :

/opt/paloaltonetworks/globalprotect/PanGPUI start

(so not sure how the 'start' argument gets added)

This installs a System Tray item (looks like a globe), so if your DE doesn't support a System Tray, maybe you won't see any UI for it.

A co-worker clicks on the icon, and the interface window appears at the top of the screen. however, unless he moves the cursor REALLY fast, the window disappears before he gets to it. I don't have that problem, but i do have the problem where clicking on he hamburger icon of that window is REALLY touchy, and moving the mouse causes the popup menu to disappear -- so i have to use the cursor keys to select [ Settings | About ]

I am *sad* that the 'globalprotect' cli executable now always throws :

Unable to run GlobalProtect CLI while GlobalProtect UI is running. Please consider installing the CLI only install package.

At least allow us to get the status (show --details, ...) stuff that way, because the UI doesn't give it in a useful way.

Also, while 'globalprotect show --notification' never showed the portal notification message, the new notification UI popup overwrites the message onto a single line over and over making it unreadable.

That all said... I'm also *sad* about the following:

'globalprotect' cli returns 1 for all commands successful or not. it should return 0 for success so we can script around it. Also, every instantiation of 'globalprotect' (even --help) has a builtin alarm() that forces a 60 second delay. so running the command multiple times (like to get multiple outputs for 'globalprotect show --{item}) take FOREVER.

also, sad-making... when the installer extracts to /opt/paloaltonetwork/ it doesn't bother to try to set proper ownership (user/group), leaving things owned by random matching UID/GID from the tarball. (for me it's ntp:Debian-exim)

I am frankly disgusted and exhausted over the quality of software in general over the past decade and trying to find current/correct documentation and working around bugs and misfeatures. siiiiigggghhhhhhh.

(also, the text-enry in this discussion forum is almost invisible to me, making it quite hard to type this message. maybe it's just my Debian Stretch/Firefox setup)

Leaving on a high note. At least, thanks for finally getting a UI for Linux. Just allow us to also use the CLI simultaneously, and fix the bugs in the cli.

thanks,

--stephen

Re: Global Protect new Linux UI

donkeystep1 — Tue, 10 Mar 2020 14:57:59 GMT

Same here on version 5.1.0-101, the UI only worked for the first time, clicking OR double-clicking on the PanGPUI doesn't take effect. And there's no menu items/ desktop icons. Ubuntu 19.04.
Tried stopping PanGPUI and running /opt/paloaltonetworks/globalprotect/PanGPUI from console, it seems to hang forever.
Tried stopping also PanGPA and PanGPS, and restarting, no effect.
Tried connecting from console - asked for certificates.

I'd be very grateful if it's possible to fix it.

Re: Global Protect new Linux UI

hshawn — Tue, 10 Mar 2020 15:21:19 GMT

I don't think they have it setup to:

* Use the gnome task bar

* Adapt to "dark" themes

But it does work, here is what I did:

* Create a "shortcut" on your desktop or in the dash-to-dock or wherever you like

* Download a nice GP icon from the internet and pop that onto your shortcut properties

It should get better over time, it didn't used to show the GUI version at all and now with 5.1.1 it does. It also did not work with all flavors of Linux without some hacks and it should now work with any Linux.

Re: Global Protect new Linux UI

VTQNetwork — Thu, 19 Mar 2020 08:22:16 GMT

Hi Guys,

I've just started to test GP linux client on Ubuntu 19.10.

I have the same problems in current and previous GP client version as you.

You can use this command to show GUI:

globalprotect launch-ui

Do you know how to monitor certificates?

I would like to show the store(s), install client cert.

In Palo doc, I've found optional modification of pangps.xml file, but it does not work for me, I have to troubleshoot 🙂

Re: Global Protect new Linux UI

VTQNetwork — Thu, 19 Mar 2020 09:56:21 GMT

OK, I've installed sert with a cli command globalprotect import-certificate --location /home/cert.p12 and it works now 🙂

Anyway, troubleshooting methods would be appreciated.

I have no idea where is my CA cert installed.

Re: Global Protect new Linux UI

GaryFowler — Fri, 20 Mar 2020 01:42:33 GMT

I'm running Ubuntu 19.10.

The GUI runs.. but, depending on the day, there are between 3 and 10 copies in the tray.. one process for each.. I have to click through each one as only one actually works. All others ask to enter a portal address.

Any clue how to get it to only start one ?

Re: Global Protect new Linux UI

Joshua_Blair — Thu, 26 Mar 2020 16:36:49 GMT

@GaryFowlerI have the same multiple copies in the tray issue. I'm using Kubuntu 19.10 and see that. I just toggled a setting in KDE to not restore my previous session to see if that'll help. I'll be rebooting in a little bit to test the theory out.

Re: Global Protect new Linux UI

Retired Member — Wed, 08 Apr 2020 01:15:32 GMT

I've run into this issue as well. I haven't figured out what's causing it yet but I'm sure replacing the startup command with an strace command will shine a light on that. The quick and dirty fix for this is to create a shell script that runs the following:

ps aux | grep PanGPU[I] | grep -v '-session ' | xargs kill

This will basically kill off any PanGUI process that isn't tied to your desktop session.

Re: Global Protect new Linux UI

GaryFowler — Thu, 16 Apr 2020 21:53:43 GMT

So far, I've found two solutions.

1. Disable Session Restore completely. The core problem appears to be with the previous PanGPUI sessions being restored. But every time you reboot, an additional session is added. Thus the first boot gives one PanGPUI.. the second reboot gives two and so on..

2. Exclude PanGPUI from session restore.

additionally, adding "X-KDE-autostart-phase=2" to the autostart file for PanGPUI appears have positive effects as well.. For me, this was installed under /etc/xdg/autostart/

Searching the apps button for 'session' yields Desktop Session app. Opening that gives me the options to "start with an empty session", as well as the "Applications to be excluded from sessions" text field (add PanGPUI)

Re: Global Protect new Linux UI

Stephen_Dowdy — Tue, 28 Apr 2020 23:57:22 GMT

You can blacklist the PanGPUI process from being saved in KDE session saves with:

kwriteconfig --file ksmserverrc --group General --key excludeApps PanGPUI

Warning: this will overwrite anything you have for that key already. it'll also remove any comments in your ksmsserverrc file. This is a PER-USER change as is. (you could create an override in /etc/xdg with the same effect for all users.

Or... manually:

kcmshell5 kcmsmserver

And either selecting "Start with an empty session", use "Restore manually saved session" (that doesn't have PanGPUI in it already), or if using "Restore previous session", specify: "PanGPUI" in the field titled "Applications to be excluded from sessions:"

Re: Global Protect new Linux UI

Stephen_Dowdy — Wed, 29 Apr 2020 00:07:59 GMT

Another thing that's REALLY annoying is:

/etc/profile.d/PanMSInit.sh

(guh, no POSIX/Bash Shell language in thisforum editor's <code> widget???)

#!/bin/bash PANGPA=/opt/paloaltonetworks/globalprotect/PanGPA pgrep -u $USER PanGPA > /dev/null 2>&1 if [ $? -ne 0 ]; then if [ -f $PANGPA ]; then $PANGPA start & fi fi

This unconditionally spins off a PanGP process for ALL interactive users. That's absurd. It also means, that when you login interactively, you get:

# exit
logout
There are running jobs.
[1]+ Running $PANGPA start &

requiring you exit twice, orkill thesejobs. Spinning that process up should be done some other way (suid exe called by the user-agent (globalprotect | panGUI) or somethign else.

At least please check if it's the 'root' user and don't do it.

thanks,

--stephen

Re: Global Protect new Linux UI

Javed_Iqbal — Sun, 10 May 2020 22:31:12 GMT

Use command 'globalprotect launch-ui' in terminal whenever you want to view the UI.

Re: Global Protect new Linux UI

rhodge — Fri, 17 Jul 2020 20:55:42 GMT

From terminal:

(/opt/paloaltonetworks/globalprotect/PanGPUI &> /dev/null &)

All one line and include parentheses.

I think newer versions also allow you to do it from the globalprotect cli. From terminal:

globalprotectlaunch-ui

Or something to that effect. Just hit tab while in the globalprotect cli and it should show all the options.