Forticlient Blank Screen on Fedora Linux

[sjoerd93]

Hey,

I am obligated to use Forticlient VPN for my workplace. Unfortunately, whenever I try to open the Forticlient GUI, I get a completely blank screen. The navigation menu on the top loads fine, I can press file which gives me an option to quit the application (and nothing else), and I can press Help which gives me two links to documentation that don't help me in this situation. The program itself doesn't load however.

Does anyone have an idea how to solve this issue? I just tried to install the rpm-package from the VPN-only client. I guess it may be specifically designed for CentOS only? If so, is there any way to get it working on Fedora?

My terminal output doesn't give me a lot:
[sjoerd@lennart ~]$ forticlient
Fontconfig warning: "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", line 6: unknown element "reset-dirs"
Platform detected: fedora
[ '/usr/lib/opt/forticlient/gui/FortiClient-linux-x64/FortiClient' ]
did-finish-load
window-all-closed

I'm running Fedora Silverblue with the latest base image from the 3th of June 2022 if that helps anyone.

Kind regards,
Sjoerd

[mssp-infotrust-sd]

Have you tried either?

https://github.com/theinvisible/openfortigui

https://github.com/adrienverge/openfortivpn

Kind of a last resort if the Fortinet products don't work on your machine, in my opinion, but some people like these projects more.

[jmennius]

I am having the same issue on Fedora Silverblue 38 (black GUI app, `fortivpn` CLI always gets an error). Forticlient VPN `7.0.7.0246`.

I was able to debug and understand the issue.

Forticlient has a system service and clients such as CLI and GUI, they communicate via an HTTP API.

One of forticlient service components, `confighandler`, is responsible for accepting connection from clients; upon receiving a request it will try to identify the calling process (by looking through `procfs`) and verify it is a 'forticlient' process. It does that by comparing process executable path with `/opt/forticlient` which it should match exactly from the beginning. Security you may ask... just cringe.

This check is not true on `rpm-ostree` systems because of the way `rpm`s in `/opt` are implemented (installed into `/usr/lib/opt/`) and even beside that - `/opt` is a symlink to `/var/opt`.

I was able to patch the binary to amend the check into looking for `/opt/forticlient` substring in the client binary path and clients indeed started working (UI now loads and CLI works).

All in all - I still can't use the bloody Forticlient. Turns out it doesn't even work on regular Workstation (38) (with SSO/SAML - doesn't connect fully) and it didn't on Silverblue.

For SAML/SSO you can use `openfortivpn` CLI by logging in manually in the browser and specifying the cookie to the client.

P.S.

To rant and vent a bit more - there are so many things wrong with Forticlient...

1. It is not normal to deliver files to `/opt` in a package manager delivered SW (rpm/deb)! If you package it - it should go into `/usr` directly (at least that's a Debian policy which makes it very clear). This would have avoided the problem.

2. Why that client 'check'? Does it achieve anything, seriously? This would have avoided the problem.

3. Oh, and the server components (running as root) look for a user DBus session to do something with it. I'm sorry, but WTF!? You have a 'client' (GUI or CLI which runs as user) to do it for god sake!

4. `confighandler` still tries to write something to `/opt/forticlient/` - `fctinstalled.tm` file. I believe it does not fail if it can't, but nevertheless.

5. None of installed binaries are available in PATH (although there is a CLI program) - see bullet 1.

TLDR - We're all better off using openfortivpn and other open clients.

[raxag]

I had the same "blank GUI" problem on Fedora Silverblue 39, and I was able to work around it by simply running:

sudo /opt/forticlient/vpn -s vpn.fqdn.com -u username -p

And that somehow worked with the inputted password, no GUI required.

[torel]

It won't work for us due to 2FA.  I have another laptop with FC38, and forticlient_vpn_7.0.10.0346_x86_64.rpm  works just fine. Still haven't got a clue as to why forticlient_vpn on my fc37 laptop just gives a white screen.   Annoying as hell.

The older laptop has low resolution display, while my work laptop has HiDPI. Maybe that is the reason...

[vincentmorel]

Hello!
Anything new about this problem?
Same thing here with Fedora 40 Silverblue and Forticlient (7.4) from the repo (Centos/8)...

[mssp-infotrust-sd]

Never got it to work and gave up. OpenConnect works flawlessly and has support for the Fortinet SSLVPN.

[vincentmorel]

Not sure the OpenConnect will work with my organisation, need 2FA auth and vulnerability scan...

[mssp-infotrust-sd]

You're SOL then. It's honestly a poorly designed application for Linux. Your going to have to stick to the major distributions on LTS releases like most businesses that would run Linux desktop. It's a small target audience already for businesses so I don't see cutting edge Linux desktop developments like Silverblue to ever work. Even running the standard Fedora 38 with Forticlient introduce various bugs that I've yet to see fixed since I became interested in running Forticlient on Linux a year ago.

Side note: MFA works with OpenConnect.

[sw2090]

if 2FA is a Fortitoken you can simply append it to your password on logon. So client doesn't mandatory need to support that.