Forticlient Blank Screen on Fedora Linux

[sjoerd93]

Hey,

I am obligated to use Forticlient VPN for my workplace. Unfortunately, whenever I try to open the Forticlient GUI, I get a completely blank screen. The navigation menu on the top loads fine, I can press file which gives me an option to quit the application (and nothing else), and I can press Help which gives me two links to documentation that don't help me in this situation. The program itself doesn't load however.

Does anyone have an idea how to solve this issue? I just tried to install the rpm-package from the VPN-only client. I guess it may be specifically designed for CentOS only? If so, is there any way to get it working on Fedora?

My terminal output doesn't give me a lot:
[sjoerd@lennart ~]$ forticlient
Fontconfig warning: "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", line 6: unknown element "reset-dirs"
Platform detected: fedora
[ '/usr/lib/opt/forticlient/gui/FortiClient-linux-x64/FortiClient' ]
did-finish-load
window-all-closed

I'm running Fedora Silverblue with the latest base image from the 3th of June 2022 if that helps anyone.

Kind regards,
Sjoerd

[mssp-infotrust-sd]

Have you tried either?

https://github.com/theinvisible/openfortigui

https://github.com/adrienverge/openfortivpn

Kind of a last resort if the Fortinet products don't work on your machine, in my opinion, but some people like these projects more.

[jmennius]

I am having the same issue on Fedora Silverblue 38 (black GUI app, `fortivpn` CLI always gets an error). Forticlient VPN `7.0.7.0246`.

I was able to debug and understand the issue.

Forticlient has a system service and clients such as CLI and GUI, they communicate via an HTTP API.

One of forticlient service components, `confighandler`, is responsible for accepting connection from clients; upon receiving a request it will try to identify the calling process (by looking through `procfs`) and verify it is a 'forticlient' process. It does that by comparing process executable path with `/opt/forticlient` which it should match exactly from the beginning. Security you may ask... just cringe.

This check is not true on `rpm-ostree` systems because of the way `rpm`s in `/opt` are implemented (installed into `/usr/lib/opt/`) and even beside that - `/opt` is a symlink to `/var/opt`.

I was able to patch the binary to amend the check into looking for `/opt/forticlient` substring in the client binary path and clients indeed started working (UI now loads and CLI works).

All in all - I still can't use the bloody Forticlient. Turns out it doesn't even work on regular Workstation (38) (with SSO/SAML - doesn't connect fully) and it didn't on Silverblue.

For SAML/SSO you can use `openfortivpn` CLI by logging in manually in the browser and specifying the cookie to the client.

P.S.

To rant and vent a bit more - there are so many things wrong with Forticlient...

1. It is not normal to deliver files to `/opt` in a package manager delivered SW (rpm/deb)! If you package it - it should go into `/usr` directly (at least that's a Debian policy which makes it very clear). This would have avoided the problem.

2. Why that client 'check'? Does it achieve anything, seriously? This would have avoided the problem.

3. Oh, and the server components (running as root) look for a user DBus session to do something with it. I'm sorry, but WTF!? You have a 'client' (GUI or CLI which runs as user) to do it for god sake!

4. `confighandler` still tries to write something to `/opt/forticlient/` - `fctinstalled.tm` file. I believe it does not fail if it can't, but nevertheless.

5. None of installed binaries are available in PATH (although there is a CLI program) - see bullet 1.

TLDR - We're all better off using openfortivpn and other open clients.

[raxag]

I had the same "blank GUI" problem on Fedora Silverblue 39, and I was able to work around it by simply running:

sudo /opt/forticlient/vpn -s vpn.fqdn.com -u username -p

And that somehow worked with the inputted password, no GUI required.

[torel]

It won't work for us due to 2FA.  I have another laptop with FC38, and forticlient_vpn_7.0.10.0346_x86_64.rpm  works just fine. Still haven't got a clue as to why forticlient_vpn on my fc37 laptop just gives a white screen.   Annoying as hell.

The older laptop has low resolution display, while my work laptop has HiDPI. Maybe that is the reason...