Leaderboard

Hello! I came across a few problems during AirVPN Suite 2.1.0 installation on a custom Linux box caused by the installer script. I had to fix the installation manually. Here my findings and thoughts. 1. read -p is not POSIX-compliant despite #!/bin/sh The install.sh script declares: #!/bin/sh and the documentation instructs users to run it with sh ./install.sh. However, the script uses read -p for interactive prompts, for example: read -p "Do you want to install AirVPN Suite? [y/n] " yn read -p is not part of POSIX sh and is not supported by shells such as Debian/Ubuntu's dash. As a result, running the installer with /bin/sh can produce an error such as: read: Illegal option -p The script does not check the return status of read, so it may continue execution with an empty/unset response. This can cause prompts to be effectively skipped and the installer to proceed with unintended defaults. Possible fix: keep the script POSIX-compatible by replacing read -p with: printf '%s' "Do you want to install AirVPN Suite? [y/n] " read yn The same issue appears in multiple interactive prompts throughout install.sh. 2. Incorrect group membership check The installer checks whether the airvpn user belongs to the airvpn group using: grep ^$AIRVPN_GROUP /etc/group | cut -d: -f4 | grep -q $AIRVPN_USER This is not a reliable way to check group membership. Because grep -q $AIRVPN_USER performs a substring match, it can produce false positives. For example, if the group members contain: someairvpnuser the check can incorrectly consider airvpn to be a member. It also directly parses /etc/group, which bypasses the system's NSS configuration, so it may fail on systems where group information is provided through LDAP, SSSD, NIS, etc. Possible fix if getent is available: getent group "$AIRVPN_GROUP" with proper parsing of the member list. If getent is not available the system's group membership mechanism may be a solution, for example: id -nG "$AIRVPN_USER" | tr ' ' '\n' | grep -qx "$AIRVPN_GROUP" 3. Not bugs but poor design install.sh performs several critical file operations using cp without checking whether they succeed. For example: cp bin/bluetit /sbin/bluetit cp bin/goldcrest $BIN_DIR cp bin/hummingbird $BIN_DIR If one of these commands fail, for any reason, the installer continues executing instead of aborting. There is no global set -e and no explicit error handling around these operations. As a result, the script can potentially reach its final success message even though one or more required components were never installed. This can leave the system in a partially installed and inconsistent state, while giving the user the impression that the installation completed successfully. The same issue should be reviewed for other critical commands such as mkdir, chmod, chown, systemctl, and service-management operations. At minimum, critical operations should check their exit status and warn the user. Seeyabyez

Hello! We're very glad to inform you that a new 10 Gbit/s full duplex server located in Los Angeles, California, is available: Flegetonte. The AirVPN client will show automatically the new server; if you use any other OpenVPN or WireGuard client you can generate all the files to access it through our configuration/certificates/key generator (menu "Client Area"->"Config generator"). The server accepts connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard. Flegetonte supports OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard. Full IPv6 support is included as well. As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses. You can check the status as usual in our real time servers monitor , by clicking the server name. Direct link: https://airvpn.org/servers/Flegetonte Do not hesitate to contact us for any information or issue. Kind regards & datalove AirVPN Staff

Hello! We have no plans to operate VPN servers in France (and in Italy) for the mandatory data retention framework still enforced in disdain of three different legally binding decisions of the CJEU (see below). France is in breach and Italy is too, but the Commission hesitates to open infraction procedures. Since the decisions pertain to the the preservation of a fundamental human right enshrined in the EU Charter of Fundamental Rights and in the European Convention on Human Rights, it does not seem inappropriate to consider that both France and Italy are committing one of the worst breaches a EU Member State can be guilty of. We might challenge with a casus belli the (il)legal framework in France, but we are already committed in other EU countries and we can't open potentially multiple legal battle fronts. The Court of Justice declares the Data Retention Directive to be invalid https://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf The Members States may not impose a general obligation to retain data on providers of electronic communications services https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-12/cp160145en.pdf The Court of Justice confirms that EU law precludes national legislation requiring a provider of electronic communications services to carry out the general and indiscriminate transmission or retention of traffic data and location data for the purpose of combating crime in general or of safeguarding national security https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-10/cp200123en.pdf Kind regards