Closed fdcastel closed 4 years ago
TC1977
commented
4 years ago So, what do systemctl status wg-quick@wg0.service and journalctl -xe show you?
And just making sure, but you've got it set so that myvpn.example.org points to your Ubuntu VM?
fdcastel
commented
4 years ago I'm very sorry @TC1977. I completely forgot (late hours...):
systemctl status wg-quick@wg0.service:
ubuntu@ALGO:~$ systemctl status wg-quick@wg0.service
● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0
Loaded: loaded (/lib/systemd/system/wg-quick@.service; indirect; vendor preset: enabled)
Active: failed (Result: exit-code) since Thu 2019-12-26 23:43:14 UTC; 15h ago
Docs: man:wg-quick(8)
man:wg(8)
https://www.wireguard.com/
https://www.wireguard.com/quickstart/
https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8
https://git.zx2c4.com/WireGuard/about/src/tools/man/wg.8
Main PID: 24663 (code=exited, status=1/FAILURE)
Dec 26 23:43:14 ALGO systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
Dec 26 23:43:14 ALGO wg-quick[24663]: [#] ip link add wg0 type wireguard
Dec 26 23:43:14 ALGO wg-quick[24663]: RTNETLINK answers: Operation not supported
Dec 26 23:43:14 ALGO wg-quick[24663]: Unable to access interface: Protocol not supported
Dec 26 23:43:14 ALGO wg-quick[24663]: [#] ip link delete dev wg0
Dec 26 23:43:14 ALGO wg-quick[24663]: Cannot find device "wg0"
Dec 26 23:43:14 ALGO systemd[1]: wg-quick@wg0.service: Main process exited, code=exited, status=1/FAILURE
Dec 26 23:43:14 ALGO systemd[1]: wg-quick@wg0.service: Failed with result 'exit-code'.
Dec 26 23:43:14 ALGO systemd[1]: Failed to start WireGuard via wg-quick(8) for wg0.Now... journalctl -xe has a very large output. But I believe the interesting part is this:
Dec 26 23:43:12 ALGO ansible-command[24543]: Invoked with chdir=configs/MYVPN.EXAMPLE.ORG/wireguard/ executable=bash _raw_params=umask 077; which segno && segno --scale=5 --output=SOME_USER.png "[Interface]
PrivateKey = mAT8W0TEF87p5fElefCRsW9antdGO9i4RjKRnf894VU=
Address = 10.30.1.3/24
DNS = 10.10.1.211,10.10.1.212
[Peer]
PublicKey = mCrHmIK3dERG3Fnw/Fwz+Ds2Z5is4GCCB0XtVq/nrUE=
PresharedKey = JvC9/loZccJFFIN/fk5Bq3s/fwaSd0WOKKVH6I08V9E=
AllowedIPs = 0.0.0.0/0,::/0
Endpoint = MYVPN.EXAMPLE.ORG:51820
" || true
_uses_shell=True warn=True stdin_add_newline=True strip_empty_ends=True argv=None creates=None removes=None stdin=None
Dec 26 23:43:13 ALGO ansible-command[24568]: Invoked with chdir=configs/MYVPN.EXAMPLE.ORG/wireguard/ executable=bash _raw_params=umask 077; which segno && segno --scale=5 --output=ANOTHER_USER.png "[Interface]
PrivateKey = gIHll/N92YT/ixSckqlIqa/fLGzoR7hKbgv9OFM61Xo=
Address = 10.30.1.4/24
DNS = 10.10.1.211,10.10.1.212
[Peer]
PublicKey = mCrHmIK3dERG3Fnw/Fwz+Ds2Z5is4GCCB0XtVq/nrUE=
PresharedKey = Y4Ve6hszCRkvZunQTbL85IeNnzjEBEQelafy4QmgXkA=
AllowedIPs = 0.0.0.0/0,::/0
Endpoint = MYVPN.EXAMPLE.ORG:51820
" || true
_uses_shell=True warn=True stdin_add_newline=True strip_empty_ends=True argv=None creates=None removes=None stdin=None
Dec 26 23:43:13 ALGO python3[24594]: ansible-stat Invoked with path=/etc/wireguard/wg0.conf follow=False get_checksum=True checksum_algorithm=sha1 get_mime=True get_attributes=True get_md5=None
Dec 26 23:43:13 ALGO python3[24607]: ansible-copy Invoked with src=/root/.ansible/tmp/ansible-tmp-1577403793.2755225-22353364926425/source dest=/etc/wireguard/wg0.conf mode=0600 follow=False _original_basename=server.conf.j2 checksum=2a594e567730eea485beb7a20a0737562e432
Dec 26 23:43:13 ALGO python3[24634]: ansible-systemd Invoked with name= state=started enabled=True daemon_reload=False daemon_reexec=False no_block=False force=None masked=None user=None scope=None
Dec 26 23:43:13 ALGO systemd[1]: Reloading.
Dec 26 23:43:14 ALGO systemd[1]: Created slice system-wg\x2dquick.slice.
-- Subject: Unit system-wg\x2dquick.slice has finished start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit system-wg\x2dquick.slice has finished starting up.
--
-- The start-up result is RESULT.
Dec 26 23:43:14 ALGO systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
-- Subject: Unit wg-quick@wg0.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit wg-quick@wg0.service has begun starting up.
Dec 26 23:43:14 ALGO wg-quick[24663]: [#] ip link add wg0 type wireguard
Dec 26 23:43:14 ALGO kernel: PKCS#7 signature not signed with a trusted key
Dec 26 23:43:14 ALGO kernel: Lockdown: Loading of unsigned modules is restricted; see man kernel_lockdown.7
Dec 26 23:43:14 ALGO wg-quick[24663]: RTNETLINK answers: Operation not supported
Dec 26 23:43:14 ALGO wg-quick[24663]: Unable to access interface: Protocol not supported
Dec 26 23:43:14 ALGO wg-quick[24663]: [#] ip link delete dev wg0
Dec 26 23:43:14 ALGO kernel: PKCS#7 signature not signed with a trusted key
Dec 26 23:43:14 ALGO wg-quick[24663]: Cannot find device "wg0"
Dec 26 23:43:14 ALGO systemd[1]: wg-quick@wg0.service: Main process exited, code=exited, status=1/FAILURE
Dec 26 23:43:14 ALGO systemd[1]: wg-quick@wg0.service: Failed with result 'exit-code'.
Dec 26 23:43:14 ALGO systemd[1]: Failed to start WireGuard via wg-quick(8) for wg0.
-- Subject: Unit wg-quick@wg0.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit wg-quick@wg0.service has failed.
--
-- The result is RESULT.Please ask me any other information which could be helpful.
fdcastel
commented
4 years ago And just making sure, but you've got it set so that myvpn.example.org points to your Ubuntu VM?
Hmm. Nope. I was first testing it into a local lab. I was going to update it AFTER the installation.
The public dns host (endpoint) is required to be correct (pointing to algo server) DURING the install process? (Sorry, a very first noob algo user here 😉)
davidemyers
commented
4 years ago Try disabling EFI Secure Boot in the Hyper-V settings for this VM.
fdcastel
commented
4 years ago Thanks @davidemyers! That solved the problem.
My VM was indeed with Secure Boot enabled:
Get-VMFirmware ALGO
VMName SecureBoot SecureBootTemplate PreferredNetworkBootProtocol BootOrder
------ ---------- ------------------ ---------------------------- ---------
ALGO On MicrosoftUEFICertificateAuthority IPv4 {Drive, Network}Running
Set-VMFirmware ALGO -EnableSecureBoot Offand running ALGO installer again worked this time.
Just out of curiosity: Why is this needed? I always run my Ubuntu VMs with Secure Boot and MicrosoftUEFICertificateAuthority template with no problems.
davidemyers
commented
4 years ago I believe the issue is that the Linux kernel won't install third-party kernel modules like WireGuard when Secure Booted.
fdcastel
commented
4 years ago I see. Thanks @davidemyers !
Describe the bug
Installation fails with:
To Reproduce
Steps to reproduce the behavior:
Create a new VM on Hyper-V using latest cloud image from Ubuntu (18.04.3)
Download Algo
Install requirements
Edit
config.cfg. Change:Install it with unattended parameters:
Expected behavior
Rainbows and fireworks.
Additional context
Full log
(Real usernames and hostnames anonymized)