https://mullvad.net/en/help/install-mullvad-app-linux
Trying to install VPN and these are the instructions Mullvad is giving me. This is ridiculous. There must be a more simple way. I know how to follow the instructions but I have no idea what I’m doing here. Can’t I just download a file and install it? I’m on Ubuntu.
As others have already pointed out, a lot of Linux software is installed from repositories in a standard way, and once you do that, it updates automatically.
However, as you’ve already discovered, there’s more than one way to install Linux software. Repositories are still the most common way, but installing single .deb’s (Debian based distributions) or .rpms (RedHat packaging format) is still there and there are more like Snap, Flatpak and Appimage. You can also often just download the source and compile it yourself. It’s a very diverse ecosystem, not like the controlled worlds of WIndows and Mac.
In this case you can download the .deb file, and pretty sure you can even install it through the file manager, just like in Windows (I don’t use Ubuntu, but I think it will just start GUI installation if you double-click on a .deb file).
But lot of things in Linux are still done through the terminal, like changing configurations and, yes, installing things.
Getting used to it takes a while, especially if you’re not used to modern Windows administration through PowerShell.
The important part is trying to figure out what each of the commands do and that the output actually means. Software that supports Linux normally has very clear instructions (like in this case), but it does require willingness to change habits, technical curiosity and some trial and error (patience). It’s not quite as polished experience as the commercial OS’s. There’s still a lot of rough edges for the user.
Good luck on your Linux journey!
Yes and with good reason. To prevent people like yourself from downloading and running malware.
Is malware specifically a problem on Linux then?
So usually people do install Linux software from trusted software repositories. Linux practically invented the idea of the app store a full ten years before the first iPhone came out and popularized the term “app.”
The problem with the Mullvad VPN is that their app is not in the trusted software repositories of most Linux distributions. So you are required to go through a few extra steps to first trust the Mullvad software repositories, and then install their VPN app the usual way using
apt installor from the software center.You could just download the “.deb” file and double click on it, but you will have to download and install all software security updates by hand. By going through the extra steps to add Mullvad to your trusted software repository list, you will get software security updates automatically whenever you install all other software updates on your computer.
Most Linux distros don’t bother to make it easy for you to add other trusted software repositories because it can be a major security risk if you trust the wrong people. So I suppose it is for the best that the easiest way to install third-party software is to follow the steps you saw on the website.
Some .deb packages actually include their repository and they can then be updated via the package manager. An example for this is the Vivaldi .deb.
Asking why something is the way it is makes you more of a “Linux user” than many.
You make a valid criticism; there’s definitely a learning curve to installing software if you choose to do it that way (since it’s not similar to other OSs), and it’s not automatically explained to new users by using the OS.
Here’s the understanding of it I’ve come to, if you’re interested:
Like others have said, the
.debfile would be the equivalent of an.exefile on Windows. Like many.exefiles, unless they include an auto-updater, they won’t automatically update.A key difference I would like to point out is that Linux package managers often update and manage parts of the OS in addition to extra software. Windows and macOS both update their OS separately.
“Ubuntu Software Center” is similar to the “Microsoft Store” on Windows and the “App Store” on macOS. Like those, it’s user friendly and provides automatic updates, but it also doesn’t have every app. You can ensure those apps are safe because the company behind the OS verifies them.
“apt-get” is the default package manager for Ubuntu. That is the tool doing the heavy lifting underneath, and what those commands Mullvad gave are for.
Mullvad could have provided a script to download and run that executes those commands for you, but then you wouldn’t know what it’s doing, especially with it needing admin permission. With how security-oriented Mullvad’s brand is, I think that’s one potential reason they explain the steps and have the user do it instead.
the .deb file would be the equivalent of an .exe file on Windows
Not
.exe. If you want to find an equivalent,.msiis the closest.
While lvxferre’s instructions are the ideal, there’s a simpler option
Download the mullvad.deb file.
Doubleclick on it from your file manager and it should automatically instsll
Every time you start mullvad it will check if the version is current and prompt you (with a link to click on) to upgrade if it’s not.
Note that works on mint, should work on ubuntu unless they’ve disabled dpkg
No, don’t. Bad advise. Use repos that are provided.
You might want to say why or you’ll get downvoted. Spoiler: its not safe and this is how you get malicious software on your computer
Also note that Mullvad has a pretty technical user base and target audience, and thus their documentation is likely geared towards them. You could also consider using Mozilla VPN, which offers pretty much the same advantages (they use Mullvad’s servers), at the same price if you pay annually, and is easier to use.
I’m already paying for Mullvad
Heh, that’s another reason not to switch - never mind then!
it’s just a fuckin step by step guide on how to add their repo to the sources.list
What’s so technical about it? It’s how you install everything on Ubuntu.
No knowing how apt works, is equivalent to not understanding why grandma_pics.zip.exe is probably a virus. If you’re that uninformed, we can’t help you.
Oh actually, looking at the Ubuntu installation docs, that doesn’t really seem to be much easier - that’s a disappointment :/
Although if you don’t mind running one terminal command (specifically,
sudo add-apt-repository ppa:mozillacorp/mozillavpn), I think after that you should just be able to use the Ubuntu App Center to install software - which usually is the way to install software in Ubuntu, and works similar to app stores on phones.
That page lists multiple installation methods, for multiple distros. There simplest one for you is just two steps.
-
Download .deb installer
-
Run
apt install ~/Downloads/MullvadVPN-*_amd64.deb
It’s not that complicated. That’s just confusingly written. And caters to a wide range of users.
Its more secure to go through a package manager. Checking signatures is important.
You can verify the signature of the manual download as well. Either way, you are trusting the files you download over HTTPS from mullvad.net. There’s no real difference, except that when you use the repo, you are trusting it indefinitely, whereas if you download the deb directly, you are only trusting it once.
Using the repo is less secure, because it opens you to future attacks against the repo itself.
Https is vulnerable to loads of attack. That’s why we sign packages.
You’re downloading the signing key over HTTPS either way, from the same server. That’s the common point of failure.
That’s why you download the key from multiple distinct domains from multiple distinct locations using multiple distinct devices and veryify their fingerprints match. If the key/fingerprint is only available on one domain, open a bug report with the maintainer.
Agreed.
Unfortunately, Mullvad’s instructions just have you download the key from mullvad.net and add it in with no further validation.
You can also get it from their GitHub page, at least for the individual debs. Not sure if they have the repo key on GitHub.
bad advise, OP should use a repo if they have apt
There’s nothing wrong with installing a .deb manually.
Personally, I’d hesitate to add any third-party repos unless there is a very good reason. In this case, the only real difference is that you won’t get the updates automatically with
sudo apt update; sudo apt upgradewithout the repo. Either way, the desktop app will notify you when updates are available. There’s very little advantage to using the repo.Adding a repo is very rarely required. It has deeper consequences than simply installing an app, and requires a higher level of trust. If you don’t understand the security implications of adding a repo (and its associated key), then my advice is: just don’t.
Yes, there is. You’re risking downloading malicious software.
What are you on about? If you are using the 3rd party repo, you are just as likely to get malware than if you download the deb directly from the wbsite. Its literally the same thing, just adding the repo means that the malware could get installed automatically and without you knowing where it came from.
No, you’re confusing two vectors of attack. I’m saying that if you fan trust the vendor, then you’re still at risk from downloading malicious software that was manipulated between the vendor and you (man in the middle attack), unless you verified a signature using a key stores offline (note https is still vulnerable because the keys are stored online)
Not untrue, and I don’t think that the possibility should be glossed over, but honestly, what do you think is more likely: this specific person getting specifically MitM’ed by a bad actor, or a bad actor taking control of a repo that hundreds of people blindly trust. I have a sneaking suspicion that OP’s threat model isn’t sophisticated enough to need to really, truly, be worrying about that.
This sort of thing happens dragnet. And mullvad users are definitely a group to be targeted. Dont assume OP isnt a refugee or journalist and give them bad advice that could get them killed
-
sudo synapticfor a graphical package manager.Otherwise, just use
sudo apt-getif the program you want isn’t there, you may need to download the source and compile it yourselfOr just download a binary if the program offers one
How do you ensure you have the right dependencies if you do that?
usually it’s an appimage, i mistakenly said binary. although there are programs that offer ELF binaries, in that case you can try running it. if it doesn’t run, check the list of runtime dependencies for the program and install what is necessary using your package manager.
Change your distribution to MX Linux and use MX Package Installer there. Select Mullvad VPN from “Popular Apps” tab there and MXPI will do all these steps for you.
Probably easier to learn a few commands than it is to switch distros though.
This post is proof that Linux desktop isn’t as good, perfect and polished as everyone says it is. Stop living in the delusion.
You’re deluded if you think that “everybody” let alone a large minority of people say that the Linux desktop is “good, perfect and polished”.
That’s a new one around here ahaha
Do you even use Linux?
Yes and I do and while it is great for infrastructure, magnitudes better than anything Microsoft ever offered as a reasonable desktop it’s a fucking a joke.
He’s using a shitty version of linux. I use Arch btw
Yeah no, generally you just copypaste the software website’s instructions. Many programs can be installed through the app store (or equivalent install commands) but a lot of aoftware you just gotta copypaste the code. Many also just provide an inataller.
The meme about linux software being much easier to install is true in some cases, but mostly bullshit. even if its justsudo apt install vlcyou generally still want to check the website to make sure its the best way, or you end ip with an out of date version.Updating software on linux is better pretty much automatic without annoying popups most of the time though.
Yes. I’m genuinely unsure how it could be any easier. It’s just add the repo and install.
But I suppose it’s a lot if you don’t know what anything means, so I’ll try to explain it at a super basic level. Sorry if this is patronising, I can’t ascertain your experience level so I have to make an assumption.
The first thing it asks you to do is:
sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.ascHm. Okay so I guess before even deciphering the command, you have to know how Linux works. So on Linux, the first word is the name of the application you want to use, and everything afterwards is stuff that you pass along to the application. It’s up to the application to program in the behaviour for interpreting the words that come after the first word. So “sudo” is the name of the application you’re using, and all that other stuff is stuff you’re telling Linux to tell that other application.
Okay, so what is sudo? sudo is short for Super User Do. It’s an application that does something (sudo) as the super user (sudo). Super User is like admin on Windows. So it’s for when you want to make system level changes or want to override permission limitations. In the past, or at a basic level, you would switch user, make the change, then switch back to your personal user. But with sudo you can borrow the permissions of the super user for the purposes of that one command and everything works smoother that way.
The way you use sudo is you run the application by typing sudo, then you type in a second application and what you want that application to do, then sudo starts that other application and gives it the instructions you asked to be passed on. The second application in this case is curl.
For example, on Windows you might do
sudo photoshop open C:\users\winuser\documents\restrictedfile.psdto open a file in Photoshop that the Windows admin decided you aren’t allowed to open.Let’s look at the command again.
sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.ascSudo is to get super permissions and doesn’t actually tell you what the command does. The application that is actually being run in this command is curl. curl goes to a url and sees it. So it basically just means download whatever is at this URL. Here the URL is
https://repository.mullvad.net/deb/mullvad-keyring.ascAll that other stuff in this command is technically curl specific, so you have to check how curl works to know what it does. But it does follow Linux conventions very closely, therefore a normal Linux user who has never used curl could still guess what it does with 100% accuracy and would probably use it correctly for the first time without checking how to use it. If you want to learn how to use it, you can use the included manual programman, by typingman curl, and as a convention, almost every Linux application will tell you how to use it if you use the -h or --help flags by typingcurl -horcurl --help.In this case, curl takes flags, these are -fsSLo, that’s 5 different flags. A flag is like a mode switch for an application, it’s specified with adding a hyphen and the trigger word. The hyphen is useful because an application like curl might want a file path
/usr/share/keyrings/mullvad-keyring.ascand a URLhttps://repository.mullvad.net/deb/mullvad-keyring.asc, so by adding the hyphen, the application knows that fsSLO is not part of the file path, but is instead specific instructions you’re giving the application. This is a normal convention on Linux, similar to how Windows applications normally program the X button in the corner to close the window.For curl specifically, by default curl doesn’t save the file, it just displays it in the terminal. So the most basic version of the command would be
curl https://repository.mullvad.net/deb/mullvad-keyring.ascand nothing else. Let’s look at what the flags do.
-f is for fail.
-s is for silent. Both of these just change the behaviour of curl to give you less feedback and information. Mullvad probably chose to do this to make it more beginner friendly, ironically.
-S is for show error. There’s a difference between lower and upper case. Show error means that even though curl was asked to be quiet and not show what it’s doing, it should still let you know if there’s an error.
-L is for location, it’s to allow redirects. Mullvad chose to include this option so that the old instructions still work if the URL changes in the future or perhaps if you have a common typo in your command.
-o (output) writes the downloaded file to disk at the specific location./usr/share/keyrings/mullvad-keyring.asc. The -o flag is the only one in this list that actually matters and changes what the application does. The rest is just there to be beginner friendly, but I think Mullvad made a mistake in including them personally, as I think they add to the confusion instead.As a standard Linux convention, flags can either be a single hyphen and a letter or two hyphens and a word or a hyphenated sentence. These are conventions and up to the application, but for curl and most applications you’ll use, both work. Similarly, curl and most applications let you use a single hyphen and then all your flags in a row, or separate them with spaces and new starting-hyphens.
curl -f --silent -S -L --output file.txt https://lemmy.mlfor example.Okay, so hopefully now you can read it a bit better. Let’s look at it again.
sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.ascWtf is that file and why do you need it in that folder? It’s downloading their encryption key to the folder where apt (a different application we haven’t encountered yet) looks for encryption keys. You need this for cryptographic verification. It’s a safety measure, and more important for security software like Mullvad. It’s not mandatory for adding repositories.
So with this command, you borrow the super user’s permissions and you download a file and put it in a folder.
Okay, next part.
echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=\$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable \$(lsb_release -cs) main" \| sudo tee /etc/apt/sources.list.d/mullvad.listOkay, this one is actually pretty complicated! Similar to above, how they added all those superfluous flags that make curl quieter, this is another case of the mullvad help-article-writers choosing to make the experience of copy/pasting the commands more seamless by sacrificing legibility.
But let’s go through it anyway. It’ll be a super quick crash course in how to use Linux.
echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=\$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable \$(lsb_release -cs) main" \| sudo tee /etc/apt/sources.list.d/mullvad.listEcho is an application that repeats whatever you type at it. If you run
echo hiit’ll outputhiinto the terminal. Deb is an application that installs .deb packages. These are like .msi files on Windows. It’s specific to Ubuntu and certain other Linux distros. The stuff that follows echo is a command.deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main, if you run it on its own, it does something. But because you wrote echo first, it’s only words that are being printed in the terminal. We’ll look at what it’s supposed to do in a minute. After that part, comes a pipe|, this is very important, then a second command.sudo tee /etc/apt/sources.list.d/mullvad.list.Okay, we’ll break this down backwards.
sudoyou already know. It’s just an application that starts another application. In this casetee. tee is an application that takes whatever you give it and writes it to a file. It’s called tee because it’s like a t-split, it both writes to a file and to the terminal at the same time, so you can monitor what’s being written. It’s specifically designed to be used with a pipe.Wtf is a pipe? A pipe
|is a built in Linux function that let’s you take the output from one application and feed it to another. In this case, the stuff you had before the pipe was a echo command. So the output is what you asked echo to echo back to you.deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main". That means that tee is writing this command (without the echo part in front of it, because that’s your command, not the output from an application) into the file located at/etc/apt/sources.list.d/mullvad.list. Tee by default overwrites whatever was already in the file, and in this case, a mode-switch flag wasn’t used to ask it to not do that. So if that file already existed (which it doesn’t), it would now be deleted and replaced with what you echo’d into it.deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main".What is
/etc/apt/sources.list.d/mullvad.list? That’s a file that belongs toapt.aptis your package manager, we’ll loop back to that. The/etcfolder is somewhere applications put their files, rather than where the user is supposed to put their files. Having the user’s files separately like that helps with knowing which files you care about when it comes to backups and system migrations and things like that. So inside /etc, apt gets it’s own folder, and inside that folder it created sources.list.d, and inside that folder, you’re now creating a file for mullvad. In this file is the definition of the new repository you’re adding.[Cutting this up to two parts because API limit]
Genuinely sure it couldn’t be easier
Instructions so long it takes up two comments
These aren’t instructions. The instructions are 3 lines and provided by the vendor.
[Part two]
Two questions:
What is a repository?
What’s the stuff that goes in the file? Why is it a command and why is it so long?I started answering the second question, so we’ll continue with that and loop back to what apt and repositories are for the next and final command.
echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/mullvad.listSo echo just means “repeat what you’re given”. Then deb is the Ubuntu equivalent to
msi. Then you’re telling thedebapplication where to find the encryption key you installed earlier, and you’re telling it which arch (short for architecture, it’s the hardware configuration of your computer) you’re interested in. When it says $ and then stuff in parenthesis like that, that stuff gets computed and substituted. So you’re not literally asking for the architecture$( dpkg --print-architecture ), but instead something likearch=amd64.dpkgis an application that keeps track of what .deb packages you have installed. With the flag --print-architecture, it’s switched to a different mode where instead of it’s primary purpose, it’s telling you what system architecture you’re using. Then it’s the URL for the repository. The URL is also variable, part of the URL will get replaced later.$(lsb_release -cs). lsb stands for linux standard base, and lsb_release is just an application that says which Linux distro you’re using. The reason this ‘standard base’ is used rather than the specific distro and version, is because it’s meant to simplify the very large diversity of Linux distributions and versions down to the minimal number of possible versions that actually have some level of incompatibility with each other. So it would say your specific major version of Ubuntu, but it wouldn’t say exactly which patch you’re on. Someone who’s not using Ubuntu, but using something that from a compatibility standpoint is fully Ubuntu compatible, might also report as a Ubuntu version when using this application. The output from this program is added to the URL. The computed result is something likehttps://repository.mullvad.net/deb/stable mantic minotaur main. Main just means the main branch of the application, as opposed to a special branch, like a beta-branch.If you notice, you’re not computing these things first and then putting the result into the file, but instead you’re inserting it with variables. This will allow your system configuration to change without the need to update the repository definition.
All in all, this is a very complicated way to add a repository. On most systems, and indeed on Ubuntu, you can do this with a single application or a flag for the package manager and then a single URL. For Ubuntu it would be
apt-add-repository https://repository.mullvad.net/deb/stable mantic minotaur main. But they chose to do it like this to make it easier to do once and forget.And then finally, what is a repository? What is apt? A repository is a place that hosts software. It’s like the Play store on Android. You can use the Ubuntu repository that is standard for your Linux distribution and guaranteed to work, guaranteed to be safe, guaranteed to be respectful towards you as the user, but you can also add third party repositories. Third party developers can add their applications to the official repository, but doing so means they have to go through a quality assurance step, and that they are limited in the ways they are allowed to abuse you. For security software, this might add too much delay between when it’s critical that they provide an update, and when that update is approved for distribution to Ubuntu users. Instead they have opted to host their application on their own repository.
Apt is your package manager. It keeps track of everything you have installed, every library and component used and required by every application, and for some package managers, every file created by every application. It checks all repositories you’ve specified for updates and automatically updates all your applications. It also deals with requirements and conflicts, ensuring that you don’t have superfluous old libraries taking space, and that when you want to install something with requirements, you don’t need to manually hunt down all the prerequisites. Some package managers available on other systems will even compile applications and deal with build files for you.
A library is a set of application features that doesn’t necessarily belong to a specific application. They do common things and are used my many applications. For a Windows equivalent, you can think of the
Microsoft Visual C++ RedistributableorDirect X.And that’s everything.
sudo apt updateSudo is to get super user permissions, and then run the application
apt,aptis your package manager, and the command you’re giving to the apt application is to update it’s internal knowledge of available packages and versions. It needs to do this because it didn’t previously have the Mullvad repository.sudo apt install mullvad-vpnSudo is to borrow the super user’s permissions, apt is your package manager, and you’re telling it to install, and then the name of the application you want to install is
mullvad-vpn. This final stepsudo apt install mullvad-vpn,sudo apt install firefoxis how you install applications on Ubuntu typically. Everything before this was because you needed to add a third party source.Phew, that’s a lot of text! So in hind-sight, it could be easier after all lol. Feel free to ask if you have any questions. It’s a lot of text, but I assure you that if I was going to explain anything about how to use Windows at this level of detail, it would be pages upon pages longer! I hope the explanation wasn’t too condescending. Good luck with learning how to use Linux.
_
Pedantic clarifications:- Technically, sudo is a command and not an application, but it’s made to be treated like an application. Also technically it doesn’t stand for superuser do, but all the stuff I told you is assumptions they want you to make to make it easier to use, but because it’s such a core part of Linux, it works differently on a technical level.
- | is actually part of bash, not Linux, but most shells have | with identical behaviour.
Lmao, i’m sure this is just going to make OP run a mile.
A bit of physical exercise shouldn’t be too bad.
you’d do it too so people don’t break their system case-in-point Linus.
Great stuff This is going to be useful even to someone who easily understood the commands.
Yes. I’m genuinely unsure how it could be any easier. It’s just add the repo and install.
It can be much easier to install a PPA than using the command line to do so. I think it’s high time it was as easy as clicking on a (verified) “install this repo” type button on a page, and confirming, entering your sudo password from the launchpad website. I’d even be OK with building it into Discover.
https://mullvad.net/en/download/vpn/linux
Download the .deb
Not at my computer, but you might check if there is a snap or flatpak
snap yourself in half
What distro are you running? I think you should be able to just find the app in the app store.
If not the webside includes the download link literally in the first paragraph: https://mullvad.net/en/download/vpn/linux
Just download and double click the package, that should bring up your app store, and then click install you will be fine.
