4

I am running an OpenVPN server on Ubuntu 14.04 as well as OpenSSH.

I have my SSH server configured to bind to an IP address on my VPN interface. Once my machine boots, binding to that IP fails.

Once I log in, can see with netstat that sshd is not listening. I am able to restart sshd and the machine will start listening properly. The IP on my VPN is the only IP I have configured sshd to listen on.

At Boot:

sshd[1016]: Set /proc/self/oom_score_adj from 0 to -1000
sshd[1016]: error: Bind to port 22 on 10.8.0.1 failed: Cannot assign requested address.
sshd[1016]: fatal: Cannot bind any address.

Restart SSH:

sshd[3481]: Set /proc/self/oom_score_adj from 0 to -1000
sshd[3481]: Server listening on 10.8.0.1 port 22.

My best guess is that sshd is starting before my VPN is up and running. Is there a way I am able to ensure sshd starts afterwards so it can bind properly?

Any suggestions about what to do or check?

  • There most likely is, but it will largely depend on your OS/distro. Please edit your question w/ that piece of information. – tink Jul 17 '14 at 4:08
  • I have included it. It is on the first line. I am running Ubuntu 14.04. – ehaydenr Jul 17 '14 at 4:09
1

I found a solution.

In the OpenVPN configuration file /etc/openvpn/server.conf you can specify a script to run on up. If you take a look at the OpenVPN manual page man openvpn, you will see --up cmd. In the /etc/openvpn/server.conf configuration file, I added a line:

up "/etc/openvpn/up.sh"

This file is one that I created and will be executed when the VPN starts. Right now, mine looks like this:

#!/bin/sh
logger VPN is UP
service ssh restart

Now, every time my OpenVPN server starts up, it will also restart the OpenSSH server as well. Likewise, I am able to also use --down cmd and specify a file in the server configuration file if I wish to have a script executed when the server is shutdown.

You can read more about these in the OpenVPN manual page - man openvpn

| improve this answer | |
  • How did you set up SSH to bind to the VPN interface? – JB0x2D1 Oct 2 '14 at 17:21
  • @JB0x2D1 I achieved it without actually binding the interface. I bound it to the IP address i knew my machine would be on after connecting to the VPN. In this case, I was hosting the VPN so I knew what ip my machine (The VPN server) would have inside the VPN. From there, you just have ssh only listen on that ip address. I am not sure whether this is 100% reliable. It was for me, but i would imagine interface binding would be better. Please comment if you learn how to bind. – ehaydenr Oct 2 '14 at 18:05
  • Thanks. I think the problem is with my client. I can connect to the VPN then run SSH with no problems on one client but not with another. The problem client is running Lubuntu – JB0x2D1 Oct 2 '14 at 18:10
0

Looks like ssh uses upstart, but openvpn doesn't ... you might be able to force ssh to come up delayed by doing this, but it's untested (I don't want to mess up my install):

update-rc.d ssh defaults 99

And as it's untested: CAVEAT EMPTOR

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.