3

After updating a VM from Ubuntu Server 14.04 LTS to 16.04 LTS OpenVPN stopped working and I would appreciate help understanding why.

Using systemctl status I could see that OpenVPN could not create the PID file in /run/openvpn or the log files in /var/log/openvpn due to "permission denied".

If I use the exact same command to start OpenVPN manually as root then everything works fine and if I change the permissions on the folders to 777 it also works fine.

/run/openvpn is owned by root:root and originally had 755 as permissions.

/var/log/openvpn is owned by openvpn:root and originally had 775 as permissions.

If I start OpenVPN with 777 as permissions I can see the following files:

/run/openvpn/server.pid root:root 644

/var/log/openvpn/openvpn.log. root:root 600
/var/log/openvpn/openvpn-status.log root:root 600

So, OpenVPN seems to be running as root so why am I getting permission denied with 755 as folder permissions when I use systemd? The exact same command line run from bash as root works as expected.

/lib/systemd/.../openvpn@.service contents:

[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
PrivateTmp=true
KillMode=mixed
Type=forking
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn
ProtectSystem=yes
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw

[Install]
WantedBy=multi-user.target

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.