After updating a VM from Ubuntu Server 14.04 LTS to 16.04 LTS OpenVPN stopped working and I would appreciate help understanding why.
Using systemctl status I could see that OpenVPN could not create the PID file in /run/openvpn or the log files in /var/log/openvpn due to "permission denied".
If I use the exact same command to start OpenVPN manually as root then everything works fine and if I change the permissions on the folders to 777 it also works fine.
/run/openvpn is owned by root:root and originally had 755 as permissions.
/var/log/openvpn is owned by openvpn:root and originally had 775 as permissions.
If I start OpenVPN with 777 as permissions I can see the following files:
/run/openvpn/server.pid root:root 644 /var/log/openvpn/openvpn.log. root:root 600 /var/log/openvpn/openvpn-status.log root:root 600
So, OpenVPN seems to be running as root so why am I getting permission denied with 755 as folder permissions when I use systemd? The exact same command line run from bash as root works as expected.
[Unit] Description=OpenVPN connection to %i PartOf=openvpn.service ReloadPropagatedFrom=openvpn.service Before=systemd-user-sessions.service Documentation=man:openvpn(8) Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true KillMode=mixed Type=forking ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid PIDFile=/run/openvpn/%i.pid ExecReload=/bin/kill -HUP $MAINPID WorkingDirectory=/etc/openvpn ProtectSystem=yes CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw [Install] WantedBy=multi-user.target