0

I'm working on setting up an openvpn server. I'm using the standard sources of debian jessie and easy-rsa as an CA.

Everything worked fine until I've tried to start openvpn via init script. When I'm running /etc/init.d/openvpn start following error comes up in /var/log/daemon.log

Options error: --client-config-dir fails with "/etc/openvpn/easy-rsa/keys/crl.jail//etc/openvpn/server.ccd": No such file or directory

Has someone of you a idea where this mess with the paths comes from? The directory what is set in the config file exists. The server.conf file:

port 1194
proto udp
dev tun

comp-lzo
keepalive 10 120

persist-key
persist-tun
user nobody
group nogroup

chroot /etc/openvpn/easy-rsa/keys/crl.jail
crl-verify crl.pem

ca /etc/openvpn/easy-rsa/keys/ca.crt
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
key /etc/openvpn/easy-rsa/keys/server.key
cert /etc/openvpn/easy-rsa/keys/server.crt

ifconfig-pool-persist /var/lib/openvpn/server.ipp
client-config-dir /etc/openvpn/server.ccd
status /var/log/openvpn/server.log
verb 4

# virtual subnet unique for openvpn to draw client addresses from
# the server will be configured with x.x.x.1
# important: must not be used on your network
server 10.254.1.0 255.255.255.0

# push routes to clients to allow them to reach private subnets
push "route 10.0.0.0 255.0.0.0"

THX for your help.

  • Copy the script cp -r /usr/share/easy-rsa/ /etc/openvpn then restart the service /etc/init.d/openvpn restart – GAD3R Nov 27 '16 at 21:48
  • The easy-rsa folder is at place. I've allready used easy-rsa to generate certificates. – andi-g Nov 27 '16 at 22:13
0

I found the bug. The server.ccd has to be in the crl.jail directory. I've changed the config like this:

...
chroot /etc/openvpn/easy-rsa/keys/crl.jail
crl-verify crl.pem

ca /etc/openvpn/easy-rsa/keys/ca.crt
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
key /etc/openvpn/easy-rsa/keys/server.key
cert /etc/openvpn/easy-rsa/keys/server.crt

ifconfig-pool-persist /var/lib/openvpn/server.ipp
client-config-dir server.ccd

...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.