I want OpenVPN to run a script when a client connects, but it seems to ignore my client-connect directive.

I am running OpenVPN 2.4.0 on Raspbian. In my server.conf, I have

script-security 3
# this is the "up" directive but the issue is the same as with client-connect
up /etc/openvpn/up.sh

/etc/openvpn/up.sh is owned by root by world-executable (rwxr-xr-x), and it is as simple as

whoami >> /tmp/connect.txt
exit 0

I can successfully connect to my server, /var/log/daemon.log even states ovpn-server[2050]: /etc/openvpn/up.sh tun0 1500 1621 init without stating any error, yet nothing appears on /tmp, as if my script was not called.

What is going wrong?

  • FWIW, here is my full server.conf port 1194 proto udp dev tun ca /etc/openvpn/certs/keys/ca.crt cert /etc/openvpn/certs/keys/....crt key /etc/openvpn/certs/keys/...key dh /etc/openvpn/certs/....pem server ifconfig-pool-persist ipp.txt push "redirect-gateway def1" push "dhcp-option DNS ..." push "dhcp-option DNS ..." script-security 3 up /etc/openvpn/up.sh keepalive 10 120 tls-auth /etc/openvpn/certs/keys/ta.key 0 cipher AES-256-CBC persist-key persist-tun status openvpn-status.log verb 9 explicit-exit-notify 1 auth ... tls-cipher ... – Daladim Jan 6 at 14:32
  • Sorry for the missing newlines :D – Daladim Jan 6 at 14:32

I'm eventually replying to myself.

OpenVPN was launched as a systemd service (target?), and its config file stated PrivateTmp=true. So it did work and the script was actually run, but it did not write in the actual /tmp folder.

And by the way, one should also use the full path to the binaries (e.g. /usr/bin/whoami), since the $PATH of the executed script may not be the same as the one of regular shells.

  • And, for a production system, script-security 2 is enough. And the script does not need to be world-executable, just executable by openvpn's user. – Daladim Jan 6 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.