1

Just installed openvpn on my VPS.

Starts flawlessly with

sudo openvpn /etc/openvpn/server/server.conf

But

sudo systemctl start openvpn-server@server

won't run. There's a conflict with systemd.

The logs:

Options error: --ca fails with '/etc/openvpn/server/ca.crt': Permission denied (errno=13)
Options error: --cert fails with '/etc/openvpn/server/server.crt': Permission denied (errno=13)
Options error: --key fails with '/etc/openvpn/server/server.key': Permission denied (errno=13)
Options error: Please correct these errors.

The systemd config:

[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/bin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
User=openvpn
Group=network
AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure

[Install]
WantedBy=multi-user.target

My server folder with keys and certificates:

ls -la
total 36
drwxr-x--- 2 openvpn network 4096 Jan 11 00:24 .
drwxr-xr-x 5 root    root    4096 Jan 11 00:02 ..
-rw------- 1 root    root    1184 Jan 10 23:26 ca.crt
-rw-r--r-- 1 root    root     424 Jan 10 23:29 dh2048.pem
-rw-r--r-- 1 root    root     618 Jan 11 16:07 server.conf
-rw------- 1 root    root    4586 Jan 10 23:28 server.crt
-rw------- 1 root    root    1704 Jan 10 23:27 server.key
-rw------- 1 root    root     636 Jan 10 23:43 ta.key

Is there a fault in permissions?

1 Answer 1

3

The config files need to be owned by openvpn.

Your systemd service definition says that openvpn needs to run as user openvpn, group network. However, when you run it using sudo, you're running it as user root.

All the files are owned by root and most of them mode 0600, thus not readable by anyone else. This needs fixing so that the openvpn user can read them.

Just run chown openvpn:network /etc/openvpn/server/*.

1
  • I also had the certs under my /home/user/.openvpn/my-vpn directory which was causing a file not found error so I had to move it to a custom /etc/openvpn/certs/my-vpn/ and it it's all working now.
    – Anis Benna
    Jun 25 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.