0

My OpenVPN server is running under nobody account and it is configured to call a script once a client gets connected (for logging client's IP along with some info):

client-connect "/etc/openvpn/scripts/clientconnect.sh 443" 

The problem is that script can successfully write into /etc/openvpn/logs/ but it fails to write into /var/log/openvpn/ Permissions are identical for both destinations:

root@vpn:/etc/openvpn# ll /var/log/openvpn/client-connect.log
-rw-r--rw- 1 root root 1 Apr 19 19:10 /var/log/openvpn/client-connect.log
root@vpn:/etc/openvpn# ll /etc/openvpn/logs/client-connect.log
-rw-r--rw- 1 root root 63103291 Apr 19 19:20 /etc/openvpn/logs/client-connect.log

Output of ls -ld / /var /var/log /var/log/openvpn/:

root@vpn:~# ls -ld / /var /var/log /var/log/openvpn/
drwxr-xr-x 23 root root   4096 Apr 13 20:15 /
drwxr-xr-x 11 root root   4096 Feb  6  2016 /var
drwxrwxr-x 14 root syslog 4096 Apr 19 00:00 /var/log
drw-rw-rw-  3 root root   4096 Apr 19 19:19 /var/log/openvpn/

I get the following error for /var/log/openvpn/ destination:

/etc/openvpn/scripts/clientconnect.sh: 12: cannot create /var/log/openvpn/client-connect.log: Permission denied

Can't figure out, what can prevent OpenVPN from writing into /var/log/openvpn/client-connect.log?

(I know that OpenVPN could be run under some other login, but I'd like to deal with permissions issue)

3
  • 1
    ls -ld / /var /var/log /var/log/openvpn/ added to your question, please. You'll see that the openvpn directory is not accessible by the nobody account. And the point of the nobody account is that nothing (nobody) should be using it. It is not an anonymous account. It is an account that no process should use. Create your own not-a-person account to run OpenVPN if you need, but don't use nobody Apr 19, 2023 at 17:54
  • ls -ld output added. I know, it is recommended to use dedicated account for each service, but noboby is currently used only for OpenVPN, and also I'd like to understand why exactly access is denied. Apr 19, 2023 at 20:40
  • It's also used for ssh security isolation, with the expectation that no process runs as nobody. I suppose if you want to provide a potential back door into ssh by running a process that handles external connections from the internet that's your choice Apr 19, 2023 at 21:25

1 Answer 1

0

Your directory permissions for /var/log/openvpn itself are wrong. You must provide execute (search) permission for a user, group, or everyone else if you want them to be able to access items in that directory

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .