I've just configured OpenVPN on my server and it has been working fine till i changed it to work in chroot mode.
This is the main configuration file vpn.example.com.conf:
local w.x.y.z port 1194 proto udp proto-force udp dev tun ifconfig-ipv6 wwww:xxxx:yyyy:zzzz::1 wwww:xxxx:yyyy:zzzz::2 ca /etc/openvpn/easy-rsa3/easyrsa3/pki/ca.crt cert /etc/openvpn/easy-rsa3/easyrsa3/pki/issued/vpn.example.com.crt key /etc/openvpn/easy-rsa3/easyrsa3/pki/private/vpn.example.com.key dh /etc/openvpn/easy-rsa3/easyrsa3/pki/dh.pem topology subnet server 10.8.0.0 255.255.255.0 server-ipv6 wwww:xxxx:yyyy:zzzz::/64 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS w.x.y.z" push "dhcp-option DNS z.w.x.y" push "dhcp-option DNS 8.8.8.8" push "route-ipv6 wwww:xxxx:yyyy:zzzz::2/64" push "route-ipv6 wwww::/3" push "redirect-gateway def1" tls-crypt /etc/openvpn/easy-rsa3/easyrsa3/ta.key tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 tls-version-min 1.2 auth SHA512 crl-verify /etc/openvpn/easy-rsa3/easyrsa3/pki/crl.pem cipher AES-256-GCM compress lz4 user nobody group nogroup verify-client-cert require remote-cert-tls client username-as-common-name plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn script-security 2 client-connect /etc/openvpn/scripts/connect_.sh client-disconnect /etc/openvpn/scripts/disconnect.sh management /run/openvpn/openvpn.sock unix pw-management-file keepalive 10 120 persist-key persist-tun status /var/log/openvpn/status.log log-append /var/log/openvpn/openvpn.log verb 3 explicit-exit-notify 1 max-clients 5 To configure chroot i just:
Created openvpn user by running
useradd openvpn -d /etc/openvpn.chown -R openvpn:openvpn /etc/openvpn.
Changed all paths in the config file into relatives ones.
Added
openvpn ALL=(ALL) NOPASSWD: /sbin/ipto /etc/sudoersAdded the following directives
chroot /etc/openvpn,iproute unpriv-ip,user openvpn,group openvpn.cat unpriv-ip#!/bin/sh /usr/bin/sudo /sbin/ip $*Also edited rsyslog config to create an extra socket into openvpn chroot directory.
Lastly simplified connect_.sh script to:
#!/bin/bash /bin/echo 'a' exit 0 When i run openvpn --config vpn.example.com.conf and try to connect i see WARNING: Failed running command (--client-connect): could not execute external program but if u run su - openvpn i can successfully run ./scripts/connect_.sh script
The following is the output when running openvpn from command line and before any client tries to connect:
cd /etc/openvpn/ root@we:/etc/openvpn# /usr/sbin/openvpn --config conf.d/vpn.example.com\[easy-rsa3+chroot\].conf --verb 3 Fri Dec 8 19:45:01 2017 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 22 2017 Fri Dec 8 19:45:01 2017 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08 Fri Dec 8 19:45:01 2017 MANAGEMENT: unix domain socket listening on /run/openvpn/openvpn.sock Fri Dec 8 19:45:01 2017 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Fri Dec 8 19:45:01 2017 PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so '[/usr/lib/openvpn/openvpn-plugin-auth-pam.so] [openvpn]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY Fri Dec 8 19:45:01 2017 Diffie-Hellman initialized with 4096 bit key Fri Dec 8 19:45:01 2017 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Fri Dec 8 19:45:01 2017 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Fri Dec 8 19:45:01 2017 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Fri Dec 8 19:45:01 2017 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Fri Dec 8 19:45:01 2017 TUN/TAP device tun0 opened Fri Dec 8 19:45:01 2017 TUN/TAP TX queue length set to 100 Fri Dec 8 19:45:01 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=1 Fri Dec 8 19:45:01 2017 unpriv-ip link set dev tun0 up mtu 1500 Fri Dec 8 19:45:01 2017 unpriv-ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255 Fri Dec 8 19:45:01 2017 unpriv-ip -6 addr add wwww:xxxx:yyyy:zzzz::1/64 dev tun0 Fri Dec 8 19:45:01 2017 Could not determine IPv4/IPv6 protocol. Using AF_INET Fri Dec 8 19:45:01 2017 Socket Buffers: R=[8388608->8388608] S=[212992->212992] Fri Dec 8 19:45:01 2017 UDPv4 link local (bound): [AF_INET]w.x.y.z:1194 Fri Dec 8 19:45:01 2017 UDPv4 link remote: [AF_UNSPEC] Fri Dec 8 18:45:01 2017 chroot to '/etc/openvpn' and cd to '/' succeeded Fri Dec 8 18:45:01 2017 GID set to openvpn Fri Dec 8 18:45:01 2017 UID set to openvpn Fri Dec 8 18:45:01 2017 MULTI: multi_init called, r=256 v=256 Fri Dec 8 18:45:01 2017 IFCONFIG POOL IPv6: (IPv4) size=252, size_ipv6=65536, netbits=64, base_ipv6=wwww:xxxx:yyyy:zzzz::1000 Fri Dec 8 18:45:01 2017 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=1 Fri Dec 8 18:45:01 2017 ifconfig_pool_read(), in='client1,10.8.0.2,wwww:xxxx:yyyy:zzzz::1000', TODO: IPv6 Fri Dec 8 18:45:01 2017 succeeded -> ifconfig_pool_set() Fri Dec 8 18:45:01 2017 IFCONFIG POOL LIST Fri Dec 8 18:45:01 2017 client1,10.8.0.2,wwww:xxxx:yyyy:zzzz::1000 Fri Dec 8 18:45:01 2017 Initialization Sequence Completed That's the output when a client tries to connect:
Fri Dec 8 18:47:44 2017 66.666.66.66:64191 TLS: Initial packet from [AF_INET]66.666.66.66:64191, sid=1c8b367d eb08e85e Fri Dec 8 18:47:47 2017 66.666.66.66:64191 VERIFY OK: depth=1, C=FF, ST=ZZZ, L=SomeCity, O=Some Text, OU=String, CN=String CA, [email protected] Fri Dec 8 18:47:47 2017 66.666.66.66:64191 Validating certificate key usage Fri Dec 8 18:47:47 2017 66.666.66.66:64191 ++ Certificate has key usage 0080, expects 0080 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 VERIFY KU OK Fri Dec 8 18:47:47 2017 66.666.66.66:64191 Validating certificate extended key usage Fri Dec 8 18:47:47 2017 66.666.66.66:64191 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication Fri Dec 8 18:47:47 2017 66.666.66.66:64191 VERIFY EKU OK Fri Dec 8 18:47:47 2017 66.666.66.66:64191 VERIFY OK: depth=1, C=FF, ST=ZZZ, L=SomeCity, O=Some Text, OU=String, CN=String CA, [email protected] Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_VER=2.4.4 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_PLAT=mac Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_PROTO=2 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_NCP=2 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_LZ4=1 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_LZ4v2=1 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_LZO=1 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_COMP_STUB=1 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_COMP_STUBv2=1 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_TCPNL=1 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_4920_3.7.4a__build_4920)" Fri Dec 8 18:47:47 2017 66.666.66.66:64191 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0 Fri Dec 8 18:47:47 2017 66.666.66.66:64191 TLS: Username/Password authentication succeeded for username 'client' [CN SET] Fri Dec 8 18:47:47 2017 66.666.66.66:64191 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA Fri Dec 8 18:47:47 2017 66.666.66.66:64191 [client1] Peer Connection Initiated with [AF_INET]66.666.66.66:64191 Fri Dec 8 18:47:47 2017 client1/66.666.66.66:64191 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=wwww:xxxx:y:zzzz::1000 Fri Dec 8 18:47:47 2017 client1/66.666.66.66:64191 WARNING: Failed running command (--client-connect): could not execute external program Fri Dec 8 18:47:48 2017 client1/66.666.66.66:64191 PUSH: Received control message: 'PUSH_REQUEST' Fri Dec 8 18:47:48 2017 client1/66.666.66.66:64191 Delayed exit in 5 seconds Fri Dec 8 18:47:48 2017 client1/66.666.66.66:64191 SENT CONTROL [client1]: 'AUTH_FAILED' (status=1) Fri Dec 8 18:47:53 2017 client1/66.666.66.66:64191 SIGTERM[soft,delayed-exit] received, client-instance exiting 
script-securityconfiguration option.