Init script just can't seem to access dh1024.pem

Data

I'm having this problem, exactly:
http://forums.openvpn.net/topic8835.html

It won't start on boot, but it will start on a manual 'service openvpn start'.
It's coming up with this in the logs:

Thu Mar 22 00:18:36 2012 OpenVPN 2.2.1 x86_64-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Sep 12 2011
Thu Mar 22 00:18:36 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Mar 22 00:18:36 2012 Note: cannot open openvpn-status.log for WRITE
Thu Mar 22 00:18:36 2012 Note: cannot open ipp.txt for READ/WRITE
Thu Mar 22 00:18:36 2012 Cannot open /opt/openvpn/keygen/keys/dh1024.pem for DH parameters: error:0200100D:system library:fopen:Permission denied: err$
Thu Mar 22 00:18:36 2012 Exiting

It still fails even when all of these have full permissions (chmod 777), and are owned by root. I imagine I'm missing something obvious here.. but I just don't know what it is. Nothing I can google gives an answer other than 'fix the permissions'.. which perhaps I don't know how to do properly.

The server.conf has user nobody, group nobody - but commenting this out makes no difference.

janjust

insert an

ls -alR /opt >> /tmp/list.txt

in the openvpn init script and reboot; check what is in the list.txt file - is the /opt filesystem mounted during boot? or later?

Data

janjust wroteinsert an

ls -alR /opt >> /tmp/list.txt

in the openvpn init script and reboot; check what is in the list.txt file - is the /opt filesystem mounted during boot? or later?

/opt:
total 40
drwxrwxrwx.  5 root  root     4096 Mar 21 22:57 openvpn

/opt/openvpn:
total 44
drwxrwxrwx.  5 root root  4096 Mar 21 22:57 .
drwxrwxrwx. 10 root root  4096 Mar 21 20:55 ..
drwxrwxrwx.  3 root root  4096 Mar 15 14:06 keygen

/opt/openvpn/keygen:
total 128
drwxrwxrwx. 3 root root  4096 Mar 15 14:06 .
drwxrwxrwx. 5 root root  4096 Mar 21 22:57 ..

/opt/openvpn/keygen/keys:
total 144
-rwxrwxrwx. 1 root root  245 Mar 15 14:38 dh1024.pem

I imagine it's mounting at boot, I'm also running a number of other scripts that run other applications in the same /opt/ directory.

Data

I've managed to fix it by moving everything to /etc/openvpn. Permission have remained the same, actually I've downgraded them as well. How bizzare.

slgen64

I had this problem, in my case it turned out to be caused by selinux. I was able to fix my issues thusly:

#Generate selinux policy lines from audit log lines and store them in moduleName.te:
grep denied /var/log/audit/audit.log.bak|audit2allow -m moduleName > moduleName.te

#Generate a selinux policy module (binary blob) from moduleName.te
checkmodule -M -m -o moduleName.mod moduleName.te

#Generate an selinux package (another binary blob) from moduleName.mod
semodule_package -o moduleName.pp -m moduleName.mod

#Load the package
semodule -i moduleName.pp

In the above the name "moduleName" is arbitrary and you might want to check the output of "grep denied /var/log/audit/audit.log".

Hopefully this helps someone.