Applies to Fedora 16 and 17; issue seems to lie with the openvpn-auth-pam.so plugin.
Tested on Fedora 16, initial Fedora 17 and latest Fedora 17 update.
Tested with Openvpn 2.2.2-7 & 2.3.2-1
After a couple of months of flawless operation, my installation of openvpn server on Fedora 17 stopped accepting new logins with a system error message for the openvpn process "too many open files". To get it running again, I had to restart the openvpn server by issuing:
systemctl restart
openvpn@server.service
I setup an offline system in which to experiment and discovered that use of the password authentication plugin: openvpn-auth-pam.so (the name changed to openvpn-plugin-auth-pam.so in the latest Fedora 17 update) caused a new file descriptor (fd) (anon_inode) to be generated upon every login. After a 1000+ logins, the openvpn process will hit its maximum allotted fd count (1024?) and refuse any subsequent connections with the "too many open files" system error.
Might I have a setup problem?
Should I report this as a bug to Openvpn or might Fedora be responsible?
My server.conf file:
port 1194
proto udp
dev tap0
# Avoid accessing upon restart
persist-key
persist-tun
#tls-auth ta.key 0
#tls-server
dh dh1024.pem
ca ca.crt
cert server.crt
key server.key
# add password protection for fedora 16 and early 17
#plugin /usr/lib/openvpn/plugin/lib/openvpn-auth-pam.so login
# add password protection for fedora 17 Latest Update, name change and path change for plugin
plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login
# end passwd protection fedora
server-bridge 192.168.10.108 255.255.255.0 192.168.10.10 192.168.10.20
keepalive 10 120
push "dhcp-option DOMAIN test-vpn-server.local"
push "dhcp-option DNS 192.168.10.1"
push "dhcp-option WINS 192.168.10.1"
# Let all clients see each other
client-to-client
max-clients 5
client-disconnect /etc/openvpn/logoff.sh
mode server
duplicate-cn
mtu-test
reneg-sec 3600
nice 3
comp-lzo
status-version 2
status openvpn-status.log
verb 3
Thanks Jim
