Openvpn unable to run x script

lobi

Running centos 6 on ca and server. Note CA and servers are different devices with no forms of connectivity (except by sneakernet).
Running centos 6 on client.
All are using openvpn 2.3.8.

Trying to push dns to the client, which requires the following config added to the client config:

script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh

However, when connecting I get the following error:

[omitted]
/usr/share/openvpn/update-resolv-conf.sh tun0 1500 1542 192.168.2.6 192.168.2.5 init
WARNING: Failed running command (--up/--down): could not execute external program
[omitted]

Please note the following:

1) I am running as root, and all the files are root:root, and the script is executable (-rwxr-xr-x.)
2) I got the script here: https://github.com/masterkorp/openvpn-update-resolv-conf/blob/master/update-resolv-conf.sh
3) I installed openresolv package from the nux-misc repo as instructed by that github URL (although, I must say that it appears to do absolutely nothing...)
4) I tried using script-security 3
5) I verified my windows clients are receiving DNS properly and can establish layer 7 connectivity to my various apps.

And most importantly....

6) I have looked everywhere online, and I can't seem to find the answer to what appears to be a very simple permissions issue (unable to execute the script).

I am shocked that such a fundamental requirement (pushing DNS to non-windows clients) is not well documented and/or fixed. I'm very frustrated 😐

Thanks for your help.

lobi

There is literally nothing on this forum post that will allow me to edit this site, even though in the bottom right hand it states I have permission to edit my own posts. Strange.

Anyway, let me elaborate a bit so I can more properly follow the forum rules.

My Goal:

My Goal is to be able to push both dhcp-option DNS (and dhcp-option DOMAIN) information to my non-Windows clients.

server.conf:

port 443
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh4096.pem
topology subnet
server 10.10.201.0 255.255.255.128
ifconfig-pool-persist ipp.txt
crl-verify /etc/openvpn/keys/crl.pem
push "route 10.8.0.0 255.255.0.0 10.10.201.1"
push "route 10.9.0.0 255.255.0.0 10.10.201.1"
push "route 10.99.0.0 255.255.0.0 10.10.201.1"
push "route 10.150.0.0 255.255.0.0 10.10.201.1"
push "route 172.16.0.0 255.255.224.0 10.10.201.1"
push "route 10.7.0.0 255.255.0.0 10.10.201.1"
push "route 10.224.0.0 255.255.0.0 10.10.201.1"
push "route 10.13.0.0 255.255.0.0 10.10.201.1"
push "route 10.222.0.0 255.255.0.0 10.10.201.1"
push "route 10.70.0.0 255.255.0.0 10.10.201.1"
push "route 10.219.0.0 255.255.0.0 10.10.201.1"
push "route 10.220.0.0 255.255.0.0 10.10.201.1"
push "route 10.212.0.0 255.255.0.0 10.10.201.1"
push "route 10.223.241.0 255.0.0.0 10.10.201.1"
push "route 10.194.0.0 255.255.0.0 10.10.201.1"
push "route 10.195.0.0 255.255.0.0 10.10.201.1"
push "route 10.198.0.0 255.255.0.0 10.10.201.1"
push "route 10.199.0.0 255.255.0.0 10.10.201.1"
push "route 10.225.0.0 255.255.0.0 10.10.201.1"
push "dhcp-option DNS 10.224.241.120"
push "dhcp-option DNS 10.212.203.100"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
cipher AES-256-CBC
tls-auth /etc/openvpn/keys/pfs.key 0
verb 4

client.conf:

ca ca.crt
cert linuxtest-client2.crt
key linuxtest-client2.key
tls-auth pfs.key 1
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh
client
dev tun
proto tcp
auth-user-pass
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 4
<connection>
remote x.x.x.x 443 # Primary server
</connection>

Actual log snippet with verb 4:

Nov 19 05:07:18 localhost openvpn[12324]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Nov 19 05:07:18 localhost openvpn[12324]: PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.0.0 10.10.201.1,route 10.9.0.0 255.255.0.0 10.10.201.1,route 10.99.0.0 255.255.0.0 10.10.201.1,route 10.150.0.0 255.255.0.0 10.10.201.1,route 172.16.0.0 255.255.224.0 10.10.201.1,route 10.7.0.0 255.255.0.0 10.10.201.1,route 10.224.0.0 255.255.0.0 10.10.201.1, route 10.13.0.0 255.255.0.0 10.10.201.1,route 10.222.0.0 255.255.0.0 10.10.201.1,route 10.70.0.0 255.255.0.0 10.10.201.1,route 10.219.0.0 255.255.0.0 10.10.201.1,route 10.220.0.0 255.255.0.0 10.10.201.1,route 10.212.0.0 255.255.0.0 10.10.201.1,route 10.223.241.0 255.0.0.0 10.10.201.1,route 10.194.0.0 255.255.0.0 10.10.201.1,route 10.195.0.0 255.255.0.0 10.10.201.1,route 10.198.0.0 255.255.0.0 10.10.201.1,route 10.199.0.0 255.255.0.0 10.10.201.1,route 10.225.0.0 255.255.0.0 10.10.201.1,dhcp-option DNS 10.224.241.120,dhcp-option DNS 10.212.203.100,route-gateway 10.10.201.1,topology subnet,ping 10,push-continuation 2'
Nov 19 05:07:18 localhost openvpn[12324]: PUSH: Received control message: 'PUSH_REPLY,ping-restart 120,ifconfig 10.10.201.2 255.255.255.128,push-continuation 1'
Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: timers and/or timeouts modified
Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: --ifconfig/up options modified
Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: route options modified
Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: route-related options modified
Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Nov 19 05:07:18 localhost openvpn[12324]: ROUTE_GATEWAY 10.212.109.1/255.255.255.0 IFACE=wlan0 HWADDR=00:1e:65:7f:60:66
Nov 19 05:07:19 localhost openvpn[12324]: TUN/TAP device tun0 opened
Nov 19 05:07:19 localhost openvpn[12324]: TUN/TAP TX queue length set to 100
Nov 19 05:07:19 localhost openvpn[12324]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 19 05:07:19 localhost openvpn[12324]: /sbin/ip link set dev tun0 up mtu 1500
Nov 19 05:07:19 localhost openvpn[12324]: /sbin/ip addr add dev tun0 10.10.201.2/25 broadcast 10.10.201.127
Nov 19 05:07:19 localhost openvpn[12324]: /etc/openvpn/update-resolv-conf.sh tun0 1500 1560 10.10.201.2 255.255.255.128 init
Nov 19 05:07:19 localhost openvpn[12324]: WARNING: Failed running command (--up/--down): could not execute external program
Nov 19 05:07:19 localhost openvpn[12324]: Exiting due to fatal error

The last three errors are most relevant. This is giving me a headache 🙁

Thanks.

xauen

WARNING: Failed running command (--up/--down): could not execute external program

have you chmod your script?
can you execute your bash script outside of openvpn? If yes, are there any errors?
Are you sure there are no illegal characters in your script?
Does your script need an external program to run. eg. mysql-devel mariadb etc...?

lobi

xauen wrote
WARNING: Failed running command (--up/--down): could not execute external program
have you chmod your script?
can you execute your bash script outside of openvpn? If yes, are there any errors?
Are you sure there are no illegal characters in your script?
Does your script need an external program to run. eg. mysql-devel mariadb etc...?

Yes, I have chmod the script to be executable:

-rwxr-xr-x. 1 openvpn openvpn 1674 Nov 19 07:56 update-resolv-conf.sh

I believe I can execute the bash script, and no errors are shown. Specifically, when I cd to the dir and type ./update-resolv-conf.sh, no errors are shown:

[root@local openvpn]# ./update-resolv-conf.sh
[root@local openvpn]#

I am not sure if there are any illegal characters in the script. The only external program that was referenced to be needed was openresolv, however I downloaded the package as instructed from that github URL as instructed (notihng to do with it, though). Note that the script is very popular and used, so I doubt there are any illegal characters in the script. Note also that I changed the RESOLVCONF variable from /usr/bin/resolvconf to etc/resolvconf.conf, I also tried /etc/resolv.conf.

See script below:

#!/bin/bash
#
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood <jdthood@yahoo.co.uk>
# and Chris Hanson
# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL.
# 07/2013 colin@daedrum.net Fixed intet name
# 05/2006 chlauber@bnc.ch
#
# Example envs set from openvpn:
# foreign_option_1='dhcp-option DNS 193.43.27.132'
# foreign_option_2='dhcp-option DNS 193.43.27.133'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
# foreign_option_4='dhcp-option DOMAIN-SEARCH bnc.local'

## You might need to set the path manually here, i.e.
RESOLVCONF=/etc/resolvconf.conf

case $script_type in

up)
  for optionname in ${!foreign_option_*} ; do
    option="${!optionname}"
    echo $option
    part1=$(echo "$option" | cut -d " " -f 1)
    if [ "$part1" == "dhcp-option" ] ; then
      part2=$(echo "$option" | cut -d " " -f 2)
      part3=$(echo "$option" | cut -d " " -f 3)
      if [ "$part2" == "DNS" ] ; then
        IF_DNS_NAMESERVERS="$IF_DNS_NAMESERVERS $part3"
      fi
      if [[ "$part2" == "DOMAIN" || "$part2" == "DOMAIN-SEARCH" ]] ; then
        IF_DNS_SEARCH="$IF_DNS_SEARCH $part3"
      fi
    fi
  done
  R=""
  if [ "$IF_DNS_SEARCH" ]; then
    R="search "
    for DS in $IF_DNS_SEARCH ; do
      R="${R} $DS"
    done
  R="${R}
"
  fi

  for NS in $IF_DNS_NAMESERVERS ; do
    R="${R}nameserver $NS
"
  done
  #echo -n "$R" | $RESOLVCONF -p -a "${dev}"
  echo -n "$R" | $RESOLVCONF -a "${dev}.inet"
  ;;
down)
  $RESOLVCONF -d "${dev}.inet"
  ;;
esac

If it isn't already obvious, I am not adept at all with bash scripting (or any scripting/programming). Really appreciate the response.

Traffic

lobi wroteI believe I can execute the bash script

lobi wroteserver.conf:

Code:
user nobody
group nogroup

Can "nobody" ?

lobi

When I chown to nobody:nobody, I still get the same openvpn error. I am unable to su - nobody and then type ./update-resolv-conf.sh, I get an error stating This account is currently not available.

The fact that I changed chown'd the script to nobody:nobody, and still got same error, should prove that this is not the cause, no?

Thanks.

Traffic

No ..

nobody cannot run scripts so disable --user nobody --group nogroup in the config.

lobi

While the script and folder (/etc/openvpn/) were chown'd to openvpn:

I commented out both user and group, didn't work
I tried adding openvpn to wheel, didn't work
I tried changed user and group to root, didnt work.

Traffic

And you *Stopped then Started* openvpn to reload the config file ?

lobi

Traffic wroteAnd you *Stopped then Started* openvpn to reload the config file ?

Yes, each time. To elaborate: I restart openvpn to reload the config file, rather than stopping, then starting. I can confirm that restarting (service openvpn restart) properly reloads the config file, since this is how I have been making changes all along.

Traffic

Traffic wroteAnd you *Stopped then Started* openvpn to reload the config file ?

lobi wrote To elaborate: I restart openvpn to reload the config file, rather than stopping, then starting

There are many ways to restart openvpn .. all of which do not restart as root.

Traffic

Oops .. I just realised you are not using --user / --group in your client config :oops:

ste123

Variable RESOLVCONF needs to be executable program resolvconf, not a related configuration file.

Can you confirm the location of resolvconf on your system by running the following command?

which resolvconf

According to this page, resolvconf should be at location /sbin/resolvconf, so if the command above returns that location, update your script to suit, e.g.:

RESOLVCONF="/sbin/resolvconf"

In other versions of the script you're using (floating around the Internet and not necessarily that repository), something that's missing in yours is a check to confirm the resolvconf filename exists and is executable. You can add this check yourself with the following code directly below the RESOLVCONF= line:

[ -x $RESOLVCONF ] || exit 0

The only downside of adding the check is the script will gracefully exit, rather than providing you the current (unfortunately unhelpful) error.

BaN

lobi wrote

xauen wrote

RESOLVCONF=/etc/resolvconf.conf

Did you put this resolvconf file in your chroot (/etc/openvpn/etc/resolvconf.conf)?
If not, then mount --bind the /etc/resolvconf.conf file in your chroot.

lobi

ste123, that worked!!!!

Thank you so much for your help; I knew it was an amateur error on my end. Note that I did not have to add

[ -x $RESOLVCONF ] || exit 0

.

Also, I am not using chroot, but thanks for that suggestion also. I hope this thread will help the next person!

Thanks to everyone.

ste123

lobi wroteste123, that worked!!!!

Thank you so much for your help; I knew it was an amateur error on my end. Note that I did not have to add

[ -x $RESOLVCONF ] || exit 0

Great to hear it worked for you.

Correct - the code snippet is optional validation as it simply checks to ensure the resolvconf tool is present and executable; if not, the script will exit without performing the up/down command. It could which would be tweaked to return an error message e.g.:

[ -x "$RESOLVCONF" ] || { echo "SCRIPT ERROR: resolvconf tool '$RESOLVCONF' does not exist or is not executable"; exit 0; }

which should provide a warning in the OpenVPN log file, and would've alerted you or someone here to the actual issue much sooner.

(the above code snippet is echoing to STDOUT,not STDERR, but that - and the message itself - can be easily changed if needed)

Traffic

ste123 wrote

[ -x $RESOLVCONF ] || exit 0

The only downside of adding the check is the script will gracefully exit, rather than providing you the current (unfortunately unhelpful) error.

The error is helpful as it states the script did not work.

lobi wroteste123, that worked!!!!

Did it work .. or just not error out ?

:mrgreen:

ste123

Traffic wrote
ste123 wrote
[ -x $RESOLVCONF ] || exit 0
The only downside of adding the check is the script will gracefully exit, rather than providing you the current (unfortunately unhelpful) error.
The error is helpful as it states the script did not work.

As I said earlier, if the message was helpful, it wouldn't have taken this many replies with varied suggestions to get to a (possible) solution, despite the OP having done their own extensive legwork before posting here. OpenVPN didn't write what would've been returned to STDERR in the script to the log file, something that would be considered (to me and probably others) helpful. Maybe it does do so when set at a higher level of verbosity, I don't know - I'm no expert.

WARNING: Failed running command (--up/--down): could not execute external program

A quick Google shows the cause of the error could also be due to calling a script with an incorrect shebang (a syntactically incorrect script?), among other reasons. My point is, an error message becomes unhelpful when you have too many possible causes for it.

P.S. I'm not trying to knock OpenVPN; although there could be improvements in this area for OpenVPN, scripters should perform more validation in their scripts, which is what I suggested for the OP's script and is something that would've helped in this case.

Traffic

OpenVPN made it clear an error occurred .. It is not a general OS debugger and so does not know what the user did wrong.

All your solution does, by your own admission, is not error out in the case of an error ..
ie: it simply over rules the problem with a layer of bash gloss.

Hence my invaluable question:

Traffic wroteDid it work .. or just not error out ?

I would rather know if I have an error ..

FYI: This particular board is for OpenVPN support .. not debugging Bash.
There are other boards for script problems ..
But you are free to waste your time, and others, how you choose ..

ste123

Traffic wroteOpenVPN made it clear an error occurred .. It is not a general OS debugger and so does not know what the user did wrong.

All your solution does, by your own admission, is not error out in the case of an error .. ie: it simply over rules the problem with a layer of bash gloss.

Well, yes, OpenVPN should know what went wrong. Unless I'm mistaken, OpenVPN would have access to the script's STDERR file descriptor, seeing it can access the script's STDOUT file descriptor. Echoing the contents of STDERR would've helped immensely in this case.

Correct - I'm not making OpenVPN shut down when there's an error in the script. To mimic the behaviour of OpenVPN which exits due to a script error, maybe all that's needed is exit 0 changed to exit 1 in the validation. Then you get the best of both worlds - a friendly error explaining what went wrong, then OpenVPN exiting.

Traffic wrote Hence my invaluable question:
Traffic wroteDid it work .. or just not error out ?
I would rather know if I have an error ..

Seeing it sounds like the OP didn't employ the validation part of my suggestion (if you actually read their response), and it no longer errors, one would assume their script is now working.

Traffic wroteFYI: This particular board is for OpenVPN support .. not debugging Bash.
There are other boards for script problems ..
But you are free to waste your time, and others, how you choose ..

Then a mod should move this thread to the right place?