Running centos 6 on ca and server. Note CA and servers are different devices with no forms of connectivity (except by sneakernet). Running centos 6 on client. All are using openvpn 2.3.8. Trying to push dns to the client, which requires the following config added to the client config: [code]script-security 2 up /etc/openvpn/update-resolv-conf.sh down /etc/openvpn/update-resolv-conf.sh[/code] However, when connecting I get the following error: [code][omitted] /usr/share/openvpn/update-resolv-conf.sh tun0 1500 1542 192.168.2.6 192.168.2.5 init WARNING: Failed running command (--up/--down): could not execute external program [omitted][/code] Please note the following: 1) I am running as root, and all the files are root:root, and the script is executable (-rwxr-xr-x.) 2) I got the script here: https://github.com/masterkorp/openvpn-update-resolv-conf/blob/master/update-resolv-conf.sh 3) I installed openresolv package from the nux-misc repo as instructed by that github URL (although, I must say that it appears to do absolutely nothing...) 4) I tried using script-security 3 5) I verified my windows clients are receiving DNS properly and can establish layer 7 connectivity to my various apps. And most importantly.... 6) I have looked everywhere online, and I can't seem to find the answer to what appears to be a very simple permissions issue (unable to execute the script). I am shocked that such a fundamental requirement (pushing DNS to non-windows clients) is not well documented and/or fixed. I'm very frustrated :| Thanks for your help.

There is literally nothing on this forum post that will allow me to edit this site, even though in the bottom right hand it states I have permission to edit my own posts. Strange. Anyway, let me elaborate a bit so I can more properly follow the forum rules. [b]My Goal:[/b] My Goal is to be able to push both dhcp-option DNS (and dhcp-option DOMAIN) information to my non-Windows clients. [b]server.conf:[/b] [code]port 443 proto tcp dev tun ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh4096.pem topology subnet server 10.10.201.0 255.255.255.128 ifconfig-pool-persist ipp.txt crl-verify /etc/openvpn/keys/crl.pem push "route 10.8.0.0 255.255.0.0 10.10.201.1" push "route 10.9.0.0 255.255.0.0 10.10.201.1" push "route 10.99.0.0 255.255.0.0 10.10.201.1" push "route 10.150.0.0 255.255.0.0 10.10.201.1" push "route 172.16.0.0 255.255.224.0 10.10.201.1" push "route 10.7.0.0 255.255.0.0 10.10.201.1" push "route 10.224.0.0 255.255.0.0 10.10.201.1" push "route 10.13.0.0 255.255.0.0 10.10.201.1" push "route 10.222.0.0 255.255.0.0 10.10.201.1" push "route 10.70.0.0 255.255.0.0 10.10.201.1" push "route 10.219.0.0 255.255.0.0 10.10.201.1" push "route 10.220.0.0 255.255.0.0 10.10.201.1" push "route 10.212.0.0 255.255.0.0 10.10.201.1" push "route 10.223.241.0 255.0.0.0 10.10.201.1" push "route 10.194.0.0 255.255.0.0 10.10.201.1" push "route 10.195.0.0 255.255.0.0 10.10.201.1" push "route 10.198.0.0 255.255.0.0 10.10.201.1" push "route 10.199.0.0 255.255.0.0 10.10.201.1" push "route 10.225.0.0 255.255.0.0 10.10.201.1" push "dhcp-option DNS 10.224.241.120" push "dhcp-option DNS 10.212.203.100" keepalive 10 120 comp-lzo user nobody group nogroup persist-key persist-tun plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn cipher AES-256-CBC tls-auth /etc/openvpn/keys/pfs.key 0 verb 4[/code] [b]client.conf:[/b] [code]ca ca.crt cert linuxtest-client2.crt key linuxtest-client2.key tls-auth pfs.key 1 script-security 2 up /etc/openvpn/update-resolv-conf.sh down /etc/openvpn/update-resolv-conf.sh client dev tun proto tcp auth-user-pass resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server cipher AES-256-CBC comp-lzo verb 4 remote x.x.x.x 443 # Primary server [/code] [b]Actual log snippet with verb 4:[/b] [code]Nov 19 05:07:18 localhost openvpn[12324]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Nov 19 05:07:18 localhost openvpn[12324]: PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.0.0 10.10.201.1,route 10.9.0.0 255.255.0.0 10.10.201.1,route 10.99.0.0 255.255.0.0 10.10.201.1,route 10.150.0.0 255.255.0.0 10.10.201.1,route 172.16.0.0 255.255.224.0 10.10.201.1,route 10.7.0.0 255.255.0.0 10.10.201.1,route 10.224.0.0 255.255.0.0 10.10.201.1, route 10.13.0.0 255.255.0.0 10.10.201.1,route 10.222.0.0 255.255.0.0 10.10.201.1,route 10.70.0.0 255.255.0.0 10.10.201.1,route 10.219.0.0 255.255.0.0 10.10.201.1,route 10.220.0.0 255.255.0.0 10.10.201.1,route 10.212.0.0 255.255.0.0 10.10.201.1,route 10.223.241.0 255.0.0.0 10.10.201.1,route 10.194.0.0 255.255.0.0 10.10.201.1,route 10.195.0.0 255.255.0.0 10.10.201.1,route 10.198.0.0 255.255.0.0 10.10.201.1,route 10.199.0.0 255.255.0.0 10.10.201.1,route 10.225.0.0 255.255.0.0 10.10.201.1,dhcp-option DNS 10.224.241.120,dhcp-option DNS 10.212.203.100,route-gateway 10.10.201.1,topology subnet,ping 10,push-continuation 2' Nov 19 05:07:18 localhost openvpn[12324]: PUSH: Received control message: 'PUSH_REPLY,ping-restart 120,ifconfig 10.10.201.2 255.255.255.128,push-continuation 1' Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: timers and/or timeouts modified Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: --ifconfig/up options modified Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: route options modified Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: route-related options modified Nov 19 05:07:18 localhost openvpn[12324]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Nov 19 05:07:18 localhost openvpn[12324]: ROUTE_GATEWAY 10.212.109.1/255.255.255.0 IFACE=wlan0 HWADDR=00:1e:65:7f:60:66 Nov 19 05:07:19 localhost openvpn[12324]: TUN/TAP device tun0 opened Nov 19 05:07:19 localhost openvpn[12324]: TUN/TAP TX queue length set to 100 Nov 19 05:07:19 localhost openvpn[12324]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Nov 19 05:07:19 localhost openvpn[12324]: /sbin/ip link set dev tun0 up mtu 1500 Nov 19 05:07:19 localhost openvpn[12324]: /sbin/ip addr add dev tun0 10.10.201.2/25 broadcast 10.10.201.127 Nov 19 05:07:19 localhost openvpn[12324]: /etc/openvpn/update-resolv-conf.sh tun0 1500 1560 10.10.201.2 255.255.255.128 init Nov 19 05:07:19 localhost openvpn[12324]: WARNING: Failed running command (--up/--down): could not execute external program Nov 19 05:07:19 localhost openvpn[12324]: Exiting due to fatal error[/code] The last three errors are most relevant. This is giving me a headache :( Thanks.

[code]WARNING: Failed running command (--up/--down): could not execute external program[/code] have you chmod your script? can you execute your bash script outside of openvpn? If yes, are there any errors? Are you sure there are no illegal characters in your script? Does your script need an external program to run. eg. mysql-devel mariadb etc...?

[quote="xauen"][code]WARNING: Failed running command (--up/--down): could not execute external program[/code] have you chmod your script? can you execute your bash script outside of openvpn? If yes, are there any errors? Are you sure there are no illegal characters in your script? Does your script need an external program to run. eg. mysql-devel mariadb etc...?[/quote] Yes, I have chmod the script to be executable: [code]-rwxr-xr-x. 1 openvpn openvpn 1674 Nov 19 07:56 update-resolv-conf.sh[/code] I [b]believe[/b] I can execute the bash script, and no errors are shown. Specifically, when I cd to the dir and type ./update-resolv-conf.sh, no errors are shown: [code][root@local openvpn]# ./update-resolv-conf.sh [root@local openvpn]# [/code] I am not sure if there are any illegal characters in the script. The only external program that was referenced to be needed was openresolv, however I downloaded the package as instructed from that github URL as instructed (notihng to do with it, though). Note that the script is very popular and used, so I doubt there are any illegal characters in the script. Note also that I changed the [b]RESOLVCONF[/b] variable from /usr/bin/resolvconf to etc/resolvconf.conf, I also tried /etc/resolv.conf. See script below: [code]#!/bin/bash # # Parses DHCP options from openvpn to update resolv.conf # To use set as 'up' and 'down' script in your openvpn *.conf: # up /etc/openvpn/update-resolv-conf # down /etc/openvpn/update-resolv-conf # # Used snippets of resolvconf script by Thomas Hood # and Chris Hanson # Licensed under the GNU GPL. See /usr/share/common-licenses/GPL. # 07/2013 colin@daedrum.net Fixed intet name # 05/2006 chlauber@bnc.ch # # Example envs set from openvpn: # foreign_option_1='dhcp-option DNS 193.43.27.132' # foreign_option_2='dhcp-option DNS 193.43.27.133' # foreign_option_3='dhcp-option DOMAIN be.bnc.ch' # foreign_option_4='dhcp-option DOMAIN-SEARCH bnc.local' ## You might need to set the path manually here, i.e. RESOLVCONF=/etc/resolvconf.conf case $script_type in up) for optionname in ${!foreign_option_*} ; do option="${!optionname}" echo $option part1=$(echo "$option" | cut -d " " -f 1) if [ "$part1" == "dhcp-option" ] ; then part2=$(echo "$option" | cut -d " " -f 2) part3=$(echo "$option" | cut -d " " -f 3) if [ "$part2" == "DNS" ] ; then IF_DNS_NAMESERVERS="$IF_DNS_NAMESERVERS $part3" fi if [[ "$part2" == "DOMAIN" || "$part2" == "DOMAIN-SEARCH" ]] ; then IF_DNS_SEARCH="$IF_DNS_SEARCH $part3" fi fi done R="" if [ "$IF_DNS_SEARCH" ]; then R="search " for DS in $IF_DNS_SEARCH ; do R="${R} $DS" done R="${R} " fi for NS in $IF_DNS_NAMESERVERS ; do R="${R}nameserver $NS " done #echo -n "$R" | $RESOLVCONF -p -a "${dev}" echo -n "$R" | $RESOLVCONF -a "${dev}.inet" ;; down) $RESOLVCONF -d "${dev}.inet" ;; esac[/code] If it isn't already obvious, I am not adept at all with bash scripting (or any scripting/programming). Really appreciate the response.

[quote="lobi"]I believe I can execute the bash script[/quote][quote="lobi"]server.conf: Code: user nobody group nogroup[/quote]Can "[i]nobody[/i]" ?

When I chown to nobody:nobody, I still get the same openvpn error. I am unable to su - nobody and then type ./update-resolv-conf.sh, I get an error stating This account is currently not available. The fact that I changed chown'd the script to nobody:nobody, and still got same error, should prove that this is not the cause, no? Thanks.

No .. [b]nobody[/b] [u]cannot[/u] run scripts so disable --[b]user nobody[/b] --[b]group nogroup[/b] in the config.

While the script and folder (/etc/openvpn/) were chown'd to openvpn: I commented out both user and group, didn't work I tried adding openvpn to wheel, didn't work I tried changed user and group to root, didnt work.

And you *Stopped then Started* openvpn to [u]reload[/u] the config file ?

[quote="Traffic"]And you *Stopped then Started* openvpn to [u]reload[/u] the config file ?[/quote] Yes, each time. To elaborate: I restart openvpn to reload the config file, rather than stopping, then starting. I can confirm that restarting (service openvpn restart) properly reloads the config file, since this is how I have been making changes all along.

[quote="Traffic"]And you *Stopped then Started* openvpn to reload the config file ?[/quote][quote="lobi"] To elaborate: I restart openvpn to reload the config file, rather than stopping, then starting[/quote]There are many ways to [i]restart[/i] openvpn .. all of which do [u]not[/u] [i]restart[/i] as root.

Openvpn unable to run x script

Traffic

ste123 wroteWell, yes, OpenVPN should know what went wrong. Unless I'm mistaken

You are mistaken ..

ste123 wroteThen a mod should move this thread to the right place

At this time mods are very busy..

If you are ready:
https://forums.openvpn.net/topic20287.html

« Previous Page