Hello. I set up OpenVPN on my VPS (Fedors 23) and I faced with problem starting OpenVPN via systemctl. As long as I want to run my OpenVPN server unprivileged, I folllowed [url=https://openvpn.net/index.php/open-source/documentation/howto.html#security]official howto[/url]: I created corresponding executable sctipt unpriv-ip, added [i]iproute[/i], [i]user[/i] and [i]group[/i] directives in server config and configured sudo accordingly. All configuration works fine while I start and stop my OpenVPN server manually. But when I try start OpenVPN server via systemctl it fails: [code] [shau-kote@myvps ~]$ sudo systemctl start openvpn@server.service [shau-kote@myvps ~]$ sudo systemctl status openvpn@server.service ● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled) Active: failed (Result: exit-code) since Sat 2015-12-12 04:11:22 UTC; 9s ago Process: 943 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS) Main PID: 944 (code=exited, status=1/FAILURE) Dec 12 04:11:21 myvps openvpn[944]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01 Dec 12 04:11:22 myvps openvpn[944]: TUN/TAP device tun0 opened Dec 12 04:11:22 myvps openvpn[944]: TUN/TAP TX queue length set to 100 Dec 12 04:11:22 myvps openvpn[944]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Dec 12 04:11:22 myvps openvpn[944]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500 Dec 12 04:11:22 myvps openvpn[944]: Linux ip link set failed: could not execute external program Dec 12 04:11:22 myvps openvpn[944]: Exiting due to fatal error Dec 12 04:11:22 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE Dec 12 04:11:22 myvps systemd[1]: openvpn@server.service: Unit entered failed state. Dec 12 04:11:22 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'. [shau-kote@myvps ~]$ [/code] I definitely do not see what the problem and I will be very grateful if someone expain me why it happens. This is my [url=https://gist.github.com/anonymous/0b72142ae23abbf32dd6]openvpn@.service (default)[/url] and [url=https://gist.github.com/anonymous/e35590879c080c1d28f6]server config[/url], if someone need it. P.S. While I googled about this problem I found [url=https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792653]bug report in Debian Bug tracking system[/url] with the same problem. There is no solution there alack. P.P.S. Also I asked [url=http://serverfault.com/questions/742069/openvpn-service-cannot-start/742077]a question on ServerFault[/url]. Some user offered me an ugly hack with [i]sleep 5[/i] in unpriv-ip script. It seemed like a solution, but later I found out that despite clean starting server service, client can not connect to server with "Connection refused". So that it is not solution.

OpenvVPN provides --[b]user[/b] and --[b]group[/b] directives to drop privileges from within the openvpn process. This is a much simpler solution. Also, you may find that enabling --[b]script-security[/b] within the server config will help. See --[b]script-security[/b], --[b]user[/b] and --[b]group[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url]

[b]Traffic[/b], thank you for reply. I thought [b]--user[/b] and [b]--group[/b] command-line directives and [b]user[/b] and [b]group[/b] config files directives are absolutely identical, aren't they? The [b]script-security[/b] in server config unfortunately changes nothing in failing at start: [code] [shau-kote@myvps ~]$ sudo grep script-security /etc/openvpn/server.conf script-security 2 [shau-kote@myvps ~]$ sudo systemctl start openvpn@server.service [shau-kote@myvps ~]$ sudo systemctl status openvpn@server.service ● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled) Active: failed (Result: exit-code) since Sat 2015-12-12 22:19:05 UTC; 3s ago Process: 932 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS) Main PID: 933 (code=exited, status=1/FAILURE) Dec 12 22:19:05 myvps openvpn[933]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01 Dec 12 22:19:05 myvps openvpn[933]: TUN/TAP device tun0 opened Dec 12 22:19:05 myvps openvpn[933]: TUN/TAP TX queue length set to 100 Dec 12 22:19:05 myvps openvpn[933]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Dec 12 22:19:05 myvps openvpn[933]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500 Dec 12 22:19:05 myvps openvpn[933]: Linux ip link set failed: could not execute external program Dec 12 22:19:05 myvps openvpn[933]: Exiting due to fatal error Dec 12 22:19:05 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE Dec 12 22:19:05 myvps systemd[1]: openvpn@server.service: Unit entered failed state. Dec 12 22:19:05 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'. [shau-kote@myvps ~]$ [/code]

[b]Traffic[/b], thank you for reply. I thought [b]--user[/b] and [b]--group[/b] command-line directives and [b]user[/b] and [b]group[/b] config file directives are identical, aren't they? I had tried to add [b]script-security 2[/b] in server config, but unfortunately it changes nothing: [quote] [shau-kote@myvps openvpn]$ sudo grep script-security server.conf script-security 2 [shau-kote@myvps openvpn]$ sudo systemctl start openvpn@server.service [shau-kote@myvps openvpn]$ sudo systemctl status openvpn@server.service ● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled) Active: failed (Result: exit-code) since Thu 2015-12-17 13:30:07 UTC; 5s ago Process: 2939 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS) Main PID: 2940 (code=exited, status=1/FAILURE) Dec 17 13:30:07 myvps openvpn[2940]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01 Dec 17 13:30:07 myvps openvpn[2940]: TUN/TAP device tun0 opened Dec 17 13:30:07 myvps openvpn[2940]: TUN/TAP TX queue length set to 100 Dec 17 13:30:07 myvps openvpn[2940]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Dec 17 13:30:07 myvps openvpn[2940]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500 Dec 17 13:30:07 myvps openvpn[2940]: Linux ip link set failed: could not execute external program Dec 17 13:30:07 myvps openvpn[2940]: Exiting due to fatal error Dec 17 13:30:07 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE Dec 17 13:30:07 myvps systemd[1]: openvpn@server.service: Unit entered failed state. Dec 17 13:30:07 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'. [shau-kote@myvps openvpn]$ [/quote] Unluckily I still don't see any solution.

The Arch Wiki is good for systemd unit files: [url]https://wiki.archlinux.org/index.php/Systemd[/url] but .. i don't think you can achieve your goal as openvpn requires root access to start (and stop; and add routes and ip addresses etc)

[quote="Traffic"]The Arch Wiki is good for systemd unit files: [url]https://wiki.archlinux.org/index.php/Systemd[/url] [/quote] Yes, I've read it. But default OpenVPN systemd unit in Fedora is very direct and clear (I posted it in the first post). It should work as far as I see. [quote="Traffic"] but .. i don't think you can achieve your goal as openvpn requires root access to start (and stop; and add routes and ip addresses etc)[/quote] Yes, but OpenVPN do this actions by [b]ip[/b]. Therefore I've set it up to run [b]ip[/b] via [b]sudo[/b]. Thus OpenVPN can start and stop while it is running as non-root. And it works perfectly without systemd. Sticking point is systemd but I don't see why.

[quote="shau-kote"]it works perfectly without systemd[/quote]can you post details of this ?

Yes, of course. Here is my console output of OpenVPN when I start it manually. I've started OpenVPN server, connected to it, disconnected from it and stopped it. Just for clarity I've severed the output stream by comments. [code] # starting the server [shau-kote@myvps openvpn]$ sudo openvpn server.conf Tue Dec 29 21:40:40 2015 OpenVPN 2.3.8 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Aug 4 2015 Tue Dec 29 21:40:40 2015 library versions: OpenSSL 1.0.2e-fips 3 Dec 2015, LZO 2.08 Tue Dec 29 21:40:40 2015 Diffie-Hellman initialized with 2048 bit key Tue Dec 29 21:40:40 2015 WARNING: file 'server.key' is group or others accessible Tue Dec 29 21:40:40 2015 WARNING: file 'ta.key' is group or others accessible Tue Dec 29 21:40:40 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file Tue Dec 29 21:40:40 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Dec 29 21:40:40 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Dec 29 21:40:40 2015 Socket Buffers: R=[87380->131072] S=[16384->131072] Tue Dec 29 21:40:40 2015 ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01 Tue Dec 29 21:40:40 2015 TUN/TAP device tun0 opened Tue Dec 29 21:40:40 2015 TUN/TAP TX queue length set to 100 Tue Dec 29 21:40:40 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Tue Dec 29 21:40:40 2015 /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500 Tue Dec 29 21:40:40 2015 /usr/local/sbin/unpriv-ip addr add dev tun0 local 10.13.7.1 peer 10.13.7.2 Tue Dec 29 21:40:40 2015 /usr/local/sbin/unpriv-ip route add 10.13.7.0/24 via 10.13.7.2 Tue Dec 29 21:40:40 2015 GID set to openvpn Tue Dec 29 21:40:40 2015 UID set to openvpn Tue Dec 29 21:40:40 2015 Listening for incoming TCP connection on [undef] Tue Dec 29 21:40:40 2015 TCPv4_SERVER link local (bound): [undef] Tue Dec 29 21:40:40 2015 TCPv4_SERVER link remote: [undef] Tue Dec 29 21:40:40 2015 MULTI: multi_init called, r=256 v=256 Tue Dec 29 21:40:40 2015 IFCONFIG POOL: base=10.13.7.4 size=62, ipv6=0 Tue Dec 29 21:40:40 2015 IFCONFIG POOL LIST Tue Dec 29 21:40:40 2015 MULTI: TCP INIT maxclients=2 maxevents=6 Tue Dec 29 21:40:40 2015 Initialization Sequence Completed # starting a connection Tue Dec 29 21:40:40 2015 Initialization Sequence Completed Tue Dec 29 21:41:02 2015 TCP connection established with [AF_INET]177.60.115.127:64843 Tue Dec 29 21:41:03 2015 177.60.115.127:64843 TLS: Initial packet from [AF_INET]177.60.115.127:64843, sid=3eee271f 7d199396 Tue Dec 29 21:41:07 2015 177.60.115.127:64843 VERIFY OK: depth=1, CN=Local CA Tue Dec 29 21:41:07 2015 177.60.115.127:64843 VERIFY OK: depth=0, CN=shau-kote Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Tue Dec 29 21:41:08 2015 177.60.115.127:64843 [shau-kote] Peer Connection Initiated with [AF_INET]177.60.115.127:64843 Tue Dec 29 21:41:08 2015 shau-kote/177.60.115.127:64843 MULTI_sva: pool returned IPv4=10.13.7.6, IPv6=(Not enabled) Tue Dec 29 21:41:08 2015 shau-kote/177.60.115.127:64843 MULTI: Learn: 10.13.7.6 -> shau-kote/177.60.115.127:64843 Tue Dec 29 21:41:08 2015 shau-kote/177.60.115.127:64843 MULTI: primary virtual IP for shau-kote/177.60.115.127:64843: 10.13.7.6 Tue Dec 29 21:41:10 2015 shau-kote/177.60.115.127:64843 PUSH: Received control message: 'PUSH_REQUEST' Tue Dec 29 21:41:10 2015 shau-kote/177.60.115.127:64843 send_push_reply(): safe_cap=940 Tue Dec 29 21:41:10 2015 shau-kote/177.60.115.127:64843 SENT CONTROL [shau-kote]: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,redirect-gateway def1,route 10.13.7.1,topology net30,ping 10,ping-restart 240,ifconfig 10.13.7.6 10.13.7.5' (status=1) # closing a connection Tue Dec 29 21:43:41 2015 shau-kote/177.60.115.127:64843 Connection reset, restarting [0] Tue Dec 29 21:43:41 2015 shau-kote/177.60.115.127:64843 SIGUSR1[soft,connection-reset] received, client-instance restarting # stopping the server Tue Dec 29 21:44:50 2015 /usr/local/sbin/unpriv-ip route del 10.13.7.0/24 ^CTue Dec 29 21:44:50 2015 Closing TUN/TAP interface Tue Dec 29 21:44:50 2015 /usr/local/sbin/unpriv-ip addr del dev tun0 local 10.13.7.1 peer 10.13.7.2 Tue Dec 29 21:44:50 2015 SIGINT[hard,] received, process exiting [shau-kote@myvps openvpn]$ [/code] As you can see, all works perfectly. The server config has [b]user openvpn[/b], [b]group openvpn[/b] and [b]iproute /usr/local/sbin/unpriv-ip[/b] directives and has not [b]script-security 2[/b] directive.

Please post full details of: [code]# openvpn --version[/code]

Here is it: [code] [shau-kote@myvps ~]$ openvpn --version OpenVPN 2.3.8 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Aug 4 2015 library versions: OpenSSL 1.0.2e-fips 3 Dec 2015, LZO 2.08 Originally developed by James Yonan Copyright (C) 2002-2010 OpenVPN Technologies, Inc. Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_pthread=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_iproute_path=/sbin/ip with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no [shau-kote@myvps ~]$ [/code]

I will [i]try[/i] setting this up myself and get back to you soon .. I have also posted this on the openvpn-users mailing list.

OpenVPN cannot start in unprivileged mode via systemctl

Traffic

Let us concentrate on your initial system.

For testing please add to your unit file:

User=openvpn
Group=openvpn

and try it again.

Traffic

Actually, setting openvpn as user and group in the unit file fails immediately as user:openvpn cannot even read my (root only) PKI. But at least it proves the the unit file assigns the requested user&group immediately.

shau-kote

Traffic wroteActually, setting openvpn as user and group in the unit file fails immediately as user:openvpn cannot even read my (root only) PKI. But at least it proves the the unit file assigns the requested user&group immediately.

Well, I've added in the OpenVPN unit file User and Group options:

[shau-kote@myvps ~]$ cat /etc/systemd/system/multi-user.target.wants/openvpn@server.service 
[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target

[Service]
PrivateTmp=true
Type=forking
PIDFile=/var/run/openvpn/%i.pid
ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf
User=openvpn
Group=openvpn

[Install]
WantedBy=multi-user.target
[shau-kote@myvps ~]$

and have tried to start it. As expected, it has failed:

[shau-kote@myvps ~]$ sudo systemctl start openvpn@server.service
Job for openvpn@server.service failed because the control process exited with error code. See "systemctl status openvpn@server.service" and "journalctl -xe" for details.
[shau-kote@myvps ~]$ sudo systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Thu 2016-01-14 23:24:56 UTC; 5s ago
  Process: 1974 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=1/FAILURE)
 Main PID: 1885 (code=exited, status=1/FAILURE)

Jan 14 23:24:56 myvps systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp...
Jan 14 23:24:56 myvps openvpn[1974]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Jan 14 23:24:56 myvps openvpn[1974]: Use --help for more information.
Jan 14 23:24:56 myvps systemd[1]: openvpn@server.service: Control process exited, code=exited status=1
Jan 14 23:24:56 myvps systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp.
Jan 14 23:24:56 myvps systemd[1]: openvpn@server.service: Unit entered failed state.
Jan 14 23:24:56 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'.
[shau-kote@myvps ~]$

shau-kote

So, I've tried to set User and Group in the unit file as root:

[shau-kote@myvps ~]$ grep 'User\|Group' /etc/systemd/system/multi-user.target.wants/openvpn@server.service 
User=root
Group=root
[shau-kote@myvps ~]$

In that case, OpenVPN successfully reads necessary file from /etc/openvpn.
Alack:

[shau-kote@myvps ~]$ sudo systemctl start openvpn@server.service 
[shau-kote@myvps ~]$ sudo systemctl status openvpn@server.service 
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Thu 2016-01-14 23:46:26 UTC; 6s ago
  Process: 2093 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
 Main PID: 2094 (code=exited, status=1/FAILURE)

Jan 14 23:46:25 myvps openvpn[2094]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01
Jan 14 23:46:25 myvps openvpn[2094]: TUN/TAP device tun0 opened
Jan 14 23:46:25 myvps openvpn[2094]: TUN/TAP TX queue length set to 100
Jan 14 23:46:25 myvps openvpn[2094]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Jan 14 23:46:25 myvps openvpn[2094]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500
Jan 14 23:46:25 myvps openvpn[2094]: Linux ip link set failed: could not execute external program
Jan 14 23:46:25 myvps openvpn[2094]: Exiting due to fatal error
Jan 14 23:46:26 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE
Jan 14 23:46:26 myvps systemd[1]: openvpn@server.service: Unit entered failed state.
Jan 14 23:46:26 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'.
[shau-kote@myvps ~]$

Traffic

Further testing has revealed that something on my setup is not correct .. I am still working on this.

Traffic

I have tried to replicate your error but I cannot get the same failure ..

Out of curiosity, what are the permissions on your unpriv-ip script ?

shau-kote

Traffic wroteOut of curiosity, what are the permissions on your unpriv-ip script ?

[shau-kote@myvps ~]$ ls -l /usr/local/sbin/unpriv-ip
-rwxr-xr-x. 1 root root 27 Jan  9 21:45 /usr/local/sbin/unpriv-ip
[shau-kote@myvps ~]$

Traffic

I can not replicate this problem.

FYI: I do not need --script-security n for this to work ..

I believe this:

shau-kote wroteJan 14 23:46:25 myvps openvpn[2094]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500

shows that unpriv-ip is executed ..

However, this:

shau-kote wroteJan 14 23:46:25 myvps openvpn[2094]: Linux ip link set failed: could not execute external program

shows that ip link set failed ..
"could not execute external program" suggests that the program can not start ..
not that it was not found and not that it exited with error status x ..

Try using this as your unpriv-ip:

#!/bin/sh
echo
echo "USER:" $(id)
/usr/bin/sudo /sbin/ip route
/usr/bin/sudo /sbin/ip $*
echo

Also try this:

#!/bin/bash
echo
echo "USER:" $(id)
/usr/bin/sudo /sbin/ip route
/usr/bin/sudo /sbin/ip $*
echo

check all absolute paths /usr/bin/sudo & /sbin/ip match your system and then check your log.

And, for good measure, what are the permissions on /usr/bin/sudo & /sbin/ip ?

« Previous Page