pikkuhanuristi
Hello!
We have openvpn network for ~2000 client devices. Until now we have encountered following exception two times (aproximately once in month):
Feb 10 10:22:03 xxxxxx ovpn-openvpn[6119]: 1000002151/xxx.xxx.xxx.xxx:10863 CRL: cannot read CRL from file /etc/openvpn/crl.pem
Feb 10 10:22:03 xxxxxx ovpn-openvpn[6119]: 1000002151/xxx.xxx.xxx.xxx:10863 Exiting
Feb 10 10:22:03 xxxxxx ovpn-openvpn[6119]: 1000002151/xxx.xxx.xxx.xxx:10863 /sbin/route del -net 10.200.0.0 netmask 255.255.0.0
Feb 10 10:22:03 xxxxxx ovpn-openvpn[6119]: 1000002151/xxx.xxx.xxx.xxx:10863 /sbin/route del -net 10.10.128.0 netmask 255.255.128.0
Feb 10 10:22:03 xxxxxx ovpn-openvpn[6119]: 1000002151/xxx.xxx.xxx.xxx:10863 Closing TUN/TAP interface
Feb 10 10:22:03 xxxxxx ovpn-openvpn[6119]: 1000002151/xxx.xxx.xxx.xxx:10863 /sbin/ifconfig tun0 0.0.0.0
Feb 10 10:22:03 xxxxxx kernel: [51813692.631966] device tun0 left promiscuous mode
Feb 10 10:22:03 xxxxxx snort[7502]: Can't acquire (-1) - The interface went down!
.
.
.
The best guess is that at the certain point of time the crl.pem -file is some how locked and it leads openvpn to crash. But at the moment it's just a guess.
What would be the cause of this kind of problem?
I really appreciate any help you can provide.
- Jani H
My server.conf:
local xxx.xxx.xxx.xxx
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
mode server
ifconfig 10.10.128.1 10.10.128.2
ifconfig-pool 10.10.128.4 10.10.255.255
route 10.10.128.0 255.255.128.0
route 10.200.0.0 255.255.0.0
push "route 10.200.0.0 255.255.0.0"
push "route 10.10.128.0 255.255.128.0"
push "route 10.1.1.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
keepalive 7 50
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 # This file is secret
tls-server
comp-lzo no
verb 5
topology p2p
management localhost 5001
crl-verify /etc/openvpn/crl.pem
script-security 2
client-disconnect "/bin/bash /root/cron/run_connect_disconnect.sh disconnect > /root/cron/openvpn.out 2> /root/cron/openvpn.err < /dev/null"
client-connect "/bin/bash /root/cron/run_connect_disconnect.sh connect > /root/cron/openvpn.out 2> /root/cron/openvpn.err < /dev/null"
