What are minimal rights for files on server?

bordeaux

Hi! Could you tell me, what are minimal and correct rights for the files in /etc/openvpn dir on server (linux)?

In my config I use:

user nobody
group nobody

So, ls -al /etc/openvpn:

# ls -al /etc/openvpn/
total 136
drwxr-xr-x.  3 root root  4096 Apr 18 11:40 .
drwxr-xr-x. 79 root root  4096 Apr 18 14:20 ..
-rw-r--r--.  1 root root  1862 Apr 18 10:43 ca.crt
-rw-r--r--.  1 root root   979 Apr 18 11:30 crl.pem
-rw-r--r--.  1 root root   769 Apr 18 10:43 dh.pem
-rw-------.  1 root root   196 Apr 18 15:02 ipp.txt
drwxr-xr-x.  3 root root  4096 Apr 13 15:47 keys
-rw-------.  1 root root 83057 Apr 18 15:03 openvpn.log
-rw-------.  1 root root   232 Apr 18 15:02 openvpn-status.log
-rw-r--r--.  1 root root  1512 Apr 18 15:02 server.conf
-rw-r--r--.  1 root root  7099 Apr 18 10:43 server.crt
-rw-------.  1 root root  3272 Apr 18 10:43 server.key
-rw-------.  1 root root   636 Apr 18 10:43 ta.key

Server working normally, but may be you know more secure settings?

Thank you in advance!

Traffic

You can use:

# chmod 600 -R /etc/openvpn/*

but be aware .. dropping privileges comes with problems ..

bordeaux

With this rights (0600) client was not connect to the server (as I think, user nobody have to read access on several files). That's why I asked for tip!

When openvpn server is running and client tries to connect, what effective user used? nobody? So, what files need to be read by nobody?

Traffic

The required files are read prior to dropping privileges .. but you need to use --persist-key and --persist-tun for server.