I was wondering if anyone has successfully completed all seven the OpenVPN hardening steps detailed in the article at the link below:
https://openvpn.net/index.php/open-source/documentation/howto.html#security
I have successfully completed all the subtasks except number 4 below:
1. tls-auth
2. proto udp
3. user/group (non-Windows only)
4. Unprivileged mode (Linux only)chroot (non-Windows only)
5. Larger RSA keys
6. Larger symmetric keys
7. Keep the root key (ca.key) on a standalone machine without a network connection
For this task, I followed another, more detailed article at the link below:
https://community.openvpn.net/openvpn/wiki/UnprivilegedUser
I am getting two errors related to insufficient privileges of the user “openvpn”. They occur when that unprivileged account tries to set the transmit queue length and change the chroot directory. Chroot is a privileged command needing the CAP_SYS_CHROOT capability which requires sudo access. I am not sure what command sets the transmit queue length. The account does have sudo access to the “ip” command through the sudoers file (and a wrapper script) which is detailed in the "Uprivileged User" article. Adding chroot to the sudoers list does not help. I am also trying to find a way to call a wrapper file to launch chroot through the OpenVPN config file. I am not sure if this is the right path or if chroot and unprivileged mode are incompatible. Those errors in the OpenVPN service log are shown below.
Fri Apr 22 17:54:55 2016 Note: Cannot set tx queue length on tun0: Operation not permitted (errno=1)
Fri Apr 22 17:54:55 2016 chroot to '/etc/openvpn' failed: Operation not permitted (errno=1)
Fri Apr 22 17:54:55 2016 Exiting due to fatal error
How can those two insufficient privileges messages be fixed?
