Hi all, I upgraded the OpenVPN server from Ubuntu 14.04 LTS to 16.04 LTS and now OpenVPN refuses to start due to permission problems. I have enabled OpenVPN using the command "systemctl enable openvpn\@server.service". It works starting OpenVPN manually using the command line "/usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/server.conf --writepid /run/openvpn/server.pid" When I try to start using "systemctl start openvpn\@server.service" it fails and the following error is shown by systemctl status openvpn\@server.service: Aug 11 14:20:07 wasat ovpn-server[1911]: Warning: Error redirecting stdout/stderr to --log file: /var/log/openvpn/openvpn.log: Permission denied (errno=13) Aug 11 14:20:07 wasat ovpn-server[1911]: Options error: --status fails with '/var/log/openvpn/openvpn-status.log': Permission denied Any suggestions on how to fix this? [b]server.conf excerpt[/b] status /var/log/openvpn/openvpn-status.log log-append /var/log/openvpn/openvpn.log [b]ls -la /var/log/openvpn[/b] drwxrwxr-x 2 openvpn openvpn 4096 Aug 11 14:17 . drwxrwxr-x 10 root syslog 4096 Aug 11 11:41 .. [b]/lib/systemd/.../openvpn@.service[/b] [Unit] Description=OpenVPN connection to %i PartOf=openvpn.service ReloadPropagatedFrom=openvpn.service Before=systemd-user-sessions.service Documentation=man:openvpn(8) Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true KillMode=mixed Type=forking ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid PIDFile=/run/openvpn/%i.pid ExecReload=/bin/kill -HUP $MAINPID WorkingDirectory=/etc/openvpn ProtectSystem=yes CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw [Install] WantedBy=multi-user.target

Hi, I'm experiencing the same problem. In some tutorials I found people using chmod to change permissions. But it was never mentioned whom the file should belong to. Right now it is root:root, I'm guessing since i had to use [i]sudo [/i]to copy the config file and the certs into /[i]etc/ovpn[/i] (I created /edited them on windows) But then starting, I get the above mentioned error, whether I use [i]/var/logs/ovpn.log[/i] or only [i]ovpn.log[/i] So which user should be the owner of the files? I'm working on Raspbian.

[quote="rokeeffe"]same issue with [b]OpenVPN AS[/b][/quote]This forum is for OpenVPN Community Edition. Please see: [url=https://forums.openvpn.net/viewtopic.php?f=30&t=22603]HOWTO: Request Help ![/url]

OpenVPN Server not starting on Ubuntu 16.04 LTS

krenaud

Hi all,

I upgraded the OpenVPN server from Ubuntu 14.04 LTS to 16.04 LTS and now OpenVPN refuses to start due to permission problems.

I have enabled OpenVPN using the command "systemctl enable openvpn\@server.service".

It works starting OpenVPN manually using the command line "/usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/server.conf --writepid /run/openvpn/server.pid"

When I try to start using "systemctl start openvpn\@server.service" it fails and the following error is shown by systemctl status openvpn\@server.service:

Aug 11 14:20:07 wasat ovpn-server[1911]: Warning: Error redirecting stdout/stderr to --log file: /var/log/openvpn/openvpn.log: Permission denied (errno=13)
Aug 11 14:20:07 wasat ovpn-server[1911]: Options error: --status fails with '/var/log/openvpn/openvpn-status.log': Permission denied

Any suggestions on how to fix this?

server.conf excerpt
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log

ls -la /var/log/openvpn
drwxrwxr-x 2 openvpn openvpn 4096 Aug 11 14:17 .
drwxrwxr-x 10 root syslog 4096 Aug 11 11:41 ..

/lib/systemd/.../openvpn@.service
[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
PrivateTmp=true
KillMode=mixed
Type=forking
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn
ProtectSystem=yes
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw

[Install]
WantedBy=multi-user.target

TiTex

check the openvpn.conf user/group parameters , that user should have write permisions for the /var/log/openvpn dir
if you don't want to do that , then just replace
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
with
status openvpn-status.log
log-append openvpn.log

which will create the files in the same dir where the config file is , most likely /etc/openvpn

ibidum

Hi, I'm experiencing the same problem.

In some tutorials I found people using chmod to change permissions.
But it was never mentioned whom the file should belong to.
Right now it is root:root, I'm guessing since i had to use sudo to copy the config file and the certs into /etc/ovpn (I created /edited them on windows)
But then starting, I get the above mentioned error, whether I use /var/logs/ovpn.log or only ovpn.log

So which user should be the owner of the files?
I'm working on Raspbian.

rokeeffe

Just to note that I am having the same issue with OpenVPN AS on Ubuntu 16.04.

systemctl status openvpnas
openvpnas.service: PID file /var/run/openvpnas.pid not readable after start: Has it been created yet?

The pid file itself is owned by root. In the /var/run dir there is also another dir called openvpn_as that is owned by the openvpn_as user.

TinCanTech

rokeeffe wrotesame issue with OpenVPN AS

This forum is for OpenVPN Community Edition.

Please see:
HOWTO: Request Help !