I have configured openvpn to use the nobody user and group after completing startup in my configuration file. systemctl start, systemctl stop and systemctl restart work flawlessly. systemctl reload fails with the following entries in the log:
systemctl start . . .
OpenVPN 2.3.8 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Aug 4 2015
library versions: OpenSSL 1.0.1i-fips 6 Aug 2014, LZO 2.08
Diffie-Hellman initialized with 4096 bit key
Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Socket Buffers: R=[212992->131072] S=[212992->131072]
ROUTE_GATEWAY X.X.X.X/255.255.254.0 IFACE=eth0 HWADDR=aa:bb:cc:dd:ee:ff
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
/bin/ip link set dev tun0 up mtu 1500
/bin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
/bin/ip route add 192.168.1.0/24 via 10.8.0.2
/bin/ip route add 10.8.0.0/24 via 10.8.0.2
GID set to nobody
UID set to nobody
UDPv4 link local (bound): [AF_INET]X.X.X.X:1194
UDPv4 link remote: [undef]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
IFCONFIG POOL LIST
Initialization Sequence Completed
systemctl reload . . . .
event_wait : Interrupted system call (code=4)
/bin/ip route del 10.8.0.0/24
RTNETLINK answers: Operation not permitted
ERROR: Linux route delete command failed: external program exited with error status: 2
/bin/ip route del 192.168.1.0/24
RTNETLINK answers: Operation not permitted
ERROR: Linux route delete command failed: external program exited with error status: 2
Closing TUN/TAP interface
/bin/ip addr del dev tun0 local 10.8.0.1 peer 10.8.0.2
RTNETLINK answers: Operation not permitted
Linux ip addr del failed: external program exited with error status: 2
SIGHUP[hard,] received, process restarting
Options error: --key fails with '/etc/openvpn/firewall.key': Permission denied
Options error: --tls-auth fails with '/etc/openvpn/ta.key': Permission denied
Options error: --writepid fails with '/var/run/openvpn/firewall.pid': Permission denied
Options error: --status fails with '/etc/openvpn/openvpn-status.log': Permission denied
Options error: Please correct these errors.
Use --help for more information.
At this point, openvpn is dead. netstat shows that it is not listening. systemctl status shows it as failed. I'm assuming from the log that the reload is actually a kill/start while still running as nobody, which obviously has access to nothing. I modified the config file and changed user/group to root and retried reload; flawless... so, how do we properly set up openvpn for user/group nobody and still execute reloads? I'm asking because I don't want to bring the tunnel down during logrotate events - I'd like to use the reload trigger like we used to. Please advise.
I'm running on OpenSuSE Leap 42.1, x64_86, openvpn-2.3.8-4.2, with kernel 4.7.0-5.g31abf6f-default.
My configuration file looks like this:
local <x.x.x.x>
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/firewall.crt
key /etc/openvpn/firewall.key
dh /etc/openvpn/dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 192.168.0.0 255.255.255.0"
client-config-dir ccd
route 192.168.1.0 255.255.255.0
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0
tls-server
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log-append /etc/openvpn/openvpn.log
verb 3
