Hello guys,
this is my first post on this forum 😃
I've a problem running OpenVPN as UnprivilegedUser on CentOS 7.
I'm following this guide:
https://community.openvpn.net/openvpn/wiki/UnprivilegedUser
First of all, I've edited my
/etc/systemd/system/multi-user.target.wants/openvpn@server.service to start OpenVPN as "openvpn" user.
Here's the line affected:
ExecStart=/usr/bin/su openvpn -s /bin/sh "$openvpn --daemon --writepid $piddir/$bn.pid --cd $work --config $c $script_security"
Also I've created the
/usr/local/sbin/unpriv-ip script with permission 755, and edited the
/etc/sudoers file as follow:
openvpn ALL=(ALL) NOPASSWD: /sbin/ip
Defaults:openvpn !requiretty
Also I've created the
/etc/openvpn/openvpn-startup script, and make it executable with chmod +x.
Last I've configured the "openvpn" user and his directories:
[root@hostname ~]# mkdir /var/lib/openvpn
[root@hostname ~]# chown openvpn:openvpn /var/lib/openvpn
[root@hostname ~]# usermod -d /var/lib/openvpn -s /sbin/nologin openvpn
[root@hostname ~]# mkdir /var/log/openvpn
[root@hostname ~]# chown openvpn:openvpn /var/run/openvpn /var/log/openvpn /etc/openvpn -R
[root@hostname ~]# chmod u+w /var/run/openvpn /var/log/openvpn -R
and added/edited this lines to the
/etc/openvpn/server.conf configuration file:
log /var/log/openvpn/openvpn
iproute /usr/local/sbin/unpriv-ip
dev tun0
persist-tun
Now the problem is that when I try to start OpenVPN with "
systemctl start openvpn@server" I get this error:
Job for openvpn@server.service failed because a configured resource limit was exceeded. See "systemctl status openvpn@server.service" and "journalctl -xe" for details.
Output of
systemctl status openvpn@server:
[root@vps10 openvpn]# systemctl status openvpn@server
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
Active: failed (Result: resources) since Sun 2016-10-02 14:58:27 CEST; 1min 40s ago
Process: 9778 ExecStart=/usr/bin/su openvpn -s /bin/sh $openvpn --daemon --writepid $piddir/$bn.pid --cd $work --config $c $script_security (code=exited, status=0/SUCCESS)
Oct 02 14:58:27 vps10.prometeo.ninja systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
Oct 02 14:58:27 vps10.prometeo.ninja su[9778]: (to openvpn) root on none
Oct 02 14:58:27 vps10.prometeo.ninja systemd[1]: PID file /var/run/openvpn/server.pid not readable (yet?) after start.
Oct 02 14:58:27 vps10.prometeo.ninja systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
Oct 02 14:58:27 vps10.prometeo.ninja systemd[1]: Unit openvpn@server.service entered failed state.
Oct 02 14:58:27 vps10.prometeo.ninja systemd[1]: openvpn@server.service failed.
Output of
journalctl -xe:
Oct 02 15:01:32 vps10.prometeo.ninja su[10087]: pam_unix(su:session): session opened for user openvpn by (uid=0)
Oct 02 15:01:32 vps10.prometeo.ninja su[10087]: pam_unix(su:session): session closed for user openvpn
Oct 02 15:01:32 vps10.prometeo.ninja systemd[1]: PID file /var/run/openvpn/server.pid not readable (yet?) after start.
Oct 02 15:01:32 vps10.prometeo.ninja systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
-- Subject: Unit openvpn@server.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit openvpn@server.service has failed.
Output of
/var/log/messages:
Oct 2 15:01:32 vps10 systemd: Started Session c2479 of user openvpn.
Oct 2 15:01:32 vps10 systemd: Starting Session c2479 of user openvpn.
Oct 2 15:01:32 vps10 systemd: PID file /var/run/openvpn/server.pid not readable (yet?) after start.
Oct 2 15:01:32 vps10 systemd: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
Oct 2 15:01:32 vps10 systemd: Unit openvpn@server.service entered failed state.
I hope that this informations are enough, and that someone want to help me.
Regards :ugeek:
