Autostart Error: unable to send audit message

docb

Hi,
I have a problem with my openvpn "on startup" since my update on Ubuntu 17.10.
I have the following configuration:
my config file (b.conf) in /etc/openvpn
this line in sudoers:

openvpn ALL=NOPASSWD: /etc/openvpn/tc.sh /etc/openvpn

if I start openvpn via commandline

sudo openvpn --config /etc/openvpn/b.conf

no Problem, works like a charm.
But when openvpn starts via autostart (AUTOSTART="all" in /etc/default/openvpn) I get this error:

Tue Oct 24 14:11:52 2017 /usr/bin/sudo /networkfolder/vpn_up.sh tunVPN 1500 1553 172.21.90.35 255.255.254.0 init
sudo: unable to send audit message
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization
Tue Oct 24 14:11:52 2017 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Tue Oct 24 14:11:52 2017 Exiting due to fatal error

Please help, I guess the error is somewhere in the sudoers file which needs to be changed due to system changes, but I am a linux noob and don't know how to fix this. My guess was also, that there is a problem with passing the sudo right to the vpn_up.sh script. So I've tried

openvpn ALL=NOPASSWD: /etc/openvpn/tc.sh /etc/openvpn /networkfolder

and

openvpn ALL=NOPASSWD: /etc/openvpn/tc.sh /etc/openvpn /networkfolder/vpn_up.sh /networkfolder/vpn_down.sh

But without success :roll:

Thank you very much!
doc

TinCanTech

We need to see your openvpn configs and logs ..

Please see:
HOWTO: Request Help !

docb

Roger,
here is the conf:

client
dev tunVPN
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
daemon BBVPN

#Die nächste Zeile muss Zeile 12 bleiben!
remote myHOST myPORT

tls-client
remote-cert-tls server
auth-user-pass /networkfolder/auth.txt
comp-lzo
verb 3
keepalive 10 120

status /networkfolder/openvpn-status.log
log-append /networkfolder/openvpn.log
#writepid /networkfolder/openvpn.pid
management 127.0.0.1 1161
#management-query-remote

script-security 2
down "/usr/bin/sudo /networkfolder/vpn_down.sh"
up "/usr/bin/sudo /networkfolder/vpn_up.sh"

auth SHA256
cipher AES-256-CBC

<ca>
-----BEGIN CERTIFICATE-----
manycharacters
-----END CERTIFICATE-----
</ca>

And here is the log:

Tue Oct 24 14:28:08 2017 WARNING: file '/networkfolder/auth.txt' is group or others accessible
Tue Oct 24 14:28:08 2017 OpenVPN 2.4.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul  3 2017
Tue Oct 24 14:28:08 2017 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Tue Oct 24 14:28:08 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1161
Tue Oct 24 14:28:08 2017 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Oct 24 14:28:08 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]myIP:myPort
Tue Oct 24 14:28:08 2017 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Oct 24 14:28:08 2017 UDP link local: (not bound)
Tue Oct 24 14:28:08 2017 UDP link remote: [AF_INET]myIP:myPort
Tue Oct 24 14:28:08 2017 TLS: Initial packet from [AF_INET]myIP:myPort, sid=346a536f 85a26067
Tue Oct 24 14:28:08 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Oct 24 14:28:08 2017 VERIFY OK: depth=1, C=US, ST=VPN, L=VPN, O=VPN, OU=VPN, CN=VPN, name=VPN, emailAddress=VPN
Tue Oct 24 14:28:08 2017 VERIFY KU OK
Tue Oct 24 14:28:08 2017 Validating certificate extended key usage
Tue Oct 24 14:28:08 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Oct 24 14:28:08 2017 VERIFY EKU OK
Tue Oct 24 14:28:08 2017 VERIFY OK: depth=0, C=US, ST=VPN, L=VPN, O=VPN, OU=VPN, CN=vpn, name=VPN
Tue Oct 24 14:28:08 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Oct 24 14:28:08 2017 [vpn] Peer Connection Initiated with [AF_INET]myIP:myPort
Tue Oct 24 14:28:09 2017 SENT CONTROL [vpn]: 'PUSH_REQUEST' (status=1)
Tue Oct 24 14:28:09 2017 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 198.18.0.1,dhcp-option DNS 198.18.0.2,rcvbuf 262144,explicit-exit-notify 5,route-gateway 172.21.94.1,topology subnet,ping 20,ping-restart 40,ifconfig 172.21.94.32 255.255.254.0,peer-id 1,cipher AES-256-GCM'
Tue Oct 24 14:28:09 2017 Option 'explicit-exit-notify' in [PUSH-OPTIONS]:5 is ignored by previous <connection> blocks 
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: explicit notify parm(s) modified
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Tue Oct 24 14:28:09 2017 Socket Buffers: R=[212992->425984] S=[212992->212992]
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: --ifconfig/up options modified
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: route options modified
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: route-related options modified
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: peer-id set
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: adjusting link_mtu to 1625
Tue Oct 24 14:28:09 2017 OPTIONS IMPORT: data channel crypto options modified
Tue Oct 24 14:28:09 2017 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Oct 24 14:28:09 2017 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 24 14:28:09 2017 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 24 14:28:09 2017 ROUTE_GATEWAY 10.11.30.1/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:15:91:0c
Tue Oct 24 14:28:09 2017 TUN/TAP device tunVPN opened
Tue Oct 24 14:28:09 2017 TUN/TAP TX queue length set to 100
Tue Oct 24 14:28:09 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Oct 24 14:28:09 2017 /sbin/ip link set dev tunVPN up mtu 1500
Tue Oct 24 14:28:09 2017 /sbin/ip addr add dev tunVPN 172.21.94.32/23 broadcast 172.21.95.255
Tue Oct 24 14:28:09 2017 /usr/bin/sudo /networkfolder/vpn_up.sh tunVPN 1500 1553 172.21.94.32 255.255.254.0 init
sudo: unable to send audit message
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization
Tue Oct 24 14:28:10 2017 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Tue Oct 24 14:28:10 2017 Exiting due to fatal error

And vpn_up.sh is:

#!/bin/bash
sudo service smbd start
/networkfolder/pushover.sh "Share online" "Share online" "chrome" "QUIET"

Thanks a lot!

TinCanTech

docb wrote I have a problem with my openvpn "on startup" since my update on Ubuntu 17.10

Probably uses systemd.

docb wrote I am a linux noob

You are now on a long and winding road, you see before you a cross road, what do you do? 😉

docb wrote if I start openvpn via commandline

sudo openvpn --config /etc/openvpn/b.conf

no Problem, works like a charm.

docb wrote But when openvpn starts via autostart (AUTOSTART="all" in /etc/default/openvpn) I get this error:

Tue Oct 24 14:11:52 2017 /usr/bin/sudo /networkfolder/vpn_up.sh tunVPN 1500 1553 172.21.90.35 255.255.254.0 init
sudo: unable to send audit message

A quick search took me to this:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792653

Looks very much like you need to use a custom systemd .service file.

Note: You are not dropping privileges in openvpn so you may not need sudo in your script.

Did you use openvpn docs to guide you ? If so we can add a note about systemd to those docs.

docb

Hi, I have found the same bug-report, but I have no systemd. "My" openvpn is in etc/init.d. I really don't know anymore which how-to I used to set openvpn up. Should I deinstall and reinstall with systemd and then try the bug-solution?

TinCanTech

Try this:

systemctl --version

docb

That is the result - and I have no clue what that means 😃

systemd 234
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN default-hierarchy=hybrid

TinCanTech

It means you Do have systemd and it is being used. The /etc/init.d/openvpn is also used but there is some kind of overlap between the two Systems. (I don't know the full details)

The point is: It is probably systemd which is causing the error due to Capabilities as discussed in that bug report. Try using the solution discussed there ..

I would recommend you switch to systemd completely (it is the future for Linux).

docb

Ok - I did as described in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792653
Copied the openvpn@.service file from /lib/systemd/system to /etc/systemd/system
I was not able to open it as described with

systemctl stop openvpn@nh.service

with this error:

No files found for openenvpn@.service.
Run 'systemctl edit --force openenvpn@.service' to create a new unit.

So I used nano to edit the file in /etc/systemd/system - this is the result:

[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script$
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
CapabilityBoundingSet=
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true

[Install]
WantedBy=multi-user.target

systemctl enable openvpn@b.service

systemctl start openvpn@b.service

actually works - at least in conf with hashed-out

#up "/usr/bin/sudo /networkfolder/vpn_up.sh"

systemctl list-unit-files --type=service

shows

openvpn-client@.service                    disabled
openvpn-server@.service                    disabled
openvpn.service                            enabled
openvpn@.service                           enabled

Everything works if I do not want to start the vpn_up.sh (where I deleted the sudo):

#!/bin/bash
service smbd start
/networkfolder/pushover.sh "Share online" "Share online" "chrome" "QUIET"

As soon as I do that, I get the same error as before:

Tue Oct 24 20:58:22 2017 /usr/bin/sudo /networkfolder/vpn_up.sh tunVPN 1500 1553 172.21.90.35 255.255.254.0 init
sudo: unable to send audit message
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization
Tue Oct 24 20:58:22 2017 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Tue Oct 24 20:58:22 2017 Exiting due to fatal error

By the way: thank you so much for helping me!

TinCanTech

docb wrote CapabilityBoundingSet=

CapabilityBoundingSet=~

is what they describe.

docb

Unfortunately also the

CapabilityBoundingSet=~

did not help, I still get the same error message:

Wed Oct 25 12:24:48 2017 /usr/bin/sudo /networkfolder/vpn_up.sh tunVPN 1500 1553 IP 255.255.254.0 init
sudo: unable to send audit message
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization
Wed Oct 25 12:24:48 2017 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Wed Oct 25 12:24:48 2017 Exiting due to fatal error

TinCanTech

Try:

[Unit]
Description=OpenVPN connection to %i
# PartOf=openvpn.service
# ReloadPropagatedFrom=openvpn.service
# Before=systemd-user-sessions.service
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
# PrivateTmp=true
WorkingDirectory=/etc/openvpn
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script$
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
# CapabilityBoundingSet=
# LimitNPROC=10
# DeviceAllow=/dev/null rw
# DeviceAllow=/dev/net/tun rw
# ProtectSystem=true
# ProtectHome=true

[Install]
WantedBy=multi-user.target

docb

Hi,
that did not help either. Am I right, that I edit this file:
/etc/systemd/system/openvpn@.service (not /lib/systemd/system/openvpn@.service where I copied the file from)?

With TinCanTechs suggestion (I hope you did not edit the ExecStart Line after the $, because it is not displayed) my Tun-device changes:
"Normal":

tunVPN: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500

        inet ip  netmask 255.255.254.0  destination ip
        inet6 ipv6  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100
        RX packets 10123  bytes 11967819 (11.9 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6577  bytes 466741 (466.7 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

to:

tunVPN: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet ip  netmask 255.255.254.0  destination ip
        inet6 ipv6  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  
(UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 16  bytes 932 (932.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

And the error stays....

Wed Oct 25 19:40:23 2017 /usr/bin/sudo /networkfolder/vpn_up.sh tunVPN 1500 155$
sudo: unable to send audit message
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization
Wed Oct 25 19:40:24 2017 WARNING: Failed running command (--up/--down): externa$
Wed Oct 25 19:40:24 2017 Exiting due to fatal error