Getting back to this after being pulled away for a while.... Configuration Details below.
I found
learned that "script-security 2" was required in server.conf to enable client-connect scripts. I added it.
I still get a failure to authenticate if "client-connect" is un-commented in server.conf.
Error from openvpn.log:
Tue Nov 28 20:08:41 2017 us=58716 Tim/172.58.139.43:58185 WARNING: Failed running command (--client-connect): could not execute external program
The script /etc/openvpn/scripts/clientconnect.sh runs fine directly from the commandline.
Per
this article, I verified that the script returns 0.
This article mentions "Your openvpn server process drops privileges: user nobody group nogroup"
So what is the recommended solution? Change the server.conf user nobody, group nogroup to and existing user and group with privileges to run the script? Or elevate the priveleges of user nobody? Create new user and group?
Reference:
# uname -a
Linux open-vpn-pi 4.9.35-v7+ #1014 SMP Fri Jun 30 14:47:43 BST 2017 armv7l GNU/Linux
# cat server.conf
ev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.1.0 255.255.255.0"
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
script-security 2
client-connect /etc/openvpn/scripts/clientconnect.sh
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
#crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
log /var/log/openvpn.log
verb 4
# Generated for use by PiVPN.io
#!/bin/bash
LOGTAIL=$(tail /var/log/openvpn.log)
echo $LOGTAIL
echo $LOGTAIL >> vpn-logtail.txt
mydate=$(date +%Y-%m-%d_%H:%M:%S)
printf 'To: *****************Subject: OpenVPN Connection to RasPi\n\nOpenVPN Connection %s \n %s \n' "$mydate" "$LOG$
LOGTAIL=$(tail -n1 /var/log/openvpn.log)
printf 'To: *****************Subject: OpenVPN Connection to RasPi\n\nOpenVPN Connection %s\n%s\n' "$mydate" "$LOGTAIL" | ssmtp -t
echo "Connect $mydate" >> vpn-client-connect-log.txt
exit 0
