Wed Nov 28 13:11:19 2018 Linux ip addr del failed: external program exited with error status: 2
Wed Nov 28 13:11:19 2018 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Nov 28 13:11:19 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Nov 28 13:11:19 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
RTNETLINK answers: Operation not permitted
I presume reading these logs it's a permissions issue regarding "ip addr del" command.
My openvpn 'mode server' version is 2.4 and it's on a debian stretch vps.
my server.conf is:
server 10.0.1.0 255.255.255.0
port 4343
proto udp
dev tun
mode server
topology subnet
#iproute /etc/openvpn/unpriv-ip
max-clients 60
compress lz4
keepalive 20 120
persist-tun
persist-key
explicit-exit-notify 1
# Push To Clients
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 127.0.0.1"
push "dhcp-option DOMAIN $MyDOMAIN"
push "dhcp-option SEARCH $MyDOMAIN"
push "topology subnet"
# TLS
tls-server
tls-version-min 1.2 'or-highest'
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh none
key-direction 1
tls-crypt /etc/openvpn/server/ta.key
remote-cert-tls client
remote-cert-eku "TLS Web Client Authentication"
auth SHA512
cipher AES-256-GCM
ncp-ciphers AES-256-GCM
ecdh-curve secp521r1
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256
# Routing
client-config-dir /etc/openvpn/ccd
client-to-client
#chroot /etc/openvpn
user nobody
group nogroup
#
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 0
dhcp-option DNS 85.214.20.141 #(CCC FoeBub)
dhcp-option DNS 204.152.184.76 #(CCC)
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
I'm not going to run this vpn as root but as unprivileged user i'm still far from conclusion.
The only 'external' script i use is the update-resolv-conf provided by debian package manager as you see from the above config.
Confused about permissions ...
