I've been struggling for 2 hours now... I want OpenVPN to run a script when a client connects, but it seems to ignore my client-connect directive! I am running OpenVPN 2.4.0 on Raspbian. In my server.conf, I have [code] ... script-security 3 up /etc/openvpn/up.sh ... [/code] /etc/openvpn/up.sh is owned by root and is world-executable (rwxr-xr-x), and it is as simple as [code] #!/bin/sh whoami >> /tmp/connect.txt exit 0 [/code] I can successfully connect to my server, /var/log/daemon.log even states [code]ovpn-server[2050]: /etc/openvpn/up.sh tun0 1500 1621 10.100.0.1 10.100.0.2 init[/code] without stating any error, yet nothing appears on /tmp, as if my script was not called. What is going wrong? :-( Thanks in advance for your help

Try with:[code]/usr/bin/whoami >> /tmp/connect.txt[/code]

client-connect script is not being called

daladim

I've been struggling for 2 hours now... I want OpenVPN to run a script when a client connects, but it seems to ignore my client-connect directive!

I am running OpenVPN 2.4.0 on Raspbian. In my server.conf, I have

...
script-security 3
up /etc/openvpn/up.sh
...

/etc/openvpn/up.sh is owned by root and is world-executable (rwxr-xr-x), and it is as simple as

#!/bin/sh
whoami >> /tmp/connect.txt
exit 0

I can successfully connect to my server, /var/log/daemon.log even states

ovpn-server[2050]: /etc/openvpn/up.sh tun0 1500 1621 10.100.0.1 10.100.0.2 init

without stating any error, yet nothing appears on /tmp, as if my script was not called. What is going wrong? :-(

Thanks in advance for your help

daladim

And here is my full server.conf, if that may help

port 1194
proto udp
dev tun
ca /etc/openvpn/certs/keys/ca.crt
cert /etc/openvpn/certs/keys/....crt
key /etc/openvpn/certs/keys/...key
dh /etc/openvpn/certs/....pem
server 10.100.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS ..."
push "dhcp-option DNS ..."
script-security 3
up /etc/openvpn/up.sh
keepalive 10 120
tls-auth /etc/openvpn/certs/keys/ta.key 0
cipher AES-256-CBC
persist-key
persist-tun status
openvpn-status.log
verb 9
explicit-exit-notify 1
auth ...
tls-cipher ...

TinCanTech

Try with:

/usr/bin/whoami >> /tmp/connect.txt

daladim

Sorry, I've just noticed that I copied and pasted my last try with an "up" script but that is exactly the same issue as with a "client-connect" directive

daladim

Thanks for your reply TinCanTech.
But it has not solved the issue (even though this script works correctly when run from a regular user shell) :-(

TinCanTech

The problem is most likely that the script env does not have $PATH so cannot find whoami.

All external commands in scripts executed by opemvpn must have full /path/to/cmd

daladim

I have tried with simple Shell builtins (a mere echo "ok" >> /tmp/connect.txt), but it does not work either (but it is still working when run form a regular user shell)
So an incomplete $PATH is not (or not the only) problem.
Would you have other ideas to suggest?

Thanks in advance

TinCanTech

I expect you are using systemd .. if so, please post your openvpn*@.service file.

daladim

Here it is. Is it the one you wanted?

user@host:/ $ cat ./lib/systemd/system/openvpn-server@.service
[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
RuntimeDirectory=openvpn-server
RuntimeDirectoryMode=0710
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw

[Install]
WantedBy=multi-user.target

I also have

user@host:/ $ cat ./lib/systemd/system/openvpn.service
# This service is actually a systemd target,
# but we are using a service since targets cannot be reloaded.

[Unit]
Description=OpenVPN service
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecReload=/bin/true
WorkingDirectory=/etc/openvpn

[Install]
WantedBy=multi-user.target

and

user@host:/ $ cat ./lib/systemd/system/openvpn@.service
[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
PrivateTmp=true
KillMode=mixed
Type=forking
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn
ProtectSystem=yes
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw

[Install]
WantedBy=multi-user.target

TinCanTech

This is the correct one to use:

daladim wrote Here it is. Is it the one you wanted?

user@host:/ $ cat ./lib/systemd/system/openvpn-server@.service
[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
RuntimeDirectory=openvpn-server
RuntimeDirectoryMode=0710
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw

[Install]
WantedBy=multi-user.target

The problem you have is: PrivateTmp=true

daladim

You're my hero!
So my complex script (that sends a mail at every connection) worked from day 1, but the script that should have been simpler for debug purposes actually mislead me.

Thanks a lot (and I definitely have to learn a bit more about systemd now...)

CedLonigo

or just install devuan and simplify your life....