Permissions propbem? Not getting log files from service.

maxburn

Windows 10 1803 and OpenVPN 2.4.7. This is a new install using config files we have used on twelve other servers and I can't figure out why I'm running into problems I haven't encountered before. First of all the service wouldn't start at all, windows service said started but it never showed up in running programs. Went to command line to find this:

C:\Program Files\OpenVPN\bin>openvpn.exe --config "C:\Program Files\OpenVPN\config\server.ovpn"
Options error: --client-config-dir fails with 'ccd': No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.

For some reason I needed to change this line from this;

client-config-dir ccd

To this;

client-config-dir "C:\\Program Files\\OpenVPN\\config\\ccd"

NONE of our other servers required that and I don't know why THIS one did. BUT that did get the service running and I can see the initial server log entries in the command prompt. Next problem is the service is not dropping any log files at all to the disk. None of our other servers have issues dropping logs to disk in default directory C:\Program Files\OpenVPN\log.

What I found out is if I run the executable shown above from an administrative level I will get the status log (which is specified in the config), but not the server log (which is not specified in the config because the default path above is fine for me).

At this point the service runs and appears to function but I'm not getting any logs at all. Help?

I uninstalled 2.4.7 and went back to 2.4.6 which I've got on many other machines working fine and it didn't help. This appears to be something special about this machine in particular.

My config if you need it:

### This file compatible with topology SUBNET
### Remember to edit LAN addressing for server routing below, and client addressing in CCD files
### Server VPN IP is 10.8.0.1, bind BMS to that IP.
### Set OpenVPN service to automatic startup (no delay) so that the IP will be there when BMS(with delayed start) asks.

### Connection info
proto tcp-server
port 1194
mode server
keepalive 10 120

### encryption info
tls-server
remote-cert-eku "TLS Web Client Authentication"
cipher AES-256-CBC
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh4096.pem"

### authentication
tls-auth "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ta.key" 0 # This file is secret

### Compression "compress" new standard, 
# lz4 best performance, lzo backwards compatibility
# Seems ER does not support new command or lz4
;compress lz4
comp-lzo

### Network 
# FYI; VPN DHCP server is on 10.8.0.254
# route gateway is 10.8.0.2
# server is on 10.8.0.1
# always avoid these addresses when addressing clients via CCD
dev tun
topology "subnet"
push "topology subnet"
server 10.8.0.0 255.255.255.0
# Push routes to connecting clients, they need to know how to route to other LANs
push "route 10.111.101.0 255.255.255.0"
;push "route 10.111.102.0 255.255.255.0"
;push "route 10.111.103.0 255.255.255.0"
;push "route 10.111.104.0 255.255.255.0"
;push "route 10.111.105.0 255.255.255.0"
;push "route 10.111.106.0 255.255.255.0"
;push "route 10.111.107.0 255.255.255.0"
# Allow LAN routing between clients
client-to-client
# Allow the server to route traffic to client LANs
route 10.111.101.0 255.255.255.0
;route 10.111.102.0 255.255.255.0
;route 10.111.103.0 255.255.255.0
;route 10.111.104.0 255.255.255.0
;route 10.111.105.0 255.255.255.0
;route 10.111.106.0 255.255.255.0
;route 10.111.107.0 255.255.255.0
# ovpn server pushes config info to clients from files in ccd dir. 
# Matches are based on CN in connecting key, so CN in key must match file name exactly. 
# Static VPN addressing and Client LAN routing is controlled in these files.
# client configuration directory (home is config dir, so rel path ok here)
client-config-dir "C:\\Program Files\\OpenVPN\\config\\ccd"

### Logging
# OpenVPN log goes to C:\Program Files\OpenVPN\log\* whatever this ovpn file is named
# 0 is silent, except for fatal errors
# 3 default?
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3
# read this to see what clients are connected
status "C:\\Program Files\\OpenVPN\\log\\openvpn-status.log"

TinCanTech

maxburn wrote

### Logging 
# OpenVPN log goes to C:\Program Files\OpenVPN\log\* whatever this ovpn file is named

For the "automatic" service, I think you need to specify your log file.

maxburn

TinCanTech wrote
maxburn wrote ### Logging # OpenVPN log goes to C:\Program Files\OpenVPN\log\* whatever this ovpn file is named
For the "automatic" service, I think you need to specify your log file.

Well for the status log it is specified (see above), I still don't get it unless I run it from an admin command prompt.

TinCanTech

maxburn wrote Well for the status log it is specified (see above), I still don't get it unless I run it from an admin command prompt.

That is correct.

maxburn

TinCanTech wrote
maxburn wrote Well for the status log it is specified (see above), I still don't get it unless I run it from an admin command prompt.
That is correct.

I'm not understanding you.

On the other servers I didn't need to specify that path and I get both the service log and status log files in the C:\Program Files\OpenVPN\log\ directory no problem when OpenVPN is run as a service. That isn't working here.

maxburn

OK, I think I have it fixed.

I need BOTH "OpenVPN Interactive Service" AND "OpenVPNService" running to get the usual log files I'm expecting. I think "OpenVPN Interactive Service" is already running and set to auto by the installer because I've never touched that one. For some reason that was stopped on this server and got my results above.

All this time I've been starting/stopping/set to auto the "OpenVPNService" service and ignoring the other one.

I should probably read up on what these do somewhere.

TinCanTech

maxburn wrote I need BOTH "OpenVPN Interactive Service" AND "OpenVPNService" running to get the usual log files I'm expecting

The OpenVPN Interactive Service is only used by the OpenVPN-GUI.

maxburn

TinCanTech wrote
maxburn wrote I need BOTH "OpenVPN Interactive Service" AND "OpenVPNService" running to get the usual log files I'm expecting
The OpenVPN Interactive Service is only used by the OpenVPN-GUI.

It must do a little more than that. Also we deselect the GUI on the installers for these servers, no need for it but the service is still there on all of them and set to auto start by the installer.

TinCanTech

The OpenVPN Interactive Service is only used by the OpenVPN-GUI, it provides a privilege separation mechanism whereby the VPN user does not have to be a local computer administrator.

Not installing the GUI does not effect the service wrappers, they are another option in the installer.