Management unix socket interface permissions

Mc.Sim

Hi folks,
I have OpenVPN server with next config

port <***cut-outed***>
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
topology subnet
server <***cut-outed***>
ifconfig-pool-persist ipp.txt
<***cut-outed***>
client-config-dir ccd
route <***cut-outed***>
push <***cut-outed***>
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
compress
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
explicit-exit-notify 1
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"
mssfix 1432
management /run/openvpn/server.sock unix

I use /run/openvpn/server.sock to get statistics from the server:

echo status | socat - unix-connect:/run/openvpn/server.sock
>INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
OpenVPN CLIENT LIST
Updated,Sun Apr  5 22:51:44 2020
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
note4-father,85.174.194.166:11015,8102,4338,Sun Apr  5 22:51:22 2020
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.1.0.4,note4-father,85.174.194.166:11015,Sun Apr  5 22:51:23 2020
GLOBAL STATS
Max bcast/mcast queue length,1
END

But I would like to limit Unix socket's permissions. By default, openvpn creates socket with 777 permissions:

ls -la /run/openvpn/server.sock
srwxrwxrwx 1 root root 0 Apr  5 22:44 /run/openvpn/server.sock

Is it possible to set permissions to 770, for example?
Thank you so much.

TiTex

see the management-client-user and management-client-group in the manual page
although the socket is still created with the same permissions, you won't be able connect to it with users other than specified by those directives

you can also use a password file to password protect the management interface

Mc.Sim

It works!
Thank U!
The socket has created with 777 permissions, but I cannot send any command to it.

root@vps:~# ls -la /run/openvpn/
total 4
drwxr-xr-x  2 root root  80 Apr  7 21:12 .
drwxr-xr-x 23 root root 840 Apr  7 20:52 ..
-rw-r--r--  1 root root   6 Apr  7 21:12 server.pid
srwxrwxrwx  1 root root   0 Apr  7 21:12 server.sock
***@vps:~$ echo status 2 | socat - unix-connect:/run/openvpn/server.sock
2020/04/07 21:13:40 socat[23376] E write(5, 0x560720fe7980, 9): Broken pipe
***@vps:~$