All -
We're experiencing a problem with the chroot setting in OpenVPN on CentOS 8. We get the following error:
Jul 16 13:01:20 bluefish openvpn[13974]: Options error: --chroot directory fails with 'jail': Permission denied (errno=13)
Jul 16 13:01:20 bluefish openvpn[13974]: Options error: Temporary directory (--tmp-dir) fails with 'jail/tmp': Permission denied (errno=13)
Jul 16 13:01:20 bluefish openvpn[13974]: Options error: Please correct these errors.
Jul 16 13:01:20 bluefish openvpn[13974]: Use --help for more information.
Jul 16 13:01:20 bluefish systemd[1]: openvpn-server@server.service: Main process exited, code=exited, status=1/FAILURE
Jul 16 13:01:20 bluefish systemd[1]: openvpn-server@server.service: Failed with result 'exit-code'.
Jul 16 13:01:20 bluefish systemd[1]: Failed to start OpenVPN service for server.
Here are the permissions on /etc/openvpn/server/jail
[root@bluefish jail]# ls -la
total 24
drwxrwxrwx. 5 nobody root 4096 Jul 16 12:23 .
drwxr-xr-x. 3 root root 4096 Jul 16 12:59 ..
drwxrwxrwx. 2 nobody root 4096 Jul 16 11:18 clients
-rw-rw-rw-. 1 nobody root 824 Jul 15 21:28 crl.pem
drwxrwxrwx. 2 nobody root 4096 Jul 16 11:56 log
drwxrwxrwx. 2 nobody root 4096 Jul 16 12:14 tmp
And the OpenVPN Server Config:
# Networking
server 10.200.0.0 255.255.255.248
topology subnet
proto udp4
port 42424
keepalive 10 60
# TUN Device
dev tun
persist-tun
# Hardening
user nobody
group nobody
chroot jail
# Client Configurations
ccd-exclusive
remote-cert-tls client
client-config-dir clients
# Server Keys
persist-key
tls-auth /etc/openvpn/server/ta.key 0
pkcs12 /etc/openvpn/server/server.p12
# Client/Server Mode Encryption
ncp-disable
auth SHA256
cipher AES-256-GCM
tls-version-min 1.3
ecdh-curve secp521r1
tls-ciphersuites TLS_AES_256_GCM_SHA384
dh /etc/openvpn/server/dh.param
# Process & Logging
daemon
tmp-dir tmp
#verb 4
#log-append log/openvpn.log
#status log/openvpn.status 3
#status-version 2
# Push Directives
push "route 192.168.13.0 255.255.255.0"
Perhaps some versioning information will be helpful:
[root@bluefish jail]# uname -r
4.18.0-147.8.1.el8_1.x86_64
[root@bluefish jail]# openvpn --version
OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
library versions: OpenSSL 1.1.1c FIPS 28 May 2019, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=yes enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=yes enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no
Thanks in advance to anyone who can provide support.
