Failed to stat CRL file - thinking file permissions

editedbaselin

Hi,

I've noticed in my log file (/var/log/openvpn.log) that I'm getting the following message each time a client connects:

Mon Nov 16 10:59:01 2020 1.2.3.4:49612 WARNING: Failed to stat CRL file, not (re)loading CRL.

I've read a few articles on here but cannot find an answer as to how to stop this. Other than this everything seems to be working fine.

I have the crl.pem file in /etc/openvpn/easy-rsa/keys/ and the permissions were:

-rw-r--r-- 1 root root 877 Oct 24 17:13 crl.pem

Looking at various forum posts, I deduced that the owner should be nobody so I made some changes and the permissions are now:

-rwxrwxrwx 1 nobody nogroup 877 Oct 24 17:13 crl.pem

I found someone doing something with sudo that I hadn't seen before, so have recreated that and it hints at an access issue.

~ $ sudo -u nobody -g nogroup stat /etc/openvpn/easy-rsa/keys/crl.pem
stat: cannot stat '/etc/openvpn/easy-rsa/keys/crl.pem': Permission denied

I guess the question is: if the owner of the file is nobody, and the group is nogroup, and the permissions are 777, why when running sudo as nobody:nogroup is permission denied? Can anyone share how the permissions look for them?

Some other details that may be useful:

~ $ cat /etc/os-release 
PRETTY_NAME="Raspbian GNU/Linux 10 (buster)"
NAME="Raspbian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=raspbian
ID_LIKE=debian
HOME_URL="http://www.raspbian.org/"
SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"

~ $ openvpn --version
OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

~ $ stat --version
stat (GNU coreutils) 8.30
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Michael Meskes.

~ $ sudo cat /etc/openvpn/server.conf
local 192.168.116.250
dev tun
proto udp
port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/116ww.crt
key /etc/openvpn/easy-rsa/keys/116ww.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem

server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2

push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.116.250"
push "redirect-gateway def1"

client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
crl-verify /etc/openvpn/easy-rsa/keys/crl.pem

This is a home install rather than an enterprise/business one with only a small number of users.

Many thanks,
Andrew

VPN-Chicken

I was able to solve this problem. It seems that OpenVPN ist trying to check for the file twice:

within the chrooted directory
searching the absolute path

Let's say that I have the following directory structure:

/etc/openvpn/chroot

where the standard config files reside in /etc/openvpn and where /etc/openvpn/chroot is the chroot directory as defined in openvpn.config like this:

chroot /etc/openvpn/chroot

What I guess is that if I just enter the location of the crl.pem with a relative path

crl-verify crl.pem

OpenVPN will search for the crl.pem at both of the following locations

/etc/openvpn/chroot/crl.pem
crl.pem

The second load (reload) fails with "Failed to stat CRL file".

If I use an absolute path like this

crl-verify /etc/openvpn/chroot/crl.pem

then I get the following error: Options error: --crl-verify fails with '/etc/openvpn/chroot//etc/openvpn/chroot/crl.pem': No such file or directory (errno=2)

However, here you can see that OpenVPN is looking for the file below the chrooted directory.

Solution:
So my solution was to create the following directory structure and add a symbolic link to the original crl.pem

# mkdir -p /etc/openvpn/chroot/etc/openvpn/chroot
# ln -s /etc/openvpn/chroot/crl.pem /etc/openvpn/chroot/etc/openvpn/chroot/crl.pem

This was the only way to get a line like the following in the OpenVPN log file after restarting OpenVPN:

CRL: loaded 1 CRLs from file /etc/openvpn/chroot/crl.pem

Hopefully this helps. 🙂

At the end this is probably only a workaround for a bug in OpenVPN

TinCanTech

Soft links cannot reach outside of a chroot .. at least their not supposed to ..

Edit: OK, it's not reaching outside the chroot. This looks like a feasible general solution .. Thanks.