ecrist wrotechroot yourself into that dir and try to execute the command. I'll bet you find you don't have access to change the routing tables.
How bizarre!
I did try to chroot and I couldn't, let alone execute ANY command. I tried 'chroot /var/lib/openvpn' and it failed with 'chroot: failed to run command `/bin/bash': No such file or directory'.
So, I created /var/lib/openvpn/bin and copied 'bash' in it, then altered ALL the necessary permissions (enabled o+r+x recursively on /var/lib/openvpn just to make sure) and still no go (note that with the above command I am trying to chroot as root!).
When I try 'chroot --userspec=_openvpn:_openvpn /var/lib/openvpn' I get 'chroot: invalid user'. I get the same message when try 'chroot --userspec=root:root /var/lib/openvpn', which I find rather bizarre!
I also tried the numerical values, i.e. 'chroot --userspec=499:499 /var/lib/openvpn' (499 = _openvpn in /etc/passwd) - no go: 'chroot: failed to run command `/bin/bash': No such file or directory' error message. I also tried 'chroot --userspec=0:0 /var/lib/openvpn' (0 = root) - same error message.
I did also try 'chroot --userspec=450:450 /var/lib/openvpn' (450 does NOT correspond to any user registered in /etc/passwd!) - same error message as above, so clearly the numerical values in --userspec are ignored. I also tried --userspec=root, --userspec=_openvpn - same effect: 'chroot: invalid user'!
As a last resort I tried 'chroot /var/lib/openvpn /sbin/ip' - that did not work either ('chroot: failed to run command `/sbin/ip': No such file or directory' error message). What am I missing here?!
All files seem to be present and the permissions were set to o+r+x on all files and directories below and including /var/lib/openvpn, so that should allow me access to anything in these directories, isn't that right?
When I try 'su - _openvpn' (I altered etc/passwd with 'usermod -d /var/lib/openvpn -s /bin/bash _openvpn' before that to make sure _openvpn has the right access) I get into /var/lib/openvpn and from there I could happily execute 'sbin/ip' - no problems!
So what seems to be wrong?
