OpenVPN Support Forum

Hi,

I set up an openvpn server with username/password authentication by adding auth-user-pass-verify line as below

auth-user-pass-verify "/usr/bin/php /home/www/domains/openvpn/scripts/login.php" via-env

I start the openvpn services by "sudo systemctl start openvpn-server@server.service". when I try to login, the log file complains "Could not open input file: /home/www/domains/openvpn/scripts/login.php", and the authentication fails.

I tried both

user nobody
group nobody

and

user root
group root

All have the same error. The /home/www/domains/openvpn/scripts/login.php exists.

I then run openvpn from command line as below, everything works perfectly.

sudo /usr/sbin/openvpn --config /etc/openvpn/server.conf

Can anyone show me how to handle this problem?

Thank you.

By the way, script-security is set to 3, as below:

script-security 3

Which version of openvpn ?

Please start here:
viewtopic.php?f=30&t=22603

TinCanTech wrote: ↑

Mon Jul 12, 2021 3:05 pm

Which version of openvpn ?

Please start here:
viewtopic.php?f=30&t=22603

Thank you TinCanTech. The Version is 2.4.11 under CentOS 8.

Strangely, I changed ProtectHome=true to ProtectHome=false in /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service,
then it works.

I have no idea what it means. I just try everything and hit the trigger at this point (so you know how much time I have spent on this error). Anyone know what it is? I also used ddd to debug openvpn, but can't find the bug.

Thank you.

vicn1222 wrote: ↑

Mon Jul 12, 2021 3:25 pm

The Version is 2.4.11

Moved to correct board.

vicn1222 wrote: ↑

Mon Jul 12, 2021 3:25 pm

I changed ProtectHome=true to ProtectHome=false in /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service, then it works.

Yes, it would.

If you want to use the proper openvpn-server@.service file then you cannot use /home for your server scripts.

TinCanTech wrote: ↑

Mon Jul 12, 2021 3:37 pm

vicn1222 wrote: ↑

Mon Jul 12, 2021 3:25 pm

I changed ProtectHome=true to ProtectHome=false in /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service, then it works.

Yes, it would.

If you want to use the proper openvpn-server@.service file then you cannot use /home for your server scripts.

Hi,.

Do you have a doc link that explains ProtectHome, or point me the source code file and line number, where I can get more information?

Thank you!

vicn1222 wrote: ↑

Mon Jul 12, 2021 4:07 pm

Do you have a doc link that explains ProtectHome, or point me the source code file and line number, where I can get more information?

This might be of interest:
https://www.freedesktop.org/software/sy ... .exec.html

Hope this helps, regards, rob0

openvpn_inc wrote: ↑

Mon Jul 12, 2021 4:30 pm

vicn1222 wrote: ↑

Mon Jul 12, 2021 4:07 pm

Do you have a doc link that explains ProtectHome, or point me the source code file and line number, where I can get more information?

This might be of interest:
https://www.freedesktop.org/software/sy ... .exec.html

Hope this helps, regards, rob0

Thank you!