2

I'm using the openvpn option client-connect to run a script when a client connects.

The script works fine when I use simple commands but when I add commands that need root privileges it doesn't work and clients can't connect to the VPN server.

For example here are some commands I try to execute:

bgpctl reload and

route add -net $ifconfig_pool_remote_ip/30 -interface $dev -static.

The commands are tested and work correctly. I'm using freeBSD.

Any idea how to fix the problem?

Thank you!

Update

Actually there was no privileges issue. The script could not execute the commands bgpctland route because it couldn't recognize them.

I could fix the problem by specifying the full path to the commands:

/usr/local/sbin/bgpctl reload

/sbin/route add -net $ifconfig_pool_remote_ip/30 -interface $dev -static

Now it works.

Thanks roaima.

1 Answer 1

1

The --client-connect script is run as the non-privileged OpenVPN user specified by the --user parameter.

You can verify this by adding these lines to the top of your --client-connect file and reviewing the output written to /tmp/ov.log after a successful connection

#!/bin/bash
exec >>/tmp/ov.log 2>&1
chmod 666 /tmp/ov.log 2>/dev/null
echo
date
id
echo "PATH=$PATH"

# Payload
bgpctl reload
route add -net "$ifconfig_pool_remote_ip/30" -interface "$dev" -static

# All done
true

On my system, using the --user nobody and --group nogroup directives I get this output:

Tue Jun  9 15:00:45 BST 2015
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
...

Since you get these as the root user and wheel group you are presumably not using the --user or --group directive.

It's also important to verify that the PATH contains the necessary directories for the commands you want to execute.

10
  • This is the output of the id command executed from the client-connect script uid=0(root) gid=0(wheel) groups=0(wheel). It seems to be the root user.
    – HaTiMuX
    Jun 9, 2015 at 8:55
  • I'm still having the same problem. Actually I didn't get your idea. Just one information, OpenVPN is run as root.
    – HaTiMuX
    Jun 9, 2015 at 13:55
  • @HaTiMuX it's necessary to start OpenVPN as root but generally recommended to downgrade its privileges as soon as possible. Please update your Question to provide an example of a command that fails, and (if appropriate) the output. Jun 9, 2015 at 13:57
  • I think the problem is with all root commands. Anyway here are the commands I try to execute: bgpctl reload and route add -net $ifconfig_pool_remote_ip/30 -interface $dev -static. The commands are tested and work correctly.
    – HaTiMuX
    Jun 9, 2015 at 14:03
  • 1
    So the problem was with the command path. Thank you very much. I'm gonna update the question and explain the solution later.
    – HaTiMuX
    Jun 9, 2015 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .