systemd: Improve the systemd unit files
PATCH 1/1 systemd: Improve the systemd unit files
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the chdir() before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.
- CAP_DAC_OVERRIDE was needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid calling chroot() in OpenVPN and rather let systemd prepare a more isolated namespace.
- Client configurations are now started with --nobind and the OpenVPN client process have lost the CAP_NET_BIND_SERVICE capability which allows binding to port < 1024.
- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)
distro/systemd/[email protected]... +6 -5
@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
distro/systemd/[email protected]... +8 -6
@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
Signature · 1 line
1.8.3.1
Hi,
I have tested these two unit files on Archlinux, CentOS7, Debian8, Fedora 24, OpenSuse 42 and Ubuntu 16.04 and they all work. I tested for a week, starting ,stopping, restarting and rebooting on 1 server and 1 client per OS. (And two instance of 2x client and 2x server)
Notes:
The problems I encountered were rectified by modifying my openvpn config files.
One issue remains when rebooting:
Services fail to start complaining about the RuntimeDirectory file exists. This only happens on reboot not starting or restarting. I could not determine which file exists but changing this fixed it:
(Diff style):
-RuntimeDirectory=openvpn
+RuntimeDirectory=openvpn-%i
(As suggested by thermi)
I would say that these .service files are likely to temporarily break (m)any existing systemd usage until admins change their configs. Especially use of --cd
Although I am not qualified to thoroughly test systemd security features, those features appear to work.
Regards
Quoted 90 lines · David Sommerseth
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the
chdir()before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.-
CAP_DAC_OVERRIDEwas needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid callingchroot()in OpenVPN and rather let systemd prepare a more isolated namespace.- Client configurations are now started with --nobind and the OpenVPN client process have lost the
CAP_NET_BIND_SERVICEcapability which allows binding to port < 1024.- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
Contribution-by Elias Probst <[email protected]...>Signed-off-by David Sommerseth <[email protected]...>--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)distro/systemd/[email protected]... +6
-5@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rwdistro/systemd/[email protected]... +8
-6@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 16 lines · On 05/11/16 16:07, debbie10t wrote:
Hi,
I have tested these two unit files on Archlinux, CentOS7, Debian8, Fedora 24, OpenSuse 42 and Ubuntu 16.04 and they all work. I tested for a week, starting ,stopping, restarting and rebooting on 1 server and 1 client per OS. (And two instance of 2x client and 2x server)
Notes: The problems I encountered were rectified by modifying my openvpn config files.
One issue remains when rebooting: Services fail to start complaining about the RuntimeDirectory file exists. This only happens on reboot not starting or restarting. I could not determine which file exists but changing this fixed it:
Quoted 4 lines
(Diff style): -RuntimeDirectory=openvpn
+RuntimeDirectory=openvpn-%i(As suggested by thermi)
This does not work on Scientific Linux 7.2 at all (RHEL7.2 clone). I did a similar thing, and it created /run/openvpn-%i and did not swap out %i with the config name. Thus making at least the server part fail, as it does not find the proper directory for the --status file.
So currently, I'm NAKing such a change and stand by the current version.
Systemd version used for testing this: systemd-219-19.el7_2.13.x86_64
- --
kind regards,
David Sommerseth
OpenVPN Technologies, Inc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYIORgAAoJEIbPlEyWcf3y5ukQAIavRA1nZPi65Zmg+KmvXUuc L+DaRP2sAxuH+aJhHbAgfISig2u7v2Qf7f+lncR/DQptlwWc4NKcO/UmkJF7UAv8 iKCbszbcwtst/7beevXYHu3HqiswydxhSzETrnOzxGggrdnQoKJN+kqUB/5A93dA nwMzLeHp7h+1vx5CkbIbkQR3J/NHoem0UnzVz+RitwJ1ru50aUvgpt6CWR96c4au 5YEti/kn6m7ze25kXtV8Vve4SgKc29a1M+QdtmVDxA6NdO1679chGYa+tbc65qCM M0cjqx3FRB51OXdT6W+CrNzrQDvqarUXtZumjiI74CqwTf1iktBEUP+P5cfSGYZa shhPCtOfoGA/whWlY3prnq5oogi2ttkrzagmOMwTJZLa5njwQ1B8MTudj7Ei8suv sKjpBNORnk0aipATbdPe6ZwEhS3t8AkcxTcMIP8W6m4zxpXXb/NI9/dFgfjcA1S1 /ijhCjGD7P5fIlGWj20muq+A5autDxtbsYGF3/rpsuCiWp0DnHcjF5DVi+i4Ie2z wD9Od+Y/tx9L/ZAPiqXpvadIBVbFCz+Xw4lyASIvFjnqq6rEHOFX9luKWF3wJdks A6YNrBnkXrbwdUPiiTvhzAUqmsGF62SOWRhj9i4HgD7ceZiqPV6u4iH/WjtSV9zK HTFRwQWNehPdgO4P0Lrj
=fb8M
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 5 lines · On 05/11/16 16:07, debbie10t wrote:
I would say that these .service files are likely to temporarily break (m)any existing systemd usage until admins change their configs. Especially use of --cd
I forgot to comment this one.
No existing installations should break by installing these unit files.
To my knowledge all distros use variants of either openvpn.service or
[email protected]... unit files. So users can migrate from the old layout to our new ones gradually.
This is also one of the reasons I've not chosen to re-user the [email protected]... scope and have a unified unit file for both server and client mode. (Another reason is that they do not require the same set of arguments and privileges/capabilities - but this is a different discussion).
And if an OpenVPN configuration file contains --cd, that doesn't mean it will break either. It *might* break if a config contains '--cd $RELATIVE_PATH', as the starting point will be different. This basically is the same situation for all options having a file argument (script hooks, cert/key files, plugin, etc). So the risk is most likely somewhat higher for those options than --cd.
- --
kind regards,
David Sommerseth
OpenVPN Technologies, Inc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYIOmEAAoJEIbPlEyWcf3yPjQP/0UuB2YPtShyVIUSfPHmbvyC b9mtXbvTOHMhHY8wV9xrZFH89+G69+jOvVfuZGfHdRssJdxnbRmF0C2TZbIzcTs/ gFL6Z90PxILXAm4b7202RaYax0pFI6iGKoTlEQ7XSpvNURHMVMfikJxY6v0faHf+ cR2eUOD3A+6Zz1Q+zszGUsWPPTdSeS87KiK4y71Bdvh4dZEGxtgIGiTGcF46PftZ IhfTYn8vVYF+78raacBL3QuO4hKjc5wVSFD8txNDWR6qzQf50glW1f5oPh2p7EgK lQvzssJRZyxJv/N6TxA5JgDyLAOndRhEF41KB1JoBcsVhMGqnpE8tEynyARc9rct u9mUI73Zf+4V8NvzpE4Zp7A9DyIIfFFUE2Ys4WStjrZT+2vbWjS+6gtO2qop4azw NLAUTwVjeAV2z3zLBmc9KgQ/m1uwNQQFV4+bWKIBjUMsezt2bV/QlhpFPX8CeZBF njktyKsHg1ps3+O6zqh18QIZHaVz5MyItfG3F7Ai0wSQeklAvOr7M82jxkVM6gv+ 17SvsH/xIlh37S8Nt/fI9hD3lyioyQzy3wVEznjNWalQZVbLCZw/xJWg1h76N+QP FFM4t9xwoG6VHWH3ZfqqrGimEo11lBU/pzcjhQPWhgNBMJlnaUJnY0DRIgG3yDFH WX6HrrCe5BkXRwKBlr04
=D5ju
-----END PGP SIGNATURE-----
Hi,
I now have these unit files working on all my test VMS.
The only problem before was that on debian 8 these services failed to start after reboot. (systemctl enable openvpn-{client/server}@config was enabled) The error message was:
main process exited, code=exited, status=233/RUNTIME_DIRECTORY
On debian 8 this turned out to be something to do with sysvinit.
This warning lead me to the cause:
# apt-get install openvpn
<s>
Setting up openvpn (2.3.12-debian0) ...
insserv: warning: current start runlevel(s) (empty) of script `openvpn' overrides LSB defaults (2 3 4 ,5).
insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `openvpn' overrides LSB defaults (0 1 6).
So, I un-installed openvpn-2.3.12 using apt-get remove and then edited the unit files to use git_master instead:
# ExecStart=/usr/sbin/openvpn --status %t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf
ExecStart=/usr/local/sbin/openvpn --status
%t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf
# ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf
ExecStart=/usr/local/sbin/openvpn --suppress-timestamps --nobind
--config %i.conf
reloaded the systemd daemon and rebooted, then the test client and server started properly with no errors.
I include these edits to demonstrate how I fixed this for debian, hopefully somebody can explain the issue ?
Other than that these unit files now work properly for *all* my VMs.
Regards
Quoted 90 lines · David Sommerseth
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the
chdir()before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.-
CAP_DAC_OVERRIDEwas needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid callingchroot()in OpenVPN and rather let systemd prepare a more isolated namespace.- Client configurations are now started with --nobind and the OpenVPN client process have lost the
CAP_NET_BIND_SERVICEcapability which allows binding to port < 1024.- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
Contribution-by Elias Probst <[email protected]...>Signed-off-by David Sommerseth <[email protected]...>--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)distro/systemd/[email protected]... +6
-5@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rwdistro/systemd/[email protected]... +8
-6@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
Quoted 8 lines · On 08/11/16 16:40, debbie10t wrote:
Hi,
I now have these unit files working on all my test VMS.
The only problem before was that on debian 8 these services failed to start after reboot. (systemctl enable openvpn-{client/server}@config was enabled) The error message was:
main process exited, code=exited, status=233/RUNTIME_DIRECTORY
It sounds like there's a conflict with a pre-existing directory.
Do you have a chance to check if the stock openvpn version you had installed ships with a pre-created /var/run/openvpn directory? (or /run/openvpn, or whatever Debian uses as the runtime directory)
Otherwise, great testing!
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Quoted 10 lines · David Sommerseth
Quoted 8 lines · On 08/11/16 16:40, debbie10t wrote:
Hi,
I now have these unit files working on all my test VMS.
The only problem before was that on debian 8 these services failed to start after reboot. (systemctl enable openvpn-{client/server}@config was enabled) The error message was:
main process exited, code=exited, status=233/RUNTIME_DIRECTORY
Quoted 8 lines
It sounds like there's a conflict with a pre-existing directory.
Do you have a chance to check if the stock openvpn version you had installed ships with a pre-created
/var/run/openvpndirectory? (or/run/openvpn, or whatever Debian uses as the runtime directory)Otherwise, great testing!
The Debian package creates /run/openvpn/./var/run is a symlink to /run in Debian.
Signature · 5 lines
Alberto Gonzalez Iniesta | Formación, consultoría y soporte técnico mailto/sip: [email protected]... | en GNU/Linux y software libre Encrypted mail preferred | http://inittab.com Key fingerprint = 5347 CBD8 3E30 A9EB 4D7D 4BF2 009B 3375 6B9A AA55
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 19 lines · Alberto Gonzalez Iniesta
Quoted 18 lines · David Sommerseth
Quoted 9 lines · On 08/11/16 16:40, debbie10t wrote:
Hi,
I now have these unit files working on all my test VMS.
The only problem before was that on debian 8 these services failed to start after reboot. (systemctl enable openvpn-{client/server}@config was enabled) The error message
was: main process exited, code=exited, status=233/RUNTIME_DIRECTORYIt sounds like there's a conflict with a pre-existing directory.
Do you have a chance to check if the stock openvpn version you had installed ships with a pre-created
/var/run/openvpndirectory? (or/run/openvpn, or whatever Debian uses as the runtime directory)
Quoted 5 lines
Quoted 2 lines
Otherwise, great testing!
The Debian package creates
/run/openvpn/./var/runis a symlink to /run in Debian.
Alright ... we can then consider to use
RuntimeDirectory=openvpn-{client,server}That should not collide. Any chance you can test that, debbie10t? Just change the RuntimeDirectory= to a directory not existing in {,/var}/run.
Thanks for the feedback, Alberto!
- --
kind regards,
David Sommerseth
OpenVPN Technologies, Inc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYIkBRAAoJEIbPlEyWcf3y7QcQAKPoQiZoNGJ5ux+f3uqwK98q 6V7aICnDJKRopJZrvbFNhGPhlS0+rU4ZrHnupqzn2Klv9SmtY7BU/R4Iys1R3/y8 ZIGAlguQyHUzxmuiV+0C2yc5Z0ccllbik6ECHzSmy6cDAu6byWDFk6jumcubTo6F oK68D3bOW2Dlo59OChBHTTft3Wm74/LifVHITTp9sNKxUgYdnjA7j7YxDk/G9EUg ASpyUFU16EA4SjLZJLdTU9UUZDmMW2UjEHNOF0uxLou02ryao5L3tZ5y66upv3oc IeL5J++w0pKg8O7E59pchsRQUnfGiNH/H4uw/cfc2wfnzGRe8Trd9x9wwoW0wtv/ ET6t3/IFm6XIvmSEHFXHlR4kjoGXn21jD7LkYZ9LRUARX8Ca7pZDddqkShkX2/Ds XV7TCjnxhgrXmIAaenLIyLj40wmVBLN1QAczaASP3uh0hnOp8o3K0DEu1ddBooKr NaJmFEmUQsUC5gO+jf0Px6d8ZWAwHxn4+PYRUfx8v/g2ECVL3Up6omwmDjwzZ1O4 iL/mKgfwypy0nFIfEYUs4s5dFmNKnOTMaykh2syUPj5ApuAqlZiCH5C9/LR3OZXe mQBcuAoOfAHzsHtvudfzj89MKmK3AcGWzkcfbVZQpq4JbD//ezSbo45aufCJU5x7 b23T8cinrbbrrEKX0HQj
=Dzuy
-----END PGP SIGNATURE-----
distro/systemd/[email protected]... line 14
Quoted 6 lines · David Sommerseth
[Service]
PrivateTmp=truedistro/systemd/[email protected]... +4
-0+RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf
--status appears to cause many problems, why is it specified here ?
Regards
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 4 lines · On 10/11/16 02:11, debbie10t wrote:
On 20/10/16 21:42, David Sommerseth wrote:
Quoted 8 lines
Quoted 5 lines
[Service] PrivateTmp=true +RuntimeDirectory=openvpn
(quoted diff) +2
-0+RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status%t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf
--status appears to cause many problems, why is it specified here ?
It is fairly common to have on server configurations, and several distributions already have this in their sysv based init scripts. So this just follows that tradition.
If a user wants to use a different status file, adding 'status /var/log/my-own-status.txt' will override the system default.
This status-file is fairly consistent in the file size, so unless you have a many thousand users connected to the same OpenVPN daemon the file size will be insignificant. As an example, 2 connected clients with 8 routes each is roughly 2.5KiB. So with 100 clients having 16 routes would most likely be around 0.5MiB of data.
I don't know quite what you mean with 'cause many problems'. If you are referring to the debian 8 testing and changing RuntimeDirectory to point at openvpn-server, then --status needs to be similarly changed, to be: %t/openvpn-server/server_%i-status.log
If you could please add more details to what goes wrong (log data), it is far easier to understand what is going on.
- --
kind regards,
David Sommerseth
OpenVPN Technologies, Inc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYJGUmAAoJEIbPlEyWcf3yyPQQALAtdjX1EN6hwZpFTdazD/Zc GkuehDfYiywdGZBXaSU7Qm74CRcNltub7rEvTfTMa/zqys1FDyExTFJtJBT+CCZS NEN6Wkd5lCiIhQdvk84Og/OpOBp+ob6sBo9VCgGS6I8uannmrvb3cCcFZax8CE47 SqOHspOE/oBT+eXGw6GmIA4m08kqtKL5f92rxK+Jc3bWiQ7nhJ831jZGBlS+XTec S9w225q8goyFea4I4XQUCECHviD116IB461HcNp0CvCos6BPLHR7xdBc3es4kwUc Hs5lQvLPZxmCwRitTdUu2NiAxHM33PJRNvGwlXjS7mnbSOgQ8cjMrFyE2RlrEtPB FtEbM82OO5UsZV+PxAPy6r48k9mAOgKz9RrvoKAwvHcQQ+mndU9akewntU2+aMSq ixsgrT78P3HTteAphJfLOQKORwmzC4oARbjtW6I15JNrEg4+C3Z0n3Tc6DydFKJ2 axcUCuFdAwb+qSeIE+VmMhCf1lfHoMCGp63TyNrfDImkfgoV+kpl5fGURfmX2Dyx DT7liTm5nGp99SxKRD3hpujmdJL05lE+pyHmeq0LTIGbcoUisMpfodVdWgomg3y1 BuVamoiKE0dqU3JZErqtZt6oiAxyihMatll1W3RC17TVssEZXG73D/mhDr/wFxod pTsQFdP5jsmZ2SqEeBlD
=orrg
-----END PGP SIGNATURE-----
Hi,
following are the server and client systemd unit files which work best for me.
Tested on:
Archlinux - OpenVPN 2.3.13 x86_64-unknown-linux-gnu - systemd 231 CentOS 7 - OpenVPN 2.3.12 x86_64-redhat-linux-gnu - systemd 219 Debian 8 - OpenVPN 2.3.13 x86_64-pc-linux-gnu - systemd 215 OpenSUSE 42.2 - OpenVPN 2.3.8 x86_64-suse-linux-gnu - systemd 228 Fedora 24 - OpenVPN 2.3.12 x86_64-redhat-linux-gnu - systemd 229 Ubuntu 16.04 - OpenVPN 2.3.13 x86_64-pc-linux-gnu - systemd 229
Tested with:
Multiple server and multiple client configs all enabled.
Tests:
systemctl enable/disable/start/stop/restart/reboot
Result:
ALL Tests passed.
Note:
I have inserted blank lines to help with email line wrap.
=====
[Unit]
Description=OpenVPN tunnel for %I
After=syslog.target network-online.target Wants=network-online.target
Documentation=man:openvpn(8) Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
PrivateTmp=true
RuntimeDirectory=openvpn-client
RuntimeDirectoryMode=0710
WorkingDirectory=/etc/openvpn/client
ExecStart=/usr/sbin/openvpn --config %i.conf --nobind --suppress-timestamps
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
[Install]
WantedBy=multi-user.target
=====
[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target Wants=network-online.target
Documentation=man:openvpn(8) Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
PrivateTmp=true
RuntimeDirectory=openvpn-server
RuntimeDirectoryMode=0710
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn --config %i.conf --status %t/openvpn-server/%i-status.log --status-version 2 --suppress-timestamps
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
[Install]
WantedBy=multi-user.target
=====
Regards
Quoted 90 lines · David Sommerseth
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the
chdir()before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.-
CAP_DAC_OVERRIDEwas needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid callingchroot()in OpenVPN and rather let systemd prepare a more isolated namespace.- Client configurations are now started with --nobind and the OpenVPN client process have lost the
CAP_NET_BIND_SERVICEcapability which allows binding to port < 1024.- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
Contribution-by Elias Probst <[email protected]...>Signed-off-by David Sommerseth <[email protected]...>--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)distro/systemd/[email protected]... +6
-5@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rwdistro/systemd/[email protected]... +8
-6@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
Quoted 14 lines · On 11/11/16 13:09, debbie10t wrote:
Hi,
following are the server and client systemd unit files which work best for me.
Tested on:
Archlinux - OpenVPN 2.3.13 x86_64-unknown-linux-gnu - systemd 231 CentOS 7 - OpenVPN 2.3.12 x86_64-redhat-linux-gnu - systemd 219 Debian 8 - OpenVPN 2.3.13 x86_64-pc-linux-gnu - systemd 215 OpenSUSE 42.2 - OpenVPN 2.3.8 x86_64-suse-linux-gnu - systemd 228 Fedora 24 - OpenVPN 2.3.12 x86_64-redhat-linux-gnu - systemd 229 Ubuntu 16.04 - OpenVPN 2.3.13 x86_64-pc-linux-gnu - systemd 229
Quoted 8 lines
Tested with:
Multiple server and multiple client configs all enabled.Tests:
systemctl enable/disable/start/stop/restart/rebootResult:
ALL Tests passed.
Thanks a lot for a very thorough testing!
I will update the patch with setting separate RuntimeDirectory= for these two profiles, then we won't step on the toes of distro provided openvpn{,@}.service files at all.
As there are quite few who are active on this ML and in our community with systemd experience, I'm going to apply the updated patch before the 2.4_beta1 release - unless there comes an informative NAK message before that time. And if someone gives an ACK, it will be applied sooner.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Quoted 70 lines
Note:
I have inserted blank lines to help with email line wrap.=====
[Unit]
Description=OpenVPN tunnel for %I
After=syslog.target network-online.target Wants=network-online.target
Documentation=man:openvpn(8) Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO[Service]
PrivateTmp=true
RuntimeDirectory=openvpn-client
RuntimeDirectoryMode=0710
WorkingDirectory=/etc/openvpn/clientExecStart=/usr/sbin/openvpn --config %i.conf --nobind --suppress-timestamps
CapabilityBoundingSet=CAP_IPC_LOCK
CAP_NET_ADMINCAP_NET_RAWCAP_SETGIDCAP_SETUIDCAP_SYS_CHROOTCAP_DAC_OVERRIDELimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw[Install]
WantedBy=multi-user.target=====
[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target Wants=network-online.target
Documentation=man:openvpn(8) Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO[Service]
PrivateTmp=true
RuntimeDirectory=openvpn-server
RuntimeDirectoryMode=0710
WorkingDirectory=/etc/openvpn/serverExecStart=/usr/sbin/openvpn --config %i.conf --status %t/openvpn-server/%i-status.log --status-version 2 --suppress-timestamps
CapabilityBoundingSet=CAP_IPC_LOCK
CAP_NET_ADMINCAP_NET_BIND_SERVICECAP_NET_RAWCAP_SETGIDCAP_SETUIDCAP_SYS_CHROOTCAP_DAC_OVERRIDELimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw[Install]
WantedBy=multi-user.target=====
This comes a bit late, sorry.
Il 20/10/2016 23:42, David Sommerseth ha scritto:
Quoted 6 lines
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
This makes sense, but it has one caveat. If there is no pidfile, external, local monitoring applications might not be able to monitor the status of the OpenVPN process anymore. I, for example, heavily utilize monit for it's email notification capabilities, and because it can actually do things if it detects anomalies.
The last time I checked, there is no easy way to get systemd to notify the admin if, say, a daemon goes down and systemd restarts it. Is this still the case?
Quoted 84 lines
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the
chdir()before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.-
CAP_DAC_OVERRIDEwas needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid callingchroot()in OpenVPN and rather let systemd prepare a more isolated namespace.- Client configurations are now started with --nobind and the OpenVPN client process have lost the
CAP_NET_BIND_SERVICEcapability which allows binding to port < 1024.- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
Contribution-by Elias Probst <[email protected]...>Signed-off-by David Sommerseth <[email protected]...>--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)distro/systemd/[email protected]... +6
-5@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rwdistro/systemd/[email protected]... +8
-6@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn/server_%i-status.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
Signature · 5 lines
Samuli Seppänen Community Manager OpenVPN Technologies, Inc irc freenode net: mattock
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 16 lines · Samuli Seppänen
This comes a bit late, sorry.
Il 20/10/2016 23:42, David Sommerseth ha scritto:
Quoted 6 lines
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
This makes sense, but it has one caveat. If there is no pidfile, external, local monitoring applications might not be able to monitor the status of the OpenVPN process anymore. I, for example, heavily utilize monit for it's email notification capabilities, and because it can actually do things if it detects anomalies.
Quoted 3 lines
The last time I checked, there is no easy way to get systemd to notify the admin if, say, a daemon goes down and systemd restarts it. Is this still the case?
Systemd will in this case mark the service as "Failed" and the status message will try to give an indication of what happened - was the process killed, segfault, stopped with an exit code, etc.
For external tools, you can now actually add the PID file yourself via the configuration file, and place the PID file exactly where it fits your need. So this actually gives a far better flexibility.
We can of course investigate if we should enable systemd to restart OpenVPN, at least the server profile, if it dies unexpectedly. Currently, I am not fully convinced we want that.
- --
kind regards,
David Sommerseth
OpenVPN Technologies, Inc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYJbstAAoJEIbPlEyWcf3yTEUQAMFkuQ+9wBYvLVqIilcPBEtL gM6rFzmtmQO9HkJnE5DdxxCLTPQu2FDpH66QxUOOkQgilji2iuub0L5ebo/yhfKH +mKCnn56553kcFSYozDDiW3S0nulCjDGZ3/dWh/jjnVbthpdnigpFswEaTfJsTn8 ZQ7Uw6rIN4ocqsySLDhTdVaxzcEE3tLXpxsvh7cqGrY7gdodxQfZ6guIN2jNpgOW vzKTr/oDbLl7mfE/yCIahH2b++rIWezPwcdXccQdCs1EiadQLwpTm7YCkc+RGXH6 cYANjeXzBCMUqb+PceRcNBgxQy+6Bo3zBNh5UC3eVcitc9I/3fAxZ+7z3H+Yacyq bOX5RGU2vjDO6M1SBtvS3fPSKAIj/yL9DxWmeOyYWJwqSXcixdXBmBtprulMhR1p LdO/Fj95onek2qeXQOuoppQO5bUu71r5OwoYmDi/BGKDvIbU7r4watNfHM8v6fiR WU4JFMGIvK0oXknv2LJUDpPjyOlMwty9y+aTIPNr+TrxEKzE9PjbfVRpCsNSDJxq W4iYZV0qS4OPJl2fHdZeX7bPxeyYsoZ6Qn2qf7QKLB6SQeEheWxeEl4JsBHgvlbO 4RgVBFJSGVKhgz7pjpYEDVXyBOCKidUBjiIDXyC5C8phIniFQb5umNDFC/6i8Deh AkfV28b/RdHq+/TUfLq+
=tTI/
-----END PGP SIGNATURE-----
Il 11/11/2016 14:35, David Sommerseth ha scritto:
Quoted 20 lines
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1Quoted 16 lines · Samuli Seppänen
This comes a bit late, sorry.
Il 20/10/2016 23:42, David Sommerseth ha scritto:
Quoted 6 lines
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
This makes sense, but it has one caveat. If there is no pidfile, external, local monitoring applications might not be able to monitor the status of the OpenVPN process anymore. I, for example, heavily utilize monit for it's email notification capabilities, and because it can actually do things if it detects anomalies.
Quoted 7 lines
Quoted 3 lines
The last time I checked, there is no easy way to get systemd to notify the admin if, say, a daemon goes down and systemd restarts it. Is this still the case?
Systemd will in this case mark the service as "Failed" and the status message will try to give an indication of what happened - was the process killed, segfault, stopped with an exit code, etc.
Yeah, and systemd integration will probably eventually find its way into external monitoring tools.
Quoted 3 lines
For external tools, you can now actually add the PID file yourself via the configuration file, and place the PID file exactly where it fits your need. So this actually gives a far better flexibility.
Yes, that is what I ended up doing, so this is definitely not a dealbreaker.
Quoted 4 lines
We can of course investigate if we should enable systemd to restart OpenVPN, at least the server profile, if it dies unexpectedly. Currently, I am not fully convinced we want that.
That should probably be a admin decision.
Quoted 26 lines
- --
kind regards,David Sommerseth
OpenVPN Technologies, Inc-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)iQIcBAEBAgAGBQJYJbstAAoJEIbPlEyWcf3yTEUQAMFkuQ+9wBYvLVqIilcPBEtL gM6rFzmtmQO9HkJnE5DdxxCLTPQu2FDpH66QxUOOkQgilji2iuub0L5ebo/yhfKH +mKCnn56553kcFSYozDDiW3S0nulCjDGZ3/dWh/jjnVbthpdnigpFswEaTfJsTn8 ZQ7Uw6rIN4ocqsySLDhTdVaxzcEE3tLXpxsvh7cqGrY7gdodxQfZ6guIN2jNpgOW vzKTr/oDbLl7mfE/yCIahH2b++rIWezPwcdXccQdCs1EiadQLwpTm7YCkc+RGXH6 cYANjeXzBCMUqb+PceRcNBgxQy+6Bo3zBNh5UC3eVcitc9I/3fAxZ+7z3H+Yacyq bOX5RGU2vjDO6M1SBtvS3fPSKAIj/yL9DxWmeOyYWJwqSXcixdXBmBtprulMhR1p LdO/Fj95onek2qeXQOuoppQO5bUu71r5OwoYmDi/BGKDvIbU7r4watNfHM8v6fiR WU4JFMGIvK0oXknv2LJUDpPjyOlMwty9y+aTIPNr+TrxEKzE9PjbfVRpCsNSDJxq W4iYZV0qS4OPJl2fHdZeX7bPxeyYsoZ6Qn2qf7QKLB6SQeEheWxeEl4JsBHgvlbO 4RgVBFJSGVKhgz7pjpYEDVXyBOCKidUBjiIDXyC5C8phIniFQb5umNDFC/6i8Deh AkfV28b/RdHq+/TUfLq+
=tTI/
-----END PGP SIGNATURE-----
Signature · 5 lines
Samuli Seppänen Community Manager OpenVPN Technologies, Inc irc freenode net: mattock
Hi,
Quoted 3 lines · David Sommerseth
We can of course investigate if we should enable systemd to restart OpenVPN, at least the server profile, if it dies unexpectedly. Currently, I am not fully convinced we want that.
I think this would be useful to have. Server processes are expected to be there - if they are not, it needs to be investigated why not, but with some reasonable delay, they should be restarted.
(I thought this was what systemd was all about? "Because sysvinit cannot restart stuff!" - which was never true, but standard rc.d scripts do not support it)
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...Quoted 10 lines · Gert Doering
Hi,
Quoted 3 lines · David Sommerseth
We can of course investigate if we should enable systemd to restart OpenVPN, at least the server profile, if it dies unexpectedly. Currently, I am not fully convinced we want that.
I think this would be useful to have. Server processes are expected to be there - if they are not, it needs to be investigated why not, but with some reasonable delay, they should be restarted.
Let's take the easiest part first ... what is a reasonable delay? RestartSec= defines how long systemd should wait before restarting the service. Default is 100ms. Would 30 seconds, 1 minute, 5 minutes, 15 minutes or 1 hour be a reasonable delay? Or another value? I honestly don't know.
So to the slightly harder part ... under which conditions should systemd restart the server? The Restart= setting can have a few alternatives.
- on-success? Only when openvpn exits with exit code 0. Probably not.
- on-failure? When openvpn exits with exit code != 0 or "unclean" exit signals. [1] Probably.
- on-abnormal? When openvpn is killed by a signal, a timeout event or watchdog timeout event happens. [1] Perhaps.
- on-abort? Only when an uncaught signal not considered as a "clean
exit" occurs. Perhaps.
- on-watchdog? Only when a watchdog timeout occurs. Most likely not.
- always? Whenever OpenVPN stops running regardless of reason
why it stopped, it will be restarted. Most likely not what we want.
- no? This is the default, which we already have.
And you can only choose one of these alternatives.
In regards to those triggers including a watchdog, that needs the OpenVPN process to signal to the systemd daemon that it will provide a watchdog signal. So unless we add that in our OpenVPN code, watchdog is not relevant for us.
The systemd.service man page [2] recommends:
Setting this to on-failure is the recommended choice for long-running services, in order to increase reliability by attempting automatic recovery from errors. For services that shall be able to terminate on their own choice (and avoid immediate restarting), on-abnormal is an alternative choice.
[1] Also includes terminated by signal, including core dump but excludes SIGHUP, SIGINT, SIGTERM adn SIGPIPE (those four signals are considered clean exits)
[2]
<https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=>
Quoted 3 lines
(I thought this was what systemd was all about? "Because sysvinit cannot restart stuff!" - which was never true, but standard rc.d scripts do not support it)
Flame bait? ;-)
I don't know exactly why this isn't enabled by default, but there are probably plenty of reasons. One could be that because the vast majority of rc.d scripts don't do this, so it would be a very unexpected change for very many services and/or sys-admins. As you see from above, the feature is easily available, fairly flexible and it is far easier to enable it than adding extra code to an rc.d script.
For the "this was what systemd was all about?" ... not just this, but it is one area of all the stuff systemd wants to improve or simplify.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Quoted 62 lines · David Sommerseth
Quoted 9 lines · Gert Doering
Hi,
Quoted 4 lines · David Sommerseth
We can of course investigate if we should enable systemd to restart OpenVPN, at least the server profile, if it dies unexpectedly. Currently, I am not fully convinced we want that.
Quoted 4 lines
I think this would be useful to have. Server processes are expected to be there - if they are not, it needs to be investigated why not, but with some reasonable delay, they should be restarted.
Let's take the easiest part first ... what is a reasonable delay? RestartSec= defines how long systemd should wait before restarting the service. Default is 100ms. Would 30 seconds, 1 minute, 5 minutes, 15 minutes or 1 hour be a reasonable delay? Or another value? I honestly don't know.
So to the slightly harder part ... under which conditions should systemd restart the server? The Restart= setting can have a few alternatives.
- on-success? Only when openvpn exits with exit code 0. Probably not.
- on-failure? When openvpn exits with exit code != 0 or "unclean" exit signals. [1] Probably.
- on-abnormal? When openvpn is killed by a signal, a timeout event or watchdog timeout event happens. [1] Perhaps.
- on-abort? Only when an uncaught signal not considered as a
"clean exit" occurs. Perhaps.- on-watchdog? Only when a watchdog timeout occurs. Most likely not.
- always? Whenever OpenVPN stops running regardless of reason
why it stopped, it will be restarted. Most likely not what we want.- no? This is the default, which we already have.
And you can only choose one of these alternatives.
In regards to those triggers including a watchdog, that needs the OpenVPN process to signal to the systemd daemon that it will provide a watchdog signal. So unless we add that in our OpenVPN code, watchdog is not relevant for us.
The systemd.service man page [2] recommends:
Setting this to on-failure is the recommended choice for long-running services, in order to increase reliability by attempting automatic recovery from errors. For services that shall be able to terminate on their own choice (and avoid immediate restarting), on-abnormal is an alternative choice.
Quoted 6 lines
[1] Also includes terminated by signal, including core dump but excludes SIGHUP, SIGINT, SIGTERM adn SIGPIPE (those four signals are considered clean exits)
[2]
<https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=>
Btw,
Quoted 1 line
I forgot to mention that there are more tweaks possible, to more fine grained define successful and failing exit codes and signals. This is done through the SuccessExitStatus= (what is considered successful exiting), RestartPreventExitStatus= (do not restart in these scenarios) and RestartForceExitStatus= (always restart when these things happens). All of them takes a list of exit codes and/or signals.
I think we should avoid tweaking them right now, unless we have a clear exit strategy in our code which falls outside of the default - where exit code 0, SIGHUP, SIGINT, SIGTERM adn SIGPIPE are the successful exits all others are failed exits.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
A User's perspective:
We run OpenVPN on some 2500 systems in a (unmanned) client-server config (we're the ones hoping to someday see Gava's client-nat and ftp-nat patches included). Long ago we came up with a brute force workaround to the service restart issue -- a script that pings back to a node behind our server, if no reply then restart service. Not pretty, but it has worked for us over many years. I'm happy to see the issue being addressed now within the source for the new versions.
Quoted 1 line
Quoted 1 line
what is a reasonable delay?
Our experience says 3 minutes.
Quoted 1 line
Quoted 1 line
under which conditions should systemd restart the server?
Our votes:
Quoted 1 line
Quoted 1 line
- on-failure?
Yes.
Quoted 1 line
Quoted 1 line
- on-abnormal?
Yes.
Quoted 1 line
Quoted 1 line
- on-abort?
Yes.
Quoted 1 line
Quoted 1 line
- always?
I am of the opinion that this IS workable, at least in our scenario (unmanned clients). For us, the most common reason for connection failure is some network change or blockage at the remote site -- but it is not always so. For us, having it continue to retry is important for troubleshooting, even if it is our fault because we did something stupid such as configuration errors (e.g. typos in the .ovpn etc.)
Hope this helps,
Marvin Adeff
Quoted 105 lines · David Sommerseth
Quoted 10 lines · Gert Doering
Hi,
Quoted 3 lines · David Sommerseth
We can of course investigate if we should enable systemd to restart OpenVPN, at least the server profile, if it dies unexpectedly. Currently, I am not fully convinced we want that.
I think this would be useful to have. Server processes are expected to be there - if they are not, it needs to be investigated why not, but with some reasonable delay, they should be restarted.
Let's take the easiest part first ... what is a reasonable delay? RestartSec= defines how long systemd should wait before restarting the service. Default is 100ms. Would 30 seconds, 1 minute, 5 minutes, 15 minutes or 1 hour be a reasonable delay? Or another value? I honestly don't know.
So to the slightly harder part ... under which conditions should systemd restart the server? The Restart= setting can have a few alternatives.
- on-success? Only when openvpn exits with exit code 0. Probably not.
- on-failure? When openvpn exits with exit code != 0 or "unclean" exit signals. [1] Probably.
- on-abnormal? When openvpn is killed by a signal, a timeout event or watchdog timeout event happens. [1] Perhaps.
- on-abort? Only when an uncaught signal not considered as a "clean
exit" occurs. Perhaps.- on-watchdog? Only when a watchdog timeout occurs. Most likely not.
- always? Whenever OpenVPN stops running regardless of reason
why it stopped, it will be restarted. Most likely not what we want.- no? This is the default, which we already have.
And you can only choose one of these alternatives.
In regards to those triggers including a watchdog, that needs the OpenVPN process to signal to the systemd daemon that it will provide a watchdog signal. So unless we add that in our OpenVPN code, watchdog is not relevant for us.
The systemd.service man page [2] recommends:
Setting this to on-failure is the recommended choice for long-running services, in order to increase reliability by attempting automatic recovery from errors. For services that shall be able to terminate on their own choice (and avoid immediate restarting), on-abnormal is an alternative choice.
[1] Also includes terminated by signal, including core dump but excludes SIGHUP, SIGINT, SIGTERM adn SIGPIPE (those four signals are considered clean exits)
[2]
<https://www.freedesktop.org/software/systemd/man/systemd.
service.html#Restart=>Quoted 3 lines
(I thought this was what systemd was all about? "Because sysvinit cannot restart stuff!" - which was never true, but standard rc.d scripts do not support it)
Flame bait? ;-)
I don't know exactly why this isn't enabled by default, but there are probably plenty of reasons. One could be that because the vast majority of rc.d scripts don't do this, so it would be a very unexpected change for very many services and/or sys-admins. As you see from above, the feature is easily available, fairly flexible and it is far easier to enable it than adding extra code to an rc.d script.
For the "this was what systemd was all about?" ... not just this, but it is one area of all the stuff systemd wants to improve or simplify.
--
kind regards,David Sommerseth
OpenVPN Technologies, Inc------------------------------------------------------------
------------------
Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
PATCH v2 1/1 systemd: Improve the systemd unit files
In reply to David SommersethThere are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the chdir() before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.
- CAP_DAC_OVERRIDE was needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid calling chroot() in OpenVPN and rather let systemd prepare a more isolated namespace.
- Client configurations are now started with --nobind and the OpenVPN client process have lost the CAP_NET_BIND_SERVICE capability which allows binding to port < 1024.
- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
v2 - Change RuntimeDirectory= to a profile specific (client, server)
directory to avoid clashing with older distro unit files
--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)
distro/systemd/[email protected]... +6 -5
@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-client +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
distro/systemd/[email protected]... +8 -6
@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-server +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
Signature · 1 line
1.8.3.1
Quoted 83 lines · David Sommerseth
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the
chdir()before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.-
CAP_DAC_OVERRIDEwas needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid callingchroot()in OpenVPN and rather let systemd prepare a more isolated namespace.- Client configurations are now started with --nobind and the OpenVPN client process have lost the
CAP_NET_BIND_SERVICEcapability which allows binding to port < 1024.- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
v2 - Change RuntimeDirectory= to a profile specific (client, server)
directory to avoid clashing with older distro unit filesContribution-by Elias Probst <[email protected]...>Signed-off-by David Sommerseth <[email protected]...>--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)distro/systemd/[email protected]... +6
-5@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-client +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rwdistro/systemd/[email protected]... +3
-4@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid
distro/systemd/[email protected]... line 18
Quoted 10 lines
distro/systemd/[email protected]... +5
-2-ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-server +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
Out of curiosity, is there a reason to put --config last ?
Thanks
Quoted 90 lines · On 12/11/16 14:48, debbie10t wrote:
Quoted 87 lines · David Sommerseth
There are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the
chdir()before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.-
CAP_DAC_OVERRIDEwas needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid callingchroot()in OpenVPN and rather let systemd prepare a more isolated namespace.- Client configurations are now started with --nobind and the OpenVPN client process have lost the
CAP_NET_BIND_SERVICEcapability which allows binding to port < 1024.- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
v2 - Change RuntimeDirectory= to a profile specific (client, server)
directory to avoid clashing with older distro unit filesContribution-by Elias Probst <[email protected]...>Signed-off-by David Sommerseth <[email protected]...>--- distro/systemd/[email protected]... | 11 ++++++----- distro/systemd/[email protected]... | 14 ++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)distro/systemd/[email protected]... +6
-5@@ -3,15 +3,16 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-client +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rwdistro/systemd/[email protected]... +6
-6@@ -1,16 +1,18 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-server +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server
Quoted 8 lines
distro/systemd/[email protected]... line 18
Quoted 6 lines
distro/systemd/[email protected]... +2
-0+ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rwOut of curiosity, is there a reason to put --config last ?
Yes, that is to allow a sys-admin to easily change our defaults without modifying the unit file.
With that said, I do see a potential little trap. A config file cannot use --daemon, as that will break how systemd expects the process to behave when being started successfully. We should probably add a simple 'grep' check in the config file, to ensure "^daemon" is not found there.
I'll check this out further.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Quoted 5 lines · David Sommerseth
Quoted 3 lines · On 12/11/16 14:48, debbie10t wrote:
On 12/11/16 11:38, David Sommerseth wrote:
Quoted 8 lines
Quoted 5 lines
distro/systemd/[email protected]... line 14
Quoted 3 lines
distro/systemd/[email protected]... +2
-0+ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.confOut of curiosity, is there a reason to put --config last ?
Yes, that is to allow a sys-admin to easily change our defaults without modifying the unit file.
Um .. How ? .. I have not read anything which says this, A page explaining what you mean would be of great help.
And related .. you cannot override --suppress-timestamps, once it is set it cannot be unset. IFAIK
Thanks
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 15 lines · On 14/11/16 15:06, debbie10t wrote:
Quoted 11 lines · David Sommerseth
Quoted 10 lines · On 12/11/16 14:48, debbie10t wrote:
Quoted 6 lines · David Sommerseth
(quoted diff) +2
-1+ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +ExecStart=/usr/sbin/openvpn --status%t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
Quoted 7 lines
Quoted 4 lines
Quoted 1 line
Out of curiosity, is there a reason to put --config last ?
Yes, that is to allow a sys-admin to easily change our defaults without modifying the unit file.
Um .. How ? .. I have not read anything which says this, A page explaining what you mean would be of great help.
As a massive example, you can do this:
openvpn --config common.conf --config --crypto.conf --config tun0.conf
OpenVPN will first load and set everything in common.conf. Then it will load crypto.conf, and it can overwrites anything common.conf have already set, and at last tun0.conf can override anything set in both common.conf and crypto.conf.
This is due to how the option parser is coded. Any options given on the command line is the same as what is in the config file; with the only difference that the config file options do not start with '--'. The parser starts with the first option, parses that - including loading configuration files and parsing them, then moves to the next option, parses that one, and so one.
This also enables a variant of the command line above. If tun0.conf adds 'config common.conf' and 'config crypto.conf', it can be started with only: openvpn --config tun0.conf. And there are some logic in the OpenVPN option parser to avoid loading the same file more than once. You can say this is a fairly traditional recursive behaviour:
- -- [pseudo code in pythonish] --------------
options = {}
parsed_configs = []
def parse_config_file(filename):
cfg = readfile(filename)
for opt, val in cfg.split(" "):
if opt == 'config':
if val in parsed_configs:
continue
parse_config_file(val)
parsed_configs.append(val)
else:
options[opt] = val
parse_config_file('tun0.conf')
- ---------------------------------------------
This is the core concept when processing config files. The logic is far more complicated in OpenVPN as it considers command line arguments as well into the same parsing logic. Even options being sent by PUSH_REPLY messages from server to clients passes through the exact same option parser, which again can override settings from the configuration file (if the option is allowed to be pushed, that is).
So to say this in a simple way: the most significant option is the last occurrence of the option. The earlier an option is listed, the less significant it gets.
I don't think we have any other documentation explicitly mentioning this. I learnt these tricks when doing the technical review for the "OpenVPN 2 Cookbook", and then later on starting to read the option parser code in option.c in more detail.
Quoted 2 lines
And related .. you cannot override --suppress-timestamps, once it is set it cannot be unset. IFAIK
You're right about --suppress-timestamps, as there exist no option to reverse this one. There are a few other scenarios where this is true as well, like --nobind and --status (it cannot be disabled, only modified to a different status file). But the list is far shorter than what it was.
I see that can be annoying for people insisting on using --log. But in this case I would rather recommend using the systemd journal directly, that will cover most use cases and you have far better control to look/grep through logs using search and range options to journalctl. And if that's not good enough, the systemd unit files we ship are to be placed under /usr/lib/systemd/system/. Currently they can easily copy our unit file from there to /etc/systemd/system, remove the --suppress-timestamp and be happy. If this turns out to be a bigger issue for the majority of users, we need to see which other options we have. Right now, I don't see this as a big issue though.
- --
kind regards,
David Sommerseth
OpenVPN Technologies, Inc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYKc5fAAoJEIbPlEyWcf3ynYgP/3jyeOKUVxXPwI70dvIaHH0B yF60iTVhQMpiw06aJd9aXIGjzeiVpee2UA6pxFtEH/xT/CuoLgHIB84i8ZUAHTkk UL1clY9IXz/fq1p7i/ZuKj3kQJBD2ppEFBvUOrM9PmmNJdiZlSoGO48eBww2hIpt bRlH0Z64NMe37wSz0OyYvgY+jA2cOb/QNvRNi9yaxG+D3Ne+dw/ZRoaZs+ZqTA6M 4cV+9UZz7oNYgZyJB8tTiR+wOJLL9DbAVPEo1BwxYqHgoOlrLqsteNKSBwkiYBwl +LEFoQdDTRJOdn3027RDjHhMSwsMktUGfwoV/FZYeQxBHzr+OvVNRN65IV7DWQcV 3VsRyCSdVuUEyyOdQjLAmKxYu4+BThe6DeoRqZ9e1HyneSCmoCEH3U9n/9fX+hsT dvGlHA7JZfE0MXhNVCC3ev37lteo0MJNuxs4Hos5qqHutHoYar5d1NpfI0sP8ZbP KqPPotyWFi5vFcnNoU9nJ+CwQrVhf6wYVtmsHghHkN9uie9RZvYA9+r41EEDNFDE kH/l6uHT1qVNvVTmDRRLH2pTw4WL9VqUx/E6RjRvbkVIB8kIMqB6TJXcvfMUzIJA DolDGYO+/stbBOvwUlQG0wDWocxJthO4LGGiSS94oksOBBtdV/fORS7bi2V2k6Eg R4MsP+BM2oBN5hOxa80Q
=ojjG
-----END PGP SIGNATURE-----
Quoted 27 lines · David Sommerseth
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1Quoted 15 lines · On 14/11/16 15:06, debbie10t wrote:
Quoted 11 lines · David Sommerseth
Quoted 10 lines · On 12/11/16 14:48, debbie10t wrote:
Quoted 6 lines · David Sommerseth
(quoted diff) +2
-1+ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +ExecStart=/usr/sbin/openvpn --status%t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
Quoted 7 lines
Quoted 4 lines
Quoted 1 line
Out of curiosity, is there a reason to put --config last ?
Yes, that is to allow a sys-admin to easily change our defaults without modifying the unit file.
Um .. How ? .. I have not read anything which says this, A page explaining what you mean would be of great help.
Quoted 8 lines
As a massive example, you can do this:
openvpn --config common.conf --config --crypto.conf --config tun0.conf
OpenVPN will first load and set everything in common.conf. Then it will load crypto.conf, and it can overwrites anything common.conf have already set, and at last tun0.conf can override anything set in both common.conf and crypto.conf.
Ahh .. I had not thought to pass things that way ! So this does make good sense. (ACK)
Quoted 1 line
- -- [pseudo code in pythonish] --------------
Ahh .. python-ish, or as i like to call it uroboros. It's on my wish list.
Quoted 4 lines
I don't think we have any other documentation explicitly mentioning this. I learnt these tricks when doing the technical review for the "OpenVPN 2 Cookbook", and then later on starting to read the option parser code in
option.cin more detail.
Good call !
Quoted 11 lines
Quoted 4 lines
And related .. you cannot override --suppress-timestamps, once it is set it cannot be unset. IFAIK
You're right about --suppress-timestamps, as there exist no option to reverse this one. There are a few other scenarios where this is true as well, like --nobind and --status (it cannot be disabled, only modified to a different status file). But the list is far shorter than what it was.
Quoted 10 lines
I see that can be annoying for people insisting on using --log. But in this case I would rather recommend using the systemd journal directly, that will cover most use cases and you have far better control to look/grep through logs using search and range options to journalctl. And if that's not good enough, the systemd unit files we ship are to be placed under
/usr/lib/systemd/system/. Currently they can easily copy our unit file from there to/etc/systemd/system, remove the --suppress-timestamp and be happy. If this turns out to be a bigger issue for the majority of users, we need to see which other options we have. Right now, I don't see this as a big issue though.
Agreed, (ACK) .. plus these will be new unit files requiring the extra step of systemctl'ing openvpn/{server/client} directory.
Regards
PATCH v3 1/1 systemd: Improve the systemd unit files
In reply to David SommersethThere are several changes which allows systemd to take care of several aspects of hardening the execution of OpenVPN.
- Let systemd take care of the process tracking directly, instead of doing that via PID files
- Make systemd prepare proper runtime directories for the OpenVPN process.
- Let systemd do the chdir() before starting OpenVPN. This allows us to avoid using the --cd option when executing openvpn.
- CAP_DAC_OVERRIDE was needed when using --chroot. Otherwise the root user would not be allowed to access files/directories not owned by root. This will change in the future, when we find better ways to avoid calling chroot() in OpenVPN and rather let systemd prepare a more isolated namespace.
- Client configurations are now started with --nobind and the OpenVPN client process have lost the CAP_NET_BIND_SERVICE capability which allows binding to port < 1024.
- Documentation URL now points at the OpenVPN 2.4 man page URL
The majority of these changes have been proposed by Elias Probst (eliasp) in the GitHub PR #22.
v3 - Add ExecPreStart= to check if OpenVPN configuration contains
'daemon'. That can break the process tracking as we now use Type=simple (default)
v2 - Change RuntimeDirectory= to a profile specific (client, server)
directory to avoid clashing with older distro unit files
--- distro/systemd/[email protected]... | 12 +++++++----- distro/systemd/[email protected]... | 15 +++++++++------ 2 files changed, 16 insertions(+), 11 deletions(-)
distro/systemd/[email protected]... +7 -5
@@ -3,15 +3,17 @@ Description=OpenVPN tunnel for %I After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/client_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/client --config %i.conf --daemon --writepid /var/run/openvpn/client_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-client +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/client +ExecStartPre=/bin/sh -c 'grep -q -E ^daemon %i.conf || exit 0 && /usr/bin/echo "OpenVPN configuration cannot contain --daemon when being managed by systemd" ; exit 1' +ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
distro/systemd/[email protected]... +9 -6
@@ -1,16 +1,19 @@ [Unit] Description=OpenVPN service for %I -After=syslog.target network.target +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] PrivateTmp=true -Type=forking -PIDFile=/var/run/openvpn/server_%i.pid -ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server --status /var/run/openvpn/server_%i-status.log --status-version 2 --config %i.conf --daemon --writepid /var/run/openvpn/server_%i.pid -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH +RuntimeDirectory=openvpn-server +RuntimeDirectoryMode=0710 +WorkingDirectory=/etc/openvpn/server +ExecStartPre=/bin/sh -c 'grep -q -E ^daemon %i.conf || exit 0 && /usr/bin/echo "OpenVPN configuration cannot contain --daemon when being managed by systemd" ; exit 1' +ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw
Signature · 1 line
1.8.3.1
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
As this is not a critical security change, we apply this without any formal ACKs. It has been thoroghly tested by several users. See mailing list for details.
Your patch has been applied to the master branch
commit 8b42c197626430118ed126c1b8256ba5ae1f699a
Author: David Sommerseth Date: Mon Nov 14 12:20:08 2016 +0100
systemd: Improve the systemd unit files
Signed-off-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: http://www.mail-archive.com/[email protected]/msg13039.html- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYLHlrAAoJEIbPlEyWcf3yP4gP/0JxPXuDA5xq8mfBDEl16R72 Z5W4iwAUNLm9KTE5ctzEkXzxGYCgx3dzRnewYbHzUb+IwGanml1i/Io5/67KP7J+ manoE3qaIhwK6XyCNanOtlTxJN447RJd1FzeCiUdmFjLpgO38dFSSdBC+YKB3IJe HNseU/Uwfymn2G/TCi6acBCnXVJUxYw0aFf9QbCk3c2gNvwgfhjDkiFkuVYiuIwH B7nPVjPtW6SwUbFtzdx4T0pOxNYildPpnGT4mHR8Ky/J/ozHdeFbHS4ytetxS6Sl q/8zk8PyCQHk9aC/ZHD1PxhbKrGZNU1FfCGtAbn+cvWa5fOobeUJPls6Vw0J8i8r Okv+s5OpbrMQsvvVkZlvVj7DZ76vkSkGjUuHtZfAtZfsUn1tUJh3b6pOt19FJ/67 3MO5bchBQMKzroviSkPSWVuM+r/zimjyx38Fc0pEbE+Q1IgYUmzfxDLuVrBHQP99 PLGC+yl5CfPCoBHjg/vhfuIBlgO/mFEk1RSedp3t2IPKl2Bow3MYMWtu3R/5itZ2 tB2h1cVx4kKEkEA+q4mZ9k3ctwjSQ0HtYYLbSWustP6xSRqCNvsTK91Q5lRrJpCj f6/Tr0qn/Ybg9SCloJISBU3kJuSQln4j0mtH+mEn1iICszJPQcxTa1RGx2eveIS+ Ih/g9ZdlgzfzBfZbVZZz
=62Hq
-----END PGP SIGNATURE-----