Re: OpenVPN Plugins and Systemd

On 29/11/2023 19:50, Colin Ryan wrote:
> Folks,
> 
> Trying to move my openvpn configuration to fully systemd modified.
> 
> I've compiled openvpn with systemd support and fundamentally it works 
> with the most recent systemd recipe's in the style of [email protected]
> 
> 
> Systemd until has this:
> 
> [Service]
> Type=notify
> PrivateTmp=true
> WorkingDirectory=/opt/aa/config/aalan
> ExecStart=/opt/aa/sbin/openvpn  --suppress-timestamps --config 
> /opt/aa/config/aalan/%i.conf
> CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE 
> CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUD>
> LimitNPROC=20
> DeviceAllow=/dev/null rw
> DeviceAllow=/dev/net/tun rw
> ProtectSystem=true
> ProtectHome=true
> KillMode=control-group
> RestartSec=30s
> Restart=always
> 
> 
> However it appears this is not allowing plug-ins to fork properly.
> 
> 
> -PLUGIN: Thread creation failed.
> 
> 
> If I use a much more primitive unit file from the early days of systemd 
> usage where the Type=forking was used to essentially just run the daemon 
> the exact same configuration file works.
> 
> As well instance without plugin also works.
> 
> I'm assuming it's some CapabilityBoundingSet issue. The daemon starts, 
> management console is available, accepts connections attempts etc but 
> when the fork to the plug-in goes it fails.
> 
> Thoughts
> 
> Colin

Which distribution do you see this on?

The [email protected] unit files has generally been deprecated in the 
upstream OpenVPN project for quite some time; due to inconsistent 
behaviors across distributions.  Many distributions still continue to 
ship these, but it is being supported by the distribution only.

The OpenVPN project ships [email protected] and 
[email protected], which is considered to be a better alternative. 
  This was introduced with OpenVPN 2.4, which added better systemd 
integration so systemd could better understand in which runtime status 
the OpenVPN process has.  And it adds a lot of hardening, depending on 
the use case (client or server config).

Can you please try and see if that works better?


-- 
kind regards,

David Sommerseth
OpenVPN Inc




_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users