Re: OpenVPN Plugins and Systemd
Colin Ryan <[email protected]>
| Newsgroups | gmane.network.openvpn.user |
|---|---|
| Message-ID | <[email protected]> |
Just for community knowledge. Through much trial and error it was concluded from some reason that the LimitNPROC was the culprit even though the plug-in only spawned 3 additional instances of OVPN. Didn't have time to really figure out why. PrivateTmp, ProtectHome, ProtectSystem are all fine to use. Colin On 2023-11-29 5:00 p.m., David Sommerseth wrote: > On 29/11/2023 19:50, Colin Ryan wrote: >> Folks, >> >> Trying to move my openvpn configuration to fully systemd modified. >> >> I've compiled openvpn with systemd support and fundamentally it works >> with the most recent systemd recipe's in the style of [email protected] >> >> >> Systemd until has this: >> >> [Service] >> Type=notify >> PrivateTmp=true >> WorkingDirectory=/opt/aa/config/aalan >> ExecStart=/opt/aa/sbin/openvpn --suppress-timestamps --config >> /opt/aa/config/aalan/%i.conf >> CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE >> CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE >> CAP_AUD> >> LimitNPROC=20 >> DeviceAllow=/dev/null rw >> DeviceAllow=/dev/net/tun rw >> ProtectSystem=true >> ProtectHome=true >> KillMode=control-group >> RestartSec=30s >> Restart=always >> >> >> However it appears this is not allowing plug-ins to fork properly. >> >> >> -PLUGIN: Thread creation failed. >> >> >> If I use a much more primitive unit file from the early days of >> systemd usage where the Type=forking was used to essentially just run >> the daemon the exact same configuration file works. >> >> As well instance without plugin also works. >> >> I'm assuming it's some CapabilityBoundingSet issue. The daemon >> starts, management console is available, accepts connections attempts >> etc but when the fork to the plug-in goes it fails. >> >> Thoughts >> >> Colin > > Which distribution do you see this on? > > The [email protected] unit files has generally been deprecated in the > upstream OpenVPN project for quite some time; due to inconsistent > behaviors across distributions. Many distributions still continue to > ship these, but it is being supported by the distribution only. > > The OpenVPN project ships [email protected] and > [email protected], which is considered to be a better > alternative. This was introduced with OpenVPN 2.4, which added better > systemd integration so systemd could better understand in which > runtime status the OpenVPN process has. And it adds a lot of > hardening, depending on the use case (client or server config). > > Can you please try and see if that works better? > > _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users