OpenVPN with PAM with systemd and SELinux

Question

I am trying to set up an OpenVPN (2.4.9) server with PAM login on CentOS 8.2 and I am facing some strange issues. Specifically, i can successfully athenticate if I start the server with the ExecStart command specified in the systemd unit file

sudo /usr/sbin/openvpn --status /home/XXX/openvpn.log --status-version 2 --suppress-timestamps --cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config server.conf

However, if I start the server via systemd

sudo systemctl start openvpn-server@server

I see the following authentication error in my openvpn log

AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: XXXX
AUTH-PAM: BACKGROUND: my_conv[0] query='Password: ' style=1
AUTH-PAM: BACKGROUND: user 'XXXX' failed to authenticate: Authentication failure
2.204.43.58:49048 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
2.204.43.58:49048 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so
2.204.43.58:49048 TLS Auth Error: Auth Username/Password verification failed for peer

Is there anyone who knows what the issue might be? I must be something about the additional systemd configuration, or am I wrong?

Cheers!

Tobias

The systemd-unit file /lib/systemd/system/[email protected] looks as follows:

[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure

[Install]
WantedBy=multi-user.target

Here is my openvpn server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/server/easy-rsa/3/pki/ca.crt
cert /etc/openvpn/server/easy-rsa/3/pki/issued/server.crt
key /etc/openvpn/server/easy-rsa/3/pki/private/server.key
dh /etc/openvpn/server/easy-rsa/3/pki/dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
duplicate-cn
keepalive 10 120
cipher AES-128-GCM
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
verb 6
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
username-as-common-name

And here my openvpn Pam file

auth required pam_succeed_if.so user ingroup vpnlogin
auth substack system-auth
auth include postlogin
account required pam_nologin.so
account include system-auth
password include system-auth
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
session include postlogin
-session optional pam_ck_connector.so

Auth logs at /var/log/secure looks as follows:

Jul 15 17:23:51 YYYY openvpn[9730]: pam_succeed_if(openvpn2:auth): requirement "user ingroup vpnlogin" was met by user "XXXX"
Jul 15 17:23:51 YYYY unix_chkpwd[9747]: check pass; user unknown
Jul 15 17:23:51 YYYY unix_chkpwd[9748]: check pass; user unknown
Jul 15 17:23:51 YYYY unix_chkpwd[9748]: password check failed for user (XXXX)
Jul 15 17:23:51 YYYY openvpn[9730]: pam_unix(openvpn2:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=XXXX

The audit log at /var/log/audit/audit.log looks as follows:

type=SERVICE_START msg=audit(1594833821.311:12583): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openvpn-server@server comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"
type=SERVICE_START msg=audit(1594833821.395:12584): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset" 
type=AVC msg=audit(1594833831.005:12585): avc:  denied  { dac_override } for  pid=9747 comm="unix_chkpwd" capability=1  scontext=system_u:system_r:chkpwd_t:s0 tcontext=system_u:system_r:chkpwd_t:s0 tclass=capability permissive=0
type=AVC msg=audit(1594833831.007:12586): avc:  denied  { dac_override } for  pid=9748 comm="unix_chkpwd" capability=1  scontext=system_u:system_r:chkpwd_t:s0 tcontext=system_u:system_r:chkpwd_t:s0 tclass=capability permissive=0
type=USER_AUTH msg=audit(1594833831.008:12587): pid=9730 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:openvpn_t:s0 msg='op=PAM:authentication grantors=? acct="XXXX" exe="/usr/sbin/openvpn" hostname=? addr=? terminal=? res=failed'^]UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1594833831.255:12588): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"

Answer 1

Resolution

I don't know if this is the best solution, but the issue got resolved when I replaced CAP_DAC_OVERRIDE by CAP_DAC_READ_SEARCH in the CapabilityBoundingSet of /lib/systemd/system/[email protected]. My understanding is that from a security standpoint this might be preferable anyway.

CAVEAT: Although for my configuration this did not raise any issues and everything seems to run smoothly, it might make problems for other configurations as the openvpn unit runs with fewer privileges.

What might be going on

I assume that unix_chkpwd gets executed with the capabilities of the calling process, which would be CAP_DAC_OVERRIDE. However, since unix_chkpwd does not need this access level, it gets denied by SELinux and fails to open /etc/shadow. If anyone with a deeper understanding of systemd/pam/SELinux knows more I would be glad to be corrected.