0

I'm working on setting up an openvpn server. I'm using the standard sources of debian jessie and easy-rsa as an CA.

Everything worked fine until I've tried to start openvpn via init script. When I'm running /etc/init.d/openvpn start following error comes up in /var/log/daemon.log

Options error: --client-config-dir fails with "/etc/openvpn/easy-rsa/keys/crl.jail//etc/openvpn/server.ccd": No such file or directory

Has someone of you a idea where this mess with the paths comes from? The directory what is set in the config file exists. The server.conf file: port 1194 proto udp dev tun

comp-lzo
keepalive 10 120

persist-key
persist-tun
user nobody
group nogroup

chroot /etc/openvpn/easy-rsa/keys/crl.jail
crl-verify crl.pem

ca /etc/openvpn/easy-rsa/keys/ca.crt
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
key /etc/openvpn/easy-rsa/keys/server.key
cert /etc/openvpn/easy-rsa/keys/server.crt

ifconfig-pool-persist /var/lib/openvpn/server.ipp
client-config-dir /etc/openvpn/server.ccd
status /var/log/openvpn/server.log
verb 4

# virtual subnet unique for openvpn to draw client addresses from
# the server will be configured with x.x.x.1
# important: must not be used on your network
server 10.254.1.0 255.255.255.0

# push routes to clients to allow them to reach private subnets
push "route 10.0.0.0 255.0.0.0"

THX for your help.

0

It seems that the directory doesn't exist, you could try making it with

mkdir -p /etc/openvpn/easy-rsa/keys/crl.jail//etc/openvpn/server.ccd

Although I would probably just use

/etc/openvpn/ccd

and adjust the config appropriately.


Update:

chroot /etc/openvpn/easy-rsa/keys/crl.jail

That is key to solving your problem.

| improve this answer | |
  • Sorry, but what do you mean with chroot /etc/openvpn/easy-rsa/keys/crl.jail ? This is in the config and the directory is there. – andi-g Nov 25 '16 at 19:11
0

I found the bug. The server.ccd has to be in the crl.jail directory. I've changed the config like this:

...
chroot /etc/openvpn/easy-rsa/keys/crl.jail
crl-verify crl.pem

ca /etc/openvpn/easy-rsa/keys/ca.crt
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
key /etc/openvpn/easy-rsa/keys/server.key
cert /etc/openvpn/easy-rsa/keys/server.crt

ifconfig-pool-persist /var/lib/openvpn/server.ipp
client-config-dir server.ccd

...
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.