0

My OpenVPN server is unable to execute a python script configured as --learn-address when the daemon is launched as a systemd service. It works fine when launched manually as root. I found that it also work as a systemd service if I comment the following line in /etc/systemd/system/openvpn@.service:

CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE

So, I guess my problem is related to a missing Capability. How can I debug that to find out what's missing? OpenVPN log just say WARNING: Failed running command (--learn-address): external program exited with error status: 1. I find nothing related to this in the syslog either.

The learn-address script is used to apply custom firewall rules based on who is connecting. The script does group membership lookups (using /usr/bin/id command) and add rules/chain with the iptable command (with sudo). After further debugging, I think it may fails when trying to call iptables. The command exits with code 3.

It already worked for a while, I wonder if it doesn't stopped to work after a system update.

  • What is this learn-address script, and can you share a copy? – John Mahowald Jul 12 at 2:24
  • @JohnMahowald Added more information. – Francis Jul 12 at 17:15
  • You might want to output stdout/stderr of that iptables command to some /tmp/file to inspect a potential error message that iptables would emit. – Tomáš Pospíšek Jul 12 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.