2

I have setup OpenVPN server and client successfully. However it all works great when I run it as root but I would like to run them with the reduced privileges of user "nobody" and group "nogroup". These are options in the config files:

Server.conf ;It's a good idea to reduce the OpenVPN ;daemon's privileges after initialization. ;You can uncomment this out on ;non-Windows systems. ;user nobody ;group nogroup

However when I enable them, I get the following errors in the connection log:

Thu Jan 21 10:22:52 2016 TUN/TAP device tun0 opened Thu Jan 21 10:22:52 2016 TUN/TAP TX queue length set to 100 Thu Jan 21 10:22:52 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Thu Jan 21 10:22:52 2016 /sbin/ip link set dev tun0 up mtu 1500 Thu Jan 21 10:22:52 2016 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5 Thu Jan 21 10:22:52 2016 /sbin/ip route add 192.168.1.98/32 via 192.168.1.254 Thu Jan 21 10:22:52 2016 ERROR: Linux route add command failed: external program exited with error status: 2 Thu Jan 21 10:22:52 2016 /sbin/ip route add 0.0.0.0/1 via 10.8.0.5 Thu Jan 21 10:22:52 2016 /sbin/ip route add 128.0.0.0/1 via 10.8.0.5 Thu Jan 21 10:22:52 2016 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5 Thu Jan 21 10:22:52 2016 GID set to nogroup Thu Jan 21 10:22:52 2016 UID set to nobody Thu Jan 21 10:22:52 2016 Initialization Sequence Completed

I know this is because the user "nobody" does not have privileges to delete routes. When I close the connection, I get this:

Thu Jan 21 10:23:00 2016 event_wait : Interrupted system call (code=4) Thu Jan 21 10:23:00 2016 /sbin/ip route del 10.8.0.1/32 Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Jan 21 10:23:00 2016 /sbin/ip route del 192.168.1.98/32 Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Jan 21 10:23:00 2016 /sbin/ip route del 0.0.0.0/1 Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Jan 21 10:23:00 2016 /sbin/ip route del 128.0.0.0/1 Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Jan 21 10:23:00 2016 Closing TUN/TAP interface Thu Jan 21 10:23:00 2016 /sbin/ip addr del dev tun0 local 10.8.0.6 peer 10.8.0.5 Thu Jan 21 10:23:00 2016 Linux ip addr del failed: external program exited with error status: 2 Thu Jan 21 10:23:00 2016 SIGINT[hard,] received, process exiting

So the question is, how do I give the required permissions to the user "nobody" and group "nogroup"?

2
  • anyone got any advice?
    – user92592
    Jan 21, 2016 at 20:32
  • Same issue on a OpenWRT router /sbin/route del -net 192.168.2.0 netmask 255.255.255.0 route: SIOCDELRT: Operation not permitted ERROR: Linux route delete command failed: external program exited with error status: 1
    – dersimn
    May 1, 2020 at 21:30

0

You must log in to answer this question.

Browse other questions tagged .