当试图service openvpn start
Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf
跑步openvpn devnet-client-vm.conf
效果很好。为什么 openvpn 无法启动?我该如何修复它?
答案1
你可能想跑
fixfiles -R openvpn restore
ls -alZ 应该给你类似这样的东西(显示你的文件现在位于正确的 selinux 上下文中):
[root@server openvpn]# ls -alZ /etc/openvpn/
drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 .
drwxr-xr-x. root root system_u:object_r:etc_t:s0 ..
drwxr-xr-x. root root unconfined_u:object_r:openvpn_etc_t:s0 certs
-rw-r--r--. root root unconfined_u:object_r:openvpn_etc_t:s0 dh2048.pem
drwxr-xr-x. root root unconfined_u:object_r:openvpn_etc_t:s0 easy-rsa
-rw-------. root root unconfined_u:object_r:openvpn_etc_rw_t:s0 ipp.txt
-rw-------. root root unconfined_u:object_r:openvpn_etc_t:s0 ta.key
-rw-------. openvpn openvpn unconfined_u:object_r:openvpn_etc_t:s0 server.conf
如果你有这样的声明
status openvpn-status.log
在您的 openvpn 配置文件中,您可能会注意到服务器仍然无法启动。看一下 /var/log/audit/audit.log 就会发现
type=AVC msg=audit(1413580155.710:1265): avc: denied { write } for pid=19725 comm="openvpn" name="openvpn-status.log" dev="dm-1" ino=54153273 scontext=system_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:openvpn_etc_t:s0 tclass=file
将此文件的上下文更改为 rw 可以解决问题:
chcon -t openvpn_etc_rw_t openvpn-status.log
和
[root@server openvpn]# ls -alZ openvpn-status.log
-rw-------. root root unconfined_u:object_r:openvpn_etc_t:s0 openvpn-status.log
会变成
-rw-------. root root unconfined_u:object_r:openvpn_etc_rw_t:s0 openvpn-status.log
随后拨打电话
service openvpn@server start
工作完美。
[root@server openvpn]# service openvpn@server status
Redirecting to /bin/systemctl status [email protected]
[email protected] - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/[email protected]; disabled)
Active: active (running) since Fri 2014-10-17 23:13:49 CEST; 9s ago
Process: 20445 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
Main PID: 20449 (openvpn)
CGroup: /system.slice/system-openvpn.slice/[email protected]
└─20449 /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server.pid --cd /etc/openvpn/ --config server.conf
Oct 17 23:13:49 server openvpn[20445]: ROUTE_GATEWAY xx.xxx.xx.x/255.255.255.0 IFACE=eth0 HWADDR=XX:XX:XX:XX:XX:XX
Oct 17 23:13:49 server openvpn[20449]: GID set to nobody
Oct 17 23:13:49 server openvpn[20449]: UID set to nobody
Oct 17 23:13:49 server openvpn[20449]: UDPv4 link local (bound): [undef]
Oct 17 23:13:49 server openvpn[20449]: UDPv4 link remote: [undef]
Oct 17 23:13:49 server openvpn[20449]: MULTI: multi_init called, r=256 v=256
Oct 17 23:13:49 server openvpn[20449]: IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Oct 17 23:13:49 server systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server.
Oct 17 23:13:49 server openvpn[20449]: IFCONFIG POOL LIST
Oct 17 23:13:49 server openvpn[20449]: Initialization Sequence Completed
PS:我用的是Centos 7。
答案2
对于找到此线程的其他人,我在 Fedora 26 上遇到了问题。事实证明,我遵循的说明是将conf文件放在/etc/openvpn目录中,但它们需要进入/etc/openvpn/server。
答案3
问题是SELinux,编辑/etc/sysconfig/selinux
和设置SELINUX=permissive
然后重新启动为我解决了它。我记得在 Fedora 中,必须运行一个命令才能正确使用 cert 目录,但我忘记了该命令是什么。设置为宽松修复可以完全修复,但更好的方法是修复它,以便它可以正确使用该目录。
答案4
我通过将conf文件移动到目录解决了上述错误 client
,例如,
/etc/openvpn/client/openvpn.conf