我正在尝试在 CentOS 8.2 上设置带有 PAM 登录的 OpenVPN (2.4.9) 服务器，但遇到了一些奇怪的问题。具体来说，如果我使用 systemd 单元文件中指定的 ExecStart 命令启动服务器，则可以成功进行身份验证
sudo /usr/sbin/openvpn --status /home/XXX/openvpn.log --status-version 2 --suppress-timestamps --cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config server.conf
但是，如果我通过 systemd 启动服务器
sudo systemctl start openvpn-server@server
我在 openvpn 日志中看到以下身份验证错误
AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: XXXX
AUTH-PAM: BACKGROUND: my_conv[0] query='Password: ' style=1
AUTH-PAM: BACKGROUND: user 'XXXX' failed to authenticate: Authentication failure
2.204.43.58:49048 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
2.204.43.58:49048 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so
2.204.43.58:49048 TLS Auth Error: Auth Username/Password verification failed for peer
有谁知道问题可能出在哪里？我肯定是与附加的 systemd 配置有关，还是我错了？
干杯!
托拜厄斯
systemd-unit 文件如下所示：/lib/systemd/system/[email protected]
[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure
[Install]
WantedBy=multi-user.target
这是我的 openvpn server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/server/easy-rsa/3/pki/ca.crt
cert /etc/openvpn/server/easy-rsa/3/pki/issued/server.crt
key /etc/openvpn/server/easy-rsa/3/pki/private/server.key
dh /etc/openvpn/server/easy-rsa/3/pki/dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
duplicate-cn
keepalive 10 120
cipher AES-128-GCM
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
verb 6
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
username-as-common-name
这是我的 openvpn Pam 文件
auth required pam_succeed_if.so user ingroup vpnlogin
auth substack system-auth
auth include postlogin
account required pam_nologin.so
account include system-auth
password include system-auth
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
session include postlogin
-session optional pam_ck_connector.so
/var/log/secure 中的身份验证日志如下：
Jul 15 17:23:51 YYYY openvpn[9730]: pam_succeed_if(openvpn2:auth): requirement "user ingroup vpnlogin" was met by user "XXXX"
Jul 15 17:23:51 YYYY unix_chkpwd[9747]: check pass; user unknown
Jul 15 17:23:51 YYYY unix_chkpwd[9748]: check pass; user unknown
Jul 15 17:23:51 YYYY unix_chkpwd[9748]: password check failed for user (XXXX)
Jul 15 17:23:51 YYYY openvpn[9730]: pam_unix(openvpn2:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=XXXX
/var/log/audit/audit.log 上的审计日志如下：
type=SERVICE_START msg=audit(1594833821.311:12583): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openvpn-server@server comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"
type=SERVICE_START msg=audit(1594833821.395:12584): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"
type=AVC msg=audit(1594833831.005:12585): avc: denied { dac_override } for pid=9747 comm="unix_chkpwd" capability=1 scontext=system_u:system_r:chkpwd_t:s0 tcontext=system_u:system_r:chkpwd_t:s0 tclass=capability permissive=0
type=AVC msg=audit(1594833831.007:12586): avc: denied { dac_override } for pid=9748 comm="unix_chkpwd" capability=1 scontext=system_u:system_r:chkpwd_t:s0 tcontext=system_u:system_r:chkpwd_t:s0 tclass=capability permissive=0
type=USER_AUTH msg=audit(1594833831.008:12587): pid=9730 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:openvpn_t:s0 msg='op=PAM:authentication grantors=? acct="XXXX" exe="/usr/sbin/openvpn" hostname=? addr=? terminal=? res=failed'^]UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1594833831.255:12588): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"
答案1
解决
我不知道这是否是最好的解决方案，但当我将 替换为 时，问题得到了解决。CAP_DAC_OVERRIDE我CAP_DAC_READ_SEARCH的理解是，从安全角度来看，这可能是更好的选择。CapabilityBoundingSet/lib/systemd/system/[email protected]
警告：虽然对于我的配置来说这并没有引起任何问题并且一切似乎都运行顺利，但由于 openvpn 单元以较少的权限运行，它可能会给其他配置带来问题。
可能发生的情况
我假设unix_chkpwd会使用调用进程的功能执行，也就是CAP_DAC_OVERRIDE。但是，由于unix_chkpwd不需要此访问级别，因此 SELinux 会拒绝它并无法打开/etc/shadow。如果对 systemd/pam/SELinux 有更深入了解的人知道更多，我将非常乐意纠正。