Ho installato correttamente il server e il client OpenVPN. Comunque funziona tutto alla grande quando lo eseguo come root, ma mi piacerebbe eseguirli con i privilegi ridotti dell'utente "nobody" e del gruppo "nogroup". Queste sono opzioni nei file di configurazione:
Server.conf
;It's a good idea to reduce the OpenVPN
;daemon's privileges after initialization.
;You can uncomment this out on
;non-Windows systems.
;user nobody
;group nogroup
Tuttavia, quando li abilito, ottengo i seguenti errori nel log di connessione:
Thu Jan 21 10:22:52 2016 TUN/TAP device tun0 opened
Thu Jan 21 10:22:52 2016 TUN/TAP TX queue length set to 100
Thu Jan 21 10:22:52 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jan 21 10:22:52 2016 /sbin/ip link set dev tun0 up mtu 1500
Thu Jan 21 10:22:52 2016 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu Jan 21 10:22:52 2016 /sbin/ip route add 192.168.1.98/32 via 192.168.1.254
Thu Jan 21 10:22:52 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Thu Jan 21 10:22:52 2016 /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Thu Jan 21 10:22:52 2016 /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Thu Jan 21 10:22:52 2016 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Thu Jan 21 10:22:52 2016 GID set to nogroup
Thu Jan 21 10:22:52 2016 UID set to nobody
Thu Jan 21 10:22:52 2016 Initialization Sequence Completed
Lo so perché l'utente "nobody" non ha i privilegi per cancellare le rotte. Quando chiudo la connessione, ottengo questo:
Thu Jan 21 10:23:00 2016 event_wait : Interrupted system call (code=4)
Thu Jan 21 10:23:00 2016 /sbin/ip route del 10.8.0.1/32
Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Jan 21 10:23:00 2016 /sbin/ip route del 192.168.1.98/32
Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Jan 21 10:23:00 2016 /sbin/ip route del 0.0.0.0/1
Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Jan 21 10:23:00 2016 /sbin/ip route del 128.0.0.0/1
Thu Jan 21 10:23:00 2016 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Jan 21 10:23:00 2016 Closing TUN/TAP interface
Thu Jan 21 10:23:00 2016 /sbin/ip addr del dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu Jan 21 10:23:00 2016 Linux ip addr del failed: external program exited with error status: 2
Thu Jan 21 10:23:00 2016 SIGINT[hard,] received, process exiting
Quindi la domanda è, come faccio a dare le autorizzazioni richieste all'utente "nessuno" e il gruppo "nogroup"?