openvpn-users — OpenVPN users list

Re: [Openvpn-users] logs entries not as openvpn user

[Gert D. <ge...@gr...>]

Hi,

On Tue, Sep 09, 2025 at 01:23:23PM -0400, Dan Langille wrote:
> > Interesting.  So does "grep foo /etc/passwd" turn up anything?
> 
> Yes, it finds the expected user (which is not actually foo).
> 
> [17:22 gw01 dvl ~] % grep foo /etc/passwd           
> foo:*:1002:1002:User &:/usr/home/foo:/bin/sh
> 
> [17:22 gw01 dvl ~] % grep foo /etc/group            
> wheel:*:0:root,dvl,foo
> foo:*:1002:

ok... so anything that ended up in the environment which might prompt
"logger" to use that?

Logger source says

        if (tag == NULL)
                tag = getlogin();

and that is documented as

     The getlogin() routine returns the login name of the user associated with
     the current session, as previously set by setlogin().  The name is
     normally associated with a login shell at the time a session is created,
     and is inherited by all processes descended from the login shell.  (This
     is true even if some of those processes assume another user ID, for
     example when su(1) is used).

so I guess it might be the user that started "sudo openvpn".

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

Re: [Openvpn-users] logs entries not as openvpn user

[Dan L. <da...@la...>]

On Tue, Sep 9, 2025, at 1:16 PM, Gert Doering wrote:
> Hi,
>
> On Tue, Sep 09, 2025 at 07:07:36AM -0400, Dan Langille wrote:
>> That's interesting:
>> 
>> Sep  9 11:06:09 gw01 foo[26475]: my id: uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
>> 
>> OpenVPN runs as root.
>
> Interesting.  So does "grep foo /etc/passwd" turn up anything?

Yes, it finds the expected user (which is not actually foo).

[17:22 gw01 dvl ~] % grep foo /etc/passwd           
foo:*:1002:1002:User &:/usr/home/foo:/bin/sh

[17:22 gw01 dvl ~] % grep foo /etc/group            
wheel:*:0:root,dvl,foo
foo:*:1002:

-- 
  Dan Langille
  da...@la...

Re: [Openvpn-users] logs entries not as openvpn user

[Gert D. <ge...@gr...>]

Hi,

On Tue, Sep 09, 2025 at 07:07:36AM -0400, Dan Langille wrote:
> That's interesting:
> 
> Sep  9 11:06:09 gw01 foo[26475]: my id: uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
> 
> OpenVPN runs as root.

Interesting.  So does "grep foo /etc/passwd" turn up anything?

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

Re: [Openvpn-users] logs entries not as openvpn user

[Dan L. <da...@la...>]

On Tue, Sep 9, 2025, at 5:31 AM, Jan Just Keijser wrote:
> Hi Dan,
> 
> On 08/09/2025 23:28, Dan Langille wrote:
>> On Mon, Sep 8, 2025, at 4:38 PM, Gert Doering wrote:
>>> Hi,
>>> 
>>> On Mon, Sep 08, 2025 at 04:24:48PM -0400, Dan Langille wrote:
>>>> I'm using openvpn-2.6.14 on FreeBSD 14.2
>>>> 
>>>> I've noticed these log entries:
>>>> 
>>>> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /usr/local/etc/openvpn/ccd/pro06.int.example.org
>>>> Sep  8 18:32:02 gw01 foo[38754]: pro06.int.example.org connected with IP 10.0.0.10
>>>> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_7e069917a782727053dbfb713ff7e3d6.tmp
>>>> 
>>>> Why would the second entry be running as user foo?
>>> Ignore my previous mail, I was assuming "this is an openvpn log prefix",
>>> but that's on the other side of "name[pid]:".
>>> 
>>> So this is from a different process than openvpn (pid=63572).  No idea
>>> what is running there - do a "ps axwu |grep 38754" to find out...
>> The processes appear to be short-lived. I think I know why:
>> 
>> client-connect    /usr/local/sbin/serverlocal-events.sh
>> client-disconnect /usr/local/sbin/serverlocal-events.sh
>> 
>> 
>> # ls -l /usr/local/sbin/serverlocal-events.sh
>> -rwxr-xr-x  1 root wheel 395 Sep  5 19:22 /usr/local/sbin/serverlocal-events.sh
>> 
>> # cat /usr/local/sbin/serverlocal-events.sh
>> #!/bin/sh
>> 
>> # Taken from https://forums.openvpn.net/viewtopic.php?t=43899
>> 
>> # Executed on the server side for client connect and disconnect events.
>> 
>> # Log client connect or disconnect event with IP address
>> 
>> case "$script_type" in
>>   client-connect)
>>     logger "$common_name connected with IP $trusted_ip"
>>     ;;
>> 
>>   client-disconnect)
>>     logger "$common_name disconnected with IP $trusted_ip"
>> esac
>> 
>> That's the script which produces the foo entry. I see no reason for it to run as foo.
>> 
> 
> does your openvpn configuration file itself contains an entry similar to
> 
>   user foo
>   group foo
> 
> ?  when the client-connect script is run, OpenVPN has switched to whatever user you specify there.
>  

It has neither of those directives.

[*11:19* gw01 *dvl* *~*] % sudo grep -i user /usr/local/etc/openvpn/openvpn.conf
[*11:19* gw01 *dvl* *~*] % sudo grep -i group /usr/local/etc/openvpn/openvpn.conf 
[*11:19* gw01 *dvl* *~*] % 

--
  Dan Langille
  da...@la...

Re: [Openvpn-users] logs entries not as openvpn user

[Dan L. <da...@la...>]

On Tue, Sep 9, 2025, at 1:32 AM, Gert Doering wrote:
> Hi,
>
> On Mon, Sep 08, 2025 at 05:28:38PM -0400, Dan Langille wrote:
>> >> Sep  8 18:32:02 gw01 foo[38754]: pro06.int.example.org connected with IP 10.0.0.10
> [..]
>> That's the script which produces the foo entry. I see no reason for it to run as foo.
>
> According to "man logger", this is what is running under...
>
>      -t tag  Mark every line in the log with the specified tag rather than the
>              default of current login name.  Use -t tag[N] to insert specific
>              decimal process id instead of id of logger.
>
> ... but it could be a double uid in /etc/passwd - so if you have set
> openvpn trun as "user bar", and foo+bar share the same uid, the reverse
> mapping done by logger ("what user am I running under?") might end up
> showing "foo".
>
> I'd add a call
>
>   logger "my id: `id -a`"
>
> to see what it has to say...


That's interesting:

Sep  9 11:06:09 gw01 foo[26475]: my id: uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)

OpenVPN runs as root.

-- 
  Dan Langille
  da...@la...

Re: [Openvpn-users] logs entries not as openvpn user

[Jan J. K. <jan...@gm...>]

Hi Dan,

On 08/09/2025 23:28, Dan Langille wrote:
> On Mon, Sep 8, 2025, at 4:38 PM, Gert Doering wrote:
>> Hi,
>>
>> On Mon, Sep 08, 2025 at 04:24:48PM -0400, Dan Langille wrote:
>>> I'm using openvpn-2.6.14 on FreeBSD 14.2
>>>
>>> I've noticed these log entries:
>>>
>>> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /usr/local/etc/openvpn/ccd/pro06.int.example.org
>>> Sep  8 18:32:02 gw01 foo[38754]: pro06.int.example.org connected with IP 10.0.0.10
>>> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_7e069917a782727053dbfb713ff7e3d6.tmp
>>>
>>> Why would the second entry be running as user foo?
>> Ignore my previous mail, I was assuming "this is an openvpn log prefix",
>> but that's on the other side of "name[pid]:".
>>
>> So this is from a different process than openvpn (pid=63572).  No idea
>> what is running there - do a "ps axwu |grep 38754" to find out...
> The processes appear to be short-lived. I think I know why:
>
> client-connect    /usr/local/sbin/serverlocal-events.sh
> client-disconnect /usr/local/sbin/serverlocal-events.sh
>
>
> # ls -l /usr/local/sbin/serverlocal-events.sh
> -rwxr-xr-x  1 root wheel 395 Sep  5 19:22 /usr/local/sbin/serverlocal-events.sh
>
> # cat /usr/local/sbin/serverlocal-events.sh
> #!/bin/sh
>
> # Taken fromhttps://forums.openvpn.net/viewtopic.php?t=43899
>
> # Executed on the server side for client connect and disconnect events.
>
> # Log client connect or disconnect event with IP address
>
> case "$script_type" in
>    client-connect)
>      logger "$common_name connected with IP $trusted_ip"
>      ;;
>
>    client-disconnect)
>      logger "$common_name disconnected with IP $trusted_ip"
> esac
>
> That's the script which produces the foo entry. I see no reason for it to run as foo.
>

does your openvpn configuration file itself contains an entry similar to

   user foo
   group foo

?  when the client-connect script is run, OpenVPN has switched to 
whatever user you specify there.

HTH,

JJK

Re: [Openvpn-users] logs entries not as openvpn user

[Jochen B. <Joc...@bi...>]

On 09.09.25 07:32, Gert Doering wrote:
> According to "man logger", this is what is running under...
> 
>       -t tag  Mark every line in the log with the specified tag rather than the
>               default of current login name.  Use -t tag[N] to insert specific
>               decimal process id instead of id of logger.
> 
> ... but it could be a double uid in /etc/passwd
I'd recommend to have the lines in the helper script changed to look 
like, e.g.,

logger -t serverlocal-events -p auth.info --id=$$ -- "$common_name ..."

because
a) as you noticed, naming the script/service is usually more specific
    than the user(id) it's run under ;-)
b) adapt the "-p" so that the lines appear wherever they're the easiest
    to find / correlate with OpenVPN's usual log output
c) "--id=$$" is probably still useless in this context, but logging the
    PID of the "logger" command/child run from a shell script is pretty
    much *guaranteed* to *always* be useless
d) "--" to guard against $common_name starting with a "-"

Kind regards,
-- 
Jochen Bern
Systemingenieur

Binect GmbH

Re: [Openvpn-users] logs entries not as openvpn user

[Gert D. <ge...@gr...>]

Hi,

On Mon, Sep 08, 2025 at 05:28:38PM -0400, Dan Langille wrote:
> >> Sep  8 18:32:02 gw01 foo[38754]: pro06.int.example.org connected with IP 10.0.0.10
[..]
> That's the script which produces the foo entry. I see no reason for it to run as foo.

According to "man logger", this is what is running under...

     -t tag  Mark every line in the log with the specified tag rather than the
             default of current login name.  Use -t tag[N] to insert specific
             decimal process id instead of id of logger.

... but it could be a double uid in /etc/passwd - so if you have set
openvpn trun as "user bar", and foo+bar share the same uid, the reverse
mapping done by logger ("what user am I running under?") might end up
showing "foo".

I'd add a call

  logger "my id: `id -a`"

to see what it has to say...

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

Re: [Openvpn-users] logs entries not as openvpn user

[Dan L. <da...@la...>]

On Mon, Sep 8, 2025, at 4:38 PM, Gert Doering wrote:
> Hi,
>
> On Mon, Sep 08, 2025 at 04:24:48PM -0400, Dan Langille wrote:
>> I'm using openvpn-2.6.14 on FreeBSD 14.2
>> 
>> I've noticed these log entries:
>> 
>> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /usr/local/etc/openvpn/ccd/pro06.int.example.org
>> Sep  8 18:32:02 gw01 foo[38754]: pro06.int.example.org connected with IP 10.0.0.10
>> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_7e069917a782727053dbfb713ff7e3d6.tmp
>> 
>> Why would the second entry be running as user foo?
>
> Ignore my previous mail, I was assuming "this is an openvpn log prefix",
> but that's on the other side of "name[pid]:".
>
> So this is from a different process than openvpn (pid=63572).  No idea
> what is running there - do a "ps axwu |grep 38754" to find out...

The processes appear to be short-lived. I think I know why:

client-connect    /usr/local/sbin/serverlocal-events.sh
client-disconnect /usr/local/sbin/serverlocal-events.sh


# ls -l /usr/local/sbin/serverlocal-events.sh
-rwxr-xr-x  1 root wheel 395 Sep  5 19:22 /usr/local/sbin/serverlocal-events.sh

# cat /usr/local/sbin/serverlocal-events.sh
#!/bin/sh

# Taken from https://forums.openvpn.net/viewtopic.php?t=43899

# Executed on the server side for client connect and disconnect events.

# Log client connect or disconnect event with IP address

case "$script_type" in
  client-connect)
    logger "$common_name connected with IP $trusted_ip"
    ;;

  client-disconnect)
    logger "$common_name disconnected with IP $trusted_ip"
esac

That's the script which produces the foo entry. I see no reason for it to run as foo.

-- 
  Dan Langille
  da...@la...

Re: [Openvpn-users] logs entries not as openvpn user

[Gert D. <ge...@gr...>]

Hi,

On Mon, Sep 08, 2025 at 04:24:48PM -0400, Dan Langille wrote:
> I'm using openvpn-2.6.14 on FreeBSD 14.2
> 
> I've noticed these log entries:
> 
> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /usr/local/etc/openvpn/ccd/pro06.int.example.org
> Sep  8 18:32:02 gw01 foo[38754]: pro06.int.example.org connected with IP 10.0.0.10
> Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_7e069917a782727053dbfb713ff7e3d6.tmp
> 
> Why would the second entry be running as user foo?

Ignore my previous mail, I was assuming "this is an openvpn log prefix",
but that's on the other side of "name[pid]:".

So this is from a different process than openvpn (pid=63572).  No idea
what is running there - do a "ps axwu |grep 38754" to find out...

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

Re: [Openvpn-users] logs entries not as openvpn user

[Gert D. <ge...@gr...>]

Hi,

On Mon, Sep 08, 2025 at 04:24:48PM -0400, Dan Langille wrote:
> Why would the second entry be running as user foo?

Is there something like --username-as-common-name involved=

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

[Openvpn-users] logs entries not as openvpn user

[Dan L. <da...@la...>]

Hello,

I'm using openvpn-2.6.14 on FreeBSD 14.2

I've noticed these log entries:

Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /usr/local/etc/openvpn/ccd/pro06.int.example.org
Sep  8 18:32:02 gw01 foo[38754]: pro06.int.example.org connected with IP 10.0.0.10
Sep  8 18:32:02 gw01 openvpn[63572]: pro06.int.example.org/10.0.0.10:64601 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_7e069917a782727053dbfb713ff7e3d6.tmp

Why would the second entry be running as user foo?

[20:21 gw01 dvl ~] % sudo grep -r foo /usr/local/etc/openvpn/ 
[20:21 gw01 dvl ~] % 

I don't see anything in the config related to foo. Nor owned by foo

[20:24 gw01 dvl ~] % sudo find /usr/local/etc/openvpn -uid foo
[20:24 gw01 dvl ~] % 

Ideas please.


-- 
  Dan Langille
  da...@la...

Re: [Openvpn-users] [Openvpn-devel] OpenVPN 2.7_beta1 released

[Gert D. <ge...@gr...>]

Hi,

On Thu, Sep 04, 2025 at 09:41:06PM +0300, Yuriy Darnobyt wrote:
> this is an early release build, it is not intended for production use.

It's not *that* bad, and I do use it on production :-)

So - we encourage you to try it out, maybe not on a super-critical system
but on a test server, and report back if it works well for you or pieces
keep falling off...

gert

-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

[Openvpn-users] OpenVPN 2.7_beta1 released

[Yuriy D. <yur...@op...>]

The OpenVPN community project team is proud to release OpenVPN 2.7_beta1.
This is the first Beta release for the feature release 2.7.0. As the Beta name implies 
this is an early release build, it is not intended for production use.

Feature changes since 2.7_alpha3:

- Introduction of route_redirect_gateway_ipv4 and _ipv6 env variables
- PUSH_UPDATE server support (via management interface)
- Rewrite of the management interface "bytecount" infastructure to better interact with DCO

Important bug fixes since 2.7_alpha3:

- Bugfixes in --dns-updown script for linux systems using resolvconf
- A large number of signed/unsigned related warnings have been fixed

The biggest noticeable difference in beta1 is the reformatting using
clang-format, leaving uncrustify as that wasn't stable across versions.

More details can be found in the Changes document:

<https://github.com/OpenVPN/openvpn/blob/master/Changes.rst>

Source code and Windows installers can be downloaded from our download page:

<https://openvpn.net/community-downloads/>

Packages for Debian, Ubuntu, Fedora, RHEL, and openSUSE are available in the various
official Community repositories:

<https://community.openvpn.net/Pages/OpenVPN%20software%20repos>

Kind regards,
Yuriy Darnobyt

Re: [Openvpn-users] How to reach the new openvpn forum?

[Bo B. <bo....@gm...>]

On Wed, 3 Sep 2025 14:28:10 +0200, Gert Doering <ge...@gr...> wrote:

>Hi,
>
>On Wed, Sep 03, 2025 at 10:51:29AM +0200, Bo Berglund wrote:
>> I have earlier been using the OpenVpn forum in parallel to the mail list, but
>> now when I try to use the forum for questions it seems like there is a new
>> forum...


>
>So, this is a typical problem of volunteers, efforts, and time...
>
>The first migration to "the new forum" was abandoned, because it did
>not work out properly.
>
>A new volunteer was found who went out - with support from OpenVPN Corp -
>to build a "new new forum", and migrate content from the old forum.
>
>I've been told that this was more problematic than expected (the migration
>tool was buggy, the database was too big and the new server OOMed, and
>more hurdles) but "it is progressing" and "there might be a new new forum
>Really Soon Now".
>
>(I'm not working on Forums, so I'm just relaying what was said in the
>IRC community meeting a few minutes ago)
>
>gert

Thanks, then I know I am not missing some crucial action.

In fact I tried posting a question in the "new forum" thread in the "old" forum
and it was processed and appeared there. So it is not closed down.

Anyways I will keep my questions in the mail list for the time being.

Again, thanks for the clarification!


-- 
Bo Berglund
Developer in Sweden

Re: [Openvpn-users] How to reach the new openvpn forum?

[Gert D. <ge...@gr...>]

Hi,

On Wed, Sep 03, 2025 at 10:51:29AM +0200, Bo Berglund wrote:
> I have earlier been using the OpenVpn forum in parallel to the mail list, but
> now when I try to use the forum for questions it seems like there is a new
> forum...

So, this is a typical problem of volunteers, efforts, and time...

The first migration to "the new forum" was abandoned, because it did
not work out properly.

A new volunteer was found who went out - with support from OpenVPN Corp -
to build a "new new forum", and migrate content from the old forum.

I've been told that this was more problematic than expected (the migration
tool was buggy, the database was too big and the new server OOMed, and
more hurdles) but "it is progressing" and "there might be a new new forum
Really Soon Now".

(I'm not working on Forums, so I'm just relaying what was said in the
IRC community meeting a few minutes ago)

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

[Openvpn-users] How to reach the new openvpn forum?

[Bo B. <bo....@gm...>]

I have earlier been using the OpenVpn forum in parallel to the mail list, but
now when I try to use the forum for questions it seems like there is a new
forum...

The forum I reached seems only to contain old postings, so I need to access the
new forum.
Where can I do that?

If I use the suggested URL: https://forums-new.openvpn.net/ I only get to an
error page.

If I instead use the URL https://forums.openvpn.net/ as suggested for
"eventually to be used address" I get to the old forum.

And I don't know how I can access my old account on the *new forum*.


-- 
Bo Berglund
Developer in Sweden

Re: [Openvpn-users] [ext] OpenVPN 2.7_alpha3 released

[Gert D. <ge...@gr...>]

Hi,

On Wed, Aug 13, 2025 at 06:25:18PM +0200, Gert Doering wrote:
> > /usr/libexec/openvpn/dns-updown: line 194: dns_server_1_address_*: invalid variable name
> > No DNS servers specified, refusing operation.
> > 2025-08-08 11:44:24 dns up command exited with status 0
> 
> Can you test this patch, please?
> 
> https://gerrit.openvpn.net/c/openvpn/+/1144

I found time to set up a VM with Debian Unstable, installed "resolvconf",
and tested this.  Without the patch, same error, with the patch, proper
DNS :-)

Merged to master, 2.7_beta1-to-be

commit 72a0e6f94f16a6dcfe2b445758d42dedaba11b92
Author: Heiko Hund <he...@is...>
Date:   Mon Aug 18 18:46:08 2025 +0200

    dns: fix systemd dns-updown script

    In the resolvconf part of the script there was one instance of a dynamic
    variable using _* left. The _* ones do not work as the regular ones, but
    only when you directly place them within ${!}, not indirectly using a
    variable.


gert

-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

Re: [Openvpn-users] [ext] OpenVPN 2.7_alpha3 released

[Gert D. <ge...@gr...>]

Hi,

On Fri, Aug 08, 2025 at 11:48:32AM +0200, Ralf Hildebrandt via Openvpn-users wrote:
> 2025-08-08 11:44:24 /usr/libexec/openvpn/dns-updown 
> setting DNS using resolvconf 
> /usr/libexec/openvpn/dns-updown: line 194: dns_server_1_address_*: invalid variable name
> No DNS servers specified, refusing operation.
> 2025-08-08 11:44:24 dns up command exited with status 0

Can you test this patch, please?

https://gerrit.openvpn.net/c/openvpn/+/1144

the shell trickery Heiko uses here is a bit beyond my pay grade - and
I haven't had time to setup my own 25.04 system "with resolvconf" yet
(holiday season...).

The basic problem here is that "dns_server_${n}_address_*" only works
in some contexts, but not in a variable assignment (or not in all
bash versions, or something).  So this is now solved differently.

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

[Openvpn-users] (no subject)

[Alireza F. <rad...@gm...>]

[Openvpn-users] (no subject)

[Alireza F. <rad...@gm...>]

[Openvpn-users] (no subject)

[Alireza F. <rad...@gm...>]

Re: [Openvpn-users] [ext] OpenVPN 2.7_alpha3 released

[Gert D. <ge...@gr...>]

Hi,

On Mon, Aug 11, 2025 at 10:04:18PM +0200, Ralf Hildebrandt wrote:
> > I guess "systemd-resolved" comes preinstalled
> 
> So I checked (25.04):
> 
> $ sudo apt install resolvconf
> Note, selecting 'systemd-resolved' instead of 'resolvconf'
> systemd-resolved is already the newest version (257.4-1ubuntu3.1).
> systemd-resolved set to manually installed.
> 
> :(
> 
> And alas, it doesn't work with systemd-resolved, but you do know that:
> 
> ...
> 2025-08-11 17:42:11 net_addr_v4_add: 172.29.0.2/21 dev tun0
> 2025-08-11 17:42:11 /usr/libexec/openvpn/dns-updown setting DNS using resolvconf

The interesting thing is that it thinks it's *not* using systemd-resolved,
because then it should print

        echo "setting DNS using resolvectl"

... which depends on

function do_resolved {
    [[ "$(readlink /etc/resolv.conf)" =~ systemd ]] || return 1


Mmmh.

(But Heiko is aware of the bug in the other method, so we should see
a bugfix soon...)

gert

-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...

Re: [Openvpn-users] [ext] OpenVPN 2.7_alpha3 released

[Ralf H. <Ral...@ch...>]

> I guess "systemd-resolved" comes preinstalled

So I checked (25.04):

$ sudo apt install resolvconf
Note, selecting 'systemd-resolved' instead of 'resolvconf'
systemd-resolved is already the newest version (257.4-1ubuntu3.1).
systemd-resolved set to manually installed.

:(

And alas, it doesn't work with systemd-resolved, but you do know that:

...
2025-08-11 17:42:11 net_addr_v4_add: 172.29.0.2/21 dev tun0
2025-08-11 17:42:11 /usr/libexec/openvpn/dns-updown setting DNS using resolvconf
/usr/libexec/openvpn/dns-updown: line 194: dns_server_1_address_*: invalid variable name
No DNS servers specified, refusing operation.
2025-08-11 17:42:11 dns up command exited with status 0
2025-08-11 17:42:11 net_route_v4_add: 10.27.0.0/16 via 172.29.0.1 dev [NULL] table 0 metric 200
...

-- 
Ralf Hildebrandt
Charité - Universitätsmedizin Berlin
Geschäftsbereich IT | Abteilung Netz | Netzwerk-Administration
Invalidenstraße 120/121 | D-10115 Berlin

Tel. +49 30 450 570 155
ral...@ch...
https://www.charite.de

Re: [Openvpn-users] [ext] OpenVPN 2.7_alpha3 released

[Ralf H. <Ral...@ch...>]

* Gert Doering <ge...@gr...>:

> I have no idea, but indeed, that seems to be the solution (plus 
> possibly "apt purge systemd-resolved").  I wasn't aware that this
> part of the systemd zoo was entirely optional.

I guess "systemd-resolved" comes preinstalled

> Since I shy away from learning details about anything-systemd, I just
> didn't know - my Ubuntus come with systemd-resolvd by default, so that's
> what I tested...

-- 
Ralf Hildebrandt
Charité - Universitätsmedizin Berlin
Geschäftsbereich IT | Abteilung Netz | Netzwerk-Administration
Invalidenstraße 120/121 | D-10115 Berlin

Tel. +49 30 450 570 155
ral...@ch...
https://www.charite.de