OpenVPN and chroot jail

ajratcliffe · 2011-10-25 23:06:10

Hello,

I'm new to archlinux having been a Ubuntu user for many years. I got fed up of every Ubuntu release breaking my OpenVPN server, so I made the move to archlinux, looking for something more stable and fun.

I've set up an OpenVPN server and client so that I can access my home network when i'm out and about - this is working fine and I have no trouble with the initial setup, however when researching how to secure the server better the OpenVPN docs pointed me to the 'chroot jail' directive. I've spent all evening trying to work it out, trying both chroot /var/run/openvpn and chroot /etc/openvpn/jail, among other weird settings, but with all attempts my client refuses to connect to the server - it doesn't even get past handshaking.

Here is my server conf file:

#--server.home OpenVPN Configuration File

#network/interfaces
port 1194
proto udp
dev tap

#certs/keys
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.home.crt
key /etc/openvpn/easy-rsa/keys/server.home.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0

#vpn
server 10.0.16.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.0.0.2"
push "dhcp-option DOMAIN home"
push "redirect-gateway def1"
keepalive 10 120
cipher AES-256-CBC
#comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
keysize 256
username-as-common-name
user nobody
group nobody
reneg-sec 0

#pam/auth/modules
plugin /usr/lib/openvpn/openvpn-auth-pam.so login

#unused
#chroot /etc/openvpn/jail
#mlock

I'm hoping that a kind person here will be able to point me in the right direction!

Thanks in advance!

synthead · 2011-10-26 01:53:20

I must ask: what are you looking for in a chroot? Are we talking about having a restricted shell account, a user locked to SFTP, or something else?

Also, what are your needs with how OpenVPN interacts with that chroot? Are you trying to run OpenVPN inside a chroot, looking to forward all your OpenVPN clients to a chroot, or something else there too?

ajratcliffe · 2011-10-26 08:02:14

Sorry, I didn't do a good job of explaining! I'm looking for the daemon to be locked into that directory after initialisation, so that if it were compromised then no damage could be done.

This is what the OpenVPN howto says (it probably explains it better):

The chroot directive allows you to lock the OpenVPN daemon into a so-called chroot jail, where the daemon would not be able to access any part of the host system's filesystem except for the specific directory given as a parameter to the directive. For example,
chroot jail
would cause the OpenVPN daemon to cd into the jail subdirectory on initialization, and would then reorient its root filesystem to this directory so that it would be impossible thereafter for the daemon to access any files outside of jail and its subdirectory tree. This is important from a security perspective, because even if an attacker were able to compromise the server with a code insertion exploit, the exploit would be locked out of most of the server's filesystem.

Hope that helps,

Thanks!

ajratcliffe · 2011-10-27 00:08:31

After some more research i've gone through the logs and have found a possible cause but I'm still unsure as to how to fix it. When chroot is disabled (ie removed from the config file) the daemon.log shows the following ouput.

Oct 27 00:57:40 localhost openvpn[2129]: OpenVPN 2.2.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on Aug 13 2011
Oct 27 00:57:40 localhost openvpn[2129]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Oct 27 00:57:40 localhost openvpn[2129]: PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-auth-pam.so '[/usr/lib/openvpn/openvpn-auth-pam.so] [login]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY 
Oct 27 00:57:40 localhost openvpn[2129]: Diffie-Hellman initialized with 2048 bit key
Oct 27 00:57:40 localhost openvpn[2129]: Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Oct 27 00:57:40 localhost openvpn[2129]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 27 00:57:40 localhost openvpn[2129]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 27 00:57:40 localhost openvpn[2129]: TLS-Auth MTU parms [ L:1589 D:166 EF:66 EB:0 ET:0 EL:0 ]
Oct 27 00:57:40 localhost openvpn[2129]: Socket Buffers: R=[114688->131072] S=[114688->131072]
Oct 27 00:57:40 localhost openvpn[2129]: TUN/TAP device tap0 opened
Oct 27 00:57:40 localhost openvpn[2129]: TUN/TAP TX queue length set to 100
Oct 27 00:57:40 localhost openvpn[2129]: /usr/sbin/ip link set dev tap0 up mtu 1500
Oct 27 00:57:40 localhost openvpn[2129]: /usr/sbin/ip addr add dev tap0 10.0.16.1/24 broadcast 10.0.16.255
Oct 27 00:57:40 localhost openvpn[2129]: Data Channel MTU parms [ L:1589 D:1450 EF:57 EB:4 ET:32 EL:0 ]
Oct 27 00:57:40 localhost openvpn[2133]: GID set to nobody
Oct 27 00:57:40 localhost openvpn[2133]: UID set to nobody
Oct 27 00:57:40 localhost openvpn[2133]: UDPv4 link local (bound): [undef]:7094
Oct 27 00:57:40 localhost openvpn[2133]: UDPv4 link remote: [undef]
Oct 27 00:57:40 localhost openvpn[2133]: MULTI: multi_init called, r=256 v=256
Oct 27 00:57:40 localhost openvpn[2133]: IFCONFIG POOL: base=10.0.16.2 size=253
Oct 27 00:57:40 localhost openvpn[2133]: IFCONFIG POOL LIST
Oct 27 00:57:40 localhost openvpn[2133]: aratclif,10.0.16.2
Oct 27 00:57:40 localhost openvpn[2133]: Initialization Sequence Completed

When I re-add the chroot /etc/openvpn, the following happens:

Oct 27 01:03:39 localhost openvpn[2244]: OpenVPN 2.2.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on Aug 13 2011
Oct 27 01:03:39 localhost openvpn[2244]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Oct 27 01:03:39 localhost openvpn[2244]: PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-auth-pam.so '[/usr/lib/openvpn/openvpn-auth-pam.so] [login]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY 
Oct 27 01:03:39 localhost openvpn[2244]: Diffie-Hellman initialized with 2048 bit key
Oct 27 01:03:39 localhost openvpn[2244]: Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Oct 27 01:03:39 localhost openvpn[2244]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 27 01:03:39 localhost openvpn[2244]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 27 01:03:39 localhost openvpn[2244]: TLS-Auth MTU parms [ L:1589 D:166 EF:66 EB:0 ET:0 EL:0 ]
Oct 27 01:03:39 localhost openvpn[2244]: Socket Buffers: R=[114688->131072] S=[114688->131072]
Oct 27 01:03:39 localhost openvpn[2244]: TUN/TAP device tap0 opened
Oct 27 01:03:39 localhost openvpn[2244]: TUN/TAP TX queue length set to 100
Oct 27 01:03:39 localhost openvpn[2244]: /usr/sbin/ip link set dev tap0 up mtu 1500
Oct 27 01:03:39 localhost openvpn[2244]: /usr/sbin/ip addr add dev tap0 10.0.16.1/24 broadcast 10.0.16.255
Oct 27 01:03:39 localhost openvpn[2244]: Data Channel MTU parms [ L:1589 D:1450 EF:57 EB:4 ET:32 EL:0 ]
Oct 27 01:03:39 localhost openvpn[2248]: chroot to '/etc/openvpn' and cd to '/' succeeded
Oct 27 01:03:39 localhost openvpn[2248]: GID set to nobody
Oct 27 01:03:39 localhost openvpn[2248]: UID set to nobody
Oct 27 01:03:39 localhost openvpn[2248]: UDPv4 link local (bound): [undef]:7094
Oct 27 01:03:39 localhost openvpn[2248]: UDPv4 link remote: [undef]
Oct 27 01:03:39 localhost openvpn[2248]: MULTI: multi_init called, r=256 v=256
Oct 27 01:03:39 localhost openvpn[2248]: IFCONFIG POOL: base=10.0.16.2 size=253
Oct 27 01:03:39 localhost openvpn[2248]: IFCONFIG POOL LIST
Oct 27 01:03:39 localhost openvpn[2248]: aratclif,10.0.16.2
Oct 27 01:03:39 localhost openvpn[2248]: Initialization Sequence Completed
Oct 27 00:03:52 localhost openvpn[2248]: MULTI: multi_create_instance called
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Re-using SSL/TLS context
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Control Channel MTU parms [ L:1589 D:166 EF:66 EB:0 ET:0 EL:0 ]
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Data Channel MTU parms [ L:1589 D:1450 EF:57 EB:4 ET:32 EL:0 ]
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Local Options hash (VER=V4): '1490c6e9'
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Expected Remote Options hash (VER=V4): '1f958c04'
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 TLS: Initial packet from 10.0.0.101:61573, sid=9cfafd7a 20c0d8fc

(Have removed some lines containing certificate info}

Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Could not create temporary file '/tmp/openvpn_acf_xyz.tmp': Permission denied
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Exiting
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Closing TUN/TAP interface
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 /usr/sbin/ip addr del dev tap0 10.0.16.1/24
Oct 27 00:03:52 localhost openvpn[2248]: 10.0.0.101:61573 Linux ip addr del failed: could not execute external program

Hopefully someone will be able to point me in the right direction!

Thanks!

Last edited by ajratcliffe (2011-10-27 23:42:54)

ajratcliffe · 2011-10-27 10:32:55

Okay, so I fixed the 'Linux ip addr del failed: could not execute external program' error by inserting 'script-security 2' into the server and client conf files, which enables OpenVPN to the successfully get to 'Re-using SSL/TLS context' but then the client just hangs.

On the client, this is shown in the log:

Oct 27 11:06:16: OpenVPN 2.2.1 x86_64-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Aug  1 2011
Oct 27 11:06:20: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Oct 27 11:06:20: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct 27 11:06:20: Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Oct 27 11:06:20: UDPv4 link local: [undef]
Oct 27 11:06:20: UDPv4 link remote: 10.0.0.49:7094
Oct 27 11:07:20: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Oct 27 11:07:20: TLS Error: TLS handshake failed
Oct 27 11:07:20: SIGUSR1[soft,tls-error] received, process restarting

The server does this weird thing of rolling the log time back an hour, then it repeats an error shown in the previous post even after having succeeded with the 'ip addr' commands.

Oct 27 11:21:53 localhost openvpn[2216]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 27 11:21:53 localhost openvpn[2216]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 27 11:21:53 localhost openvpn[2216]: TLS-Auth MTU parms [ L:1589 D:166 EF:66 EB:0 ET:0 EL:0 ]
Oct 27 11:21:53 localhost openvpn[2216]: Socket Buffers: R=[114688->131072] S=[114688->131072]
Oct 27 11:21:53 localhost openvpn[2216]: TUN/TAP device tap0 opened
Oct 27 11:21:53 localhost openvpn[2216]: TUN/TAP TX queue length set to 100
Oct 27 11:21:53 localhost openvpn[2216]: /usr/sbin/ip link set dev tap0 up mtu 1500
Oct 27 11:21:53 localhost openvpn[2216]: /usr/sbin/ip addr add dev tap0 10.0.16.1/24 broadcast 10.0.16.255
Oct 27 11:21:53 localhost openvpn[2216]: Data Channel MTU parms [ L:1589 D:1450 EF:57 EB:4 ET:32 EL:0 ]
Oct 27 11:21:53 localhost openvpn[2220]: chroot to '/etc/openvpn' and cd to '/' succeeded
Oct 27 11:21:53 localhost openvpn[2220]: GID set to nobody
Oct 27 11:21:53 localhost openvpn[2220]: UID set to nobody
Oct 27 11:21:53 localhost openvpn[2220]: UDPv4 link local (bound): [undef]:7094
Oct 27 11:21:53 localhost openvpn[2220]: UDPv4 link remote: [undef]
Oct 27 11:21:53 localhost openvpn[2220]: MULTI: multi_init called, r=256 v=256
Oct 27 11:21:53 localhost openvpn[2220]: IFCONFIG POOL: base=10.0.16.2 size=253
Oct 27 11:21:53 localhost openvpn[2220]: IFCONFIG POOL LIST
Oct 27 11:21:53 localhost openvpn[2220]: aratclif,10.0.16.2
Oct 27 11:21:53 localhost openvpn[2220]: Initialization Sequence Completed
Oct 27 10:22:39 localhost openvpn[2220]: MULTI: multi_create_instance called
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Re-using SSL/TLS context
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Control Channel MTU parms [ L:1589 D:166 EF:66 EB:0 ET:0 EL:0 ]
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Data Channel MTU parms [ L:1589 D:1450 EF:57 EB:4 ET:32 EL:0 ]
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Local Options hash (VER=V4): '1490c6e9'
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Expected Remote Options hash (VER=V4): '1f958c04'
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 TLS: Initial packet from 10.0.0.220:63769, sid=d4a93e3d b1e9c322

(Certificates verified ok here, removed the lines)

Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Could not create temporary file '/tmp/openvpn_acf_xyz.tmp': Permission denied
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Exiting
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Closing TUN/TAP interface
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 /usr/sbin/ip addr del dev tap0 10.0.16.1/24
Oct 27 10:22:39 localhost openvpn[2220]: 10.0.0.220:63769 Linux ip addr del failed: could not execute external program

I'm really confused now!!

Last edited by ajratcliffe (2011-10-27 23:42:02)

ajratcliffe · 2011-10-27 23:46:38

Just to update:

I've added the 'mlock' and 'chroot /etc/openvpn' together which removes the need to store to /tmp, hence removing the errors shown. The timezone shift in the log was caused by the lack of /etc/localtime within the chroot directory (/etc/openvpn).

The connection however hangs at both client and server showing "Re-using SSL/TLS context" and I can't work that one out at all.

Any help would be greatly appreciated!

Arch Linux

#1 2011-10-25 23:06:10

OpenVPN and chroot jail

#2 2011-10-26 01:53:20

Re: OpenVPN and chroot jail

#3 2011-10-26 08:02:14

Re: OpenVPN and chroot jail

#4 2011-10-27 00:08:31

Re: OpenVPN and chroot jail

#5 2011-10-27 10:32:55

Re: OpenVPN and chroot jail

#6 2011-10-27 23:46:38

Re: OpenVPN and chroot jail

Board footer