systemd를 통해 Fedora 34에서 openvpn 클라이언트를 시작하는 방법은 무엇입니까?

systemd를 통해 Fedora 34에서 openvpn 클라이언트를 시작하는 방법은 무엇입니까?

그래서 Fedora 34에서 openvpn 클라이언트를 시작하는 데 문제가 있습니다.

터미널에서 이런게 나오네요

[root@mybox ~]# systemctl start openvpn-client@default
Job for [email protected] failed because the control process exited with error code.
See "systemctl status [email protected]" and "journalctl -xeu [email protected]" for details.
[root@mybox ~]# systemctl status openvpn-client@default
× [email protected] - OpenVPN tunnel for default
     Loaded: loaded (/usr/lib/systemd/system/[email protected]; disabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Mon 2021-08-09 18:35:01 AEST; 1s ago
       Docs: man:openvpn(8)
             https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
             https://community.openvpn.net/openvpn/wiki/HOWTO
    Process: 3970 ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf (code=exited, status=1/FAILURE)
   Main PID: 3970 (code=exited, status=1/FAILURE)
        CPU: 23ms

Aug 09 18:35:01 mybox systemd[1]: Starting OpenVPN tunnel for default...
Aug 09 18:35:01 mybox openvpn[3970]: Options error: In [CMD-LINE]:1: Error opening configuration file: default.conf
Aug 09 18:35:01 mybox openvpn[3970]: Use --help for more information.
Aug 09 18:35:01 mybox systemd[1]: [email protected]: Main process exited, code=exited, status=1/FAILURE
Aug 09 18:35:01 mybox systemd[1]: [email protected]: Failed with result 'exit-code'.
Aug 09 18:35:01 mybox systemd[1]: Failed to start OpenVPN tunnel for default.
[root@mybox ~]#

내 구성 파일은 다음 위치에 있습니다.

root@mybox client]# ls -al
total 12
drwxr-x---. 1 root openvpn   60 Aug  9 03:47 .
drwxr-xr-x. 1 root root      60 Aug  9 03:47 ..
-rw-r--r--. 1 root openvpn 1818 Dec  8  2020 ca.crt
-rw-------. 1 root openvpn   23 Dec  8  2020 .credentials
-rw-r--r--. 1 root openvpn  535 Aug  9 03:55 default.conf
[root@mybox client]# pwd
/etc/openvpn/client

default.conf의 내용은 다음과 같습니다.

[root@mybox client]# cat default.conf 
client
remote usa.my-vpn-server-here.com 1194 udp
remote usa.my-vpn-server-here.com 443 tcp-client

comp-lzo adaptive
ca /etc/openvpn/client/ca.crt
dev tun
tls-client
script-security 2
cipher AES-256-CBC
mute 10

route-delay 5
redirect-gateway def1
resolv-retry infinite
persist-key
persist-tun
remote-cert-tls server
mssfix

auth-user-pass /etc/openvpn/client/.credentials
auth-nocache

시스템화된 서비스입니다.

로그에서 뭔가를 얻을 수 있기를 바라며 "--verbose 9 --log /var/log/openvpn.log"를 추가했습니다. 그러나 "systemctl start"를 실행한 후에도 /var/log/openvpn.log가 존재하지 않습니다. 또한 서비스 파일을 편집한 후 "systemctl daemon-reload"를 실행하고 있습니다.

[Unit]
Description=OpenVPN tunnel for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/client
ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process

[Install]
WantedBy=multi-user.target

"ExecStart"의 값을 사용하여 openvpn을 수동으로 시작하면 오류가 발생하지 않습니다.

[root@mybox client]# /usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf --verb 9 --log /var/log/openvpn.log
WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
^C[root@mybox client]# /usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf
WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
OpenVPN 2.5.3 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 18 2021
library versions: OpenSSL 1.1.1k  FIPS 25 Mar 2021, LZO 2.10
TCP/UDP: Preserving recently used remote address: [AF_INET]24.123.153.76:1194
UDP link local: (not bound)
UDP link remote: [AF_INET]24.123.153.76:1194
[my-vpn-server-here.com] Peer Connection Initiated with [AF_INET]24.123.153.76:1194
WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
TUN/TAP device tun0 opened
net_iface_mtu_set: mtu 1500 for tun0
net_iface_up: set tun0 up
net_addr_v4_add: 24.123.0.47/16 dev tun0
Initialization Sequence Completed

어떤 아이디어가 잘못될 수 있나요? 감사해요!


업데이트 1:

  1. 테스트로 Fedora 구성(인증서 + .conf + 자격 증명) 파일을 Manjaro 라이브 USB에 복사했습니다. pacman을 통해 openvpn을 설치하고 아무 문제 없이 systemd를 통해 OpenVPN을 시작했습니다.
  2. 또 다른 테스트로 Manjaro 라이브 USB의 .service 파일을 Fedora 설정으로 복사하고 Fedora를 교체했습니다.[이메일 보호됨]그리고 여전히 systemd를 통해 OpenVPN을 시작할 수 없습니다.

답변1

제 경우에는 를 실행하여 문제가 해결되었습니다 fixfiles -R /etc/openvpn restore. 파일을 다른 곳에서 복사했는데, 뭔가(SELinux?) 문제가 생겼을 수도 있습니다.

Fedora를 처음 실행해봤습니다.

관련 정보