Ubuntu 23.10 - Failed to execute program net.openvpn.v3.sessions: Permission denied

[Marietto2008]

Hello.

I cannot figure out how it's possible that I'm getting "permission denied" as root (and as a normal user) when I launch openvpn3 on Ubuntu 23.10 :

$ openvpn3 session-start --dco true --config vpn.aus.imthebestvpn.net.ovpn  

** ERROR ** 

Failed preparing proxy:
Error calling StartServiceByName for net.openvpn.v3.sessions:              
Failed to execute program net.openvpn.v3.sessions: Permission denied 

I'm using this version of openvpn3 :

OpenVPN3/Linux v21 (openvpn3) 
OpenVPN core v3.8.2 linux x86_64 64-bit 
Copyright (C) 2012-2022 OpenVPN Inc. All rights reserved. 

Something might be missing execute permission, but I cannot figure out from this error message what that might be. In any event, I followed the installation instructions exactly as written so I'm at a loss. Any suggestions on where to begin troubleshooting this ? Since this error is similar to this one :

#99

I will post the same informations that you asked on that post :

# cat /usr/share/dbus-1/system-services/net.openvpn.v3.configuration.service

[D-BUS Service]
Name=net.openvpn.v3.configuration
User=openvpn
Exec=/usr/libexec/openvpn3-linux/openvpn3-service-configmgr --state-dir "/var/lib/openvpn3/configs"

ls -ltr /usr/libexec/openvpn3-linux/openvpn3-service-configmgr
-rwxr-xr-x 1 root root 342600 ott  6 12:27 /usr/libexec/openvpn3-linux/openvpn3-service-configmgr

$ ls -ltr /usr/libexec/openvpn3-linux/

total 3404
-rwxr-xr-x 1 root root   12749 ott  6 12:27 openvpn3-systemd
-rwxr-xr-x 1 root root  326544 ott  6 12:27 openvpn3-service-sessionmgr
-rwxr-xr-x 1 root root  695288 ott  6 12:27 openvpn3-service-netcfg
-rwxr-xr-x 1 root root  326184 ott  6 12:27 openvpn3-service-logger
-rwxr-xr-x 1 root root  342600 ott  6 12:27 openvpn3-service-configmgr
-rwxr-xr-x 1 root root 1621528 ott  6 12:27 openvpn3-service-client
-rwxr-xr-x 1 root root  150024 ott  6 12:27 openvpn3-service-backendstart

$ /usr/libexec/openvpn3-linux/openvpn3-service-configmgr

OpenVPN3/Linux v21 (openvpn3-service-configmgr)
OpenVPN core v3.8.2 linux x86_64 64-bit
Copyright (C) 2012-2022 OpenVPN Inc. All rights reserved.
** ERROR ** Could not connect to net.openvpn.v3.log service
            Failed preparing proxy: Error calling StartServiceByName for net.openvpn.v3.log: Failed to execute program net.openvpn.v3.log: Permission denied

sudo /usr/libexec/openvpn3-linux/openvpn3-service-configmgr

[sudo] password for ziomario: 
[INFO] Dropping root group privileges to openvpn
[INFO] Dropping root user privileges to openvpn
OpenVPN3/Linux v21 (openvpn3-service-configmgr)
OpenVPN core v3.8.2 linux x86_64 64-bit
Copyright (C) 2012-2022 OpenVPN Inc. All rights reserved.
** ERROR ** Could not connect to net.openvpn.v3.log service
            Failed preparing proxy: Error calling StartServiceByName for net.openvpn.v3.log: Failed to execute program net.openvpn.v3.log: Permission denied

$ /usr/libexec/openvpn3-linux/openvpn3-service-logger --service --idle-exit 0 --state-dir /var/lib/openvpn3 --log-level 6

 Logger INFO: OpenVPN3/Linux v21 (openvpn3-service-logger)
OpenVPN core v3.8.2 linux x86_64 64-bit
Copyright (C) 2012-2022 OpenVPN Inc. All rights reserved.
 Logger INFO: Log method: StreamWriter
terminate called after throwing an instance of 'DBusException'
  what():  openvpn3-service-logger could not register 'net.openvpn.v3.log'
Aborted

$ sudo /usr/libexec/openvpn3-linux/openvpn3-service-logger --service --idle-exit 0 --state-dir /var/lib/openvpn3 --log-level 6
[INFO] Dropping root group privileges to openvpn
[INFO] Dropping root user privileges to openvpn
OpenVPN3/Linux v21 (openvpn3-service-logger)
OpenVPN core v3.8.2 linux x86_64 64-bit
Copyright (C) 2012-2022 OpenVPN Inc. All rights reserved.
Log method: journald

[dsommers]

First a heads-up; OpenVPN 3 Linux on Ubuntu 23.10 is currently not stable - and in many cases - not functional at all. This is related to the issues in #171. I am fully focused on resolving that first. It might be that there are further changes in 23.10 which makes the current glib2 implementation fail as well.

I will follow up on this ticket once the work on #171 is ready for more widely testing.

[Marietto2008]

Isn't there supposed to be a service file like this ?

openvpn3-linux/src/service-autostart/net.openvpn.v3.sessions.service.in

Line 9 in edf113b

[D-BUS Service]

I don't know why it is not there. Anyway,I've created this service file on /usr/lib/systemd/user :

net.openvpn.v3.sessions.service :

[D-BUS Service] 
Name=net.openvpn.v3.sessions
User=@[email protected]@
Exec=@LIBEXEC_PATH@/openvpn3-service-sessionmgr

now,what should I do ?

[dsommers]

There are two types of .service files. It's the systemd unit files which you refer to. And it is the D-Bus auto-start service files. While systemd can interact with the D-Bus daemon on in regards service management, there are no requirements for this to be present.

What you need to do is to just wait; I'm working full time on a complete overhaul of the D-Bus implementation to make it run well with glib2-2.76 and newer. Ubuntu 23.10 ships with glib2-2.78. This is not expected to work due to glib2 is now behaving slightly differently under the hood, which makes the glib2 integration layer in OpenVPN 3 Linux misbehave very badly.

[app-z]

Hi
The same issue on 23.10
Any news? At least solution

[Marietto2008]

I changed os (from linux to FreeBSD) and the problem has gone ;) Il lun 1 gen 2024, 22:04 appz ***@***.***> ha scritto:

…

Hi The same issue on 23.10 Any news? At least solution — Reply to this email directly, view it on GitHub <#214 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFYNCZIAAXN3M5GHZ32B3DYMMQEHAVCNFSM6AAAAAA7LAKOXWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNZTGQ3TSNBWGY> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[diman82]

@Marietto2008 Can you please share how you managed to install the client at all on 23.10?
Repositories are not yet released, so haven't managed to install it (the official way)..

[dsommers]

@diman82 Can you please try the development snapshot? Details here: #171 (comment)

If that works, we can probably close this ticket.

[diman82]

@dsommers Can confirm all works like a charm, thanks!

[dsommers]

Thanks! Closing this one. Please re-open if there are other issues related to net.openvpn.v3.sessions.

[Marietto2008]

Here on github I see the bad habit to close the tickets very soon,before to have reached a good number of positive reviews. I think it's not good. Anyway,it does not still work for me with Ubuntu 23.10 :

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scrivania# sudo add-apt-repository ppa:djpig/openvpn

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scrivania# sudo apt update

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scrivania# sudo apt upgrade

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scrivania# openvpn3 session-start --dco true --config vpn.aus.iamthebestvpn.net.ovpn  

** ERROR ** Failed preparing proxy: Error calling StartServiceByName for net.openvpn.v3.sessions: Failed to execute program net.openvpn.v3.sessions: Permission denied

[dsommers]

@Marietto2008 How did you install OpenVPN 3 Linux?

If you have modified the net.openvpn.v3.sessions.service file, ensure you completely uninstall the openvpn3 packages completely first. Ensure you don't have any traces of it in /usr/share/dbus-1 (find /usr/share/dbus-1 -type f -name "net.openvpn.*") ... and re-install it using sudo apt install openvpn3.

If you have modified any of the .service files like you described in your comment, it will definitely break.

Once re-installed, please provide the contents of /var/lib/openvpn3/openvpn3-init-config.log.

Also, since you had a reply where you said you had switched to FreeBSD, I took your words for it and expected you were no longer interested in this project.

[Marietto2008]

Same error as before :

root@Z390:/usr/lib/systemd/user# openvpn3 session-start --dco true --config vpn.aus.iamthebestvpn.net.ovpn

** ERROR ** Failed preparing proxy: Error calling StartServiceByName for net.openvpn.v3.sessions: Failed to execute program net.openvpn.v3.sessions: Permission denied

What should be the content of this file ? ---> net.openvpn.v3.sessions.service

because actually I have renamed it to net.openvpn.v3.sessions.service_ since I hadn't any content inside it.

nano /var/lib/openvpn3/openvpn3-init-config.log

** openvpn3-admin init-config start -- Sun Nov 12 11:52:10 PM CET 2023
- Detected settings will be saved to disk? YES
- Existing configurations will be preserved

* Checking for OpenVPN user and group accounts
    Found:  openvpn user - uid 144
    Found:  openvpn group - gid 153

* Checking OpenVPN 3 Linux state/configuration directory
    Using directory: /var/lib/openvpn3
    Directory found

* Logger Configuration
    Configuration file: /var/lib/openvpn3/log-service.json
    systemd-journald active state: active
    :: Result ::  Will use systemd journald for logging
    Configuration saved

* Network Configuration
    Configuration file: /var/lib/openvpn3/netcfg.json
    Found systemd-resolved
    Found accessible /etc/resolv.conf
    Parsing /etc/resolv.conf ... Done
    Found systemd-resolved configured (127.0.0.53) in /etc/resolv.conf 
    :: Result :: Will use systemd-resolved
    Configuration saved

* Ensuring SELinux file labels are correct
    - Could not retrieve SELinux status; skipping
** openvpn3-admin init-config done (exit-code: 0)

** openvpn3-admin init-config start -- Mon Jan 29 04:12:31 PM CET 2024
- Detected settings will be saved to disk? YES
- Existing configurations will be preserved

* Checking for OpenVPN user and group accounts
    Found:  openvpn user - uid 144
    Found:  openvpn group - gid 153

* Checking OpenVPN 3 Linux state/configuration directory
    Using directory: /var/lib/openvpn3
    Directory found

* Logger Configuration
    Configuration file: /var/lib/openvpn3/log-service.json
    systemd-journald active state: active
    :: Result ::  Will use systemd journald for logging
    !! Will not overwrite existing configuration file
    !! Configuration UNCHANGED

* Network Configuration
    Configuration file: /var/lib/openvpn3/netcfg.json
    Found systemd-resolved
    Found accessible /etc/resolv.conf
    Parsing /etc/resolv.conf ... Done
    Found systemd-resolved configured (127.0.0.53) in /etc/resolv.conf 
    :: Result :: Will use systemd-resolved
    !! Will not overwrite existing configuration file
    !! Configuration UNCHANGED

* Ensuring SELinux file labels are correct
    - Could not retrieve SELinux status; skipping
** openvpn3-admin init-config done (exit-code: 0)

** openvpn3-admin init-config start -- Tue Jan 30 12:10:53 PM CET 2024
- Detected settings will be saved to disk? YES
- Existing configurations will be preserved

* Checking for OpenVPN user and group accounts
    Found:  openvpn user - uid 144
    Found:  openvpn group - gid 153

* Checking OpenVPN 3 Linux state/configuration directory
    Using directory: /var/lib/openvpn3
    Directory found

* Logger Configuration
    Configuration file: /var/lib/openvpn3/log-service.json
    systemd-journald active state: active
    :: Result ::  Will use systemd journald for logging
    !! Will not overwrite existing configuration file
    !! Configuration UNCHANGED

* Network Configuration
    Configuration file: /var/lib/openvpn3/netcfg.json
    Found systemd-resolved
    Found accessible /etc/resolv.conf
    Parsing /etc/resolv.conf ... Done
    Found systemd-resolved configured (127.0.0.53) in /etc/resolv.conf 
    :: Result :: Will use systemd-resolved
    !! Will not overwrite existing configuration file
    !! Configuration UNCHANGED

* Ensuring SELinux file labels are correct
    - Could not retrieve SELinux status; skipping
** openvpn3-admin init-config done (exit-code: 0)

I use both the Oses,Linux and FreeBSD.

[dsommers]

What should be the content of this file ?

net.openvpn.v3.sessions.service

This file is shipped by the openvpn3 package. It should be exactly what that package uses. That differs slightly between each Linux distribution. But typically something along these lines:

 [D-BUS Service]
 Name=net.openvpn.v3.sessions
 User=openvpn
 Exec=/usr/libexec/openvpn3-linux/openvpn3-service-sessionmgr

Please try to enable sh or bash on the openvpn user account, and try to start the command below as the openvpn user in a terminal. What does that give as output?

 $ /usr/libexec/openvpn3-linux/openvpn3-service-sessionmgr --log-level 6 --log-file stdout: --idle-exit 0

If it does not give any errors, try to start a VPN session - but try first without DCO.

[Marietto2008]

---> Please try to enable sh or bash on the openvpn user account

how ?

[Marietto2008]

root@Z390:/usr/lib/systemd/user# /usr/libexec/openvpn3-linux/openvpn3-service-sessionmgr --log-level 6 --log-file stdout: --idle-exit 0

[INFO] Dropping root group privileges to openvpn
[INFO] Dropping root user privileges to openvpn
OpenVPN3/Linux v21 (openvpn3-service-sessionmgr)
OpenVPN core v3.8.2 linux x86_64 64-bit
Copyright (C) 2012-2022 OpenVPN Inc. All rights reserved.
** ERROR ** Could not connect to net.openvpn.v3.log service
            Failed preparing proxy: Error calling StartServiceByName for net.openvpn.v3.log: Failed to execute program net.openvpn.v3.log: Permission denied

[Marietto2008]

Anyway I want to create a thread on the Ubuntu forums to ask if my Ubuntu 23.04 is broken like you think it is. And for sure,how to fix it without destroying the system.

[dsommers]

You can do:

# sudo apt reinstall dbus

[Marietto2008]

Don't close the ticket. I can't reboot the PC for the next 3 days. Then I will tell you if reinstalling dbus worked or not.

[Marietto2008]

If it will not work when I will reboot,I have the plan B ready :

https://www.reddit.com/r/Ubuntu/comments/1afg5t2/ubuntu_2310_failed_to_execute_program/

[dsommers]

Just looked at your reddit post .... I don't understand how you managed to interpret my "reinstall dbus" as apt remove dbus. That will of course brick your system. The whole systemd stack depends on it.

I did a test changing the group ownership from messagebus to root.

# stat /usr/lib/dbus-1.0/dbus-daemon-launch-helper | grep Gid
Access: (4754/-rwsr-xr--)  Uid: (    0/    root)   Gid: (  109/messagebus)
# chgrp root /usr/lib/dbus-1.0/dbus-daemon-launch-helper
# chmod u+s /usr/lib/dbus-1.0/dbus-daemon-launch-helper
# stat /usr/lib/dbus-1.0/dbus-daemon-launch-helper | grep Gid
Access: (4754/-rwsr-xr--)  Uid: (    0/    root)   Gid: (    0/    root)
# openvpn3 configs-list
** ERROR ** Failed preparing proxy: Error calling StartServiceByName for net.openvpn.v3.configuration: Failed to execute program net.openvpn.v3.configuration: Permission denied

This is exactly the same error you get. From the log files:

Feb 01 08:04:16 devtest-ubu2304 dbus-daemon[700]: [system] Activated service 'net.openvpn.v3.configuration' failed: Failed to execute program net.openvpn.v3.configuration: Permission denied

And an strace gives the -1 EACCES (Permission denied) error.

Manually restoring it:

# chgrp messagebus /usr/lib/dbus-1.0/dbus-daemon-launch-helper
# chmod u+s /usr/lib/dbus-1.0/dbus-daemon-launch-helper
# stat /usr/lib/dbus-1.0/dbus-daemon-launch-helper | grep Gid
Access: (4754/-rwsr-xr--)  Uid: (    0/    root)   Gid: (  109/messagebus)
# openvpn3 configs-list
Configuration path
Imported                        Last used                 Used
Name                                                      Owner
------------------------------------------------------------------------------
/net/openvpn/v3/configuration/51aaec5bx645ax48c1xaea7xbd8898710e66
Mon Aug  7 18:50:53 2023        Sat Dec 16 18:49:58 2023  2
devtest-case1b                                            root
------------------------------------------------------------------------------

I still recommend REINSTALLING (not removing) the dbus package. I don't know which other files may have the wrong file attributes and ownership set on your system. And it might be you should reinstall even more packages.

But I'm closing this now. This is not an issue or bug related to openvpn3-linux.

[dsommers]

Just a note on the chgrp calls. That will reset the setuid flag, which is why it's needed to call chmod u+s.

Regardless, reinstalling the dbus package is the sane thing to do first.

[Marietto2008]

---> Just looked at your reddit post .... I don't understand how you managed to interpret my "reinstall dbus" as apt remove dbus. That will of course brick your system. The whole systemd stack depends on it.

Don't worry. I asked that question before you suggested that I could have used :

# sudo apt reinstall dbus

---> I did a test changing the group ownership from messagebus to root.

I'm really curious to understand what changed such setting, because I didn't do it intentionally.

[Marietto2008]

I made progress,but it still does not work :

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scaricati/VPN/personalVPNPro# openvpn3 session-start --dco true --config vpn.us.witopia.net.ovpn
Using configuration profile from file: vpn.us.witopia.net.ovpn
Session path: /net/openvpn/v3/sessions/dd7654bds5f85s4c21sbe87sa191d46c2927
session-start: ** ERROR ** Failed to connect: Connection, Client disconnected

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scaricati/VPN/personalVPNPro# openvpn3 session-start --config vpn.us.witopia.net.ovpn
Using configuration profile from file: vpn.us.witopia.net.ovpn
Session path: /net/openvpn/v3/sessions/667fc249s5780s431ds8aebs62e1e46ade3a
session-start: ** ERROR ** Failed to connect: Connection, Client disconnected

[dsommers]

Try starting the VPN session using the openvpn2 command ... what does that give you?

$ /usr/bin/openvpn2 --config vpn.us.witopia.net.ovpn --verb 6

[dsommers]

Also, what does this command give you?

$ sudo openvpn3-admin version --services

[Marietto2008]

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scrivania# sudo openvpn3-admin version --services
OpenVPN 3 D-Bus services:

  - Client backend starter service
     openvpn3-service-backendstart: flichtenheld_gdbuspp:d2eeccb9f73ee5e1

  - Configuration Service
     openvpn3-service-configmgr:    v21

  - Log Service
     openvpn3-service-logger:       v21

  - Network Configuration Service
     openvpn3-service-netcfg:       v21

  - Session Manager Service
     openvpn3-service-sessionmgr:   v21

[Marietto2008]

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scaricati/VPN/personalVPNPro# /usr/bin/openvpn2 --config vpn.us.witopia.net.ovpn --verb 6

** ERROR ** The following options are missing to establish  a connection: --client

[dsommers]

So it's a configuration file issue. Add a line client to the config file.

[Marietto2008]

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scaricati/VPN/personalVPNPro# /usr/bin/openvpn2 --config vpn.vs.witopia.net.ovpn --client --verb 6
Press CTRL-C to stop the connection

2024-02-01 19:30:04.366584 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CFG_OK) config_path=/net/openvpn/v3/configuration/8aaae961xfde6x4262xac61xc13fe07c6335
2024-02-01 19:30:04.366751 [LOG] Starting connection
2024-02-01 19:30:04.366870 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING) 
2024-02-01 19:30:04.562215 [LOG] Waiting for server response
2024-02-01 19:30:04.611195 [LOG] Connecting
2024-02-01 19:30:04.611375 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING) 
2024-02-01 19:30:05.022339 [LOG] Connected: vpn.us.witopia.net:1194 (185.123.114.39) via /UDP on tun/10.119.57.158/ gw=[10.119.57.157/] mtu=(default)
2024-02-01 19:30:05.022384 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTED) 
2024-02-01 19:30:05.022427 [LOG] [COMPRESS_ERROR] server pushed compression settings that are not allowed and will result in a non-working connection. 
2024-02-01 19:30:05.022444 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_DISCONNECTED) 

Session manager initiated disconnect...
Disconnected

but I should use openvpn3,right ? well..

root@Z390-AORUS-PRO-DEST:/home/ziomario/Scaricati/VPN/personalVPNPro# /usr/bin/openvpn3 --config vpn.us.witopia.net.ovpn --client --verb 6
/usr/bin/openvpn3: Unknown command '--config'

[dsommers]

The openvpn2 is executable is an "OpenVPN 2.x wrapper". It's a python script providing a very similar command line interface as the classic /usr/sbin/openvpn. The openvpn2 script uses the OpenVPN 3 Linux stack under the hood.

This server you are connecting to ... is that an old setup you are in charge of? It seems quite out-of-date to today's standards. Compression has been deprecated for a long while; since the VORACLE attack surfaced (some time around 2018 or so).

OpenVPN 3 Linux have a higher security defaults which aligns with the capability of using DCO out-of-the-box. That means in basically cipher to the server must be a AEAD based cipher (AES-GCM or ChaCha20-Poly1305), no weak hashing algorithms (SHA2+) and no compression.

Compression is a bit tricky. As there is a difference between compression itself and compression framing. OpenVPN supports compression framing without compressing any data.

If you control all clients connecting to a server and the server ... consider removing any compression options (compress or comp-lzo) from your configuration files. Optionally, if the server is running OpenVPN 2.6, you can use the compress migrate to support both, where the server can identify if the client requires compression or not - and will switch the wire protocol accordingly.

On the OpenVPN 3 Linux side, you can try to set the --allow-compression override to asym.

 $ openvpn3 config-manage --config CONFIG_NAME --allow-compression asym

or with the openvpn2 wrapper

$ openvpn2 --config CONFIG_FILE --verb 6 --profile-override allow-compression asym

[dsommers]

I recommend you to study the man pages though.

$ man openvpn2
$ man openvpn3-config-manage
$ man openvpn3-session-start
$ man openvpn3

And also notice the "SEE ALSO" sections in all of them. (I do spot now that the man pages may not fully up-to-date, but it mostly lacks some details - nothing is really wrong except the "tech preview" of DCO; that is no longer a tech-preview - it is fully supported)

In addition all these commands have --help screen as well; that is typically more up-to-date.

[Marietto2008]

Sorry to tell you,but usually I'm not able to read the man pages because they are too full of technicalities. I prefer to read more concise and easy tutorials or to ask help to someone. Sorry again for that,but if I want to really understand how something work,knowing what are my weakness,I should do in this way. That's because I haven't solid basis on computer sciences. This is only an hobby for me. I try to do my best. My job is totally different. Anyway,this is the openvpn config file that I usually use on FreeBSD where it works perfectly,but I don't think that on FreeBSD I use openvpn3. I'm trying to use it with openvpn3 on Ubuntu.

openvpn.conf :

client
dev tun
proto udp
remote vpn.usa.witopia.net
resolv-retry infinite
nobind
persist-key
persist-tun
ca /home/marietto/Desktop/Files/OS/FreeBSD/Scripts/Witopia/personalVPNPro/ca.crt
cert /home/marietto/Desktop/Files/OS/FreeBSD/Scripts/Witopia/personalVPNPro/CN11706244.crt
key /home/marietto/Desktop/Files/OS/FreeBSD/Scripts/Witopia/personalVPNPro/CN11706244.key
remote-cert-tls server
cipher AES-256-CBC
verb 3
port 1194
tun-mtu 1500
mssfix 1450
mute 20
pull
mute-replay-warnings

so,this is how I tried to use it with openvpn3 :

openvpn3 config-manage --config openvpn.conf --allow-compression asym
config-manage: ** ERROR ** No configuration profiles found

can you tell me what's missing ? thanks.

[dsommers]

If you had bothered to read the man page for the openvpn3 command, you would have seen there is a openvpn3 config-import command which explains what that command does. And by checking openvpn3 config-manage man page (referenced in the "SEE ALSO" section), it is explained how to use it to modify/manage imported configuration profiles.

The error you got in the previous connection attempt:

 [COMPRESS_ERROR] server pushed compression settings that are not allowed and will result in a non-working connection. 

Notice the server pushed aspect. That means it is the OpenVPN server pushing configuration options to the client. That should be fixed.

[Marietto2008]

You have replied faster than me,you are like speedy gonzales. I've removed the config "comp-lzo" before your post,according with what you had suggested earlier. And that error is gone. Please refresh the page.

[dsommers]

JFTR ... The man pages for OpenVPN 3 Linux is trying to be end-user friendly. I strive to avoid too much technical details I consider unneeded. Some details will be needed in some cases, but I try hard to restrain that information to the needed scope alone.

There is also a openvpn3-linux man page which explains a bit of all the various pieces in the OpenVPN 3 Linux stack, and how they relate to each other. Parts of this may be fairly technical, but that comes quite a bit further down.

There are most likely room for improvements too. And we happily accept patches improving documentation too. All the documentation is available as plain text files and should be very easy to edit ... https://codeberg.org/OpenVPN/openvpn3-linux/src/branch/master/docs/man

[Marietto2008]

While it is easier to make it work using openvpn2 :

# openvpn2 --config openvpn.conf --verb 6
Press CTRL-C to stop the connection

2024-02-02 14:54:46.752838 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CFG_OK) config_path=/net/openvpn/v3/configuration/4e5a2942x6abcx46a5xb0c2x2461493ea4ed
2024-02-02 14:54:46.752929 [LOG] Starting connection
2024-02-02 14:54:46.752969 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING) 
2024-02-02 14:54:46.888327 [LOG] Waiting for server response
2024-02-02 14:54:46.936174 [LOG] Connecting
2024-02-02 14:54:46.936223 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING) 
2024-02-02 14:54:47.342473 [LOG] Connected: vpn.usa.witopia.net:1194 (185.113.164.29) via /UDP on tun/10.119.57.158/ gw=[10.119.57.157/] mtu=(default)
2024-02-02 14:54:47.342542 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTED) 

[dsommers]

I see I've forgotten to mention to run sudo openvpn3-admin log-service --log-level 6. That will give you a lot more connection details.

[Marietto2008]

---> If you had bothered to read the man page for the openvpn3 command, you would have seen there is a openvpn3 config-import command which explains what that command does. And by checking openvpn3 config-manage man page (referenced in the "SEE ALSO" section), it is explained how to use it to modify/manage imported configuration profiles.

please don't think that I don't read man pages because I'm lazy. I love the computers. For me to read the man pages is very hard because often I'M NOT ABLE TO UNDERSTAND WHAT IT MEANS,WHAT SHOULD I DO. For me there is some serious understanding problems.

[dsommers]

If there are anything we can in the OpenVPN 3 Linux man pages to make it easier to understand - I'm all ears.

[Marietto2008]

Man,this is exactly the kind of informations that my mind find hard to "process" ; I also think that this is NOT the right method to explain something. There aren't practical example,there aren't backgrounds,situation that you can use to drain some further informations that can help you to correctly assemble the command you need :

# man openvpn3-config-manage

OPENVPN3‐CONFIG‐MANAGE(1)                                 OpenVPN 3 Linux                                 OPENVPN3‐CONFIG‐MANAGE(1)

NAME
       openvpn3‐config‐manage - OpenVPN 3 Linux ‐ Configuration Profile Management

SYNOPSIS
       openvpn3 config-manage -o DBUS-PATH | --path DBUS-PATH | --config CONFIG-NAME [OPTIONS]
       openvpn3 config-manage -h | --help

DESCRIPTION
       Manage  settings for an imported configuration profile.  This allows to override parts of the original config profile.  Note
       that this will not be reflected in the output of openvpn3 config-dump.  Use openvpn3 config-manage --show to see the  exist‐
       ing overrides.

OPTIONS
       -h, --help
              Print usage and help details to the terminal

       -o DBUS-PATH, --path DBUS-PATH
              D-Bus configuration path to the configuration to delete.  This can be found in openvpn3 configs-list.

       --config-path DBUS-PATH
              Alias for --path.

       -c CONFIG-NAME, --config CONFIG-NAME
              Can  be  used instead of --path where the configuration profile name is given instead.  Available configuration names
              can be found via openvpn3 configs-list.

       -r NEW-CONFIG-NAME, --rename NEW-CONFIG-NAME
              Renames the configuration profile

       --tag TAG-VALUE
              Adds a tag value to a configuration profile

       --remove-tag TAG-VALUE
              Remove a tag value from a configuration profile

       -s, --show
              Show the current profile settings

       --exists
              Checks if a configuration profile exists.  Requires either --config or --path.  Will exit  with  0  if  configuration
              profile is found, otherwise 1.

       --quiet
              Don't display informative information when modifying the configuration profile.

       --dco BOOL
              Enable  kernel based Data Channel Offload.  This moves the tunnelled network traffic to be handled inside the kernel.
              This improves the processing of the network traffic and moves the encryption, decryption  and  packet  authentication
              for  the  tunnelled  network  traffic  to be handled inside the kernel instead of begin passed via the OpenVPN client
              process in user space.

              This option is only available if openvpn3-linux has been built with this support.

              WARNING:
                     This is currently a tech preview feature and is not ready for production environments.  It also  requires  the
                     ovpn-dco kernel module to be installed to work and at least a Linux 5.4 kernel.

       --server-override HOST
              Override the remote server hostname/IP address to connect against.

       --port-override PORT
              Override the remote server port to connect against.  Valid values: 1 to 65535.

       --proto-override PROTO
              Override the connection protocol.  Valid values are tcp and udp.

       --ipv6 ARG
              Sets the IPv6 connect policy for the client.  Valid values are yes, no and default

       --persist-tun BOOL
              Overrides the --persist-tun argument in the configuration profile.  If set to true, the tun adapter will persist dur‐
              ing the reconnect.  If false, the tun adapter will be torn down before reconnects.  Valid values are: true, false

       --log-level LEVEL
              Overrides  the default log level.  The default log level is 3 if the configuration file does not contain a --verb op‐
              tion.  This override will take place over any other log verbosity settings.  Valid values are between 1 and 6.

       --dns-fallback-google BOOL
              If set to true, the DNS resolver settings will include Google DNS servers.  Valid values are: true, false

       --dns-scope SCOPE
              Defines the DNS query scope.  This is currently only supported when enabling the systemd-resolved(8) resolver support
              in openvpn3-service-netcfg(8).  Supported values are:

              global: (default)
                     The VPN service provided DNS server(s) will be used for all types of DNS queries.

              tunnel:
                     The VPN service provided DNS server(s) will only be used for queries for DNS domains pushed by  the  VPN  ser‐
                     vice.

                     NOTE   The  DNS  domains pushed by the VPN service may be queried by DNS servers with systemd-resolved(8) ser‐
                            vice if their respective interfaces are configured to do global DNS queries.  But other non-listed  DNS
                            domains will not be sent to this VPN service provider's DNS server.

       --dns-setup-disabled BOOL
              If set to true, DNS settings will not be configured on the system.  Valid values are: true, false

       --dns-sync-lookup BOOL
              If set to true, DNS lookups will happen synchronously.  Valid values are: true, false

       --auth-fail-retry BOOL
              If set to true, the client will try to reconnect instead of disconnecting if authentication fails.  Valid values are:
              true, false

       --allow-compression ARG
              This controls whether the client wants to allow compression on traffic between the client to the server.  Valid argu‐
              ment values:

              no:    Do not compress at all

              asym:  Only allow server to send compressed data

              yes:   Both client and server can use compression

       --enable-legacy-algorithms BOOL
              By default, OpenVPN 3 Linux only expects to work with servers capable of doing AEAD ciphers on the data channel, such
              as  AES-GCM or ChaCha20-Poly1305 (if supported by the TLS library).  To connect to legacy servers not capable of AEAD
              ciphers on the data channel, it might help to enable legacy cipher algorithms.

       --tls-version-min ARG
              Sets the minimum TLS version for the control channel.  For this to be functional, the SSL/TLS library in use needs to
              support this restriction on both server and client.  Valid argument values are:

              tls_1_0:
                     Enforce minimum TLSv1.0

              tls_1_1:
                     Enforce minimum TLSv1.1

              tls_1_2:
                     Enforce minimum TLSv1.2

              tls_1_3:
                     Enforce minimum TLSv1.3.  This is currently only supported by OpenSSL 1.1.1.

       --tls-cert-profile ARG
              This sets the acceptable certificate and key parameters.  Valid argument values are:

              legacy:
                     Allows minimum 1024 bits RSA keys with certificates signed with SHA1.

              preferred:
                     Allows minimum 2048 bits RSA keys with certificates signed with SHA256 or higher. (default)

              suiteb:
                     This follows the NSA Suite-B specification.

       --proxy-host PROXY-SERVER
              HTTP proxy to establish the VPN connection via.

       --proxy-port PROXY-PORT
              Port where the HTTP proxy is available.

       --proxy-username PROXY-USER
              Username to use for the HTTP proxy connection

       --proxy-password PROXY-PASSWORD
              Password to use for the HTTP proxy connection

       --proxy-auth-cleartext BOOL
              Allow HTTP proxy authentication to happen in clear-text.  Valid values are: true, false

       --unset-override OVERRIDE
              This removes an override setting from the configuration profile.  The OVERRIDE value is  the  setting  arguments  en‐
              listed  here  but  without  the  leading --.  For example, if --tls-cert-profile suiteb was set, it can be unset with
              --unset-override tls-cert-profile.

SEE ALSO
       openvpn3(1) openvpn3-config-acl(1) openvpn3-config-import(1) openvpn3-configs-list(1) openvpn3-config-remove(1)

                                                                                                          OPENVPN3‐CONFIG‐MANAGE(1)

I have no idea about how to create a profile,reading that. I imagine that you don't see how much difficult can be for me,because you are experienced,you know how to orient yourself in that mess,but not me.

[dsommers]

Okay, fair point!

What if the "DESCRIPTION" part is better worded?

Current text:

Manage  settings for an imported configuration profile.  This allows to override parts of the
original config profile.  Note that this will not be reflected in the output of openvpn3 config-dump.
Use openvpn3 config-manage --show to see the  existing overrides.

Proposed update:

Configuration profiles imported using openvpn3 config-import(1) can be managed via this
command.  This gives the possibility to set or modify profile overrides on many of the
OpenVPN options from the imported configuration file.

Use openvpn3 config-manage --show to see the existing overrides set on a configuration
profile.

Note: These settings may not be reflected when using the openvpn3 config-dump(1)
command to retrieve the OpenVPN formatted configuration file.

[Marietto2008]

That discoursive part is not useful for me. I learn by doing. I usually use a mixture between trial and error method,intuition,looking for already similar assembled commands. My learning process needs to find few informations that go straight to the point heavily based on practical examples.

[dsommers]

So even the SYNOPSIS is unclear how to move forward?

 openvpn3 config-import -c FILE | --config FILE [-n NAME | --name NAME] [-p | --persistent]

(where each of these options are described just a few lines down)

What about he information here? https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux#Usingopenvpn3

[Marietto2008]

# openvpn3 session-start --config openvpn.conf

Using configuration profile from file: openvpn.conf
Session path: /net/openvpn/v3/sessions/e9cfd288s11d8s4bcbs8b1dsf0f6fcdbb95f
session-start: ** ERROR ** Failed to start session

[Marietto2008]

# openvpn3 config-import -c openvpn.conf -n vpn -p
Configuration imported.  Configuration path: /net/openvpn/v3/configuration/e368a681x2a69x43c0xad88xf87c90553144

ok,now how can I start the vpn session ?