Re: [Openvpn-users] How to enable timestamps in server logfile?
On Wed, 22 Jun 2022 18:32:59 -0400, Nathan Stratton Treadway wrote: >So now my guess is that you had an apt sources.list entry pointing to >the build.openvpn.net repo back in your Xenial days, which then probably >got disabled by the Ubuntu release-upgrade process (and thus apt no >longer suggests newer versions of the OpenVPN package from that repo). > I opened the /etc/apt/sources.list file on my server and searched for the word openvpn but it found no hit... But I do not know if that is the correct word to search for to get the entry that might have been a custom entry on 18.04... When I make a release upgrade (as suggested when logging on to the system via ssh) like I did from 18.04 to get to 20.04 does the process make a backup of the apt sources file or does it simply just remove the external locations? I found a file /etc/apt/sources.list.save but that too does not contain any trace of the word openvpn. That file is listing "bionic" in all places where the current file lists "focal" > >Anyway, at this point I think your choices now (when you are back home) >are either to manually switch to the current Ubuntu-provided package (as >discussed in the earlier emails), or to re-enable the build.openvpn.net >repo (switching to their Focal release) and then upgrade to the newer >package currently provided there. But presumably one way or the other >you will want to upgrade away from 2.4.7-xenial0... I will probably need very detailed instructions for that since I am not used to do anything other than: apt update && apt full-upgrade -y on my systems... -- Bo Berglund Developer in Sweden ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On 23/06/22 02:05, David Sommerseth wrote: /usr/lib/systemd/system/openvpn-server@.service ^^ This is the proper service file being packaged. Even though, as this is from a Debian package, I would have expected it under /lib/systemd/system. Thanks to the big /usr merge, they're going to be the same place anyway. On my debian bullseye system: richard@zircon:~$ file /lib /lib: symbolic link to usr/lib https://wiki.debian.org/UsrMerge I assume Ubuntu has done or will do the same thing - IIRC it's led by systemd. https://discourse.ubuntu.com/t/usr-merge-to-become-required-in-hh/18962 Richard ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On 22/06/2022 22:03, Bo Berglund wrote: On Wed, 22 Jun 2022 15:58:35 +0200, David Sommerseth wrote: [...snip...] I see you get a recommendation to remove '--suppress-timestamp'. That is only useful if you decide to use --log. If you let the journal do that job, it will already provide the timestamps for you. And if you also have rsyslog installed too, it will pick up journal events and put these log entries to the configured log files - which will include timestamps. Generally speaking, consider the --log option only to be useful on systems without a system logger available. So if I simply remove the log entry in the conf file and restart openvpn services I will get the log into Journalctl including timestamps? Yes, correct! This seems like a modification I could do remotely without risking the system getting shut down? I mean commenting out the log setting in the conf file... Absolutely, removing the --log option is normally a safe operation. If you have SSH access to the box outside of the VPN, it is also safe to do a 'systemctl restart' of your openvpn-server@.service units. -- kind regards, David Sommerseth OpenVPN Inc ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Wed, Jun 22, 2022 at 12:38:24 +0200, Bo Berglund wrote: > On Tue, 21 Jun 2022 01:52:48 -0400, Nathan Stratton Treadway > wrote: > > >On Mon, Jun 20, 2022 at 08:51:47 +0200, Bo Berglund wrote: > > > >> Originally I used OpenVPN since around 2014 on RaspberryPi to access my > >> home > >> LAN. I did not have an Ubuntu server back then. > >> Then in 2016 I built the Ubuntu server to handle a lot of other things > >> too, like > >> subversion and such, and I also installed OpenVPN there. > >> But I no longer remember *how* I installed it, it might have been done > >> using > >> some apt repository fiddling so I am now on the wrong branch > > > >The top entry in the /usr/share/doc/openvpn/changelog.Debian.gz should > >give you at least a little information about the specific build of > >the currently-installed version of the package... > > This is what I have in the file: > > openvpn (2.4.7-xenial0) stable; urgency=medium > > * preparing release v2.4.7 (ChangeLog, version.m4, Changes.rst) (Gert > Doering, > 2b8aec62) > ... lots of more lines ... > Well, the interesting line would have been the "signature" line at the end of that section, immediately before the "openvpn (2.4[...]" header line for the next-mentioned-package-version's section But seeing Gert Doering mentioned in that quoted text was enough to make me wonder if this was a package built by the OpenVPN project -- and sure enough, the "-xenial0" naming convention seems to be what they use (as shown in this repository listing: https://build.openvpn.net/debian/openvpn/release/2.4/pool/xenial/main/o/ ) So now my guess is that you had an apt sources.list entry pointing to the build.openvpn.net repo back in your Xenial days, which then probably got disabled by the Ubuntu release-upgrade process (and thus apt no longer suggests newer versions of the OpenVPN package from that repo). Anyway, at this point I think your choices now (when you are back home) are either to manually switch to the current Ubuntu-provided package (as discussed in the earlier emails), or to re-enable the build.openvpn.net repo (switching to their Focal release) and then upgrade to the newer package currently provided there. But presumably one way or the other you will want to upgrade away from 2.4.7-xenial0... Nathan Nathan Stratton Treadway - natha...@ontko.com - Mid-Atlantic region Ray Ontko & Co. - Software consulting services - http://www.ontko.com/ GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239 Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239 ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Wed, Jun 22, 2022 at 16:11:40 +0200, David Sommerseth wrote: > On 20/06/2022 00:10, Nathan Stratton Treadway wrote: > >On Sun, Jun 19, 2022 at 23:03:15 +0200, Bo Berglund wrote: > >>I get this: > >> > >>dpkg -L openvpn | grep systemd.*openv > >>/lib/systemd/system-generators/openvpn-generator > >>/lib/systemd/system/openvpn.service > >>/lib/systemd/system/openvpn@.service > >>/usr/lib/systemd/system/openvpn-client@.service > >>/usr/lib/systemd/system/openvpn-server@.service > > Oh, that's interesting. We need to look into this more carefully, > might be either that the package manager overlooked this detail or > that we're lacking a "systemd service directory override" in our > source code which Debian packaging would need. (David, just wanted to make sure you noticed that in other parts of this thread we realized that Bo's system has a very old OpenVPN package still installed. I don't know about recent build.openvpn.net packages, but the current Ubuntu Focal package [i.e. openvpn 2.4.7-1ubuntu2.20.04.3] uses "/lib/systemd/" consistently in the paths for the systemd files.) Nathan Nathan Stratton Treadway - natha...@ontko.com - Mid-Atlantic region Ray Ontko & Co. - Software consulting services - http://www.ontko.com/ GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239 Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239 ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Wed, 22 Jun 2022 15:58:35 +0200, David Sommerseth
wrote:
>> But will journalctl work independently of the openvpn log option settings,
>> like
>> verbosity etc?
>> I have this now in the two instance conf files:
>>
>> log /etc/openvpn/log/openvpn.log
>> verb 4
>> mute 10
>>
>> and:
>>
>> log /etc/openvpn/log/ovpn_local.log
>> verb 4
>> mute 10
>
>No, it will not work independently. When the --log option is missing,
>all logging goes to stdout ("terminal") and that's the output the
>journald picks up. The --verb and --mute options will work as expected.
>
>I see you get a recommendation to remove '--suppress-timestamp'. That
>is only useful if you decide to use --log. If you let the journal do
>that job, it will already provide the timestamps for you. And if you
>also have rsyslog installed too, it will pick up journal events and put
>these log entries to the configured log files - which will include
>timestamps.
>
>Generally speaking, consider the --log option only to be useful on
>systems without a system logger available.
>
So if I simply remove the log entry in the conf file and restart openvpn
services I will get the log into Journalctl including timestamps?
This seems like a modification I could do remotely without risking the system
getting shut down?
I mean commenting out the log setting in the conf file...
--
Bo Berglund
Developer in Sweden
___
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On 20/06/2022 00:10, Nathan Stratton Treadway wrote: On Sun, Jun 19, 2022 at 23:03:15 +0200, Bo Berglund wrote: I get this: dpkg -L openvpn | grep systemd.*openv /lib/systemd/system-generators/openvpn-generator /lib/systemd/system/openvpn.service /lib/systemd/system/openvpn@.service /usr/lib/systemd/system/openvpn-client@.service /usr/lib/systemd/system/openvpn-server@.service Oh, that's interesting. We need to look into this more carefully, might be either that the package manager overlooked this detail or that we're lacking a "systemd service directory override" in our source code which Debian packaging would need. For whatever reason Debian has, they deviated from the rest of the Linux world insisting on putting service files under /lib/systemd ... where most others (all distros I know of) uses /usr/lib/systemd. But that's a Debian artifact - which Ubuntu picks up. -- kind regards, David Sommerseth OpenVPN Inc ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On 18/06/2022 23:20, Bo Berglund wrote: On Sat, 18 Jun 2022 20:01:10 +, tincantech via Openvpn-users wrote: If you want your log-file to contain time-stamps then edit the file: /lib/systemd/system/openvpn-server@.service remove '--supress-timestamps' I cannot find such a file... Well, you now know the solution. All you need do is find where your Ubuntu hides systemd, So I searched from / instead: sudo find / -name "openvpn-server*" /usr/lib/systemd/system/openvpn-server@.service ^^ This is the proper service file being packaged. Even though, as this is from a Debian package, I would have expected it under /lib/systemd/system. /sys/fs/cgroup/devices/system.slice/ All these files under /sys are on a pseudo file system, not a real file system. They represent data stored in the kernel. The /sys/fs/cgroup part is about resource management on your system. Generally, you don't need to care much about these areas unless you dig into system management through cgroup. /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service /etc/systemd/system/multi-user.target.wants/openvpn-server@serverlocal.service These are the result of 'systemctl enable' commands. These are the files matching and I don't know which two are the real files to edit... I looked in the file: /usr/lib/systemd/system/openvpn-server@.service and it contains this: [Service} ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf So here I can remove the --suppress-timestamps argument, but does it cover BOTH of my two service instances?? As mentioned in a prior mail today; unless you insist on using --log, leave the --supress-timestamps alone :) A unit file which ends with a '@' means it is to be considered a "template". So when you call 'systemctl start openvpn-server@server.service', the %i is replaced with what comes between the '@' and '.service'. I assume I have to restart openvpn service to make it "take": sudo systemctl restart openvpn-server@server sudo systemctl restart openvpn-server@serverlocal Correct. Or is it: sudo systemctl restart openvpn-server There exists no 'openvpn-server.service' unit, so this will fail. Only the "template" version exists, which needs a "value" ... openvpn-server@value.service. -- kind regards, David Sommerseth OpenVPN Inc ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On 18/06/2022 10:26, Bo Berglund wrote:
On Wed, 15 Jun 2022 22:58:46 +0200, David Sommerseth
wrote:
[...snip...]
But will journalctl work independently of the openvpn log option settings, like
verbosity etc?
I have this now in the two instance conf files:
log /etc/openvpn/log/openvpn.log
verb 4
mute 10
and:
log /etc/openvpn/log/ovpn_local.log
verb 4
mute 10
No, it will not work independently. When the --log option is missing,
all logging goes to stdout ("terminal") and that's the output the
journald picks up. The --verb and --mute options will work as expected.
I see you get a recommendation to remove '--suppress-timestamp'. That
is only useful if you decide to use --log. If you let the journal do
that job, it will already provide the timestamps for you. And if you
also have rsyslog installed too, it will pick up journal events and put
these log entries to the configured log files - which will include
timestamps.
Generally speaking, consider the --log option only to be useful on
systems without a system logger available.
[...snip...]
This system was created back in 2016 or thereabouts on an Ubuntu Server system
and has been migrated through the Ubuntu versions since then. Now at Ubuntu
20.04.4 LTS.
So the way of launching the service has also changed ove the years, I only a few
months back moved to using the /etc/openvpn/server and /etc/openvpn/client
directories to store the conf files and modified the startup etc to suit the new
way of operation.
The way I did that:
1) sudo systemctl stop openvpn
sudo systemctl stop openvpn@server.service
sudo systemctl stop openvpn@serverlocal.service
2) sudo systemctl disable openvpn@server.service
sudo systemctl disable openvpn@serverlocal.service
sudo systemctl disable openvpn.service
3) Edit /etc/default/openvpn and comment out the AUTOSTART line
4) sudo mkdir /etc/openvpn/client
sudo mkdir /etc/openvpn/server
5) sudo mv /etc/openvpn/server*.conf /etc/openvpn/server/
6) sudo systemctl enable --now openvpn-server@server
sudo systemctl enable --now openvpn-server@serverlocal
It seemed to work, but you might have spotted a flaw in this migration, so
please advice how to actually disable/mask the offending services.
I would consider running:
systemctl mask openvpn.service openvpn@.service
And here's a another systemd trick ... with upstart/sysv init scripts,
you had the 'service' helper.
# service openvpn start
Which is essentially has this semantic: 'service SUBJECT VERB'. This
was changed with systemctl, so you now have: 'systemctl VERB SUBJECTS'
where you can list more SUBJECTS and perform the same VERB operation on
them all. So your step 1) can be done like this:
# systemctl stop \
openvpn openvpn@server.service openvpn@serverlocal.service
--
kind regards,
David Sommerseth
OpenVPN Inc
___
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Tue, 21 Jun 2022 01:52:48 -0400, Nathan Stratton Treadway
wrote:
>On Mon, Jun 20, 2022 at 08:51:47 +0200, Bo Berglund wrote:
>
>> Originally I used OpenVPN since around 2014 on RaspberryPi to access my home
>> LAN. I did not have an Ubuntu server back then.
>> Then in 2016 I built the Ubuntu server to handle a lot of other things too,
>> like
>> subversion and such, and I also installed OpenVPN there.
>> But I no longer remember *how* I installed it, it might have been done using
>> some apt repository fiddling so I am now on the wrong branch
>
>The top entry in the /usr/share/doc/openvpn/changelog.Debian.gz should
>give you at least a little information about the specific build of
>the currently-installed version of the package...
This is what I have in the file:
openvpn (2.4.7-xenial0) stable; urgency=medium
* preparing release v2.4.7 (ChangeLog, version.m4, Changes.rst) (Gert Doering,
2b8aec62)
... lots of more lines ...
>
>> What would be the proper way to do the manual upgrade?
>>
>> Is there a way to find out from where the openvpn I do have is coming and
>> what
>> is blocking it from being upgraded via apt in that case?
>>
>[...]
>> apt policy openvpn
>> openvpn:
>> Installed: 2.4.7-xenial0
>> Candidate: 2.4.7-xenial0
>> Version table:
>> *** 2.4.7-xenial0 100
>> 100 /var/lib/dpkg/status
>> 2.4.7-1ubuntu2.20.04.4 500
>> 500 http://se.archive.ubuntu.com/ubuntu focal-updates/main amd64
>> Packages
>> 500 http://security.ubuntu.com/ubuntu focal-security/main amd64
>> Packages
>> 500 http://archive.ubuntu.com/ubuntu focal-security/main amd64
>> Packages
>> 500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64
>> Packages
>
>This "apt policy" shows that you have the standard Ubuntu repos in your
>apt.sources list, and thus the standard package is available to install.
>
>(It doesn't get installed by default because the dpkg version sort
>algorithm treats "2.4.7-xenial0" as newer than the version
>"2.4.7-1ubuntu2.20.04.4" and doesn't want to downgrade the package.)
>
>But I think you would be able to manually force installation of the
>stock Focal package using the command "apt install openvpn/focal" to
>force selection of the version of the package from the specified distro.
>(Or alternatively "apt install openvpn=2.4.7-1ubuntu2.20.04.4" to give
>an explicit version string.)
I will try that the next time I am back home where the server lives.
Too dangerous to try remotely since the VPN is in use on a lot of places.
>> Can I just uninstall openvpn and then install via apt to get the latest?
>> Or will that throw out any custom config I have done too?
>
>("remove" -- as opposed to "purge" -- will leave all custom config
>files, so they should be there waiting when you install the package
>again. But I'd say you might as well try the "install .../focal" approach
>first and see if you can do it all in one step.)
OK, that is good to know!
>> Currently over the summer I am not at my home LAN but I connect there via
>> OpenVPN on my router, so presumably I would have to wait until I am back
>> home so
>> I have direct access to the server, right?
>> (Since I would lose connection once the server OpenVPN goes down).
>
>Yeah -- in that case it's probably best to wait...
>
>(If the package upgrade works as expected, OpenVPN would automatically
>start back up afterwards, so you'd presumably just see a slight pause in
>your ssh session and then resume normal operation... but if anything
>goes wrong with the upgrade, you'd be in trouble)
>
>
> Nathan
The OpenVPN server needs a reboot now and then (Ubuntu alerts of that on SSH
login) and I have done so a number of times without ill effects.
So yes, OpenVPN clients reconnect when the server is back up after a minute or
two.
--
Bo Berglund
Developer in Sweden
___
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Mon, Jun 20, 2022 at 08:51:47 +0200, Bo Berglund wrote:
> Originally I used OpenVPN since around 2014 on RaspberryPi to access my home
> LAN. I did not have an Ubuntu server back then.
> Then in 2016 I built the Ubuntu server to handle a lot of other things too,
> like
> subversion and such, and I also installed OpenVPN there.
> But I no longer remember *how* I installed it, it might have been done using
> some apt repository fiddling so I am now on the wrong branch
The top entry in the /usr/share/doc/openvpn/changelog.Debian.gz should
give you at least a little information about the specific build of
the currently-installed version of the package...
> What would be the proper way to do the manual upgrade?
>
> Is there a way to find out from where the openvpn I do have is coming and what
> is blocking it from being upgraded via apt in that case?
>
[...]
> apt policy openvpn
> openvpn:
> Installed: 2.4.7-xenial0
> Candidate: 2.4.7-xenial0
> Version table:
> *** 2.4.7-xenial0 100
> 100 /var/lib/dpkg/status
> 2.4.7-1ubuntu2.20.04.4 500
> 500 http://se.archive.ubuntu.com/ubuntu focal-updates/main amd64
> Packages
> 500 http://security.ubuntu.com/ubuntu focal-security/main amd64
> Packages
> 500 http://archive.ubuntu.com/ubuntu focal-security/main amd64
> Packages
> 500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
This "apt policy" shows that you have the standard Ubuntu repos in your
apt.sources list, and thus the standard package is available to install.
(It doesn't get installed by default because the dpkg version sort
algorithm treats "2.4.7-xenial0" as newer than the version
"2.4.7-1ubuntu2.20.04.4" and doesn't want to downgrade the package.)
But I think you would be able to manually force installation of the
stock Focal package using the command "apt install openvpn/focal" to
force selection of the version of the package from the specified distro.
(Or alternatively "apt install openvpn=2.4.7-1ubuntu2.20.04.4" to give
an explicit version string.)
> Can I just uninstall openvpn and then install via apt to get the latest?
> Or will that throw out any custom config I have done too?
("remove" -- as opposed to "purge" -- will leave all custom config
files, so they should be there waiting when you install the package
again. But I'd say you might as well try the "install .../focal" approach
first and see if you can do it all in one step.)
> Currently over the summer I am not at my home LAN but I connect there via
> OpenVPN on my router, so presumably I would have to wait until I am back home
> so
> I have direct access to the server, right?
> (Since I would lose connection once the server OpenVPN goes down).
Yeah -- in that case it's probably best to wait...
(If the package upgrade works as expected, OpenVPN would automatically
start back up afterwards, so you'd presumably just see a slight pause in
your ssh session and then resume normal operation... but if anything
goes wrong with the upgrade, you'd be in trouble)
Nathan
Nathan Stratton Treadway - natha...@ontko.com - Mid-Atlantic region
Ray Ontko & Co. - Software consulting services - http://www.ontko.com/
GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239
Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239
___
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Sun, 19 Jun 2022 18:10:14 -0400, Nathan Stratton Treadway
wrote:
>> I am not enough into Linux to get anything useful from this...
>> Hopefully you can.
>
>Well, I don't know how much difference it will make for your overall
>project, but this output shows that you are still running an old
>("xenial") version of OpenVPN... and that package puts .service files
>under both
> /lib/
>and
> /usr/lib/
>
>So I think that explains the results you saw from your "find" commands.
>
>I'm guessing you used a locally-build package for 2.4.7 under Xenial
>(since the Ubuntu repo for Xenial has version 2.3.10)... but the naming
>conventions clash ("-xenial0" is greater than "-1ubuntu" in the package
>version-string sort order) and so the system didn't automatically move
>to the Focal-provided package when you upgraded.
Originally I used OpenVPN since around 2014 on RaspberryPi to access my home
LAN. I did not have an Ubuntu server back then.
Then in 2016 I built the Ubuntu server to handle a lot of other things too, like
subversion and such, and I also installed OpenVPN there.
But I no longer remember *how* I installed it, it might have been done using
some apt repository fiddling so I am now on the wrong branch
>Anyway, unless you have a specific reason to stick with the -xenial
>package, you could go ahead and manually upgrade to the
>2.4.7-1ubuntu2.20.04.4 version of the package... at which point all your
>.service files should appear together under /usr/lib/ (and from that
>point your system should automaticly offer to update to newer versions
>of the package within Focal, if any someday get released).
What would be the proper way to do the manual upgrade?
Is there a way to find out from where the openvpn I do have is coming and what
is blocking it from being upgraded via apt in that case?
Checking version gives this:
$ openvpn --version
OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11]
[MH/PKTINFO] [AEAD] built on Feb 19 2019
library versions: OpenSSL 1.0.2n 7 Dec 2017, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes
with_gnu_ld=yes with_mem_check=no with_plugindir='${prefix}/lib/openvpn'
with_sysroot=no
I tried this to see more about openvpn on my system:
sudo apt list --installed | grep openvpn
openvpn/now 2.4.7-xenial0 amd64 [installed,local]
apt policy openvpn
openvpn:
Installed: 2.4.7-xenial0
Candidate: 2.4.7-xenial0
Version table:
*** 2.4.7-xenial0 100
100 /var/lib/dpkg/status
2.4.7-1ubuntu2.20.04.4 500
500 http://se.archive.ubuntu.com/ubuntu focal-updates/main amd64
Packages
500 http://security.ubuntu.com/ubuntu focal-security/main amd64 Packages
500 http://archive.ubuntu.com/ubuntu focal-security/main amd64 Packages
500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
2.4.7-1ubuntu2 500
500 http://se.archive.ubuntu.com/ubuntu focal/main amd64 Packages
500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages
Can I just uninstall openvpn and then install via apt to get the latest?
Or will that throw out any custom config I have done too?
Currently over the summer I am not at my home LAN but I connect there via
OpenVPN on my router, so presumably I would have to wait until I am back home so
I have direct access to the server, right?
(Since I would lose connection once the server OpenVPN goes down).
--
Bo Berglund
Developer in Sweden
___
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Sat, Jun 18, 2022 at 23:20:54 +0200, Bo Berglund wrote: > I looked in the file: > /usr/lib/systemd/system/openvpn-server@.service > > and it contains this: > [Service} > ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log > --status-version 2 --suppress-timestamps --config %i.conf > > So here I can remove the --suppress-timestamps argument, but does it cover > BOTH > of my two service instances?? > (I don't use this feature personally, but based on my reading of the .service file:) Assuming your setup has the two files /etc/openvpn/server/server.conf and /etc/openvpn/server/serverlocal.conf (and that the openvpn-server@.service file on your system is not too different than the one in the Focal package)... then yes, the openvpn-server@.service covers both of your service instances. Basically when you try to start the "openvpn-server@serverlocal" service, systemd uses the "openvpn-server@.service" file with a parameter of "serverlocal" (which is then substituted in for the "%i" specifier within the .service file). (You can read more about this functionality by searching for the word "template" in the systemd.unit man page) Nathan Nathan Stratton Treadway - natha...@ontko.com - Mid-Atlantic region Ray Ontko & Co. - Software consulting services - http://www.ontko.com/ GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239 Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239 ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Sun, Jun 19, 2022 at 23:03:15 +0200, Bo Berglund wrote:
> I get this:
>
> dpkg -L openvpn | grep systemd.*openv
> /lib/systemd/system-generators/openvpn-generator
> /lib/systemd/system/openvpn.service
> /lib/systemd/system/openvpn@.service
> /usr/lib/systemd/system/openvpn-client@.service
> /usr/lib/systemd/system/openvpn-server@.service
>
> and:
>
> ls -l $(dpkg -L openvpn | grep systemd.*open)
> -rwxr-xr-x 1 root root 899 Feb 19 2019
> /lib/systemd/system-generators/openvpn-generator
> -rw-r--r-- 1 root root 320 Feb 19 2019 /lib/systemd/system/openvpn.service
> -rw-r--r-- 1 root root 914 Feb 19 2019 /lib/systemd/system/openvpn@.service
> -rw-r--r-- 1 root root 702 Feb 19 2019
> /usr/lib/systemd/system/openvpn-client@.service
> -rw-r--r-- 1 root root 824 Jun 18 23:26
> /usr/lib/systemd/system/openvpn-server@.service
[...]
> I get this:
>
> apt-cache policy openvpn
> openvpn:
> Installed: 2.4.7-xenial0
> Candidate: 2.4.7-xenial0
> Version table:
> *** 2.4.7-xenial0 100
> 100 /var/lib/dpkg/status
> 2.4.7-1ubuntu2.20.04.4 500
> 500 http://se.archive.ubuntu.com/ubuntu focal-updates/main amd64
> Packages
> 500 http://security.ubuntu.com/ubuntu focal-security/main amd64
> Packages
> 500 http://archive.ubuntu.com/ubuntu focal-security/main amd64
> Packages
> 500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
> 2.4.7-1ubuntu2 500
> 500 http://se.archive.ubuntu.com/ubuntu focal/main amd64 Packages
> 500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages
>
> I am not enough into Linux to get anything useful from this...
> Hopefully you can.
Well, I don't know how much difference it will make for your overall
project, but this output shows that you are still running an old
("xenial") version of OpenVPN... and that package puts .service files
under both
/lib/
and
/usr/lib/
So I think that explains the results you saw from your "find" commands.
I'm guessing you used a locally-build package for 2.4.7 under Xenial
(since the Ubuntu repo for Xenial has version 2.3.10)... but the naming
conventions clash ("-xenial0" is greater than "-1ubuntu" in the package
version-string sort order) and so the system didn't automatically move
to the Focal-provided package when you upgraded.
Anyway, unless you have a specific reason to stick with the -xenial
package, you could go ahead and manually upgrade to the
2.4.7-1ubuntu2.20.04.4 version of the package... at which point all your
.service files should appear together under /usr/lib/ (and from that
point your system should automaticly offer to update to newer versions
of the package within Focal, if any someday get released).
Nathan
Nathan Stratton Treadway - natha...@ontko.com - Mid-Atlantic region
Ray Ontko & Co. - Software consulting services - http://www.ontko.com/
GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239
Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239
___
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Sun, 19 Jun 2022 14:43:48 -0400, Nathan Stratton Treadway wrote: >On Sat, Jun 18, 2022 at 19:03:48 +0200, Bo Berglund wrote: >> On Sat, 18 Jun 2022 13:46:09 +, tincantech via Openvpn-users >> wrote: >> >If you want your log-file to contain time-stamps then edit the file: >> >/lib/systemd/system/openvpn-server@.service >> >remove '--supress-timestamps' >> >> I cannot find such a file... >> >> bosse@ubuntuserv:/lib/systemd/system$ ls -la open* >> -rw-r--r-- 1 root root 987 Jan 19 2021 open-iscsi.service >> -rw-r--r-- 1 root root 489 Jul 12 2021 open-vm-tools.service >> -rw-r--r-- 1 root root 320 Feb 19 2019 openvpn.service >> -rw-r--r-- 1 root root 914 Feb 19 2019 openvpn@.service >> >> And: >> >> bosse@ubuntuserv:/lib/systemd$ find ./ -name "openvpn*" >> ./system/openvpn@.service >> ./system/openvpn.service >> ./system-generators/openvpn-generator >> > >I'm no expert on systemd's inner workings, but do have OpenVPN running >on a Ubuntu Focal/20.04 box > >What do you get if you run these commands on your system?: > > $ dpkg -L openvpn | grep systemd.*openv > $ ls -l $(dpkg -L openvpn | grep systemd.*open) I get this: dpkg -L openvpn | grep systemd.*openv /lib/systemd/system-generators/openvpn-generator /lib/systemd/system/openvpn.service /lib/systemd/system/openvpn@.service /usr/lib/systemd/system/openvpn-client@.service /usr/lib/systemd/system/openvpn-server@.service and: ls -l $(dpkg -L openvpn | grep systemd.*open) -rwxr-xr-x 1 root root 899 Feb 19 2019 /lib/systemd/system-generators/openvpn-generator -rw-r--r-- 1 root root 320 Feb 19 2019 /lib/systemd/system/openvpn.service -rw-r--r-- 1 root root 914 Feb 19 2019 /lib/systemd/system/openvpn@.service -rw-r--r-- 1 root root 702 Feb 19 2019 /usr/lib/systemd/system/openvpn-client@.service -rw-r--r-- 1 root root 824 Jun 18 23:26 /usr/lib/systemd/system/openvpn-server@.service >On my system with openvpn 2.4.7-1ubuntu2.20.04.3 currently installed, I >get: > >== >$ dpkg -L openvpn | grep systemd.*openv >/lib/systemd/system/openvpn-client@.service >/lib/systemd/system/openvpn-server@.service >/lib/systemd/system/openvpn.service >/lib/systemd/system/openvpn@.service >/lib/systemd/system-generators/openvpn-generator > >$ ls -l $(dpkg -L openvpn | grep systemd.*open) >-rwxr-xr-x 1 root root 899 Jul 19 2021 >/lib/systemd/system-generators/openvpn-generator >-rw-r--r-- 1 root root 688 Jul 19 2021 >/lib/systemd/system/openvpn-client@.service >-rw-r--r-- 1 root root 810 Jul 19 2021 >/lib/systemd/system/openvpn-server@.service >-rw-r--r-- 1 root root 299 Jul 19 2021 /lib/systemd/system/openvpn.service >-rw-r--r-- 1 root root 946 Jul 19 2021 /lib/systemd/system/openvpn@.service >== > >So it seems that my Ubuntu OpenVPN package does install the >/lib/systemd/system/openvpn-server@.service file > >(What does "apt-cache policy openvpn" say on your system?) > I get this: apt-cache policy openvpn openvpn: Installed: 2.4.7-xenial0 Candidate: 2.4.7-xenial0 Version table: *** 2.4.7-xenial0 100 100 /var/lib/dpkg/status 2.4.7-1ubuntu2.20.04.4 500 500 http://se.archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages 500 http://security.ubuntu.com/ubuntu focal-security/main amd64 Packages 500 http://archive.ubuntu.com/ubuntu focal-security/main amd64 Packages 500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages 2.4.7-1ubuntu2 500 500 http://se.archive.ubuntu.com/ubuntu focal/main amd64 Packages 500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages I am not enough into Linux to get anything useful from this... Hopefully you can. -- Bo Berglund Developer in Sweden ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Sat, Jun 18, 2022 at 19:03:48 +0200, Bo Berglund wrote: > On Sat, 18 Jun 2022 13:46:09 +, tincantech via Openvpn-users > wrote: > >If you want your log-file to contain time-stamps then edit the file: > >/lib/systemd/system/openvpn-server@.service > >remove '--supress-timestamps' > > I cannot find such a file... > > bosse@ubuntuserv:/lib/systemd/system$ ls -la open* > -rw-r--r-- 1 root root 987 Jan 19 2021 open-iscsi.service > -rw-r--r-- 1 root root 489 Jul 12 2021 open-vm-tools.service > -rw-r--r-- 1 root root 320 Feb 19 2019 openvpn.service > -rw-r--r-- 1 root root 914 Feb 19 2019 openvpn@.service > > And: > > bosse@ubuntuserv:/lib/systemd$ find ./ -name "openvpn*" > ./system/openvpn@.service > ./system/openvpn.service > ./system-generators/openvpn-generator > I'm no expert on systemd's inner workings, but do have OpenVPN running on a Ubuntu Focal/20.04 box What do you get if you run these commands on your system?: $ dpkg -L openvpn | grep systemd.*openv $ ls -l $(dpkg -L openvpn | grep systemd.*open) On my system with openvpn 2.4.7-1ubuntu2.20.04.3 currently installed, I get: == $ dpkg -L openvpn | grep systemd.*openv /lib/systemd/system/openvpn-client@.service /lib/systemd/system/openvpn-server@.service /lib/systemd/system/openvpn.service /lib/systemd/system/openvpn@.service /lib/systemd/system-generators/openvpn-generator $ ls -l $(dpkg -L openvpn | grep systemd.*open) -rwxr-xr-x 1 root root 899 Jul 19 2021 /lib/systemd/system-generators/openvpn-generator -rw-r--r-- 1 root root 688 Jul 19 2021 /lib/systemd/system/openvpn-client@.service -rw-r--r-- 1 root root 810 Jul 19 2021 /lib/systemd/system/openvpn-server@.service -rw-r--r-- 1 root root 299 Jul 19 2021 /lib/systemd/system/openvpn.service -rw-r--r-- 1 root root 946 Jul 19 2021 /lib/systemd/system/openvpn@.service == So it seems that my Ubuntu OpenVPN package does install the /lib/systemd/system/openvpn-server@.service file (What does "apt-cache policy openvpn" say on your system?) Nathan Nathan Stratton Treadway - natha...@ontko.com - Mid-Atlantic region Ray Ontko & Co. - Software consulting services - http://www.ontko.com/ GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239 Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239 ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, --- Original Message --- On Sunday, June 19th, 2022 at 06:35, Bo Berglund wrote: > On Sat, 18 Jun 2022 22:00:20 +, tincantech via Openvpn-users > openvpn-users@lists.sourceforge.net wrote: > > > You haven't found the file that you were looking for .. > > > Then it does not exist on my Ubuntu system On *your* system .. If the file did not exist then this command: `systemctl enable openvpn-server@server` would throw this error `Failed to enable unit: Unit file openvpn-server@.service does not exist.` -- -BEGIN PGP SIGNATURE- Version: ProtonMail wsBzBAEBCAAGBQJirvXHACEJEE+XnPZrkLidFiEECbw9RGejjXJ5xVVVT5ec 9muQuJ2YbwgAzNaeRd7SS0fVqLlwWExVOIOLH0EuygRQwH4KuVnXYDv7m52o UOID1XFZ2SvKCirqKWGozekXSdI6m2Dd34Zn+7rya7dux0pYoyDapROXC/Dl fYaT+NDauRZ7LrLKx7nLPjPlRyHh6ffoZmBtnjohrgJHULZQ4Rm7Jk1hNj8Q ET45jCjyO5MtYCm4ulkL7WqWDvo5urJygc4ND0kHVUhrdacxx2hVkMFxkmUg E5+8QnZEEO7m93Bh1R2dnjCrpG1PAJmgsL+0/5LKR2kjZlZcZvNsSxcZPYKi ZHj/xFsRk/g65bcFgiZNd9YGufwh43in5bcbzcyGpmcEO9WgmYqogw== =59mo -END PGP SIGNATURE- publickey - tincantech@protonmail.com - 0x09BC3D44.asc Description: application/pgp-keys publickey - tincantech@protonmail.com - 0x09BC3D44.asc.sig Description: PGP signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, --- Original Message --- On Saturday, June 18th, 2022 at 22:20, Bo Berglund wrote: > On Sat, 18 Jun 2022 20:01:10 +, tincantech via Openvpn-users > openvpn-users@lists.sourceforge.net wrote: > > > > > If you want your log-file to contain time-stamps then edit the file: > > > > /lib/systemd/system/openvpn-server@.service > > > > remove '--supress-timestamps' > > > > > > I cannot find such a file... > > > > Well, you now know the solution. > > > > All you need do is find where your Ubuntu hides systemd, > > > So I searched from / instead: > > sudo find / -name "openvpn-server*" > /usr/lib/systemd/system/openvpn-server@.service > /sys/fs/cgroup/devices/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service > /sys/fs/cgroup/devices/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service > /sys/fs/cgroup/memory/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service > /sys/fs/cgroup/memory/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service > /sys/fs/cgroup/pids/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service > /sys/fs/cgroup/pids/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service > /sys/fs/cgroup/systemd/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service > /sys/fs/cgroup/systemd/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service > /sys/fs/cgroup/unified/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service > /sys/fs/cgroup/unified/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service > /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service > /etc/systemd/system/multi-user.target.wants/openvpn-server@serverlocal.service > > These are the files matching and I don't know which two are the real files to > edit... > You haven't found the file that you were looking for .. -- -BEGIN PGP SIGNATURE- Version: ProtonMail wsBzBAEBCAAGBQJirkrjACEJEE+XnPZrkLidFiEECbw9RGejjXJ5xVVVT5ec 9muQuJ09CAgAliBU02umk0lQobpWYQbLZB6JHKE4qicHk1OYohU7btkv08Es /nu6ACm3zW6JOlFpBBPpZEql++zxGfkKFuJGBhKaD+6SWUzaCMM77/QGl2JT ELKcfeTGLnDSX3mnsIjbnyMEXX2eFdz50sKr6kbcRVeFhhXPNzCDsY0IDOv0 rql+6h4aJ/e1MeyI2QoNw9kqctwSnFxKeqBR2xoL2oyYFWWhm33ukIhNTgvu 0LiPb8lHj7el6/Yp5kBdV7D0brq3gM74VO5r7dIxAcvLG729rNY3WN8hE+Mu WFPBRZgxf4yM0keI5BPaSUJBFnY4HZAtSWcTdum51EwGz2AGiGtU2g== =LKQC -END PGP SIGNATURE- publickey - tincantech@protonmail.com - 0x09BC3D44.asc Description: application/pgp-keys publickey - tincantech@protonmail.com - 0x09BC3D44.asc.sig Description: PGP signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Sat, 18 Jun 2022 20:01:10 +, tincantech via Openvpn-users wrote: >> > If you want your log-file to contain time-stamps then edit the file: >> > /lib/systemd/system/openvpn-server@.service >> > remove '--supress-timestamps' >> >> >> I cannot find such a file... > >Well, you now know the solution. > >All you need do is find where your Ubuntu hides systemd, So I searched from / instead: sudo find / -name "openvpn-server*" /usr/lib/systemd/system/openvpn-server@.service /sys/fs/cgroup/devices/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service /sys/fs/cgroup/devices/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service /sys/fs/cgroup/memory/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service /sys/fs/cgroup/memory/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service /sys/fs/cgroup/pids/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service /sys/fs/cgroup/pids/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service /sys/fs/cgroup/systemd/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service /sys/fs/cgroup/systemd/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service /sys/fs/cgroup/unified/system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service /sys/fs/cgroup/unified/system.slice/system-openvpn\x2dserver.slice/openvpn-server@serverlocal.service /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service /etc/systemd/system/multi-user.target.wants/openvpn-server@serverlocal.service These are the files matching and I don't know which two are the real files to edit... I looked in the file: /usr/lib/systemd/system/openvpn-server@.service and it contains this: [Service} ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf So here I can remove the --suppress-timestamps argument, but does it cover BOTH of my two service instances?? I assume I have to restart openvpn service to make it "take": sudo systemctl restart openvpn-server@server sudo systemctl restart openvpn-server@serverlocal Or is it: sudo systemctl restart openvpn-server -- Bo Berglund Developer in Sweden ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, --- Original Message --- On Saturday, June 18th, 2022 at 18:03, Bo Berglund wrote: > On Sat, 18 Jun 2022 13:46:09 +, tincantech via Openvpn-users > openvpn-users@lists.sourceforge.net wrote: > > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA256 > > > > Hi, > > > > --- Original Message --- > > On Saturday, June 18th, 2022 at 09:26, Bo Berglund bo.bergl...@gmail.com > > wrote: > > > > > > > > > The way I did that: > > > > > > 1) sudo systemctl stop openvpn > > > sudo systemctl stop openvpn@server.service > > > sudo systemctl stop openvpn@serverlocal.service > > > 2) sudo systemctl disable openvpn@server.service > > > sudo systemctl disable openvpn@serverlocal.service > > > sudo systemctl disable openvpn.service > > > 3) Edit /etc/default/openvpn and comment out the AUTOSTART line > > > 4) sudo mkdir /etc/openvpn/client > > > sudo mkdir /etc/openvpn/server > > > 5) sudo mv /etc/openvpn/server*.conf /etc/openvpn/server/ > > > 6) sudo systemctl enable --now openvpn-server@server > > > sudo systemctl enable --now openvpn-server@serverlocal > > > > > > It seemed to work, but you might have spotted a flaw in this migration, so > > > please advice how to actually disable/mask the offending services. > > > > That looks to be correct. > > > Thanks for the confirmation! > > > If you want your log-file to contain time-stamps then edit the file: > > /lib/systemd/system/openvpn-server@.service > > remove '--supress-timestamps' > > > I cannot find such a file... Well, you now know the solution. All you need do is find where your Ubuntu hides systemd, perhaps google "search" can do that for you. -- -BEGIN PGP SIGNATURE- Version: ProtonMail wsBzBAEBCAAGBQJiri72ACEJEE+XnPZrkLidFiEECbw9RGejjXJ5xVVVT5ec 9muQuJ25AQgAo+3Ej7fFwzYIv5V+g2aM1V/d0N42PUQCwN4IjGeYkw98Bh4R r1WkyuyJTdmEffbQK4MEds7v1GgAlT785WI2vG5fMOkv3DNi4YQ8uLEseugo 6+Dx3XmcibJBiDudUGcNx3pkw6/ZqrVORdSaJA6MIKTJdMLCfzMhtdxPimXl kFweJlRVAJWJt1s7Tnj+7hJvvSWhD1px9FFU7Aa1vs4eOGX8Vst6cTAmrDwS mMaqcFwS3p5OwZZ8+FNC5tihUM6PJPWMoNoAlnAJH5hD+LSfluRiWJGb2EXu Osl19SB5tR2dD28QhjHVvOWkQbAux1FV+3DoIXVGVU5Fx9cTbRQvZA== =fN24 -END PGP SIGNATURE- publickey - tincantech@protonmail.com - 0x09BC3D44.asc Description: application/pgp-keys publickey - tincantech@protonmail.com - 0x09BC3D44.asc.sig Description: PGP signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Sat, 18 Jun 2022 13:46:09 +, tincantech via Openvpn-users wrote: >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA256 > >Hi, > >--- Original Message --- >On Saturday, June 18th, 2022 at 09:26, Bo Berglund >wrote: > > > >> The way I did that: >> >> 1) sudo systemctl stop openvpn >> sudo systemctl stop openvpn@server.service >> sudo systemctl stop openvpn@serverlocal.service >> 2) sudo systemctl disable openvpn@server.service >> sudo systemctl disable openvpn@serverlocal.service >> sudo systemctl disable openvpn.service >> 3) Edit /etc/default/openvpn and comment out the AUTOSTART line >> 4) sudo mkdir /etc/openvpn/client >> sudo mkdir /etc/openvpn/server >> 5) sudo mv /etc/openvpn/server*.conf /etc/openvpn/server/ >> 6) sudo systemctl enable --now openvpn-server@server >> sudo systemctl enable --now openvpn-server@serverlocal >> >> It seemed to work, but you might have spotted a flaw in this migration, so >> please advice how to actually disable/mask the offending services. >> > >That looks to be correct. Thanks for the confirmation! >If you want your log-file to contain time-stamps then edit the file: >/lib/systemd/system/openvpn-server@.service >remove '--supress-timestamps' I cannot find such a file... bosse@ubuntuserv:/lib/systemd/system$ ls -la open* -rw-r--r-- 1 root root 987 Jan 19 2021 open-iscsi.service -rw-r--r-- 1 root root 489 Jul 12 2021 open-vm-tools.service -rw-r--r-- 1 root root 320 Feb 19 2019 openvpn.service -rw-r--r-- 1 root root 914 Feb 19 2019 openvpn@.service And: bosse@ubuntuserv:/lib/systemd$ find ./ -name "openvpn*" ./system/openvpn@.service ./system/openvpn.service ./system-generators/openvpn-generator As you can see there are only two files with names starting with openvpn and neither of them contain the keyword. OTOH they date back to Feb 19 2019, so they are probably leftovers that are unused anyway... Maybe the files actually used on Ubuntu reside elsewhare? -- Bo Berglund Developer in Sweden ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, --- Original Message --- On Saturday, June 18th, 2022 at 09:26, Bo Berglund wrote: > The way I did that: > > 1) sudo systemctl stop openvpn > sudo systemctl stop openvpn@server.service > sudo systemctl stop openvpn@serverlocal.service > 2) sudo systemctl disable openvpn@server.service > sudo systemctl disable openvpn@serverlocal.service > sudo systemctl disable openvpn.service > 3) Edit /etc/default/openvpn and comment out the AUTOSTART line > 4) sudo mkdir /etc/openvpn/client > sudo mkdir /etc/openvpn/server > 5) sudo mv /etc/openvpn/server*.conf /etc/openvpn/server/ > 6) sudo systemctl enable --now openvpn-server@server > sudo systemctl enable --now openvpn-server@serverlocal > > It seemed to work, but you might have spotted a flaw in this migration, so > please advice how to actually disable/mask the offending services. > That looks to be correct. If you want your log-file to contain time-stamps then edit the file: /lib/systemd/system/openvpn-server@.service remove '--supress-timestamps' -- -BEGIN PGP SIGNATURE- Version: ProtonMail wsBzBAEBCAAGBQJirdcSACEJEE+XnPZrkLidFiEECbw9RGejjXJ5xVVVT5ec 9muQuJ0bmwf/VZVrJWPRhRbYyMsnbm1Gl0q+azB1FKuc0dXH4Sy4dQK2cSpt 249OUTQGkGBk+IvuvqwAgncklCTW6WmN/CtifOrBxJ5DmVAD2TVSEyPRMUgB py2m6lOlkZOcbF7maUjpkHGAyFGvZe0bwh69OjzH2onPP3Q8ed5G8jhg53qE tsywtlgUd0Pby/o0Mi1fGlH56I4TK47OREg4o/QJIzXicYdzdHD88CImq+SG gYG8KZws9DBFVYIaP79Bh/n/t1YKsqx7UAMAhqS/ydj7uDdE3ZeK2tp/BGYW bHODZMWWeMqf5MtttdSKp6xPODAbRG/rOk1Mk3amXJWqPu3B4wQ7/Q== =18Fw -END PGP SIGNATURE- publickey - tincantech@protonmail.com - 0x09BC3D44.asc Description: application/pgp-keys publickey - tincantech@protonmail.com - 0x09BC3D44.asc.sig Description: PGP signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Wed, 15 Jun 2022 22:58:46 +0200, David Sommerseth wrote: >So in other words: On a systemd enabled system, using the "log" option >is not optimal. Does this mean that I should completely remove the log entries in the conf files or somehow use some specific entry that stops it from logging? >Generally speaking, on systemd enabled systems you have the journalctl >which is the main interface to read log entries. The basic output looks >quite similar to any common log file. But you can also use the '-o' >output to get far more details, including better machine readable outputs. > Thanks for this advice, I did not know that all this could be done with journalctl! I have to expand my notes to encompass this too. But will journalctl work independently of the openvpn log option settings, like verbosity etc? I have this now in the two instance conf files: log /etc/openvpn/log/openvpn.log verb 4 mute 10 and: log /etc/openvpn/log/ovpn_local.log verb 4 mute 10 >And a final note in regards to the systemd unit files. Please >disable/mask the use of openvpn@*.service and openvpn.service unit >files. When you only use the openvpn-client@.service and >openvpn-server@.client, you will have an environment which will be >easier to debug and troubleshoot. I mention this as I saw the >"openvpn@server.service" unit was listed as "failed". > > This system was created back in 2016 or thereabouts on an Ubuntu Server system and has been migrated through the Ubuntu versions since then. Now at Ubuntu 20.04.4 LTS. So the way of launching the service has also changed ove the years, I only a few months back moved to using the /etc/openvpn/server and /etc/openvpn/client directories to store the conf files and modified the startup etc to suit the new way of operation. The way I did that: 1) sudo systemctl stop openvpn sudo systemctl stop openvpn@server.service sudo systemctl stop openvpn@serverlocal.service 2) sudo systemctl disable openvpn@server.service sudo systemctl disable openvpn@serverlocal.service sudo systemctl disable openvpn.service 3) Edit /etc/default/openvpn and comment out the AUTOSTART line 4) sudo mkdir /etc/openvpn/client sudo mkdir /etc/openvpn/server 5) sudo mv /etc/openvpn/server*.conf /etc/openvpn/server/ 6) sudo systemctl enable --now openvpn-server@server sudo systemctl enable --now openvpn-server@serverlocal It seemed to work, but you might have spotted a flaw in this migration, so please advice how to actually disable/mask the offending services. -- Bo Berglund Developer in Sweden ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
On 15/06/2022 16:48, Bo Berglund wrote: On Wed, 15 Jun 2022 14:00:52 +, tincantech via Openvpn-users wrote: I have scanned the documentation for OpenVPN: https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/ But I do not find a setting that will swichh ON timetsmps in log lines. There are these related items: --suppress-timestamps It seems to disallow timestam ps which is exactly what my installation does without this setting... --machine-readable-output I really do not understand the description here. It seems like this would use some kind of special formatting of the timestamp, but does not control the fact that we want timestamps in the first place... time_ascii and time_unix Seems to only be related to the execution of the --client-connect script. I have looked in vain for a --enable-timestamps settings. The only log related items in my conf file are: log /etc/openvpn/log/openvpn.log verb 4 mute 10 It would help a lot if I could see the timestamps when debugging problems I would recommend you to install rsyslog the package if you want to be more advanced. These do the log-to-disk in plain-text far more efficient than the primitive OpenVPN logging mechanism. And it removes some CPU cycles from the OpenVPN process doing that. So in other words: On a systemd enabled system, using the "log" option is not optimal. Generally speaking, on systemd enabled systems you have the journalctl which is the main interface to read log entries. The basic output looks quite similar to any common log file. But you can also use the '-o' output to get far more details, including better machine readable outputs. $ journalctl -o help short short-full short-iso short-iso-precise short-precise short-monotonic short-unix verbose export json json-pretty json-sse cat with-unit As you have explained, you run multiple OpenVPN configurations (server.conf, serverlocal.conf). With the journalctl, you can then filter on these configs alone: # journalctl -u openvpn-server@server.service And then you can narrow in to a smaller time window # journalctl -b(Since last boot) # jorunalctl -b-2 (Since the last 2 boots) # journalctl --since -10m (Last 10 minutes) # journalctl --since "2022-06-15 10:00" # journalctl --since yesterday It also supports --until as well. If you add -f, you get the "tail -f" behavior. When using the more verbose output formats (like verbose, json/json-pretty, export), you see there are more meta data fields. You can also filter on those: # journalctl _PID=2741081 # journalctl _COMM=openvpn + SYSLOG_FACILITY=3 And all of these options can be combined, including -u and -o. And you can also filter on fields not listed in the output. I also mentioned rsyslog initially, as that is also able to add filters and log specific events into dedicated log files. It also has a native journal support via the imjournal module, where rsyslog can also be configured to process the json formatted data and apply filters based on the structured journal data. And a final note in regards to the systemd unit files. Please disable/mask the use of openvpn@*.service and openvpn.service unit files. When you only use the openvpn-client@.service and openvpn-server@.client, you will have an environment which will be easier to debug and troubleshoot. I mention this as I saw the "openvpn@server.service" unit was listed as "failed". -- kind regards, David Sommerseth OpenVPN Inc -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, this is a setting in the openvpn systemd unit file. The setting to remove is --suppress-timestamps from the 'ExecStart=' line. Sorry, I forgot to say that my server is an Ubuntu 20.04.4 server with openvpn version: OpenVPN 2.4.7 x86_64-pc-linux-gnu Where can I find the openvpn systemd unit file to edit? The command: sudo ls -l /etc/systemd/system/ Does not show any openvpn related files... This is what I can get from systemctl: $ sudo systemctl | grep openvpn openvpn-server@server.service loaded active running OpenVPN service for server openvpn-server@serverlocal.service loaded active running OpenVPN service for serverlocal openvpn.service loaded active exitedOpenVPN service ? openvpn@server.service loaded failed failedOpenVPN connection to server system-openvpn.sliceloaded active active system-openvpn.slice system-openvpn\x2dserver.slice loaded active active system-openvpn\x2dserver.slice Why do I want this? --- I am trying to set up a back-channel for an ovpn connection for a remote router. It connects fine and the clients on that router can navigate the Internet just fine via VPN too. But I also want to be able to configure the router itself so I want to be able to connect to 192.168.213.1 via the OpenVPN
Re: [Openvpn-users] How to enable timestamps in server logfile?
On Wed, 15 Jun 2022 14:00:52 +, tincantech via Openvpn-users wrote: > >> I have scanned the documentation for OpenVPN: >> https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/ >> >> But I do not find a setting that will swichh ON timetsmps in log lines. >> >> There are these related items: >> >> --suppress-timestamps >> It seems to disallow timestam ps which is exactly what my installation does >> without this setting... >> >> --machine-readable-output >> I really do not understand the description here. It seems like this would use >> some kind of special formatting of the timestamp, but does not control the >> fact >> that we want timestamps in the first place... >> >> time_ascii and time_unix >> Seems to only be related to the execution of the --client-connect script. >> >> I have looked in vain for a --enable-timestamps settings. >> >> The only log related items in my conf file are: >> log /etc/openvpn/log/openvpn.log >> verb 4 >> mute 10 >> >> It would help a lot if I could see the timestamps when debugging problems >> >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA256 > >Hi, > >this is a setting in the openvpn systemd unit file. > >The setting to remove is --suppress-timestamps from the 'ExecStart=' line. > Sorry, I forgot to say that my server is an Ubuntu 20.04.4 server with openvpn version: OpenVPN 2.4.7 x86_64-pc-linux-gnu Where can I find the openvpn systemd unit file to edit? The command: sudo ls -l /etc/systemd/system/ Does not show any openvpn related files... This is what I can get from systemctl: $ sudo systemctl | grep openvpn openvpn-server@server.service loaded active running OpenVPN service for server openvpn-server@serverlocal.service loaded active running OpenVPN service for serverlocal openvpn.service loaded active exitedOpenVPN service ? openvpn@server.service loaded failed failedOpenVPN connection to server system-openvpn.sliceloaded active active system-openvpn.slice system-openvpn\x2dserver.slice loaded active active system-openvpn\x2dserver.slice Why do I want this? --- I am trying to set up a back-channel for an ovpn connection for a remote router. It connects fine and the clients on that router can navigate the Internet just fine via VPN too. But I also want to be able to configure the router itself so I want to be able to connect to 192.168.213.1 via the OpenVPN server when the router is connected. This works fine on another remote location where I can access the router interface for config just fine while it is connected by OVPN. So the settings on that for this have been used as template for the new router connection. But I cannot connect to the router still. I figured I should try to check what is happening in the logs but cannot see the timestamps so as to pinpoint where the connection differs from the one at the working location... -- Bo Berglund Developer in Sweden ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, alternatively, you can view the log file with `journalctl`. This will then include timestamps from the journal. Something like `journalctl -u openvpn-server01` Regards Sent with Proton Mail secure email. --- Original Message --- On Wednesday, June 15th, 2022 at 15:00, tincantech wrote: > Hi, > > this is a setting in the openvpn systemd unit file. > > The setting to remove is --suppress-timestamps from the 'ExecStart=' line. > > Regards > > > Sent with Proton Mail secure email. > --- Original Message --- > On Wednesday, June 15th, 2022 at 14:50, Bo Berglund bo.bergl...@gmail.com > wrote: > > > > > I have scanned the documentation for OpenVPN: > > https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/ > > > > But I do not find a setting that will swichh ON timetsmps in log lines. > > > > There are these related items: > > > > --suppress-timestamps > > It seems to disallow timestam ps which is exactly what my installation does > > without this setting... > > > > --machine-readable-output > > I really do not understand the description here. It seems like this would > > use > > some kind of special formatting of the timestamp, but does not control the > > fact > > that we want timestamps in the first place... > > > > time_ascii and time_unix > > Seems to only be related to the execution of the --client-connect script. > > > > I have looked in vain for a --enable-timestamps settings. > > > > The only log related items in my conf file are: > > log /etc/openvpn/log/openvpn.log > > verb 4 > > mute 10 > > > > It would help a lot if I could see the timestamps when debugging problems > > > > -- > > Bo Berglund > > Developer in Sweden > > > > ___ > > Openvpn-users mailing list > > Openvpn-users@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/openvpn-users -BEGIN PGP SIGNATURE- Version: ProtonMail wsBzBAEBCAAGBQJiqeaTACEJEE+XnPZrkLidFiEECbw9RGejjXJ5xVVVT5ec 9muQuJ1AvQf9E04VHcGYZ6PUPtvjYBK8swK5RF9FBuv2CrvjtaXfmc95GwMS g56QxeH6NNrsawr66ENPC96EUVgsrENGTopphwpq+WSgUsLsg31DkuGuJ8Vn JDK8wg+xxfKOhITVUoEM4ybK8OYj+p0UqDRiReMSxxLag78wQLwy+pw3eEkp qbqjp0RTM4GMh3quunYXytUwC8bm4HV2AAJN9hmtvnbV8MUqt7JlCpeWk7tC sB/DQqqeeZ946dhvVoTVp9wx8ky/aLfkZQQ3TtqFFFcyeLMdJCFeoyhVSuJ7 zsHypHOxh0xjaEqQfT4sv4DUxZa6WxfHLffFUAwCViBjiB9BbeAO2w== =woG4 -END PGP SIGNATURE- publickey - tincantech@protonmail.com - 0x09BC3D44.asc Description: application/pgp-keys publickey - tincantech@protonmail.com - 0x09BC3D44.asc.sig Description: PGP signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
Re: [Openvpn-users] How to enable timestamps in server logfile?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, this is a setting in the openvpn systemd unit file. The setting to remove is --suppress-timestamps from the 'ExecStart=' line. Regards Sent with Proton Mail secure email. --- Original Message --- On Wednesday, June 15th, 2022 at 14:50, Bo Berglund wrote: > I have scanned the documentation for OpenVPN: > https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/ > > But I do not find a setting that will swichh ON timetsmps in log lines. > > There are these related items: > > --suppress-timestamps > It seems to disallow timestam ps which is exactly what my installation does > without this setting... > > --machine-readable-output > I really do not understand the description here. It seems like this would use > some kind of special formatting of the timestamp, but does not control the > fact > that we want timestamps in the first place... > > time_ascii and time_unix > Seems to only be related to the execution of the --client-connect script. > > I have looked in vain for a --enable-timestamps settings. > > The only log related items in my conf file are: > log /etc/openvpn/log/openvpn.log > verb 4 > mute 10 > > It would help a lot if I could see the timestamps when debugging problems > > > -- > Bo Berglund > Developer in Sweden > > > > ___ > Openvpn-users mailing list > Openvpn-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/openvpn-users -BEGIN PGP SIGNATURE- Version: ProtonMail wsBzBAEBCAAGBQJiqeYCACEJEE+XnPZrkLidFiEECbw9RGejjXJ5xVVVT5ec 9muQuJ1AmAf9FknChO+VWbdAnPZFc4b3GO2rhDeNZCkQC004kS7IOvLRgqNn bNa2iXgssnxpE69xK1EaPq4yfmmotW3c6A/M+NojcrEf+Cctb2lgwTQ/d+zo uzbDTkWk1C/oHsJ6LyJV2oqird8jX0Urwo4Q95zy3pzLBOkLU970MAemL+Rv u8ZPD2D6DQKtsdgDE0VsCR8+iS4FGU0p8wy9MF4vZBN5aczgeKKhnPRrxeXX x9RmnqmuYhKVhozwyRl3cZueHCQM/0lythSouKO4+Mda+kTDLiwg4yKvATbG ogQcuw+fqy5IBUmBb/Zqrde9CN6+OFvvumU92C7zMyRc5xi/uqxPOg== =V4aB -END PGP SIGNATURE- publickey - tincantech@protonmail.com - 0x09BC3D44.asc Description: application/pgp-keys publickey - tincantech@protonmail.com - 0x09BC3D44.asc.sig Description: PGP signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
