stackhpc / ansible-role-openvpn Goto Github PK

When tested on a Debian based system, several failures were observed due to no verification that the openvpn group exists:

TASK [openvpn : Ensure OpenVPN Easy-RSA directory exists] **************************************************************************************************************
fatal: [3.132.87.227]: FAILED! => {"changed": false, "gid": 0, "group": "root", "mode": "0755", "msg": "chgrp failed: failed to look up group openvpn", "owner": "root", "path": "/etc/openvpn/easy-rsa", "size": 4096, "state": "directory", "uid": 0}

It looks like there is no openvpn group utilized in Debian and the directory/file ownership is set to root:root

When changing the ownership to root:root in the file modules used in tasks/server.yml, the task completed successfully.

I not sharp enough with openvpn to know a definite best fix: You could create the group and modify Debian installations of openvpn to run under those permissions, more simple, or just fork the logic so that it sets the permissions of the openvpn/easy-rsa directories to root:root if Ansible detects it's a Debian based system (I know this works)

The service fails due to the runas portion of the config:

user nobody
group nobody

Debian systems, although some variance, tend to use:

user nobody
group nogroup