This time its my DS214+ im trying to setup as my regular nas is down due to hardware failure.Īnyway i got nzbget installed manually via spk file, got nzbget up and running. Nzbget usually is a piece of cake to setup on debian/ubuntu/centos and what ever other linux flavour i tried. So far im at setting up nzbget, and i just dont get it. It turns out that you are blocked by SELinux: after running the client container and trying to access /dev/net/tun inside it, you will get the following AVC denial in the audit log: type=AVC msg=audit(1563869264.I've used the dev-branch and compiled nzbget, python, mono and nzbdrone. ROUTE_GATEWAY xx.xx.xx.xx/255.255.255.0 IFACE=tap0 HWADDR=0a:38:ba:e6:4b:5fĮRROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)Įrror number may change depending on whether I run the command with -privileged or not. Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key OPTIONS IMPORT: adjusting link_mtu to 1624 OPTIONS IMPORT: -ip-win32 and/or -dhcp-option options modified OPTIONS IMPORT: route-related options modified
OPTIONS IMPORT: -ifconfig/up options modified OPTIONS IMPORT: timers and/or timeouts modified Peer Connection Initiated with xx.xx.xx.xx:1194 VERIFY OK: depth=0, C=ES, ST=XXX, L=XXX, O=XXXXX, CN=Ĭontrol Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Validating certificate extended key usage VERIFY OK: depth=1, C=ES, ST=XXX, L=XXX, O=XXXXX, CN=internal-ca WARNING: this configuration may cache passwords in memory - use the auth-nocache option to prevent this TLS: Initial packet from xx.xx.xx.xx:1194, sid=3ebc16fc 8cb6d6b1 TCP/UDP: Preserving recently used remote address: xx.xx.xx.xx:1194 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Library versions: OpenSSL 1.1.1c FIPS, LZO 2.08 This is the log I get when configuring the client with verb 3: OpenVPN 2.4.7 x86_64-redhat-linux-gnu built on Feb 20 2019 I can effectively verify there is no /dev/net/ directory when using -privileged, even if I pass the -cap-add=NET_ADMIN -device=/dev/net/tun parameters. Then instead of the permission-denied error (errno=13), I get a no-such-file-or-directory error (errno=2): ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2) If I try with -privileged: podman run -v $(pwd):/vpn:Z -privileged -cap-add=NET_ADMIN -device=/dev/net/tun -it peque/vpn Ls: cannot access '/dev/net/tun': Permission denied
I can also list /dev/net, but will get a "permission denied error": # ls -l /dev/net Then, from the container, I can: # ls -l /dev/ | grep netĭrwxr-xr-x. Running the container with: podman run -v $(pwd):/vpn:Z -cap-add=NET_ADMIN -device=/dev/net/tun -it peque/vpn Using Podman 1.4.4 (rootless) and Fedora 30 distribution with kernel 5.1.19. I get the following error: ERROR: Cannot open TUN/TAP dev /dev/net/tun: Permission denied (errno=13)Īny ideas on how could I fix this? I would not mind changing the base image if that could help (i.e.: to Alpine or anything else as long as it allows me to use openvpn for the connection). If I try to run it with (note $(pwd), where the VPN configuration and credentials are stored): podman run -v $(pwd):/vpn:Z -cap-add=NET_ADMIN -device=/dev/net/tun -it peque/vpn CMD īuilding the image with: podman build -t peque/vpn.
0 kommentar(er)
