Description:

down-root plugin exits with an error whenever it is used by OpenVPN configured to run with dropped privileges. As a result any script that was to be executed by the mentioned plugin with elevated privileges is not executed at all, precluding any final clean-up from happening.

For more information look at https://github.com/OpenVPN/openvpn/pull/28. Although referenced pull request is reported as closed the problem still persist in Arch. What appears to solve the problem (I tested it myself) is setting “KillMode” to “process” in client service file.

For completeness I have to add that I made sure the script I want to run on connection down is accessible and executable by down-root plugin and it otherwise works as intended.

Additional info:
* package version(s): 2.4.0-2
* config and/or log files etc.

Jan 06 17:57:38 gizmo openvpn[10462]: openvpn: DOWN-ROOT: Error sending script execution signal to background process: Connection refused
Jan 06 17:57:38 gizmo openvpn[10462]: PLUGIN_CALL: POST /usr/lib/openvpn/plugins/openvpn-plugin-down-root.so/PLUGIN_DOWN status=1
Jan 06 17:57:38 gizmo openvpn[10462]: PLUGIN_CALL: plugin function PLUGIN_DOWN failed with status 1: /usr/lib/openvpn/plugins/openvpn-plugin-down-root.so
Jan 06 17:57:38 gizmo openvpn[10462]: ERROR: up/down plugin call failed

Steps to reproduce:

1. Set connection configuration file for client to drop privileges upon connection (“user nobody” and “group nobody”).
2. In the same config use down-root plugin to execute script when connection terminates, e.g. “plugin /usr/lib/openvpn/plugins/openvpn-plugin-down-root.so /etc/openvpn/client.down”.
3. Start client connection.
4. Close client connection.