Linux under OpenVPN process exception exit how to Solve

Source: Internet
Author: User

The recent OpenVPN service abnormal quit many times, because the original in order to troubleshoot problems record a large number of debug log, resulting in problems when you want to locate the problem is very difficult, the instant log was brushed off, the process dropped, instantaneous start, instantaneous and dropped, resulting in a lot of orders lost! Because the day file records too much useless information, dare not to search the log to locate the problem, began to boldly guess:
1. The OpenVPN server (virtual machine) has not enough memory because only 2G memory
2. I/O is too high, because the log turned on the cause of DEBUG, a large number of log operations,
3. Open file descriptor not enough, system default 1024
4. Malicious attack on the OpenVPN service

Based on a guess of 4 points, start coping,
1. The first choice of the OPENPVN server (virtual machine) memory adjusted to 4G, after the restart found that the OpenVPN service after the start of a few minutes or abnormal off,
2. The log adjusted for error, OpenVPN after the start of a few minutes or abnormal exit. View Log found to be

Feb 17:17:42 localhost openvpn[1219]: qn_anqiu/xxx.xxx.xxx.xx:27351 crl:cannot read:/usr/local/cine/etc/keys/ Crl.pem:Too many open files (errno=24)

3. With the above error log prompts, the 3rd of the conjecture is correct. To execute a command:

Shell $> Ulimit-shn 65535

After starting the OpenVPN process, the normal did not exit again.
4. View log found that there is an IP per minute in the abnormal request OpenVPN server, directly in the Iptables filter out this IP

Feb 13:06:16 localhost openvpn[1219]: 58.244.191.51:47374 Warning:bad encapsulated Packet length from peer (18245), WH Ich must to > 0 and < = 1544--Please ensure that--TUN-MTU or--LINK-MTU are equal on both peers--this condition Could also indicate a possible active attack on the TCP link--[attemping restart ...]
Feb 13:07:21 localhost openvpn[1219]: 58.244.191.51:6043 Warning:bad encapsulated Packet length from peer (18245), whi CH must to > 0 and < = 1544--Please ensure that--TUN-MTU or--LINK-MTU are equal on both peers--this condition C Ould also indicate a possible active attack on the TCP link--[attemping restart ...]

After the above modification, after two days OpenVPN or abnormal dropped once, after the log or the old problem:

Feb 17:17:42 localhost openvpn[1219]: qn_anqiu/xxx.xxx.xxx.xx:27351 crl:cannot read:/usr/local/cine/etc/keys/ Crl.pem:Too many open files (errno=24)

Even if you open the file descriptor process should not drop AH, this indicates that the OpenVPN BUG, Crl.pem The file is a log off of the certificate, if the certificate of cancellation is not passed, the OpenVPN service will reject the connection, I currently have more than 800 clients to connect, Does every connection request that the file not be freed? Wouldn't it be enough if you didn't release 65,535 file descriptors?
In order to solve the problem, we have to modify the configuration file to remove the verification of the parameters of the certificate, in the restart OpenVPN process, it is normal that there has never been a problem. The specific how to produce also needs to be further observed and studied.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.