LimitNPROC=10 is too tight.

[Rombobeorn]

LimitNPROC=10 is set in distro/systemd/openvpn-client@.service.in and distro/systemd/openvpn-server@.service.in. As I understand the documentation, that limit applies collectively to all the processes and threads that run in the openvpn account.

I have a box with three OpenVPN tunnels, and a so-called external script that is invoked when the tunnels go up or down. The script invokes a few other programs to notify some things of the state change, and some of those processes happen to start a second thread. When all three tunnels restart in parallel, they easily run into the ten-thread limit, even though the system resources consumed are negligible.

LimitNPROC=100 would be much less likely to cause problems, while still being low enough to serve its purpose. Things like fork bombs would have to start way more than 100 processes to do any damage on any modern computer.