Error other provider

[LaCorneilleDeBerni]

Hi, I'm newbie here and on all the linux based system.

I try to install haugene/docker-transmission-openvpn on raspberry pi. I try to make my best to understand all parameters, but I think i miss some. I don't understand why it's write "No such file or directory" whereas they are upload by the command in environment variables GITHUB_CONFIG_SOURCE_REPO. The dir /etc/openvpn/cyberghost is already make.

My volumes are
container : /data
host : /mnt/ssd1/download/transmissionopenvpn

container : /config
host : /mnt/ssd1/download/transmissionopenvpn

Starting container with revision: b33d0fe
Creating TUN device /dev/net/tun
Using OpenVPN provider: CYBERGHOST
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for CYBERGHOST. Defaulting to external config
Downloading configs from https://github.com/LaCorneilleDeBerni/vpn-configs-contrib/archive/main.zip into /tmp/tmp.DS7xaFC3yq
Extracting configs to /tmp/tmp.YF7CuUkYvF
Found configs for CYBERGHOST in /tmp/tmp.YF7CuUkYvF/vpn-configs-contrib-main/openvpn/cyberghost, will replace current content in /etc/openvpn/cyberghost
Cleanup: deleting /tmp/tmp.DS7xaFC3yq and /tmp/tmp.YF7CuUkYvF
No VPN configuration provided. Using default.
Modifying /etc/openvpn/cyberghost/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
sed: can't read /etc/openvpn/cyberghost/default.ovpn: No such file or directory
Modification: Change ca certificate path
sed: can't read /etc/openvpn/cyberghost/default.ovpn: No such file or directory
Modification: Change ping options
sed: can't read /etc/openvpn/cyberghost/default.ovpn: No such file or directory
sed: can't read /etc/openvpn/cyberghost/default.ovpn: No such file or directory
sed: can't read /etc/openvpn/cyberghost/default.ovpn: No such file or directory
sed: can't read /etc/openvpn/cyberghost/default.ovpn: No such file or directory
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
2022-12-02 14:40:01 Cipher negotiation is disabled since neither P2MP client nor server mode is enabled
Options error: You must define TUN/TAP device (--dev)
Use --help for more information.

Thanks for your time !

[haugene]

Hey. The important line here is No VPN configuration provided. Using default. and then we see the sed: can't read /etc/openvpn/cyberghost/default.ovpn: No such file or directory lines appear.

Since you have not provided a value for OPENVPN_CONFIG it will look for a file called default.ovpn by default. Looking at the configs you have added to your fork it should work if you set OPENVPN_CONFIG=openvpn then it will choose the openvpn.ovpn config file that is there.

Hope that works 🤞 😄

[LaCorneilleDeBerni]

First, thank for your answer !
Great ! I don't know how I missed that, I rename my file as "default.ovpn" on the GitHub page.

An other problem right now : When I downloaded cyberghost files, I had not only .ovpn, but .crt .key and .ca files. I put them into the same directory on GitHub, with the exact same name (follow those indications haugene/vpn-configs-contrib/CONTRIBUTING.md) but I have this errno=2. Am I miss an other thing? Really, thank you for your time !

Starting container with revision: b33d0fe
Creating TUN device /dev/net/tun
Using OpenVPN provider: CYBERGHOST
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for CYBERGHOST. Defaulting to external config
Downloading configs from https://github.com/LaCorneilleDeBerni/vpn-configs-contrib/archive/main.zip into /tmp/tmp.oLoiwd4gDc
Extracting configs to /tmp/tmp.UJ8XjUBfNg
Found configs for CYBERGHOST in /tmp/tmp.UJ8XjUBfNg/vpn-configs-contrib-main/openvpn/cyberghost, will replace current content in /etc/openvpn/cyberghost
Cleanup: deleting /tmp/tmp.oLoiwd4gDc and /tmp/tmp.UJ8XjUBfNg
No VPN configuration provided. Using default.
Modifying /etc/openvpn/cyberghost/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
2022-12-03 15:11:00 DEPRECATED OPTION: ncp-disable. Disabling cipher negotiation is a deprecated debug feature that will be removed in OpenVPN 2.6
2022-12-03 15:11:00 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
Options error: --cert fails with 'client.crt': No such file or directory (errno=2)
2022-12-03 15:11:00 WARNING: cannot stat file 'client.key': No such file or directory (errno=2)
Options error: --key fails with 'client.key': No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.

[haugene]

Right. So your config contains the lines:

ca ca.crt
cert client.crt
key client.key

which assumes that the files are in the current working directory when the config is read. This is not how we're running the container today. The configs will be within /etc/openvpn/<provider>/client.key for example, in your case /etc/openvpn/cyberghost/client.key

We have a script that will automatically make that adjustment for the ca.crt and that's why it's not throwing an error for that file, but just the other two.

I can add support for the other two files as well, or you can change those lines to:

cert /etc/openvpn/cyberghost/client.crt
key /etc/openvpn/cyberghost/client.key

and it should work. I will gladly make the addition to the script, but...

Having a look at the manual for OpenVPN and looking at the --cert and --key stuff they do mention "signed private keys" etc. So I'm only wondering if this is something that should be kept private.

Don't have time to dig into that now. But could you help me investigate if they are safe to expose publicly? And then we can make the adjustments to the script if needed.

I did try running with your config and key+cert and I'm getting an error with AUTH: Received control message: AUTH_FAILED as I was just using a dummy username and password combo. So it doesn't seem to provide automatic access to connect with your account or anything.

Still - we should verify that this is a safe practice before officially supporting it.

[LaCorneilleDeBerni]

Ok, I understand. I will contact cyberghost directly to see if it's sensitive data or not, I keep inform you.

Really thanks to share all of your work !

[LaCorneilleDeBerni]

So, I had them by chat. "We cannot guarantee as it is already outside the CyberGhost Support. However, as mentioned, with that matter, we recommend not to put in public for it not to be at risk."
Not more answer from them...