File permissions

Best practice often dictates that once operations requiring escalated privileges have been completed, a daemon or process should drop to an unprivileged user. Many of the OpenVPN how-to documents illustrate this by calling the --user and --group configuration parameters. These same instructions, along with other guidance suggest that your configuration, certificates, keys, and other related files have root ownership. This practice prevents an unprivileged user or process from surreptitiously changing keys, routes, and other parameters.

Once OpenVPN reduces its running privileges, it will be unable to re-read the configuration files, certificates, and keys without some additional options. This may be the desired behavior, and it is the more secure configuration though it is not very resilient. When an option such as --ping-restart is used, the OpenVPN process will attempt to restart itself, requiring a re-read of the certificate, keys, and configuration. If privileges have...