wg-quick spamming my logs

gearhead · 2022-04-22 02:02:14

I have installed wireguard to be able to connect to my server in another state. It works and I can connect.

What I did notice, though, was that my log was filling so fast I was running out of space on /. I get this repeated over and over when the wireguard is or is not active:

Apr 21 20:51:30 V550VX sudo[2761]: kmgrider : PWD=/home/kmgrider ; USER=root ; COMMAND=/bin/systemctl show -p LoadState -p ActiveState wg-quick@wg0.service
Apr 21 20:51:30 V550VX sudo[2761]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1002)
Apr 21 20:51:30 V550VX sudo[2761]: pam_unix(sudo:session): session closed for user root
Apr 21 20:51:38 V550VX sudo[2771]: kmgrider : PWD=/home/kmgrider ; USER=root ; COMMAND=/bin/systemctl show -p LoadState -p ActiveState wg-quick@wg0.service
Apr 21 20:51:38 V550VX sudo[2771]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1002)
Apr 21 20:51:38 V550VX sudo[2771]: pam_unix(sudo:session): session closed for user root

I run Arch with Gnome and use a gnome extension to be able to turn on and off the wireguard VPN to connect when I need to.
https://extensions.gnome.org/extension/ … indicator/
I have a hunch this is what is spamming my log, though. Is there a way to fix it so it does not spam the log and fill my root partition on my hard drive?

Keith

seth · 2022-04-22 06:30:19

The extension mindleslly uses sudo to poll the activatation state of the wg-quick service. It also manipulates your sudoers for various commands.
It also references pkexec w/o ever using it.
Edit this nonsense out of the tools.sh and don't install random shit you found on the interwebz w/o vetting it. Especially if it demands root permissions.
Joe user should get challenged on de/activation of wireguard (pkexec or piping pinentry into sudo) and polling doesn't and must not require root permissons - granting *everybody* the passwordless ability to do so is insane.

So bottom line and my verdict:
it's clearly the extension causing those logged audits and the extension is at best (I've not checked it's entirety) inept and clumsy - you should rather not trust it at all.

gearhead · 2022-04-22 12:26:29

Done. Thanks for the help.

Now for the larger question. How are we supposed to control our wireguard connections from the Gnome UI? NetworkManager's UI does not really support it. There used to be a special plugin or something to NM, but it is no longer being developed. This poorly written extension was all that I could find.

Keith

seth · 2022-04-22 14:06:56

https://wiki.archlinux.org/title/WireGu … orkManager
https://gitlab.freedesktop.org/NetworkM … issues/358

Unfortunately (well, not for me) I don't use gnome and would not configure wg through a GUI anyway and I have no idea whether there's any kind of good GUI.
You could however raise this w/ the extension author and ask him to improve the script - or derive your own, better extension that does not make mindless use of sudo.

Arch Linux

#1 2022-04-22 02:02:14

wg-quick spamming my logs

#2 2022-04-22 06:30:19

Re: wg-quick spamming my logs

#3 2022-04-22 12:26:29

Re: wg-quick spamming my logs

#4 2022-04-22 14:06:56

Re: wg-quick spamming my logs

Board footer