Non root users can't run openvpn as client

Del Pede · 2009-01-21 12:17:02

I'm trying to get non root users to run openvpn as a client, so they can connect to a openvpn server. But non root users are not able to run get it running. It returns

 Cannot allocate TUN/TAP dev dynamically

tun is loaded, via modprobe tun, and root is able to get it running via same config.

bash-3.2# ls -l /dev/net/tun 
crw-rw-rw- 1 root root 10, 200 21 jan 13:02 /dev/net/tun

Tun seem to have the right permissions.

Can anyone shed a bit of light on this issue.
Thanks

Del Pede

diddi · 2009-01-21 15:41:44

You must start openvpn as root, as that is the only user who can initiate tun/tap device.

However, to reduce security risks, the --user and --group parameter can be used to make openvpn drop root privileges after the tun/tap device is initiated.

If --user and/or --group is used, the --persist-tun can be used to hold the device, in case the connection resets.

Hope that helps!
/Diddi

Del Pede · 2009-01-21 15:52:27

diddi wrote:

You must start openvpn as root, as that is the only user who can initiate tun/tap device.
However, to reduce security risks, the --user and --group parameter can be used to make openvpn drop root privileges after the tun/tap device is initiated.
If --user and/or --group is used, the --persist-tun can be used to hold the device, in case the connection resets.
Hope that helps!
/Diddi

But then my regular users, can't initiate OpenVPN to connect to a privatenetwork. I would have to give them root rights, which is not an option. It seems odd, that non root users, can't get access to /dev/net/tun when it's allready there, and with rw access to everybody.

Isn't there anyway, to allow openvpn to run as a client, without having to do it via root?

diddi · 2009-01-21 19:41:28

I think, the problem is that openvpn does a few things that's kernel-related (like bringing up a new interface) and, for security reasons, only root has access to do.
One thing that I havn't checked out, is how much you could do with the openvpn socket (command line connection).
There should be a CLI-client to connect to the daemon, and certain settings can be made from there.
Not sure if it's possible, but if it is, then you might be able to start openvpn at boot-time, making it drop privileges to normal user, and then have other users connecting to it via CLI client and create their own connections.

Another solution might be to set the openvpn binary setuid root. However, I personally DO NOT recommend doing so as it is highly dangerous to your system.
By setting a binary setuid root, means that the binary will have root-privileges upon startup (no matter which user actually started it, and without password), and this also means that in case the binary is compromised, a bug is found or whatever, a normal user may be able to exploit it and gain root-access.

I understand your problem, and I don't really know the technical details to why it's not possible. (Also, I might be wrong : )

/Diddi

Del Pede · 2009-01-21 20:06:28

I can understand why you wouldn't want to run OpenVPN as a server, as a non root user, but in my eyes, running openvpn as a client, isn't any different, than letting users connect to a wlan. I might be very wrong on that one, but just looking for a solution ;-)

Starting OpenVPN as a client at boot up, is not an option, since it won't be able to connect to anything. I'd would like to use this on a laptop, which i use on different networks, and this is actually a problem i have on various distributions (like Ubuntu). I could of course see if i can install a vpn plugin for gnome-network-manager. I've had succes with that plugin on ubuntu, and has been able to connect to OpenVPN network as non-root user, but through network-manager-openvpn.

I guess I have to find a way of letting users start op OpenVPN as a client, with a minimum of root priveligies

tam1138 · 2009-01-21 20:39:50

Del Pede wrote:

I can understand why you wouldn't want to run OpenVPN as a server, as a non root user, but in my eyes, running openvpn as a client, isn't any different, than letting users connect to a wlan.

You're absolutely correct, and all the utilities that allow normal users to connect to vlans are setuid root. "The thing" here is that, even if you start an OpenVPN session as a user, it affects the entire machine. User 1 can create the VPN and then user 2 can access the connections enabled by it, just like user 1 can configure the wireless network and user 2 can use it. This is, in my opinion, indicative of a larger problem whereby single-user interfaces (eg, interface configuration programs) affect multi-user machines. In one sense they are good, because it's convenient to change such things using pretty GUI apps on machines that only ever see one user, but it damages the user's perspective when moving to a multi-user machine model, as apparent by the OP's confusion.

Okay, lots of philosophizing. The short answer is that a normal user shouldn't be able to run the OpenVPN client because it alters kernel state (eg, routes, interfaces, etc). If you really really really want to do this, you could conceivably make the openvpn binary setuid root, but that's not just asking for trouble, it's begging for it, so forget I made that suggestion.

Del Pede · 2009-01-21 20:53:38

tam1138 wrote:

Okay, lots of philosophizing. The short answer is that a normal user shouldn't be able to run the OpenVPN client because it alters kernel state (eg, routes, interfaces, etc). If you really really really want to do this, you could conceivably make the openvpn binary setuid root, but that's not just asking for trouble, it's begging for it, so forget I made that suggestion.

It makes sense. Don't let users get to much access to kernel. So what are my options, when i have users on roaming laptops, that needs to establish contact to a VPN? Try and get network-manager-openvpn installed? Are there other gui options. I've haven't really come across any, truth be told. Perhaps i could get around it with some tricky within /etc/sudoers?

All help so far have been greatly appreciated

Kirurgs · 2009-01-21 21:09:37

Guys, what about networkmanager? I use it as it's really FAST way of connection to anything, it's basically one click connection to wlan, vpnc, openvpn, dsl whatver...
I compile that myself using my own PKGBUILD's, which I borrowed from AUR and modified for some reasons of mine...
I dunno what about KDE, coz I'm using Gnome...

Del Pede · 2009-01-21 21:17:48

Kirurgs wrote:

Guys, what about networkmanager? I use it as it's really FAST way of connection to anything, it's basically one click connection to wlan, vpnc, openvpn, dsl whatver...
I compile that myself using my own PKGBUILD's, which I borrowed from AUR and modified for some reasons of mine...
I dunno what about KDE, coz I'm using Gnome...

I use Gnome as well, but i guess you can use network manager in KDE as well (i think i read something about that earlier for kubuntu users). I should try and give network-manager-openvpn a run under Arch Linux.

But at least i got some mystery solved today. Learning is always nice.
Thanks alot

Kirurgs · 2009-01-21 21:42:59

KDE has knetworkmanager and I don't know is it up to date, as I build it from svn + git versions (they split up core and everything else)...
Packages You need for NM are:
wpa-supplicant
libnetworkmanager
networkmanager
network-manager-apllet
networkmanager-openvpn
+ dependencies like openvpn itself...

I'm speaking for -git and -svn versions..
Hope this will clear up things for You...

Del Pede · 2009-01-21 21:45:15

Kirurgs wrote:

KDE has knetworkmanager and I don't know is it up to date, as I build it from svn + git versions (they split up core and everything else)...
Packages You need for NM are:
wpa-supplicant
libnetworkmanager
networkmanager
network-manager-apllet
networkmanager-openvpn
+ dependencies like openvpn itself...
I'm speaking for -git and -svn versions..
Hope this will clear up things for You...

I looked it up on AUR, and the package seemed out of date, so I reckon i have to compile it from scratch myself. Never really have installed from SVN before, so i better give that a reading.

But thanks

Kirurgs · 2009-01-21 22:08:04

PKGBUILD's are the thing You need, they will do everything, all the compilation is there
Just run the yaourt -S wpa-supplicant and all other and You should be fine...

If You never used AUR, check how to use it in the first place...

P.S. On the other hand, I have all the binaries compiled like yesterday, if that makes Your life easier, I can send then to You

damjan · 2009-01-22 04:29:54

Del Pede wrote:

But then my regular users, can't initiate OpenVPN to connect to a privatenetwork. I would have to give them root rights, which is not an option.

you know about "sudo" right?

sudo can be used ro selectivelly give root (or other users) rights to people with or without using a password.

Del Pede · 2009-01-22 10:36:46

damjan wrote:

Del Pede wrote:
But then my regular users, can't initiate OpenVPN to connect to a privatenetwork. I would have to give them root rights, which is not an option.
you know about "sudo" right?
sudo can be used ro selectivelly give root (or other users) rights to people with or without using a password.

I know about sudo, and that is the direction i'm heading as of now. Giving my users some priveliges to run openvpn as a client. My plan was to make a script, that would start openvpn and mount some dirs of a server. Having my users do that manually isn't really something i trust them to manage ;-)

I'm not really to strong on the syntax of /etc/sudoers, but that should be easily read up on, i suppose

Rad3k · 2010-04-23 13:42:02

I know it's an old thread, but I think I've found a partial solution to the problem. If you don't need dhcp, you can set up a persistent tun interface at system startup - just add something like that to your rc.local:

openvpn --mktun --dev tun0
ifconfig tun0 [local IP in VPN] pointopoint [server IP in VPN]

Then, you can run openvpn on tun0 as a normal user, but you'll be limited to static IP configuration in your VPN. If this bothers you, you can remove the ifconfig line and experiment with some connection managers (network-manager, wicd) to do the interface configuration.

Arch Linux

#1 2009-01-21 12:17:02

Non root users can't run openvpn as client

#2 2009-01-21 15:41:44

Re: Non root users can't run openvpn as client

#3 2009-01-21 15:52:27

Re: Non root users can't run openvpn as client

#4 2009-01-21 19:41:28

Re: Non root users can't run openvpn as client

#5 2009-01-21 20:06:28

Re: Non root users can't run openvpn as client

#6 2009-01-21 20:39:50

Re: Non root users can't run openvpn as client

#7 2009-01-21 20:53:38

Re: Non root users can't run openvpn as client

#8 2009-01-21 21:09:37

Re: Non root users can't run openvpn as client

#9 2009-01-21 21:17:48

Re: Non root users can't run openvpn as client

#10 2009-01-21 21:42:59

Re: Non root users can't run openvpn as client

#11 2009-01-21 21:45:15

Re: Non root users can't run openvpn as client

#12 2009-01-21 22:08:04

Re: Non root users can't run openvpn as client

#13 2009-01-22 04:29:54

Re: Non root users can't run openvpn as client

#14 2009-01-22 10:36:46

Re: Non root users can't run openvpn as client

#15 2010-04-23 13:42:02

Re: Non root users can't run openvpn as client

Board footer