Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to connect to an OpenVPN server. It works perfectly when I use root to give out the commands to connect:

openvpn /etc/openvpn/client.conf

but with a normal user I get this error messages in the log:

Aug 15 18:01:43 a openvpn[4755]: OpenVPN 2.1.1 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Jan  5 2010
Aug 15 18:01:43 a openvpn[4755]: WARNING: you are using user/group/chroot/setcon without persist-tun -- this may cause restarts to fail
Aug 15 18:01:43 a openvpn[4755]: WARNING: you are using user/group/chroot/setcon without persist-key -- this may cause restarts to fail
Aug 15 18:01:43 a openvpn[4755]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Aug 15 18:01:43 a openvpn[4755]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Aug 15 18:01:43 a openvpn[4755]: Control Channel Authentication: using '/home/MYUSERNAME/.cert/shared.key' as a OpenVPN static key file
Aug 15 18:01:43 a openvpn[4755]: LZO compression initialized
Aug 15 18:01:43 a openvpn[4756]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Aug 15 18:01:43 a openvpn[4756]: UDPv4 link local: [undef]
Aug 15 18:01:43 a openvpn[4756]: UDPv4 link remote: 111.222.333.444:443
Aug 15 18:01:43 a openvpn[4756]: [vpnserver] Peer Connection Initiated with 192.168.1.1:443
Aug 15 18:01:46 a openvpn[4756]: Note: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Aug 15 18:01:46 a openvpn[4756]: Note: Attempting fallback to kernel 2.2 TUN/TAP interface
Aug 15 18:01:46 a openvpn[4756]: Cannot allocate TUN/TAP dev dynamically
Aug 15 18:01:46 a openvpn[4756]: Exiting

So it looks like I need root priviledges to run the mentioned command.

Solutions that I've googled:
- setuid bit: https://fedoraproject.org/wiki/Features/RemoveSETUID - not good anymore
- "visudo" as root, then append this to the file:

MYUSERNAME ALL = NOPASSWD: /usr/sbin/openvpn

Then the "MYUSERNAME" user can launch the "sudo /usr/sbin/openvpn" binary with root priviledges.

p.s.1:

$ which openvpn
/usr/sbin/openvpn

p.s.2: Using Fedora 14/bash.

THE QUESTION:
- Are there any better/safer methods to launch the OpenVPN client as a normal user?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

OpenVPN needs root access because it needs to asign IP addresses to your newly created interface.

If you are running on a graphical mode, you could try NetworkManager plugin for openvpn, which runs pretty well and lets your vpn just one click away. Some users think that NetworkManager is a little bit intrusive (but that is OFT).

Other than that, your best shot is, as you stated, sudo. Far better than playing with setuid bit, IMHO.

share|improve this answer
    
it also needs root to add the routes to the routing table. –  Sirex Aug 16 '11 at 6:45
    
You mean this NetworkManager? - unix.stackexchange.com/questions/18788/… ... –  LanceBaynes Aug 16 '11 at 8:17
    
@LanceBaynes there is only one NetworkManager :). I have no idea if you can. The best way to find out is to generate you config file, then have it imported by NetworkManager, –  Torian Aug 16 '11 at 12:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.