1

Openconnect website does have a chapter called "Running as a non-root user".

However, if you read it more closely, you will see that it does not answer the question of how to run openconnect as a non-root user. You ether need to call /etc/vpnc/vpnc-script as a root, or you need to use ip tools, which also require root access. In other words, you'll need root access one way and the other.

However, there are legit use cases when we need to grant a user the ability to connect to a VPN, while we still don't want them to have full root access.

How do you cope with that?

2
  • openconnect has a NetworkManager (which is tagged in this question) agent. Can you use NetworkManager without being root? If the answer is yes, that's it.
    – A.B
    May 19 at 22:57
  • I believe that might be a solution, but I'm yet to find a working .nmconnection file for a CISCO Anyconnect client. man nm-settings-keyfile(5) not very helpful as relevant examples are lacking.
    – foki
    May 19 at 23:53

1 Answer 1

1

This is a very unspecific answer, but you can configure tools like 'sudo' to give specific users the ability to run specific commands or script with specifically changed permissions. So you could allow a user sudo permissions to run openconnect and no other command with sudo.

Words of warning, giving a user sudo permissions to run ip is unsave. It can be used to gain a general root shell as explained in the gtfobins.

7
  • Good point. Listing commands with sudo access is both unsafe and nonpractical here. The former is due to what you referred to. The latter is because /etc/vpnc/vpnc-script invokes multiple other commands, and exploring the source code of a script to extract the list of programs you should "whitelist" in the /etc/sudoers file is not a practical solution.
    – foki
    May 19 at 22:44
  • As far as I understand you don't need to whitelist all the commands in the script, you just need to whitelist the script. As long as the script is not editable to the user and you can't supply arguments to the script to do things, they are not supposed to do, AND the user can not change the binaries called from the script, it should be save. This is always scary, but it is how access control works and I don't know how it could be improved.
    – bananabook
    May 20 at 7:39
  • What useful script do you know to which you cannot supply arguments. For example, ip is not save (even has -batch flag through which you can supply any script). It's very unsave. See gtfobins.github.io/gtfobins/ip/#sudo
    – foki
    May 20 at 15:34
  • You don't need to know a script you can just write one yourself. And my answer already linked that method.
    – bananabook
    May 20 at 15:40
  • 1
    Well, there are many reasons. For example, if you do sudo openconnect -b ... your process will be owned by root not your user. That is, you'll not be able to do pkill openconnect, for example. On the other hand, if you now "whitelist" kill, the user will be able to kill any process, and so on ...
    – foki
    May 20 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.