Gentoo/OpenVPN Non Root

Page last edited 1,325 days 8 hours ago
From Alon Bar-Lev's Site
Jump to: navigation, search

OpenVPN Client Non Root

End result, user can use own tool (I use knemo) to connect/disconnect from net-misc/openvpn.

The logic is to create tun device and allow users to access it, and wrapping the /sbin/ip using sudo.

The control of the daemon is done using the OpenVPN management interface.

Setup

Linux Kernel Configuration: Add tap
  Device Drivers  ---> 
    [*] Network device support  --->
      <M>   Universal TUN/TAP device driver support
emerge net-misc/openvpn net-dns/openresolv

net-dns/openresolv is optional, but makes life much easier, see Gentoo/Openresolv.

It is very recommended to configure firewall on your computer, see firehol configuration.

Add:

File: /etc/conf.d/net
rc_net_vpn0_need="firewall" # optional, if you setup firewall.
rc_net_vpn0_provide="!net"
tuntap_vpn0="tun"
iproute2_vpn0="group users"
config_vpn0="null"
txqueuelen_vpn0="100"
metric_vpn0="1"
ln -s net.lo /etc/init.d/net.vpn0 rc-update add net.vpn0 default /etc/init.d/net.vpn0 start
File: ~/openvpn/my-ip
#!/bin/sh
sudo /sbin/ip $@
File: ~/openvpn/my-up.sh
#!/bin/sh
script="${0//my-}"
if [ ${EUID} != 0 ] ; then
        if [[ -x /usr/bin/sudo ]] ; then
                echo "" | sudo -p "" -S /etc/openvpn/"${script}" "$@"
                exit $?
        fi
        echo "You need configure sudo to run $0" >&2
        exit 1
else
        /etc/openvpn/"${script}" "$@"
        exit $?
fi
ln -s my-up.sh ~/openvpn/my-down.sh
File: ~/openvpn/server.conf
Add:
dev-type tun
dev vpn0
daemon
up my-up.sh
down my-down.sh
iproute my-ip
up-delay
up-restart
down-pre
script-security 2
auth-retry nointeract
management-signal
management 127.0.0.1 2222
management-query-passwords
management-forget-disconnect
remap-usr1 SIGTERM
File: /etc/sudoers.d/openvpn
Defaults        env_keep += "foreign_option_1"
Defaults        env_keep += "foreign_option_2"
Defaults        env_keep += "foreign_option_3"
Defaults        env_keep += "foreign_option_4"
Defaults        env_keep += "foreign_option_5"
Defaults        env_keep += "dev"

%users ALL=(ALL) NOPASSWD: /etc/openvpn/up.sh
%users ALL=(ALL) NOPASSWD: /etc/openvpn/down.sh
%users ALL=(ALL) NOPASSWD: /sbin/ip

Until bug 391175 is resolved, update the following to have DNS lookup of vpn0 be prioritized:

File: /etc/resolvconf.conf
interface_order="lo lo[0-9]* vpn*"

Dialogs

Fetch openvpn-kde-dialogs.pl from [here], and customize. Usually comment out

#use MIME::Base64;
#use Crypt::X509;
emerge dev-perl/Net-Telnet

knemo

Context menu

Start:

( /usr/sbin/openvpn --cd /home/user/openvpn --config server.conf & ); exec /home/user/openvpn/openvpn-kde-dialogs.pl 2222 1

Stop:

killall openvpn

Maintainer

Alon Bar-Lev

Authors

Originally written by: Alon Bar-Lev - 2011-11-17


Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".