Gentoo/OpenVPN Non Root
OpenVPN Client Non Root
End result, user can use own tool (I use knemo) to connect/disconnect from net-misc/openvpn.
The logic is to create tun device and allow users to access it, and wrapping the /sbin/ip using sudo.
The control of the daemon is done using the OpenVPN management interface.
Setup
Linux Kernel Configuration: Add tap |
Device Drivers ---> [*] Network device support ---> <M> Universal TUN/TAP device driver support |
net-dns/openresolv is optional, but makes life much easier, see Gentoo/Openresolv.
It is very recommended to configure firewall on your computer, see firehol configuration.
Add:
rc_net_vpn0_need="firewall" # optional, if you setup firewall. rc_net_vpn0_provide="!net" tuntap_vpn0="tun" iproute2_vpn0="group users" config_vpn0="null" txqueuelen_vpn0="100" metric_vpn0="1"
#!/bin/sh sudo /sbin/ip $@
#!/bin/sh script="${0//my-}" if [ ${EUID} != 0 ] ; then if [[ -x /usr/bin/sudo ]] ; then echo "" | sudo -p "" -S /etc/openvpn/"${script}" "$@" exit $? fi echo "You need configure sudo to run $0" >&2 exit 1 else /etc/openvpn/"${script}" "$@" exit $? fi
dev-type tun dev vpn0 daemon up my-up.sh down my-down.sh iproute my-ip up-delay up-restart down-pre script-security 2 auth-retry nointeract management-signal management 127.0.0.1 2222 management-query-passwords management-forget-disconnect remap-usr1 SIGTERM
Defaults env_keep += "foreign_option_1" Defaults env_keep += "foreign_option_2" Defaults env_keep += "foreign_option_3" Defaults env_keep += "foreign_option_4" Defaults env_keep += "foreign_option_5" Defaults env_keep += "dev" %users ALL=(ALL) NOPASSWD: /etc/openvpn/up.sh %users ALL=(ALL) NOPASSWD: /etc/openvpn/down.sh %users ALL=(ALL) NOPASSWD: /sbin/ip
Until bug 391175 is resolved, update the following to have DNS lookup of vpn0 be prioritized:
interface_order="lo lo[0-9]* vpn*"
Dialogs
Fetch openvpn-kde-dialogs.pl from [here], and customize. Usually comment out
#use MIME::Base64; #use Crypt::X509;
knemo
Start:
Stop:
Maintainer
Authors
Originally written by: Alon Bar-Lev - 2011-11-17
Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".