review and merge vpn-firewall pull reqeust - 'Using capabilities instead of sudoers'

phabricator-migrator · February 19, 2024, 5:43pm

Information

ID: 655
PHID: PHID-TASK-ipp73fhgk4fqilndbb7m
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

github.com/adrelanos/vpn-firewall

Using capabilities instead of sudoers

opened 05:40PM - 29 Mar 17 UTC

closed 11:13AM - 06 Nov 17 UTC

ghost

With modern systemd and kernel we can use capabilities to start openvpn unprivil…eged instead of using sudoers file. It'll be easier to maintain and it enable openvpn to modify tun device characteristic when needed. Additionally we can harden runtime environment for better security. Here's sample service: ``` [Service] User=tunnel Group=tunnel Restart=always ProtectSystem=strict ProtectControlGroups=true RestrictRealtime=true ProtectKernelModules=true CapabilityBoundingSet= CapabilityBoundingSet=CAP_NET_ADMIN AmbientCapabilities=CAP_NET_ADMIN ReadWritePaths=/etc/resolv.conf /run/openvpn-client /run/resolvconf ProtectKernelTunables=true NoNewPrivileges=true RestrictAddressFamilies=AF_INET AF_UNIX AF_NETLINK PrivateTmp=true ProtectHome=true ``` Above will need to load `tun` kernel module before start. It can be set in `/etc/modules-load.d`. Also file read permissions could be managed from by ACL instead of chown.

review and merge vpn-firewall pull reqeust - 'Using capabilities instead of sudoers'

Information

Description

Comments