search

Zomboided / service.vpn.manager

VPN plugin for Kodi
GNU General Public License v2.0
307 stars 80 forks source link

Sudo requirement is a major security flaw #289

Closed springjools closed 4 years ago

springjools commented 4 years ago

Addon requires the user associated with kodi to be a sudoer, which is not recommended. It also requires the caching of user's vpn credentials in an unsafe manner.

Would it be possible to find alternative methods for these issues. For example entering the credentals from a file? Also is it really necessary to kill the vpn process, maybe it could be restarted instead?

Unless your actual goal is to gather a vpn database with paid credentials?

Zomboided commented 4 years ago

Yeah, storing the userID and password in a plain text file, which is what openvpn requires is unsafe. Putting those credentials in the xml for the Kodi settings is also unsafe. So even if I encrypt the settings and store them elsewhere, they need to get unencrypted and stored on disk for input to openvpn. Even if I accept that something is better than nothing, then the private certificates and keys used are also stored unecrypted for input to openvpn. This isn't going to get fixed.

The use of sudo (or admin on Windows, as it's the same issue there) isn't great, but the main use case is Kodi boxes like LibreELEC on which everything is unsecure so my motivation to spend time fixing this is close to zero. Sure it can be used on a full Linux/Window box where this is less than ideal but on those boxes there are other options for managing vpn connections outside of Kodi.

If you think I'm gathering credentials then your options are :

  1. Don't use this free software
  2. Inspect the code which is available on github
springjools commented 4 years ago

I was thinking of mainly this:

Sure it can be used on a full Linux/Window box where this is less than ideal but on those boxes there are other options for managing vpn connections outside of Kodi.

I apologise if I missed this setting, but is the sudo not required on a linux box runnin debian? I mean does the kodi user not have to be a member of the sudoers group?

Zomboided commented 4 years ago

No, I mean that you can use the software provided by the VPN provider, or manage the VPN connection independently. If you want the add-on to do it, then it needs admin/sudo access.

On Mon, May 4, 2020 at 9:36 AM Jools notifications@github.com wrote:

I was thinking of mainly this:

Sure it can be used on a full Linux/Window box where this is less than ideal but on those boxes there are other options for managing vpn connections outside of Kodi.

I apologise if I missed this setting, but is the sudo not required on a linux box runnin debian? I mean does the kodi user not have to be a member of the sudoers group?

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub https://github.com/Zomboided/service.vpn.manager/issues/289#issuecomment-623332639, or unsubscribe https://github.com/notifications/unsubscribe-auth/AECJZZMGI7QGQH5C4BQHD43RPZ47LANCNFSM4MYRC5XA .