search

danfruehauf / NetworkManager-ssh

SSH VPN integration for NetworkManager
Other
261 stars 38 forks source link

Can't open tun devices #77

Open Red-M opened 6 years ago

Red-M commented 6 years ago

Maybe I am doing this wrong but I can't seem to get any tun devices opened at all even if I am in the correct groups that should be able to open a tun interface.

I get:

$ /sbin/ifconfig tun101 10.8.0.8 netmask 255.255.255.252 pointopoint 10.8.0.9 up
SIOCSIFADDR: Operation not permitted
tun101: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: Operation not permitted
SIOCSIFDSTADDR: Operation not permitted
tun101: ERROR while getting interface flags: No such device
tun101: ERROR while getting interface flags: No such device

This could be a distro issue as I did have this working without root on both sides before, however I have had to rebuild a few machines lately due to other issues.

danfruehauf commented 6 years ago

This could be a distro issue as I did have this working without root on both sides before, however I have had to rebuild a few machines lately due to other issues.

If you got it to work without root, let me know what you did. But generally you need root to open new tun devices...

Red-M commented 6 years ago

I was in the netdev group on both machines however it seems an update may have reverted this.

Can I ask that some extra options to allow for sudo/su on the requesting/client machine be added so that I may supply a password to allow the tun on my machine to be opened?

Red-M commented 6 years ago

or allow tunctl to create a tun for the user (with access to change the tun for that user sudo tunctl -t tun0 -u <user> or su -c 'tunctl -t tun0 -u <user>') after sudo/su and then start the ssh session.

danfruehauf commented 6 years ago

Can I ask that some extra options to allow for sudo/su on the requesting/client machine be added so that I may supply a password to allow the tun on my machine to be opened?

Yes, it is a very fair ask. I've been wondering for a while what's the best way to go about that - so there is flexibility with the remote command that is going to be executed. I'm open to ideas that can make it easy for more people.