d4h0
commented
2 years ago Is there any way, an attacker that got access to my system could use Vopono to execute arbitrary commands? Vopono seems to interact with several complex systems, so I guess even you can't be sure about that, but I may be wrong.
I just realized, that asking this was a bit dumb. Vopono itself, obviously, executes arbitrary commands, so setting NOPASSWD for vopono would anybody allow executing commands with root privileges...
jamesmcm
Hi,
Thank you so much for creating Vopono! So far, it seems to work very well :)
I'm wondering what the best way would be to script Vopono.
For example, let's say, I'd like to change my VPN connection every 30 minutes, and I'm running Privoxy within Vopono (this way, I could just configure my browser to use Privoxy as HTTP proxy, and I wouldn't have to restart my browser every 30 minutes):
$ vopono -v exec --provider azirevpn -k -u root -f 8118 --server norway "privoxy --chroot --user privoxy /etc/privoxy/config"The scripting part would be easy, of course, but after 30 minutes (I believe) the script would ask for my password again.
What would be the best way to avoid this?
For example, I could run my script as root. But that seems to lead to problems with Vopono (from the issues I've read). Besides that, for the obvious reasons, I'd like to avoid running my script as root.
Another option would be to switch to passwordless sudo (disabling the requirement to enter the password, when executing a command via
sudo), which I would like to avoid as well.It seems, the SUDO_ASKPASS environment variable could be used to provide the password, but I'm not sure how to do this securely.
The last option I see, would be to set
NOPASSWDonly for/usr/bin/voponoviasudoers:my_user host_name=NOPASSWD: /usr/bin/voponoThis looks the most promising to me, but I never did something like this, and I have no clue if that would be secure.
Is there any way, an attacker that got access to my system could use Vopono to execute arbitrary commands? Vopono seems to interact with several complex systems, so I guess even you can't be sure about that, but I may be wrong.
If this option turns out to be secure, I believe it would be good to add it to the
systemdsection of the user guide. You are mentioning passwordless sudo access, but I interpreted this as "passwordless sudo access for everything". But maybe this interpretation is wrong, and you meant settingNOPASSWDonly forvopono.Thanks again, for your work! :)