[Openvpn-devel] GUI repo

[Openvpn-devel] GUI repo

[Selva Nair]

[-- Attachment #1: Type: text/plain, Size: 228 bytes --]

Hi,

We can now remove the HighestAvailable privilege request in GUI, but have
to keep it in the 2.3.x windows installer which doesn't have iservice. So
it may be useful to make a release branch in the GUI repo.

Thanks,

Selva

[-- Attachment #2: Type: text/html, Size: 324 bytes --]

Re: [Openvpn-devel] GUI repo

[@ 2016-02-07 16:00 UTC (permalink / raw)]

[-- Attachment #1: Type: text/plain, Size: 493 bytes --]

if you mean interactive service, keep in mind that people sometimes start
openvpn as a child of openvpn-gui, not as a service

воскресенье, 7 февраля 2016 г. пользователь Selva Nair написал:

> Hi,
>
> We can now remove the HighestAvailable privilege request in GUI, but have
> to keep it in the 2.3.x windows installer which doesn't have iservice. So
> it may be useful to make a release branch in the GUI repo.
>
> Thanks,
>
> Selva
>
>

[-- Attachment #2: Type: text/html, Size: 680 bytes --]

Re: [Openvpn-devel] GUI repo

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 845 bytes --]

Hi,

On Sun, Feb 07, 2016 at 09:00:28PM +0500, ???????? ?????????????? wrote:
> if you mean interactive service, keep in mind that people sometimes start
> openvpn as a child of openvpn-gui, not as a service

Interactive Service is running openvpn.exe under control of openvpn-gui,
and you won't notice anything different - except that it magically works
even if the user has no permissions to set routes, and the "want admin!"
flag is not set on the GUI.

And, of course, that bugs in openvpn-gui or openvpn will not lead to a
privilege breach anymore.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...1296...
fax: +49-89-35655025                        gert@...1297...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 291 bytes --]

Re: [Openvpn-devel] GUI repo

[@ 2016-02-07 20:12 UTC (permalink / raw)]

[-- Attachment #1: Type: text/plain, Size: 1276 bytes --]

there's still "Start OpenVPN directly"

https://github.com/OpenVPN/openvpn-gui/blob/master/openvpn.c#L724

in such case admin rights are still required for routes manipulation.


maybe we should release two installers (or make a checkbox in installer?)

1) regular mode (with highest priv manifest)
2) paranoya mode (without highest priv)


those who really care will choose whatever they want to


2016-02-08 0:27 GMT+05:00 Gert Doering <gert@...1296...>:

> Hi,
>
> On Sun, Feb 07, 2016 at 09:00:28PM +0500, ???????? ?????????????? wrote:
> > if you mean interactive service, keep in mind that people sometimes start
> > openvpn as a child of openvpn-gui, not as a service
>
> Interactive Service is running openvpn.exe under control of openvpn-gui,
> and you won't notice anything different - except that it magically works
> even if the user has no permissions to set routes, and the "want admin!"
> flag is not set on the GUI.
>
> And, of course, that bugs in openvpn-gui or openvpn will not lead to a
> privilege breach anymore.
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //
> www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert@...1296...
> fax: +49-89-35655025
> gert@...1297...
>

[-- Attachment #2: Type: text/html, Size: 2217 bytes --]

Re: [Openvpn-devel] GUI repo

[Selva Nair]

[-- Attachment #1: Type: text/plain, Size: 781 bytes --]

Hi,

On Sun, Feb 7, 2016 at 11:00 AM, Илья Шипицин <chipitsine@...277...> wrote:

> if you mean interactive service, keep in mind that people sometimes start
> openvpn as a child of openvpn-gui, not as a service


Requiring HighestAvailable was an interim solution until interactive
service becomes available.  Users who do not want to use the interactive
service can use Run As Administrator.

So the idea is to keep the current manifest  in the GUI distributed with
2.3 and remove the HigestAvailable from that to be distributed with 2.4.
This change is also required to let admin users (with UAC) use interactive
service, as the plan is to make the GUI not connect to the service if run
with higher privileges (see my pending pull request).

Selva

[-- Attachment #2: Type: text/html, Size: 1393 bytes --]

Re: [Openvpn-devel] GUI repo

[Selva Nair]

[-- Attachment #1: Type: text/plain, Size: 853 bytes --]

Hi,

On Sun, Feb 7, 2016 at 3:12 PM, Илья Шипицин <chipitsine@...277...> wrote:

> there's still "Start OpenVPN directly"
>
> https://github.com/OpenVPN/openvpn-gui/b, lob/master/openvpn.c#L724
> <https://github.com/OpenVPN/openvpn-gui/blob/master/openvpn.c#L724>
>
> in such case admin rights are still required for routes manipulation.
>

Once interactive service is available in the distribution, such usage would
require the user to explicitly start the GUI with admin rights.


> maybe we should release two installers (or make a checkbox in installer?)
>
> 1) regular mode (with highest priv manifest)
> 2) paranoya mode (without highest priv)
>

For 2.4 just one installer with privilege request in the manifest would be
enough. No need to force UAC prompt for privilege escalation when not
required.

Selva

[-- Attachment #2: Type: text/html, Size: 1491 bytes --]

Re: [Openvpn-devel] GUI repo

[@ 2016-02-07 20:32 UTC (permalink / raw)]

[-- Attachment #1: Type: text/plain, Size: 1129 bytes --]

as far as I understand it is up to user whether to install openvpn as a
service or not.
if openvpn is not installed as a service, highest priv is required, right?

2016-02-08 1:29 GMT+05:00 Selva Nair <selva.nair@...277...>:

> Hi,
>
> On Sun, Feb 7, 2016 at 3:12 PM, Илья Шипицин <chipitsine@...277...> wrote:
>
>> there's still "Start OpenVPN directly"
>>
>> https://github.com/OpenVPN/openvpn-gui/b, lob/master/openvpn.c#L724
>> <https://github.com/OpenVPN/openvpn-gui/blob/master/openvpn.c#L724>
>>
>> in such case admin rights are still required for routes manipulation.
>>
>
> Once interactive service is available in the distribution, such usage
> would require the user to explicitly start the GUI with admin rights.
>
>
>> maybe we should release two installers (or make a checkbox in installer?)
>>
>> 1) regular mode (with highest priv manifest)
>> 2) paranoya mode (without highest priv)
>>
>
> For 2.4 just one installer with privilege request in the manifest would be
> enough. No need to force UAC prompt for privilege escalation when not
> required.
>
> Selva
>
>
>

[-- Attachment #2: Type: text/html, Size: 2232 bytes --]

Re: [Openvpn-devel] GUI repo

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 1449 bytes --]

Hi,

On Mon, Feb 08, 2016 at 01:12:37AM +0500, ???????? ?????????????? wrote:
> there's still "Start OpenVPN directly"
> 
> https://github.com/OpenVPN/openvpn-gui/blob/master/openvpn.c#L724
> 
> in such case admin rights are still required for routes manipulation.

In this case, it would just not work.

There's basically four cases:

 - you have no admin rights and use the iservice -> works
 - you have admin rights and do not use the iservice -> works
 - you have no admin rights and use *tap* with no routes and no v6 -> works
 - it does not work

I do not see a real problem here.  If you do not want to use the iservice,
you need to either have admin rights or stick to tap, done.

> maybe we should release two installers (or make a checkbox in installer?)
> 
> 1) regular mode (with highest priv manifest)
> 2) paranoya mode (without highest priv)
> 
> 
> those who really care will choose whatever they want to

Where would the benefit in refusing to use the iservice and sticking to
"highest priv manifest"?  All you get by doing this is "larger exposed
surface to exploitable bugs, as more code has to run with elevated privs"

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...1296...
fax: +49-89-35655025                        gert@...1297...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 291 bytes --]

Re: [Openvpn-devel] GUI repo

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 745 bytes --]

Hi,

On Sun, Feb 07, 2016 at 03:25:51PM -0500, Selva Nair wrote:
> So the idea is to keep the current manifest  in the GUI distributed with
> 2.3 and remove the HigestAvailable from that to be distributed with 2.4.
> This change is also required to let admin users (with UAC) use interactive
> service, as the plan is to make the GUI not connect to the service if run
> with higher privileges (see my pending pull request).

+1

(just for the record) :-)

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...1296...
fax: +49-89-35655025                        gert@...1297...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 291 bytes --]

Re: [Openvpn-devel] GUI repo

[@ 2016-02-08 3:27 UTC (permalink / raw)]

[-- Attachment #1: Type: text/plain, Size: 2237 bytes --]

2016-02-08 2:55 GMT+05:00 Gert Doering <gert@...1296...>:

> Hi,
>
> On Mon, Feb 08, 2016 at 01:12:37AM +0500, ???????? ?????????????? wrote:
> > there's still "Start OpenVPN directly"
> >
> > https://github.com/OpenVPN/openvpn-gui/blob/master/openvpn.c#L724
> >
> > in such case admin rights are still required for routes manipulation.
>
> In this case, it would just not work.
>
> There's basically four cases:
>
>  - you have no admin rights and use the iservice -> works
>  - you have admin rights and do not use the iservice -> works
>  - you have no admin rights and use *tap* with no routes and no v6 -> works
>  - it does not work
>
> I do not see a real problem here.  If you do not want to use the iservice,
> you need to either have admin rights or stick to tap, done.
>

you open a website and see "sql timeout period elapsed prior to
completion". ok, no real problem here. it was actually a timeout and
website tells that.

but how does it look from user point of view ? why do we show that to user
? how do you we want user to interact with that ?

same thing with vpn. people just want to use it. you are right, there're 4
cases. in every case we must provide very good UX/UI approach. if we can
not make it work, ok, let us say to user in intelligent way "you know, we
put security consideration first, your partcular case is very special,
please do so and so".

I do not beleive that "windows route add command failed" is proper way of
telling those things to user. same as for "sql exception" on website.



>
> > maybe we should release two installers (or make a checkbox in installer?)
> >
> > 1) regular mode (with highest priv manifest)
> > 2) paranoya mode (without highest priv)
> >
> >
> > those who really care will choose whatever they want to
>
> Where would the benefit in refusing to use the iservice and sticking to
> "highest priv manifest"?  All you get by doing this is "larger exposed
> surface to exploitable bugs, as more code has to run with elevated privs"
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //
> www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert@...1296...
> fax: +49-89-35655025
> gert@...1297...
>

[-- Attachment #2: Type: text/html, Size: 3483 bytes --]

Re: [Openvpn-devel] GUI repo

[@ 2016-02-08 3:35 UTC (permalink / raw)]

[-- Attachment #1: Type: text/plain, Size: 1929 bytes --]

I saw that PR.

I have one question regarding that.
when we deployed openvpn, we used to supply our users a config file without
"nobind" keyword.

it worked for most of our users, however, those who needed 2 or more vpn
connections complained that "port already bind". so, we added "nobind" to
client config files and people become happy.

what about that PR. there might be cases when

1) interactive service installed
2) user is administrator


how many openvpn processes will be running ? how many of them will attempt
to bind to 1194 ?

2016-02-08 2:56 GMT+05:00 Gert Doering <gert@...1296...>:

> Hi,
>
> On Sun, Feb 07, 2016 at 03:25:51PM -0500, Selva Nair wrote:
> > So the idea is to keep the current manifest  in the GUI distributed with
> > 2.3 and remove the HigestAvailable from that to be distributed with 2.4.
> > This change is also required to let admin users (with UAC) use
> interactive
> > service, as the plan is to make the GUI not connect to the service if run
> > with higher privileges (see my pending pull request).
>
> +1
>
> (just for the record) :-)
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //
> www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert@...1296...
> fax: +49-89-35655025
> gert@...1297...
>
>
> ------------------------------------------------------------------------------
> Site24x7 APM Insight: Get Deep Visibility into Application Performance
> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
> Monitor end-to-end web transactions and take corrective actions now
> Troubleshoot faster and improve end-user experience. Signup Now!
> http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140
> _______________________________________________
> Openvpn-devel mailing list
> Openvpn-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-devel
>
>

[-- Attachment #2: Type: text/html, Size: 3081 bytes --]

Re: [Openvpn-devel] GUI repo

[Selva Nair]

[-- Attachment #1: Type: text/plain, Size: 767 bytes --]

Hi,

On Sun, Feb 7, 2016 at 10:35 PM, Илья Шипицин <chipitsine@...277...> wrote:

> what about that PR. there might be cases when
>
> 1) interactive service installed
> 2) user is administrator
>

It will just work in all cases that worked before (as Gert said, 1, 2 and
1&&2). The pull request only does three things:

1. Attempt iService if the process is not elevated, else directly start
openvpn
2. Use HKCU to store GUI-specific registry keys
3. Save logs in %UserProfile%\OpenVPN\log

'highestPrivilege' in the manifest is not removed -- not yet.


> how many openvpn processes will be running ? how many of them will attempt
> to bind to 1194 ?
>

Though tempting, this has nothing to do with the PR so I'll pass.

Selva

[-- Attachment #2: Type: text/html, Size: 1512 bytes --]

Re: [Openvpn-devel] GUI repo

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 673 bytes --]

Hi,

On Mon, Feb 08, 2016 at 08:27:13AM +0500, ???????? ?????????????? wrote:
> but how does it look from user point of view ? why do we show that to user
> ? how do you we want user to interact with that ?

Installer installs iservice, GUI uses it, done.

If someone wants expert mode and clicks on "do not install iservice!"
at installation time, this is what they get: expert mode.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...1296...
fax: +49-89-35655025                        gert@...1297...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 291 bytes --]

Re: [Openvpn-devel] GUI repo

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 1439 bytes --]

Hi,

On Mon, Feb 08, 2016 at 08:35:54AM +0500, ???????? ?????????????? wrote:
> I have one question regarding that.
> when we deployed openvpn, we used to supply our users a config file without
> "nobind" keyword.
> 
> it worked for most of our users, however, those who needed 2 or more vpn
> connections complained that "port already bind". so, we added "nobind" to
> client config files and people become happy.
> 
> what about that PR. there might be cases when
> 
> 1) interactive service installed
> 2) user is administrator
> 
> how many openvpn processes will be running ? how many of them will attempt
> to bind to 1194 ?

You still seem to misunderstand what iservice does - iservice does not
automatically run "thousands of OpenVPN processes".  It will do what the
GUI tells it to.

So if it does not work without iservice because GUI tries to start two
jobs with "bind 1194", it will not work with iservice either - no 
difference here.  First bind will succeed, second one will not.

What is "first" depends on what the GUI starts first - it's all controlled
by the GUI, the service does not start anything on its own.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...1296...
fax: +49-89-35655025                        gert@...1297...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 291 bytes --]

Re: [Openvpn-devel] GUI repo

[@ 2016-02-08 8:22 UTC (permalink / raw)]

[-- Attachment #1: Type: text/plain, Size: 1739 bytes --]

I saw few cases when openvpn.exe remains running even after openvpn-gui
told it to stop (and it was awful).
is iservice magic of start/stop openvpn.exe  the same as for openvpn-gui ?

if yes, I would say that it is ok to switch to iservice by default.

2016-02-08 12:42 GMT+05:00 Gert Doering <gert@...1296...>:

> Hi,
>
> On Mon, Feb 08, 2016 at 08:35:54AM +0500, ???????? ?????????????? wrote:
> > I have one question regarding that.
> > when we deployed openvpn, we used to supply our users a config file
> without
> > "nobind" keyword.
> >
> > it worked for most of our users, however, those who needed 2 or more vpn
> > connections complained that "port already bind". so, we added "nobind" to
> > client config files and people become happy.
> >
> > what about that PR. there might be cases when
> >
> > 1) interactive service installed
> > 2) user is administrator
> >
> > how many openvpn processes will be running ? how many of them will
> attempt
> > to bind to 1194 ?
>
> You still seem to misunderstand what iservice does - iservice does not
> automatically run "thousands of OpenVPN processes".  It will do what the
> GUI tells it to.
>
> So if it does not work without iservice because GUI tries to start two
> jobs with "bind 1194", it will not work with iservice either - no
> difference here.  First bind will succeed, second one will not.
>
> What is "first" depends on what the GUI starts first - it's all controlled
> by the GUI, the service does not start anything on its own.
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //
> www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert@...1296...
> fax: +49-89-35655025
> gert@...1297...
>

[-- Attachment #2: Type: text/html, Size: 2604 bytes --]