Hi Ola, > Hi Stefan > > As pptp obviously can be run also for non-root users I'm starting to think > that we should move pptp from /usr/sbin to /usr/bin. That would also solve > this problem, right?
I don't think thats the solution, it would break my (and probably others) setups. I'm using 'suid root' on /usr/sbin/pptp (see bug #384455) and call pon/poff as 'normal user which needs to be a member of group dip'. After pptp-linux install, i always do: 1) # chmod u+s,o-x /usr/sbin/pptp 2) # chown root.dip /usr/sbin/pptp 3) # pptpsetup ... ... ... 4) # <manually fix the path in the tunnel files> 5) # <add selected users to group dip> Reading your arguments on bug #384455 i have the feeling that you overlooked the 'o-x' on step 1) above which makes pptp unexecutable for 'normal users' which are not member of group 'dip' assigned in 2). With this setup, root needs to setup the connections and root adds users which should be able to connect to the group 'dip'. The actual user can't change the setup and don't needs to login as root to make a connection, which is IMHO more secure and handy. However, the user created by the squeeze d-i is automatically added to the group 'dip' (see change in package user-setup 1.29), this wasn't the case for older releases of debian. The solution as I see it, is: - fix pptpsetup to use the absolute path /usr/sbin/pptp (This is what this bug is about, breaks nothing, famous last words :-) - fix #384455, but maybe with group 'pptp' and not 'dip' (Needs the pptpsetup fix. I can make a patch if you agree on this solution) This group permission scheme is wide spread in debian packages, it would be nice to have it in pptp-linux too. Regards Stefan
signature.asc
Description: This is a digitally signed message part.
