Hi Stefan Thanks a lot for the additional information. Good to know that I was not so wrong when it come to privileges. I agree with you that the absolute path approach is probably preferred.
Thanks, // Ola On Tue, Mar 08, 2011 at 04:54:46PM +0100, Stefan Kisdaroczi wrote: > Hi Ola, > > > Hi Stefan > > > > As pptp obviously can be run also for non-root users I'm starting to think > > that we should move pptp from /usr/sbin to /usr/bin. That would also solve > > this problem, right? > > I don't think thats the solution, it would break my (and probably others) > setups. > > I'm using 'suid root' on /usr/sbin/pptp (see bug #384455) and call pon/poff > as > 'normal user which needs to be a member of group dip'. > > After pptp-linux install, i always do: > 1) # chmod u+s,o-x /usr/sbin/pptp > 2) # chown root.dip /usr/sbin/pptp > 3) # pptpsetup ... ... ... > 4) # <manually fix the path in the tunnel files> > 5) # <add selected users to group dip> > > Reading your arguments on bug #384455 i have the feeling that you overlooked > the 'o-x' on step 1) above which makes pptp unexecutable for 'normal users' > which are not member of group 'dip' assigned in 2). > > With this setup, root needs to setup the connections and root adds users > which > should be able to connect to the group 'dip'. The actual user can't change > the > setup and don't needs to login as root to make a connection, which is IMHO > more secure and handy. > > However, the user created by the squeeze d-i is automatically added to the > group 'dip' (see change in package user-setup 1.29), this wasn't the case for > older releases of debian. > > The solution as I see it, is: > - fix pptpsetup to use the absolute path /usr/sbin/pptp > (This is what this bug is about, breaks nothing, famous last words :-) > - fix #384455, but maybe with group 'pptp' and not 'dip' > (Needs the pptpsetup fix. I can make a patch if you agree on this solution) > > This group permission scheme is wide spread in debian packages, it would be > nice to have it in pptp-linux too. > > Regards > Stefan -- --- Inguza Technology AB --- MSc in Information Technology ---- / [email protected] Annebergsslingan 37 \ | [email protected] 654 65 KARLSTAD | | http://inguza.com/ Mobile: +46 (0)70-332 1551 | \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 / --------------------------------------------------------------- -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
