From 96dcd4f08fcfd954d67e63f0dcf5264a275f6bc7 Mon Sep 17 00:00:00 2001 From: Matthias Andree Date: Sun, 31 Oct 2021 18:37:47 +0100 Subject: [PATCH] security/openvpn: create and use dedicated openvpn user (two commits squashed for clarity) PR: 259384 (cherry picked from commit bb6ec079c50dc6f45700dd5897b35f66a19ee51c) (cherry picked from commit 89d9e9320aff2d4c61be4c7dfa1b6829717bd034) --- GIDs | 2 +- UIDs | 2 +- security/openvpn/Makefile | 12 ++++++- ...patch-doc_man-sections_generic-options.rst | 11 +++++++ security/openvpn/files/patch-doc_openvpn.8 | 20 +++++++++++ .../openvpn/files/patch-doc_openvpn.8.html | 20 +++++++++++ security/openvpn/files/pkg-message.in | 33 ++++++++++++++----- 7 files changed, 89 insertions(+), 11 deletions(-) create mode 100644 security/openvpn/files/patch-doc_man-sections_generic-options.rst create mode 100644 security/openvpn/files/patch-doc_openvpn.8 create mode 100644 security/openvpn/files/patch-doc_openvpn.8.html diff --git a/GIDs b/GIDs index 109235222730..9fb724f71113 100644 --- a/GIDs +++ b/GIDs @@ -240,7 +240,7 @@ conduit:*:297: # free: 298 owncast:*:299: backuppc:*:300: -# free: 301 +openvpn:*:301: netdata:*:302: # free: 303 # free: 304 diff --git a/UIDs b/UIDs index 76d70a455da8..f85f3da178c6 100644 --- a/UIDs +++ b/UIDs @@ -245,7 +245,7 @@ conduit:*:297:297::0:0:Conduit daemon:/var/db/conduit:/usr/sbin/nologin # free: 298 owncast:*:299:299::0:0:& daemon:/nonexistent:/usr/sbin/nologin backuppc:*:300:300::0:0:BackupPC pseudo-user:/nonexistent:/usr/sbin/nologin -# free: 301 +openvpn:*:301:301::0:0:OpenVPN pseudo-user:/nonexistent:/usr/sbin/nologin netdata:*:302:302::0:0:NetData Daemon:/var/cache/netdata:/usr/sbin/nologin # free: 303 # free: 304 diff --git a/security/openvpn/Makefile b/security/openvpn/Makefile index 686f62e010d1..0c571b012fd6 100644 --- a/security/openvpn/Makefile +++ b/security/openvpn/Makefile @@ -2,7 +2,7 @@ PORTNAME= openvpn DISTVERSION= 2.5.4 -PORTREVISION?= 0 +PORTREVISION?= 1 CATEGORIES= security net net-vpn MASTER_SITES= https://swupdate.openvpn.org/community/releases/ \ https://build.openvpn.net/downloads/releases/ \ @@ -30,6 +30,9 @@ CONFLICTS_INSTALL?= openvpn-2.[!5].* openvpn-devel-[0-9]* openvpn-mbedtls-[0-9]* SUB_FILES= pkg-message openvpn-client +USERS= openvpn +GROUPS= openvpn + PORTDOCS= * PORTEXAMPLES= * @@ -100,6 +103,13 @@ _tlslibs=libssl libcrypto CONFIGURE_ARGS+= --enable-comp-stub .endif +post-patch: + ${REINPLACE_CMD} -E -i '' -e 's/(user|group) nobody/\1 openvpn/' \ + -e 's/"nobody"( after init)/"openvpn" \1/' \ + ${WRKSRC}/sample/sample-config-files/*.conf \ + ${WRKSRC}/sample/sample-config-files/xinetd-*-config \ + ${WRKSRC}/doc/man-sections/generic-options.rst + pre-configure: .ifdef (LOG_OPENVPN) @${ECHO} "Building with LOG_OPENVPN=${LOG_OPENVPN}" diff --git a/security/openvpn/files/patch-doc_man-sections_generic-options.rst b/security/openvpn/files/patch-doc_man-sections_generic-options.rst new file mode 100644 index 000000000000..a6fecf86a6fd --- /dev/null +++ b/security/openvpn/files/patch-doc_man-sections_generic-options.rst @@ -0,0 +1,11 @@ +--- doc/man-sections/generic-options.rst.orig 2021-10-31 16:17:17 UTC ++++ doc/man-sections/generic-options.rst +@@ -431,7 +431,7 @@ which mode OpenVPN is configured as. + able to gain control of an OpenVPN session. Though OpenVPN's security + features make this unlikely, it is provided as a second line of defense. + +- By setting ``user`` to :code:`nobody` or somebody similarly unprivileged, ++ By setting ``user`` to :code:`openvpn` or somebody similarly unprivileged, + the hostile party would be limited in what damage they could cause. Of + course once you take away privileges, you cannot return them to an + OpenVPN session. This means, for example, that if you want to reset an diff --git a/security/openvpn/files/patch-doc_openvpn.8 b/security/openvpn/files/patch-doc_openvpn.8 new file mode 100644 index 000000000000..a536dae76755 --- /dev/null +++ b/security/openvpn/files/patch-doc_openvpn.8 @@ -0,0 +1,20 @@ +--- doc/openvpn.8.orig 2021-10-05 05:57:01 UTC ++++ doc/openvpn.8 +@@ -358,7 +358,7 @@ lower priority, \fBn\fP less than zero is higher prior + .B \-\-persist\-key + Don\(aqt re\-read key files across \fBSIGUSR1\fP or \fB\-\-ping\-restart\fP\&. + .sp +-This option can be combined with \fB\-\-user nobody\fP to allow restarts ++This option can be combined with \fB\-\-user openvpn\fP to allow restarts + triggered by the \fBSIGUSR1\fP signal. Normally if you drop root + privileges in OpenVPN, the daemon cannot be restarted since it will now + be unable to re\-read protected key files. +@@ -577,7 +577,7 @@ useful to protect the system in the event that some ho + able to gain control of an OpenVPN session. Though OpenVPN\(aqs security + features make this unlikely, it is provided as a second line of defense. + .sp +-By setting \fBuser\fP to \fBnobody\fP or somebody similarly unprivileged, ++By setting \fBuser\fP to \fBopenvpn\fP or somebody similarly unprivileged, + the hostile party would be limited in what damage they could cause. Of + course once you take away privileges, you cannot return them to an + OpenVPN session. This means, for example, that if you want to reset an diff --git a/security/openvpn/files/patch-doc_openvpn.8.html b/security/openvpn/files/patch-doc_openvpn.8.html new file mode 100644 index 000000000000..5b1e8e805e13 --- /dev/null +++ b/security/openvpn/files/patch-doc_openvpn.8.html @@ -0,0 +1,20 @@ +--- doc/openvpn.8.html.orig 2021-10-05 05:57:01 UTC ++++ doc/openvpn.8.html +@@ -650,7 +650,7 @@ lower priority, n le + + --persist-key +

Don't re-read key files across SIGUSR1 or --ping-restart.

+-

This option can be combined with --user nobody to allow restarts ++

This option can be combined with --user openvpn to allow restarts + triggered by the SIGUSR1 signal. Normally if you drop root + privileges in OpenVPN, the daemon cannot be restarted since it will now + be unable to re-read protected key files.

+@@ -824,7 +824,7 @@ initialization, dropping privileges in the process. Th + useful to protect the system in the event that some hostile party was + able to gain control of an OpenVPN session. Though OpenVPN's security + features make this unlikely, it is provided as a second line of defense.

+-

By setting user to nobody or somebody similarly unprivileged, ++

By setting user to openvpn or somebody similarly unprivileged, + the hostile party would be limited in what damage they could cause. Of + course once you take away privileges, you cannot return them to an + OpenVPN session. This means, for example, that if you want to reset an diff --git a/security/openvpn/files/pkg-message.in b/security/openvpn/files/pkg-message.in index 29d37b360f3c..c527aec28683 100644 --- a/security/openvpn/files/pkg-message.in +++ b/security/openvpn/files/pkg-message.in @@ -1,17 +1,34 @@ [ { type: install message: <.ovpn +Connect to VPN server as a client with this command to include +the client.up/down scripts in the initialization: +openvpn-client .ovpn - For compatibility notes when interoperating with older OpenVPN - versions, please see +For compatibility notes when interoperating with older OpenVPN +versions, please see - Note that OpenVPN does not officially support LibreSSL. +Note that OpenVPN does not officially support LibreSSL. + +Note that OpenVPN configures a separate user and group "openvpn", +which should be used instead of the NFS user "nobody" +when an unprivileged user account is desired. + +You may want to add user openvpn and group openvpn when creating your +configuration files, the example configuration shows this only as comments. +EOM +} +{ type: upgrade + message: <