How can I run something that needs sudo at every login without having to do so manually? (kbin.social)

submitted 4 months ago* (last edited 4 months ago) by ReCursing@kbin.social to c/linux@kbin.social

15 comments fedilink hide all child comments

I want to run openvpn every time I log on, but currently I run

sudo openvpn --config <myconfig> --auth-user-pass <user/pass>

every time. Is there a way to make it run that automatically and not need my password?

I could make it launch a terminal and run a script but is there a way that would not require me to type my password every time? Can I maybe give myself permissions to whatever openvpn needs so it doesn't need sudo? How do I find out what those permissions are? Is this the right place to ask?

I'm running KDE/Plasma 6 on Manjaro should that matter

edit: Thanks all! I'm going to try the systemd option, if I can't get that working I'll fall back to the cronjob option, and failing that changing openvpn to not need a password for sudo and launching a script at kde statup.

top 15 comments

sorted by: hot top controversial new old

[-] tophneal@sh.itjust.works 6 points 4 months ago

A systemd service file can do this

[-] Godort@lemm.ee 1 points 4 months ago

This is the way I would handle this.

[-] ReCursing@kbin.social 1 points 4 months ago

That looks pretty straightforward. I'll look into doing that. And if I can;t make it work I'll go with the cron job option suggested by @Andromeda above

[-] tophneal@sh.itjust.works 1 points 4 months ago* (last edited 4 months ago)

Actually OP, for the easiest, safest option to your system I would say @Supermariofan67 hit the nail on the head. Use your network manager settings: https://forum.manjaro.org/t/automatically-connect-to-vpn-on-startup/46298

If it’s not already installed there’s an openvpn plugin: https://software.manjaro.org/package/networkmanager-openvpn

[-] nieceandtows@programming.dev 1 points 4 months ago

Yeah OP, look into this. It's easy once you get the hang of it, and you don't have to make your system vulnerable by making sudo password less.

[-] exscape@kbin.social 2 points 4 months ago

You can make sudo password-less for a single command (including using specific arguments) though, so even if using sudo were the only solution, it wouldn't be that bad. For example, I have a sudoers entry that allows my user to decrypt my ZFS pool by executing a root-owned script (with permissions 700), but everything else requires a password.

[-] Supermariofan67@programming.dev 3 points 4 months ago

For this in particular, look into setting up NetworkManager to do the openvpn configuration, it has that functionality built in. Otherwise, systemd unit file

[-] tophneal@sh.itjust.works 2 points 4 months ago

I don’t use open VPN so I don’t know for sure, but I think you’re right as the best way to go. Pretty sure I recall Network Manager having an option to set a vpn to be always on when a network connection is made and an option to save credentials.

[-] UID_Zero@infosec.pub 2 points 4 months ago

Look into editing the sudoers file. Add a line that allows you to run openvpn with the NOPASSWD option.

I strongly recommend not using that for everything, just the specific commands you need to run non-interactively.

[-] ReCursing@kbin.social 1 points 4 months ago

I didn't know that was an option! Sounds generally insecure but if the other options here don't work out this should solve it. Thanks!

[-] UID_Zero@infosec.pub 2 points 4 months ago

It's only as insecure as you make it. It's an option, it needs to be used responsibly.

[-] lurch@sh.itjust.works 2 points 4 months ago

AFAIK you can allow it in the sudoers file to not need a password, if you keep the sudo.

idk how KDE autostarts, tho.

[-] jadi@mastodon.social 1 points 4 months ago

@ReCursing you can set your user to be able to run openvpn as root (sudo) without password
https://www.youtube.com/watch?v=rNxitwVtRvo

[-] e_t_@kbin.pithyphrase.net 1 points 4 months ago

Read the documentation on the sudoers file. You can specify particular commands to not require a password.

[-] Atemu@lemmy.ml 1 points 4 months ago

If you're using NetworkManager, I'd recommend you to use it to create a VPN profile instead and connect to that on startup through the unprivileged nmcli.

this post was submitted on 24 Mar 2024

4 points (100.0% liked)

Linux

59 readers

2 users here now

founded 1 year ago