{"action":"created","issue":{"url":"https://api.github.com/repos/opnsense/core/issues/1103","repository_url":"https://api.github.com/repos/opnsense/core","labels_url":"https://api.github.com/repos/opnsense/core/issues/1103/labels{/name}","comments_url":"https://api.github.com/repos/opnsense/core/issues/1103/comments","events_url":"https://api.github.com/repos/opnsense/core/issues/1103/events","html_url":"https://github.com/opnsense/core/issues/1103","id":169026993,"number":1103,"title":"IPSec (charon) demon does not reduce privilege after startup","user":{"login":"mikejuni","id":3623403,"avatar_url":"https://avatars.githubusercontent.com/u/3623403?v=3","gravatar_id":"","url":"https://api.github.com/users/mikejuni","html_url":"https://github.com/mikejuni","followers_url":"https://api.github.com/users/mikejuni/followers","following_url":"https://api.github.com/users/mikejuni/following{/other_user}","gists_url":"https://api.github.com/users/mikejuni/gists{/gist_id}","starred_url":"https://api.github.com/users/mikejuni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikejuni/subscriptions","organizations_url":"https://api.github.com/users/mikejuni/orgs","repos_url":"https://api.github.com/users/mikejuni/repos","events_url":"https://api.github.com/users/mikejuni/events{/privacy}","received_events_url":"https://api.github.com/users/mikejuni/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/opnsense/core/labels/upstream","name":"upstream","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"fichtner","id":1915288,"avatar_url":"https://avatars.githubusercontent.com/u/1915288?v=3","gravatar_id":"","url":"https://api.github.com/users/fichtner","html_url":"https://github.com/fichtner","followers_url":"https://api.github.com/users/fichtner/followers","following_url":"https://api.github.com/users/fichtner/following{/other_user}","gists_url":"https://api.github.com/users/fichtner/gists{/gist_id}","starred_url":"https://api.github.com/users/fichtner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fichtner/subscriptions","organizations_url":"https://api.github.com/users/fichtner/orgs","repos_url":"https://api.github.com/users/fichtner/repos","events_url":"https://api.github.com/users/fichtner/events{/privacy}","received_events_url":"https://api.github.com/users/fichtner/received_events","type":"User","site_admin":false},"assignees":[{"login":"fichtner","id":1915288,"avatar_url":"https://avatars.githubusercontent.com/u/1915288?v=3","gravatar_id":"","url":"https://api.github.com/users/fichtner","html_url":"https://github.com/fichtner","followers_url":"https://api.github.com/users/fichtner/followers","following_url":"https://api.github.com/users/fichtner/following{/other_user}","gists_url":"https://api.github.com/users/fichtner/gists{/gist_id}","starred_url":"https://api.github.com/users/fichtner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fichtner/subscriptions","organizations_url":"https://api.github.com/users/fichtner/orgs","repos_url":"https://api.github.com/users/fichtner/repos","events_url":"https://api.github.com/users/fichtner/events{/privacy}","received_events_url":"https://api.github.com/users/fichtner/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/opnsense/core/milestones/5","html_url":"https://github.com/opnsense/core/milestones/17.1","labels_url":"https://api.github.com/repos/opnsense/core/milestones/5/labels","id":1782388,"number":5,"title":"17.1","description":"","creator":{"login":"AdSchellevis","id":9783985,"avatar_url":"https://avatars.githubusercontent.com/u/9783985?v=3","gravatar_id":"","url":"https://api.github.com/users/AdSchellevis","html_url":"https://github.com/AdSchellevis","followers_url":"https://api.github.com/users/AdSchellevis/followers","following_url":"https://api.github.com/users/AdSchellevis/following{/other_user}","gists_url":"https://api.github.com/users/AdSchellevis/gists{/gist_id}","starred_url":"https://api.github.com/users/AdSchellevis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AdSchellevis/subscriptions","organizations_url":"https://api.github.com/users/AdSchellevis/orgs","repos_url":"https://api.github.com/users/AdSchellevis/repos","events_url":"https://api.github.com/users/AdSchellevis/events{/privacy}","received_events_url":"https://api.github.com/users/AdSchellevis/received_events","type":"User","site_admin":false},"open_issues":55,"closed_issues":43,"state":"open","created_at":"2016-05-23T10:26:33Z","updated_at":"2016-09-14T07:16:49Z","due_on":"2017-01-25T23:00:00Z","closed_at":null},"comments":6,"created_at":"2016-08-03T01:29:10Z","updated_at":"2016-09-14T07:20:43Z","closed_at":null,"body":"IPSec (charon) daemon from strongswan does not reduce privilege from root after startup. It would greatly improve security if this is done and there should not be any harm of doing so.\r\n\r\nCurrently if you do \r\n`ps aux | grep charon`\r\nyou will see that it is running as root."},"comment":{"url":"https://api.github.com/repos/opnsense/core/issues/comments/246927562","html_url":"https://github.com/opnsense/core/issues/1103#issuecomment-246927562","issue_url":"https://api.github.com/repos/opnsense/core/issues/1103","id":246927562,"user":{"login":"mikejuni","id":3623403,"avatar_url":"https://avatars.githubusercontent.com/u/3623403?v=3","gravatar_id":"","url":"https://api.github.com/users/mikejuni","html_url":"https://github.com/mikejuni","followers_url":"https://api.github.com/users/mikejuni/followers","following_url":"https://api.github.com/users/mikejuni/following{/other_user}","gists_url":"https://api.github.com/users/mikejuni/gists{/gist_id}","starred_url":"https://api.github.com/users/mikejuni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikejuni/subscriptions","organizations_url":"https://api.github.com/users/mikejuni/orgs","repos_url":"https://api.github.com/users/mikejuni/repos","events_url":"https://api.github.com/users/mikejuni/events{/privacy}","received_events_url":"https://api.github.com/users/mikejuni/received_events","type":"User","site_admin":false},"created_at":"2016-09-14T07:20:43Z","updated_at":"2016-09-14T07:20:43Z","body":"Hi, just re-open it to let you know that I've tested setting `user = nobody` in `/usr/local/etc/strongswan.d/charon.conf` and it can drop privilege. I am using plain FreeBSD (may switch to HBSD soon) but I think it would apply here as well.\r\nHowever, the catch is that this setup would only work if your FBSD / HBSD setup is a pure router setup with a default route pointing to the internet (in a road-warrior setup) because once the daemon dropped privilege, although it can setup ipsec child SA association it cannot add a route properly (you'll see it throwing errors), which I think could potentially be fixed by using scripting hooks in StrongSwan via some sudo work."}}
{"actor":{"display_login":"mikejuni"}}