Changes between Version 2 and Version 3 of PrivilegeSeparation

Timestamp:

03/12/12 10:10:16 (12 years ago)

Author:

Samuli Seppänen

Comment:

--

PrivilegeSeparation

@@ -24 +24 @@
  * ''TUN/TAP device:'' a virtual Ethernet interface
  * ''OpenVPN:'' a tunneling daemon
+ * ''OpenVPN service:'' a system service wrapper for OpenVPN
  * ''OpenVPN configuration files'' 
  * ''Network utilities:'' ifconfig, route, etc.
@@ -52 +53 @@
 This solution was suggested by James Yonan. According to him it's fairly common in enterprise VPN clients:
 
-||'''Component'''||'''Runs as'''||
-||OpenVPN GUI||Interactive user||
-||OpenVPN service||Privileged user||
-||OpenVPN||Privileged user||
+||'''Component'''||'''Runs as'''||'''Tasks'''||
+||OpenVPN GUI||Interactive user||Initiate connections and disconnections||
+||OpenVPN service||Privileged user||Accept requests from the GUI and control OpenVPN||
+||OpenVPN||Privileged user||Setting up TUN/TAP interfaces, routes, making connections, etc.||
 
 Using this approach, ''OpenVPN service'' provides a simple API that the ''OpenVPN GUI'' uses to connect and disconnect. So, when the interactive user wants to connect, the following happens: