How to run `openconnect` without being `root` and without any `root` action at any time, not even to setup it forever?
Jun 27, 1:24pm

Running openconnect as a non-root user without any root privileges—even for initial setup—is possible, but it requires some configuration and limitations. Here’s how you can achieve this:

1. Use User-Space VPN (No Root Required)

openconnect can run entirely in user space if you use the --interface option to specify a tun/tap device that the user has access to. However, by default, creating tun/tap interfaces requires root privileges.

Solution: Pre-configure a tun/tap device

If you can get a one-time root access (or ask an admin), you can create a persistent tun/tap device and grant your user permissions to it:

bash
# As root (one-time setup):
ip tuntap add mode tun user <your_username> name vpn0
chown <your_username> /dev/net/tun

After this, your user can use vpn0 without root.

But since you want no root at all, this is not an option.

2. Use --no-dtls and --no-esp (If Supported)

Some VPN servers support running openconnect without kernel-level networking (DTLS/ESP). This allows it to run entirely in user space, but:

  • It may not work with all servers.
  • Performance and security may be reduced.

Example:

bash
openconnect --no-dtls --no-esp vpn.example.com

3. Use openconnect with vpnc-script in User Space

If your VPN server supports running in user space (e.g., over a plain TCP connection), you can use:

bash
openconnect --protocol=anyconnect vpn.example.com

But this depends on the server configuration.

4. Use a User-Space VPN Alternative

If openconnect cannot run without root, consider alternatives like:

  • WireGuard in user space: wireguard-tools with WG_USERSPACE=1.
  • SoftEther VPN: Can run in user space.
  • TunSafe: User-space WireGuard client.

5. Use a Container (Podman/Docker)

If you can run containers as a non-root user (e.g., with podman), you can run openconnect inside a container where it has the necessary permissions:

bash
podman run --rm -it --net=host --device=/dev/net/tun openconnect/openconnect vpn.example.com

This isolates the VPN process but still requires /dev/net/tun access.

6. Use a Proxy Instead of VPN

If your goal is to access restricted resources, consider using a proxy (e.g., ssh -D or 3proxy) instead of a VPN.

Summary Table

Pre-configure tun/tap
Once
Yes
Not fully root-free
--no-dtls --no-esp
No
No
Server-dependent, less secure
User-space VPN alternatives
No
No
WireGuard/SoftEther/TunSafe
Container (Podman/Docker)
No*
No
Needs /dev/net/tun access
Proxy (SSH/3proxy)
No
No
Not a full VPN

Final Answer

If you absolutely cannot use root at any time, your best options are:

  1. Use --no-dtls --no-esp (if the server supports it).
  2. Switch to a user-space VPN like WireGuard or SoftEther.
  3. Use a proxy if full VPN is not strictly required.

Would you like help testing if your VPN server supports user-space connections?

Jun 27, 1:24pm

This is a shared conversation and may include unverified content that doesn't reflect Mistral AI's views. Login to resume chatting.

Vibe can make mistakes. Check answers. Learn more