1

I've downloaded and installed NordVPN on Ubuntu and am a bit incredulous at its operation.

After I downloaded its .deb file and installed it, apparently it can be activated with the command nordvpn connect, and I'm expected to believe that this command encrypts and reroutes all packets from my machine to go to their servers first.

This seems like a pretty big operation that should require communication with the operating system. If I had multiple users on my system, they are all suddenly having their applications redirect to NordVPN's servers. Why doesn't it require sudo?

I should note that other VPNs with command line interfaces seem to work this way as well (ExpressVPN).

6

NordVPN uses /var/run/nordvpnd.sock to allow the nordvpn client tool to communicate with the nordvpnd daemon (which is running as root).

3

I don't know nordvpn (and you don't seem to trust it: why did you then install it, especially from a non-ubuntu source?!); but sudo is by far not the only, or even usual way of a program to interact with the networking stack:

For example, since Ubuntu uses systemd, it uses NetworkManager, which, perfectly normally, allows you to … select a wifi network to route all traffic through, as a "normal" user (given your user has been given those privileges, but that's usually the case for "human" users). The same it offers for VPN connections; it's all interaction with a specific API/RPC interface.

Other than that, basically since Linux was a multiuser system, there was setsuid, i.e. the possibility to give an executable file the flag "execute as root". Without that flag, sudo wouldn't work (it's really nothing magic, that small program). It's also possible the nordvpn executable simply has that flag set.

2
  • It could also be using capabilities (specifically CAP_NET_ADMIN), but that's far less likely than either possibility you've listed. – Austin Hemmelgarn Sep 3 '19 at 18:23
  • I actually stopped using their client in favor of a custom script that calls their apis. After your answer. I couldn't really figure out how it worked, so it had no place on my system – DeepDeadpool Feb 15 '20 at 19:21
1

It does require sudo:

I downloaded its .deb file and installed it

That's the step that needed sudo. Once that was done, it made it easy for you to turn it on, but you couldn't have just extracted the .deb as non-root and had that work.

0

From the NordVPN website:

Additionally, if you receive the following issue: Whoops! Permission denied accessing /run/nordvpn/nordvpnd.sock, all you need to do is write the following command: sudo usermod -aG nordvpn $USER and then reboot your device.

Try this:

sudo usermod -aG nordvpn $USER

And it turns out you can logout then log back in. It worked for me on Debian 10.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.