4

Not looking for any solutions here, just explanation. I work remotely for a university in another state; they supply a proprietary VPN to connect to their network. I work on a Ubuntu machine and for hygiene, have set up a separate user account for the university work. I normally switch back and forth between my Worker account and my Self account according to whatever's going on. I only ever connect to campus from Worker.

But if I make the connection from Worker and then log in the Self user, the VPN disconnects with a complaint about the multiple users; if I launch the VPN while Self is already logged in (but suspended), it connects and then disconnects with the same complaint.

Why? I asked IT, who checked with the Network people behind the curtain and relayed their response that, as I expected, it was a policy set on the server end and that it was "for security reasons". And of course, no further explanation can be obtained.

I've also found that I can run a VM in a Worker session and connect from there despite that being, actually, a different user. I can even make simultaneous connections from both top-level Worker and the VM -- which to me begins to seem more like the kind of thing they'd maybe want to avoid.

So what are the "security reasons"? What hazard is avoided by prohibiting simultaneous unrelated logins but allowing VMs? And what if I were working on the old-school kind of Unix system where there were actually multiple active concurrent users? I'm willing to assume I can't get around this -- no interest in being tricky -- but it's inconvenient, so what I'll do is just work from Self and let the university's stuff be exposed to whatever filth I may stumble into there. I just wish the Network lords would explain things so I'd know how to be a better citizen.

Improve this question

1 Answer 1

Reset to default
9

When you connect to the university over the VPN, your computer becomes part of the university's internal network, exactly as if you'd gone into one of the offices and plugged it in to an Ethernet jack. The security risks are the same: when you log in a second account, that second account has access to the university's network just as if you sat down at a logged-in computer in the office. Understandably, the university's system administrator doesn't want random people using the university's network, and part of the protection is locking out the VPN if someone other than an authorized user is logged in to a remote computer.

If you really want to do this, you'll need to stick both "Worker" and the VPN into a virtual machine and run it from "Self"'s account. This maintains the encapsulation the university is looking for -- "Self"'s network traffic can't travel over the VPN -- while letting you use two accounts at the same time.

(Your proposed solution of "work from Self and let the university's stuff be exposed to whatever filth I may stumble into there" strikes me as a very bad idea. If you do that, the university can see everything you're doing, and you're likely to be fired for violating the network-use policy.)

Improve this answer
10
  • Thanks! That all makes perfect sense. Obviously I haven't properly understood the ways different resources are shared; I assumed network connections were the kind of thing that would be per-user. Must do more homework.
    – uhClem
    Jan 8, 2022 at 21:22
  • 1
    Oh right -- but what of my question about the old-style multi-user Unix systems? If this is the case, how would it be possible for one user to have access to a remote network while others did not?
    – uhClem
    Jan 8, 2022 at 21:32
  • 1
    @uhClem: old-style multi-user Unix systems were not something you'd VPN from; if you had access to one, then it probably was your workplace, so they were something you'd VPN to (or more likely, something you'd dial-in to).
    – user1686
    Jan 9, 2022 at 8:10
  • 3
    @uhClem: now if you're talking about personal computers that happen to run a multi-user OS (such as Linux), or modern multi-user systems like a shared server (though again, it's pretty unlikely that you'd VPN from one, rather to one), they all have the same issue – VPNs affect all users on both Linux and Windows. There are ways to avoid this though, e.g. "policy routing" on Linux can match by UID, but it takes a little bit of additional setup.
    – user1686
    Jan 9, 2022 at 8:18
  • 2
    You say "Understandably", but this means that a user is prevented from using multiple user accounts for privilege separation / information isolation (like OP). If a security policy prevents people from adopting good security hygiene, it's a stupid policy. I'd be tempted to communicate to the employer "this does not work with my setup; please provide a work laptop". That, or monkey-patch the VPN client to hide the other account from it.
    – marcelm
    Jan 9, 2022 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .