Please warn the user when VPN is disconnected

[Dennis Heinson]

Binary package hint: network-manager

I sometimes use VPN for security reasons. I connect to an (insecure) WLAN or ethernet internet uplink and then tunnel all my traffic through VPN. Generally, this works fine using Network manager.

For various reasons though, this connection can drop at times (Flakey WLAN, Re-plugging a cable, and so forth). While Network-Manager notifies me of this using the notification system, BY DEFAULT it reconnects to the WLAN or ethernet and tunnels everything through that.

There should be a "are you sure?" clickbox before this happens!

Thank you!

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and taking the time to report a bug. While I understand your argument, this is more of a usability issue in network-manager and not a security vulnerability in and of itself.

[Jamie Strandboge (jdstrand)]

Based on IRC discussion, here are a couple more points:
 * this should really be addressed in network-manager upstream, as it is a UI issue
 * network-manager can be configured to not connect automatically by Editing the connection. If on a very hostile network, perhaps this can be used to avoid a reconnect

[Dennis Heinson (dheinson)]

Re: Point number 2 - yes, that is a good idea imho. However, since Ubuntu aims at usability by making the system safe by default, would a way to solve this be to disable auto-reconnection (opt-in vs. the current opt-out scheme)? Or should another security mechanism be put in place?

[Thomas Hood (jdthood)]

Upstream bug report has been marked a duplicate of upstream Bug 349151 - [enh] automatically reconnect VPN if dropped

[Thomas Hood (jdthood)]

Marked Invalid in accordance with status for upstream NetworkManager, but perhaps this should be wishlist.

[Mathieu Trudel-Lapierre (cyphermox)]

This bug is wishlist in terms of making VPN connections reconnect and possibly for future work in having connections with dependencies (e.g. taking care of automatically pulling in a VPN on an untrusted network).

[Dennis Heinson (dheinson)]

I still can't believe that this is not being recognized as a security flaw. All an attacker has to do is to interrupt the VPN connection (i.e. by jamming a WLAN signal) and bam! - lots of open ports in the local network.