2

I have two users with admin rights: AdminA and AdminB. When I create a VPN connection for AdminA, it also shows up for AdminB and vice versa.

How can I prevent the VPN connection that I created for AdminA from showing up in AdminB's account?

1 Answer 1

2

You can't. In Mac OS X as in traditional Unix, network settings are per-system, not per-user, because network changes affect all users of the system.

It helps to consider the case when other users have their own processes running concurrently with yours, such as via Fast User Switching or SSHing into the box from somewhere else, or cron or launchd jobs. If you fire up your VPN session, everyone's processes on that system get the enhanced connectivity afforded by your VPN session, not just your own processes.

If you don't want someone else to fire up a given VPN link, don't share your VPN login credentials with them.

2
  • 1
    Thanks for the explanation. However it doesn't make sense at all not to be able to create per user VPN connections, even from the point of view of privacy: what if I didn't want the other users of my computer to know that somebody on that computer has setup a VPN connection to a particular VPN provider? Apr 27, 2010 at 15:41
  • AdminA trusts AdminB enough to give him access to superuser privs on the host, but not enough to let him see some VPN settings? Even if there was a way to set permissions to keep other users from seeing one user's VPN settings, any Admin on the system could assert their superuser powers to override those permissions. Because Admins are allowed to override privilege restrictions, what it seems you really want is a way to encrypt AdminA's VPN settings with a key that only AdminA knows, so that only AdminA can decrypt and use them, no matter who has access to superuser powers.
    – Spiff
    Apr 28, 2010 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .