Tunnelblick needs admin credentials anytime a user launches is for the first time.

[Mathieu]

Even though the config files are place with the right permissions (in /Library/Application Support/Tunnelblick), every time a user launches TB for the first time, it asks for admin credentials. How can I prevent this?

[jkbull...gmail.com]

Were the config files installed by Tunnelblick, or are you trying to put the files in place some other way (manually or with a script)?

What messages are in the Console log, and what message does the user see when asked for the admin credentials?

[Mathieu]

I'm putting in the config files via script in /Library/Application Support/Tunnelblick.

Console log? Not sure. Here is an extract from system.log:

Jul 15 12:18:50 myhost Tunnelblick[75041]: Tunnelblick: OS X 10.11.5; Tunnelblick 3.6.5beta04 (build 4565)
Jul 15 12:18:50 myhost Tunnelblick[75041]: Need to reload 'tunnelblickd'
Jul 15 12:19:52 myhost Tunnelblick[75041]: Tunnelblick needs to:
Jul 15 12:19:52 myhost Tunnelblick[75041]: Beginning installation or repair
Jul 15 12:19:52 myhost authexec[75090]: executing /Applications/Tunnelblick.app/Contents/Resources/installer
Jul 15 12:19:53 myhost Tunnelblick[75041]: Installation or repair succeeded; Log:
    Tunnelblick installer started 2016-07-15 12:19:52. 1 arguments: 0x0101
    Changed ownership of /Users/myuser/Library/Application Support/Tunnelblick from 713627801:1067465985 to 713627801:80
    Changed ownership of /Users/myuser/Library/Application Support/Tunnelblick/Configurations from 713627801:1067465985 to 713627801:80
    Used launchctl to load tunnelblickd
    Tunnelblick installer finished without error
Jul 15 12:19:53 myhost Tunnelblick[75041]: Set program update feedURL to https://www.tunnelblick.net/appcast-b.rss
Jul 15 12:19:53 myhost Tunnelblick[75041]: Launching a thread to remove the old login item (if any) so we can use the new mechanism that controls Tunnelblick's launch on login
Jul 15 12:19:53 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/LaunchAgents
Jul 15 12:19:53 myhost Tunnelblick[75041]: Copied our 'net.tunnelblick.tunnelblick.LaunchAtLogin.plist' into ~/Library/LaunchAgents
Jul 15 12:19:53 myhost Tunnelblick[75041]: No old login item to remove
Jul 15 12:19:56 myhost Tunnelblick[75041]: Copied easy-rsa
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-ca
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-dh
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-inter
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-key
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-key-pass
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-key-pkcs12
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-key-server
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-req
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/build-req-pass
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/clean-all
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/ChangeLog
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/COPYING
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/doc
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/doc/EasyRSA-Advanced.md
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/doc/EasyRSA-Readme.md
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/doc/EasyRSA-Upgrade-Notes.md
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/doc/Hacking.md
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/doc/Intro-To-PKI.md
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/doc/TODO
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/easyrsa
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 600 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/openssl-1.0.cnf
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/vars.example
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/x509-types
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/x509-types/ca
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/x509-types/client
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/x509-types/COMMON
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/easyrsa3/x509-types/server
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/KNOWN_ISSUES
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/Licensing
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/Licensing/gpl-2.0.txt
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/README
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/EasyRSA-3/README.quickstart.md
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/inherit-inter
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/list-crl
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 600 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/openssl-0.9.6.cnf
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 600 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/openssl-0.9.8.cnf
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 600 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/openssl-1.0.0.cnf
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/pkitool
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/README
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/revoke-full
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/sign-req
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/TB-version.txt
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 644 to 400 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/v3version.txt
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 600 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/vars
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 500 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa/whichopensslcnf
Jul 15 12:20:44 myhost Tunnelblick[75041]: applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes
Jul 15 12:20:44 myhost Tunnelblick[75041]: Finished shutting down Tunnelblick; allowing termination

[jkbull...gmail.com]

On Friday, July 15, 2016 at 4:04:44 PM UTC-4, Mathieu wrote:

I'm putting in the config files via script in /Library/Application Support/Tunnelblick.

That's not where configurations go:

• Shared configurations go in /Library/Application Support/Tunnelblick/Shared.
  
  
• Private configurations are more complicated; one copy goes into /Users/USERNAME/Library/Application Support/Tunnelblick/Configurations, and another, with different ownership and permissions, goes into /Library/Application Support/Tunnelblick/Users/USERNAME/ (where USERNAME is the short username of the user).

However, assuming the log entries are the typical entries that the user is seeing, I don't think this has nothing to do with the configurations – I think the problem is indicated here:

Jul 15 12:18:50 myhost Tunnelblick[75041]: Need to reload 'tunnelblickd'

See https://groups.google.com/forum/#!topic/tunnelblick-discuss/UYeR7vv_rXM

(I have just posted an update to that thread.)

 

Console log? Not sure. Here is an extract from system.log:

Jul 15 12:18:50 myhost Tunnelblick[75041]: Tunnelblick: OS X 10.11.5; Tunnelblick 3.6.5beta04 (build 4565)
Jul 15 12:18:50 myhost Tunnelblick[75041]: Need to reload 'tunnelblickd'
Jul 15 12:19:52 myhost Tunnelblick[75041]: Tunnelblick needs to:
Jul 15 12:19:52 myhost Tunnelblick[75041]: Beginning installation or repair
Jul 15 12:19:52 myhost authexec[75090]: executing /Applications/Tunnelblick.app/Contents/Resources/installer
Jul 15 12:19:53 myhost Tunnelblick[75041]: Installation or repair succeeded; Log:
    Tunnelblick installer started 2016-07-15 12:19:52. 1 arguments: 0x0101
    Changed ownership of /Users/myuser/Library/Application Support/Tunnelblick from 713627801:1067465985 to 713627801:80
    Changed ownership of /Users/myuser/Library/Application Support/Tunnelblick/Configurations from 713627801:1067465985 to 713627801:80
    Used launchctl to load tunnelblickd
    Tunnelblick installer finished without error
Jul 15 12:19:53 myhost Tunnelblick[75041]: Set program update feedURL to https://www.tunnelblick.net/appcast-b.rss
Jul 15 12:19:53 myhost Tunnelblick[75041]: Launching a thread to remove the old login item (if any) so we can use the new mechanism that controls Tunnelblick's launch on login
Jul 15 12:19:53 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/LaunchAgents
Jul 15 12:19:53 myhost Tunnelblick[75041]: Copied our 'net.tunnelblick.tunnelblick.LaunchAtLogin.plist' into ~/Library/LaunchAgents
Jul 15 12:19:53 myhost Tunnelblick[75041]: No old login item to remove
Jul 15 12:19:56 myhost Tunnelblick[75041]: Copied easy-rsa
Jul 15 12:19:56 myhost Tunnelblick[75041]: Changed permissions from 755 to 700 on /Users/myuser/Library/Application Support/Tunnelblick/easy-rsa

<snip>

[Mathieu]

Yes they are in /Library/Application Support/Tunnelblick/Shared. Typo.

Thanks! I will check out that link. This is almost exactly what I am doing. (Munki)

[Mathieu]

And thanks for the code update!