I've been testing openssh-4.3_p2 on my gentoo systems for remote layer2 access to my home network. It works well (haven't tested latency sensitive traffic, eg voip, yet), but only when logging in as root. I've created a first draft patch against 4.3_p2 that compiles cleanly on linux, and allows remote users to establish tun/tap vpn as unprivileged users. This is done via the TUNSETOWNER ioctl(). This patch is proof of concept only. It does not add the capability to the other *nixs, has not been tested for security, and needs to be cleaned up. I'm willing to do that if there is interest in adding this capability to openssh...
Created attachment 1179 [details] proof-of-concept TUNSETOWNER patch This patch is the one referenced in the opening comment.
Created attachment 1199 [details] patch updated for openssh-4.4_p1 Attached patch update for openssh-4.4_p1. cleaned up #ifdefs by assuming this capability would be desired on other platforms. Stubbed out (definitely not working) code for other platforms.
Created attachment 1315 [details] upgrade to latest version patch upgraded to version 4.6p1. Compiles cleanly on x86_64 running Gentoo. Still need some help with the *BSD code.