Remotely starting a VPN connection does not work

[BrassDude]

Hi,

I've installed Fedora 16 on my desktop machine and set up a VPN connection in the NetworkManager. When I'm sitting at my desktop I can easily start the VPN connection (I've saved the password). Also from the command line using the nmcli command works straight forward.

But when I'm remotely logged-in via ssh (e.g. from my laptop at home) I can't start the VPN connection on my desktop. I get:

$> nmcli con up id "My VPN Connection"
Error: Connection activation failed: Not authorized to control networking.

Why does it only work when I'm sitting at my desktop and not remotely? Is there something I need to set? Thanks for your help.

[BrassDude]

Hmm - so nobody has an idea what is going on here? Even the slightest tip or hint would be greatly appreciated. Thanks.

[beaker_]

Nope.., not a cluie. Both openvpn --config xyz and systemctl work here so... not enough info.

[smr54]

Might be a firewall, might be SELinux, might be something in the vpn configuration.

What type of VPN switch are you using--that is, are you connecting to a Cisco switch, an MS VPN server, OpenVPN server?

If it's a Cisco vpn server, then I'd just recommend using vpnc rather than the NM client. If it's not Cisco, then I really don't know.

[beaker_]

Ok... Crash course in polkit for ya:

At the terminal:

su
$ pkaction |grep NetworkManager
 org.freedesktop.NetworkManager.enable-disable-network
 org.freedesktop.NetworkManager.enable-disable-wifi
 org.freedesktop.NetworkManager.enable-disable-wimax
 org.freedesktop.NetworkManager.enable-disable-wwan
 org.freedesktop.NetworkManager.network-control
 org.freedesktop.NetworkManager.settings.modify.hostname
 org.freedesktop.NetworkManager.settings.modify.own
 org.freedesktop.NetworkManager.settings.modify.system
 org.freedesktop.NetworkManager.sleep-wake
 org.freedesktop.NetworkManager.wifi.share.open
 org.freedesktop.NetworkManager.wifi.share.protected

$ pkaction --action-id org.freedesktop.NetworkManager.network-control --verbose
  description:       Allow control of network connections
  message:           System policy prevents control of network connections
  vendor:            NetworkManager
  vendor_url:        http://www.gnome.org/projects/NetworkManager
  icon:              nm-icon
  implicit any:      no
  implicit inactive: yes
  implicit active:   yes

So write your own policy. For example:
/etc/polkit-1/localauthority/90-mandatory.d/90-my.thinly.checked.pkla

[Network Manager - Control... haha]
Identity=unix-user:Beaker
Action=org.freedesktop.NetworkManager.network-control
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Brush up on your polkit and convince your self it works as desired because, well.., you don't want to screw up your network connection 100miles away.

Now the loaded question is; why are you relying on network manager as opposed to a service?

[jpollard]

Can't tell from here (haven't needed VPN yet), but I have run across other problems - some VPNs require the network access to to other systems to be cut off. A local user is not cut off as they are "local" a ssh session, on the other hand, is remote - and if the VPN successfully started you would be cut off from the system.

[BrassDude]

Thanks Beaker - your tweak by adding your code snippet in a file under /etc/polkit-1/localauthority/90-mandatory.d/ did it for me. I can now start the VPN client remotely. Not yet quite clear to me what I really did - have to read more on how the PolicyKit works. But thanks anyway.