11

I want to control Network manager from the command-line. This worked well enough in Ubuntu 10.04 (with cnetworkmanager, nmcli is another possible choice).

Since the upgrade to Ubuntu 10.10 however, a D-Bus exception is raised when I attempt to activate a connection from within a SSH terminal:

org.freedesktop.NetworkManager.PermissionDenied: Not authorized to control networking.

It may have to do with /etc/dbus-1/system.d/NetworkManager.conf; where else to look for a clue ?

This issue occurs only when I am ssh'd into the machine; in a gnome session I don't get the same issue -- with the same (admin) user account in both cases.

Improve this question

3 Answers 3

Reset to default
14

On more recent Ubuntu's this is control by the polkit.

make new file: /etc/polkit-1/localauthority/50-local.d/allow-ssh-networking.pkla

Add:

[Let adm group modify system settings for network]
Identity=unix-group:adm
Action=org.freedesktop.NetworkManager.network-control
ResultAny=yes

Then restart the polkit service. (Make sure your user is in the adm group)

You can find a list of valid NetworkManager actions on your system with pkaction | grep NetworkManager

More info: https://forums.fedoraforum.org/showthread.php?276493-Remotely-starting-a-VPN-connection-does-not-work

Improve this answer
4
  • For Raspbian (tested on Buster), you need to replace /etc with /var/lib
    – MrMas
    Aug 30, 2019 at 15:50
  • 1
    this works great on ubuntu 18.04 :)
    – ste
    Feb 4, 2020 at 8:54
  • 1
    For me this just changed the error message to Failed to add/activate connection. (32) Insufficient privileges. What solved was this: askubuntu.com/a/752168/63606
    – Avio
    Jan 29, 2021 at 10:38
  • Even works on Ubuntu 16.04LTS (sigh yes this box should be updated but 🤷🏻‍♂️). Many thanks!
    – Dan
    Mar 7, 2021 at 1:56
5

By default, DBus only allows root and users sitting at the physical console to control networking settings.

This can be changed by editing DBus policy files, in this case /etc/dbus-1/system.d/NetworkManager.conf

Improve this answer
3
  • Any idea for Fedora boxes?
    – Jonathon Reinhart
    Jul 8, 2015 at 17:31
  • on my Mint 17.2 system the necessary file is called org.freedesktop.NetworkManager.conf
    – frankster
    Aug 11, 2016 at 14:32
  • This answer is outdated, sometime I'll update it for the proper way using polkit. Until then, see gist.github.com/grawity/3886114
    – u1686_grawity
    Aug 11, 2016 at 14:36
0

Polkit v122 uses javascript for rule files, INI syntax was deprecated. This worked for me:

/* Allow adm group to use nmcli con up/down over ssh */
polkit.addRule(function(action, subject) {
    if (subject.isInGroup("adm") && (
            action.id === "org.freedesktop.NetworkManager.enable-disable-network"
         || action.id === "org.freedesktop.NetworkManager.network-control"
        )
    ) {
        return polkit.Result.YES;
    }
})

— placed as /etc/polkit-1/rules.d/authorize-ssh-nmcli.rules; systemctl restart polkit to apply.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .