3 ms·

I just spent an hour trying to get it to connect to a VPN via a shell script with no success sudo nmcli conn up id "VPN" --ask Works great but there is no

I just spent an hour trying to get it to connect to a VPN via a shell script with no success sudo nmcli conn up id "VPN" --ask Works great but there is no sign of --password --user-name Instead I have to write my configuration to a file and read from the that file. Even then I couldn't get it working. Also `--ask` doesn't ask for your user name. I mean, sure, it's probably fine when you know how to use it but it has to be one of the least intuitive CLI front ends I have used I am also frustrated that I couldn't figure it out, which makes me biased

znpy 6y ago
just yesterday i set up a vpn client very easily by running nmcli connection import type openvpn file myconfig.vpn the only issue that i had was SELinux doing its job, and was quickly fixed. Even easier than with the usual gui tools.
- vfclists 6y ago
  How did you find SELinux was doing its job and how long did it take? I gave up on SELinux about 20 years ago when it was a source of endless frustration, or was that 15?
  - dx87 6y ago
    You can have SELinux in a learning mode where it gives you a notification when it blocks something, and a command you can run to make it not block that action any more.
  - freedomben 6y ago
    selinux is at the heart just about labels. If something tries to do something but doesn't have the right label, selinux will block it. I agree working with selinux is a bit of a PITA but if you learn sealert, ausearch, and/or audit2allow it can severely reduce the pain and allow you to keep selinux enabled. I really like this page personally: https://wiki.centos.org/HowTos/SELinux https://wiki.centos.org/HowTos/SELinux
  - znpy 6y ago
    it took me about 10-15 minutes to turn my eyes towards SELinux, after some initial debugging. i turned off selinux temporarily and activated the connection successfully, and determined that it was indeed SELinux that was preventing NetworkManager from doing its job. then i re-enabled SELinux went to look at /var/log/audit/audit.log to see what it had to complain about and indeed some files created by NetworkManager in /root/.cert had bad contexts. I set the proper contexts (semanage fcontext -a -t <context> <pathregex>), applied them (restorecon -Rv /root) and all was well. SELinux was initially scary but: - The "SELinux for mere mortals" talks are very informative introductory video (https://www.youtube.com/watch?v=_WOKRaM-HI4 https://www.youtube.com/watch?v=_WOKRaM-HI4) - The SELinux User's and Administrator's Guide from Red Hat was a deeper explaination (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/index https://access.redhat.com/documentation/en-us/red_hat_enterp... -- linking to rhel 7 because that's what i read at the time) I had to study this stuff in order to get Red Hat certified (RHCSA, passed with 300/300). Getting certified is absolutely worth it. Getting certified is the difference between "10-15 minutes to get a diagnosis" and "I gave up on SELinux about 20 years ago".

znpy 6y ago

just yesterday i set up a vpn client very easily by running nmcli connection import type openvpn file myconfig.vpn the only issue that i had was SELinux doing its job, and was quickly fixed. Even easier than with the usual gui tools.

vfclists 6y ago
How did you find SELinux was doing its job and how long did it take? I gave up on SELinux about 20 years ago when it was a source of endless frustration, or was that 15?
- dx87 6y ago
  You can have SELinux in a learning mode where it gives you a notification when it blocks something, and a command you can run to make it not block that action any more.
- freedomben 6y ago
  selinux is at the heart just about labels. If something tries to do something but doesn't have the right label, selinux will block it. I agree working with selinux is a bit of a PITA but if you learn sealert, ausearch, and/or audit2allow it can severely reduce the pain and allow you to keep selinux enabled. I really like this page personally: https://wiki.centos.org/HowTos/SELinux https://wiki.centos.org/HowTos/SELinux
- znpy 6y ago
  it took me about 10-15 minutes to turn my eyes towards SELinux, after some initial debugging. i turned off selinux temporarily and activated the connection successfully, and determined that it was indeed SELinux that was preventing NetworkManager from doing its job. then i re-enabled SELinux went to look at /var/log/audit/audit.log to see what it had to complain about and indeed some files created by NetworkManager in /root/.cert had bad contexts. I set the proper contexts (semanage fcontext -a -t <context> <pathregex>), applied them (restorecon -Rv /root) and all was well. SELinux was initially scary but: - The "SELinux for mere mortals" talks are very informative introductory video (https://www.youtube.com/watch?v=_WOKRaM-HI4 https://www.youtube.com/watch?v=_WOKRaM-HI4) - The SELinux User's and Administrator's Guide from Red Hat was a deeper explaination (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/index https://access.redhat.com/documentation/en-us/red_hat_enterp... -- linking to rhel 7 because that's what i read at the time) I had to study this stuff in order to get Red Hat certified (RHCSA, passed with 300/300). Getting certified is absolutely worth it. Getting certified is the difference between "10-15 minutes to get a diagnosis" and "I gave up on SELinux about 20 years ago".