# Exec Node bash command "Not authorized to control networking"

**URL:** <https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415>\
**Category:** General\
**Created:** [21 March 2020 14:20 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415 "2020-03-21T14:20:39Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [21 March 2020 14:20 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/1 "2020-03-21T14:20:40Z")

</div>

Hello together,  
I am new so please apologize if this is not the right thread to place my question.

I am trying to switch on my VPN Connection via the Exec-Node with following command:  
nmcli con up id vpnname  
This works fine from cmd line, also I get no prompt for sudo i can run this as user.  
But when i try this from node red i get the following error from the exec node.  
Code 4: Command failed: nmcli con up id vpnnameError: Connection activation failed: Not authorized to control networking.

Thank you for your ideas.  
Br,  
Gill

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [21 March 2020 15:53 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/2 "2020-03-21T15:53:18Z")

</div>

> [@Gill](#):
>
> Connection activation failed: Not authorized to control networking.

Are you running node-red as the same user as you are using in the command line?  
If you are not sure then what OS are you using, how did you install node-red and how are you running node-red?

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [26 March 2020 07:52 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/3 "2020-03-26T07:52:41Z")

</div>

Hello thank you for replaying.  
Yes it is the same user.  
I am running Ubuntu 18.04 and installed node red with the same user.  
I only have one user on the machine.  
I have now set it up on a rasp pi 4 and I do not have the problem on this.

I managed to solve it on Ubuntu by adding : ALL=(ALL) NOPASSWD: ALL  
to /etc/sudoers file.

Now i have a new problem stuck on the Node Red Projects settings.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [26 March 2020 09:28 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/4 "2020-03-26T09:28:19Z")

</div>

> [@Gill](#):
>
> I am trying to switch on my VPN Connection via the Exec-Node with following command:  
> nmcli con up id vpnname  
> This works fine from cmd line

Is that true, or did you have to use sudo with the command?

> [@Gill](#):
>
> I managed to solve it on Ubuntu by adding : ALL=(ALL) NOPASSWD: ALL  
> to /etc/sudoers file.

Do you realise that means that if anyone manages to gain entry to your machine or into your node-red app that they would have full control of the system?  
It is much safer to only allow access to the particular command you want to run, though there are still risks.

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [26 March 2020 10:36 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/5 "2020-03-26T10:36:23Z")

</div>

Hi Colin,  
yes I am able to run the cmd without sudo from the terminal.  
I understand the risk with full control, for me it was just a test and not a working environment.

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [26 March 2020 20:34 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/6 "2020-03-26T20:34:27Z")

</div>

So, Back to square one.  
I have now completed a clean install on Ubuntu 19.10.  
When I try to use the same cmd that works on the raspi, I get error 4  
"Command failed: nmcli con up id VPNError: Connection activation failed: Not authorized to control networking ,from the exec node.  
I run the same cmd straight from terminal and it works without password or sudo.  
Like you said Collin I do not want to use the solution as mentioned above as this setup i want as a production environment.

---

<div class="post-metadata">

**Author:** ![Trying\_to\_learn](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/trying_to_learn/32/28400_2.png) [@Trying\_to\_learn](https://discourse.nodered.org/u/Trying_to_learn)\
**Post date:** [26 March 2020 21:08 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/7 "2020-03-26T21:08:15Z")

</div>

Ok, (second attempt as replying.)

I'm not expert, but how can you know Node-Red has the same privileges as _you_?

How did you install Node-Red? You installed it; you are using it from the default included programs; something else.

That may go a way to help understand the problem.

To be sure:  
This is on Ubuntu 19.x and **not** the RasPi.  
The RasPi is a test bed and it works.  
It does seem like privilege problems.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [26 March 2020 21:16 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/8 "2020-03-26T21:16:31Z")

</div>

> [@Gill](#):
>
> VPNError: Connection activation failed: Not authorized to control networking

This may be helpful

> <https://stackoverflow.com/questions/38855933/not-authorized-to-control-networking-from-cron>

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [27 March 2020 07:09 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/9 "2020-03-27T07:09:00Z")

</div>

Hello Colin,

yes I have tried this, but still no luck.

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [27 March 2020 07:18 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/10 "2020-03-27T07:18:24Z")

</div>

Node-Red Installed by the recommended script:

```auto
bash <(curl -sL https://raw.githubusercontent.com/node-red/linux-installers/master/deb/update-nodejs-and-nodered)

```

Ubuntu 19.10 / clean install  
Raspi 4 / works with same flow

Flow:  
Inject \> nmcli con up id VPN \> exec node  
Result:  
Error 4  
Command failed: nmcli con up id VPN  
Error: Connection activation failed: Not authorized to control networking.

Flow: /with sudo  
Inject \> sudo nmcli con up id VPN \> exec node  
Result:  
Error 1  
Command failed: sudo nmcli con up id VPN  
sudo: no tty present and no askpass program specified

Terminal: Without sudo No password requested  
nmcli con up id vpn  
Result  
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/2)

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [27 March 2020 08:29 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/11 "2020-03-27T08:29:59Z")

</div>

The problem is undoubtedly something along the lines of the link I posted with problems running via cron. However since that post is over three years old I expect the security system in Ubuntu has evolved since then so the post is out of date.

I suggest maybe asking in an Ubuntu forum.

The problem when you tried it with sudo in an exec node is because it expects a password, so you would have to use visudo to allow the node-red user to use `sudo nmcli` without having to enter a password. Your earlier posts suggested that you fixed the problem by giving everybody access to any sudo command. It is possible to grant just the node-red user access to use only nmcli with sudo so that might also be a viable solution. In fact I think you can allow the node red user to use `sudo nmcli con up id VPN` without a password but no other commands, though I am not certain about that.

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [27 March 2020 14:22 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/12 "2020-03-27T14:22:40Z")

</div>

Hi Colin,  
I fully agree, I will further try the link you sent and other forums regarding this subject. Hopefully i can find similar information on Ubuntu 19.10.  
when i find something i will post it here.  
Thanks together,

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [28 March 2020 07:42 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/13 "2020-03-28T07:42:59Z")

</div>

Hi together,  
as pointed out by _ **Colin** _ it has to do with **pkla-check-authorization**.  
So i have done a bit of digging and found the following:

**Listing NetworkManager polkit permissions** :  
Type in Terminal  
`nmcli general permissions`  
This will output something like this:

> ```
> PERMISSION VALUE   
> org.freedesktop.NetworkManager.enable-disable-network yes     
> org.freedesktop.NetworkManager.enable-disable-wifi yes     
> org.freedesktop.NetworkManager.enable-disable-wwan yes     
> org.freedesktop.NetworkManager.enable-disable-wimax yes     
> org.freedesktop.NetworkManager.sleep-wake no      
> org.freedesktop.NetworkManager.network-control yes     
> org.freedesktop.NetworkManager.wifi.share.protected yes     
> org.freedesktop.NetworkManager.wifi.share.open yes     
> org.freedesktop.NetworkManager.settings.modify.system yes     
> org.freedesktop.NetworkManager.settings.modify.own yes     
> org.freedesktop.NetworkManager.settings.modify.hostname auth    
> org.freedesktop.NetworkManager.settings.modify.global-dns auth    
> org.freedesktop.NetworkManager.reload auth    
> org.freedesktop.NetworkManager.checkpoint-rollback auth    
> org.freedesktop.NetworkManager.enable-disable-statistics yes     
> org.freedesktop.NetworkManager.enable-disable-connectivity-check yes     
> org.freedesktop.NetworkManager.wifi.scan unknown
> ```

The "org.freedesktop.NetworkManager.network-control" is needed to use the following commands:

`nmcli con up "connection name"` and `nmcli con down "connection name"`

you can list "your connection name" by typing: `nmcli con`

Now we need to create a local policy for a specific user:  
Create a file in the folder "/var/lib/polkit-1/localauthority/50-local.d/" and name the file something like "10-network-manager.pkla"  
This can be done by typing:  
`touch /var/lib/polkit-1/localauthority/50-local.d/10-network-manager.pkla`  
Edit the file with the following:

> [Let user modify system settings for network]  
> Identity=unix-user:USERNAME  
> Action=org.freedesktop.NetworkManager.network-control  
> ResultAny=yes  
> ResultInactive=no  
> ResultActive=yes

The Important one was **ResultAny=yes**

Save the file. Any change or new policy is straight away active, no logoff or reboot needed.

After this the command `nmcli con up "connection name"` for node-red exec node works.

sources:  
[https://man.linuxreviews.org/man8/pkla-check-authorization.8.html](https://man.linuxreviews.org/man8/pkla-check-authorization.8.html)  
[https://people.freedesktop.org/~lkundrak/nm-dbus-api/nmcli-examples.html](https://people.freedesktop.org/~lkundrak/nm-dbus-api/nmcli-examples.html)

> <https://askubuntu.com/questions/708261/how-do-i-set-the-policy-for-users-to-modify-the-network-state-and-connections/708262#708262>

I hope this sums it up and thank you for leading me in the right direction.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [28 March 2020 08:28 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/14 "2020-03-28T08:28:35Z")

</div>

That's useful stuff to know. I still don't understand why you could run it from the command line but not in an exec node though.

---

<div class="post-metadata">

**Author:** ![Gill](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gill/32/18882_2.png) [@Gill](https://discourse.nodered.org/u/Gill)\
**Post date:** [28 March 2020 08:33 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/15 "2020-03-28T08:33:31Z")

</div>

Hi Colin,  
I could run it from the cmd line because:  
`ResultActive=yes`  
was already set in the original policy.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [28 March 2020 09:03 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/16 "2020-03-28T09:03:44Z")

</div>

Ah, right, yes. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [11 April 2020 09:03 UTC](https://discourse.nodered.org/t/exec-node-bash-command-not-authorized-to-control-networking/23415/17 "2020-04-11T09:03:45Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.