[apatheticonion]

I just spent an hour trying to get it to connect to a VPN via a shell script with no success

    sudo nmcli conn up id "VPN" --ask

Works great but there is no sign of

    --password
    --user-name

Instead I have to write my configuration to a file and read from the that file. Even then I couldn't get it working.

Also `--ask` doesn't ask for your user name.

I mean, sure, it's probably fine when you know how to use it but it has to be one of the least intuitive CLI front ends I have used

I am also frustrated that I couldn't figure it out, which makes me biased

[znpy]

just yesterday i set up a vpn client very easily by running

    nmcli connection import type openvpn file myconfig.vpn

the only issue that i had was SELinux doing its job, and was quickly fixed.

Even easier than with the usual gui tools.

[vfclists]

How did you find SELinux was doing its job and how long did it take?

I gave up on SELinux about 20 years ago when it was a source of endless frustration, or was that 15?

[znpy]

it took me about 10-15 minutes to turn my eyes towards SELinux, after some initial debugging.

i turned off selinux temporarily and activated the connection successfully, and determined that it was indeed SELinux that was preventing NetworkManager from doing its job.

then i re-enabled SELinux went to look at /var/log/audit/audit.log to see what it had to complain about and indeed some files created by NetworkManager in /root/.cert had bad contexts.

I set the proper contexts (semanage fcontext -a -t <context> <pathregex>), applied them (restorecon -Rv /root) and all was well.

SELinux was initially scary but:

- The "SELinux for mere mortals" talks are very informative introductory video (https://www.youtube.com/watch?v=_WOKRaM-HI4)

- The SELinux User's and Administrator's Guide from Red Hat was a deeper explaination (https://access.redhat.com/documentation/en-us/red_hat_enterp... -- linking to rhel 7 because that's what i read at the time)

I had to study this stuff in order to get Red Hat certified (RHCSA, passed with 300/300).

Getting certified is absolutely worth it. Getting certified is the difference between "10-15 minutes to get a diagnosis" and "I gave up on SELinux about 20 years ago".

[dx87]

You can have SELinux in a learning mode where it gives you a notification when it blocks something, and a command you can run to make it not block that action any more.

[freedomben]

selinux is at the heart just about labels. If something tries to do something but doesn't have the right label, selinux will block it.

I agree working with selinux is a bit of a PITA but if you learn sealert, ausearch, and/or audit2allow it can severely reduce the pain and allow you to keep selinux enabled. I really like this page personally: https://wiki.centos.org/HowTos/SELinux