The error you're encountering, nm-settings-error-quark: Insufficient privileges (1), occurs when the Proton VPN backend (or any application) tries to modify NetworkManager connections via its Python bindings (nmclient). This error specifically indicates that the process lacks the necessary permissions to perform the operation.

Why This Happens Only via SSH

1. PolicyKit (polkit) Restrictions:

   • NetworkManager operations (e.g., adding/modifying connections) require root or elevated privileges via PolicyKit.
   • When you're logged in locally (e.g., via a GUI or direct console), your session is often automatically authorized for certain actions via polkit.
   • Over SSH, your session may not have the same PolicyKit permissions by default, even if you're the same user.

2. SSH Session Context:

   • SSH sessions often run in a non-interactive, non-graphical context, which can lack the DBus session bus or PolicyKit agent required for privilege escalation.
   • Some systems restrict NetworkManager modifications to local sessions only for security reasons.

3. User vs. System Bus:

   • NetworkManager typically uses the system DBus bus, which requires elevated permissions.
   • If your SSH session doesn't have access to the system bus or lacks the necessary polkit rules, the operation fails.

How to Fix It

1. Run the Command with sudo

If you're running the Proton VPN CLI or a script that triggers this error, try:

sudo protonvpn-cli

or prefix the command with sudo to ensure it has the required privileges.

2. Configure PolicyKit for SSH

If you want to allow your SSH user to manage NetworkManager without sudo, you can create a PolicyKit rule:

1. Create a file at:
   bash

   Copy

   /etc/polkit-1/rules.d/50-allow-networkmanager-ssh.rules

2. Add the following content (replace your_username with your actual username):
   javascript

   Copy

   polkit.addRule(function(action, subject) {
       if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
           subject.user == "your_username") {
           return polkit.Result.YES;
       }
   });

3. Restart polkit:
   bash

   Copy

   sudo systemctl restart polkit

3. Use pkexec for Specific Commands

If the issue persists, you can explicitly request elevated permissions for the command:

pkexec python3 /usr/lib/python3/dist-packages/proton/vpn/backend/networkmanager/core/networkmanager.py

4. Check DBus Environment Variables

Ensure your SSH session has the correct DBus environment variables set. Add this to your ~/.bashrc or ~/.zshrc:

export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u)/bus

Then reload your shell:

source ~/.bashrc

5. Debug PolicyKit Permissions

Check if your user has the required permissions:

busctl call org.freedesktop.PolicyKit1 /org/freedesktop/PolicyKit1/Authority org.freedesktop.PolicyKit1.Authority CheckAuthorization "ss:system-bus-name,org.freedesktop.NetworkManager" "org.freedesktop.NetworkManager.settings.modify.system" "unix-user:$(id -u)" 0

If this returns NO, the issue is PolicyKit-related.

6. Run NetworkManager in Debug Mode

To confirm the issue, run:

sudo journalctl -u NetworkManager --no-pager -n 50

or

sudo NM_DEBUG=1 nmcli

Look for permission-denied errors.

Temporary Workaround

If you only need to use Proton VPN occasionally via SSH, the simplest solution is to:

sudo protonvpn-cli login
sudo protonvpn-cli connect

Final Notes

• Security Risk: Allowing SSH users to modify NetworkManager without sudo can be a security risk. Only do this if you trust the user and the network.
• Proton VPN Specifics: If this is a Proton VPN-specific issue, check their official documentation for Debian 13 compatibility notes. Some VPN clients require additional setup for headless/SSH environments.