Ssh – Enabling system management privileges for non-local users – How the heck does `polkit` work, anyways

I am managing a CentOS 6.2 server remotely using X over SSH (actually NX, but that's just a proxy).

The Everything is working correctly, except when I try to do tasks that would normally require administrative permissions (such as things in palimpsest, or any other GUI tools).

When I try to do things which would trigger a authentication dialog (through polkit-gnome)the permissions dialog is silently failing, and the software is running as my user account, rather then root.

To clarify, if I change package settings using the package manager at the local console, I get a pop-up – "Authentication is required to (add/remove) packages".

If I do this remotely, the authentication fails, and I get a "Authorization Failed" dialog.

It seems to boil down to policykit configuration, but I've followed the polkit man pages, and edited my configuration, and it hasn't changed anything.

I can manage packages/do super-user stuff from the command line without any problems. However, I am very visually oriented, and much prefer a GUI when possible.

Ok, so it seems that I need to add a new rule to policykit.

Going off the man pages, I created a file (named 20-remote-admin-allow.pkla), and dropped it into /etc/polkit-1/localauthority/50-local.d/. Since there seems to be multiple polkit config directories, I copied the same file into /var/lib/polkit-1/localauthority/50-local.d/.

It does not appear to have changed anything.

Here is my config file, as mentioned above:

[root@cloaica zul]# cat /var/lib/polkit-1/localauthority/50-local.d/10-remote-admin-allow.pkla 
[Let remote users do admin stuff]
Identity=unix-user:zul
Action=*
ResultAny=auth_admin
ResultInactive=auth_admin
ResultActive=auth_self_keep

[root@cloaica zul]# cat /etc/polkit-1/localauthority/50-local.d/20-remote-admin-allow.pkla 
[Allow Remote Administraton]
Identity=unix-user:zul
Action=*
ResultAny=auth_admin
ResultInactive=auth_admin
ResultActive=auth_admin
[root@cloaica zul]# 

pkaction --verbose still reports

implicit any:      no
implicit inactive: no

for most actions, and said actions fail if I attempt them, with "Authentication Failed" dialog, as mentioned above.

Seriously, I does anyone actually understand how polkit actually works?

Policykit seems to be an ongoing nightmare, and considering there used to be a GUI configuration tool and it was removed, I don't understand how anyone thought this was ready for release into a production OS.

To be clear, I like having the "please authenticate to perform this action" dialogs. I just want to actually have them, rather then having the system silently fail to authenticate.

I don't want to remove the entirety of polkit, just make it either think all sessions are active, or that inactive sessions get the same permissions as active sessions.