Add elevation for dangerous ssh flags

client/ui/main.go

@@ -8,6 +8,7 @@ import (
 	"flag"
 	"io/fs"
 	"log"
+	"os"
 	"runtime"
 	"strings"
 
@@ -16,6 +17,7 @@ import (
 	"github.com/wailsapp/wails/v3/pkg/events"
 	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
+	"github.com/netbirdio/netbird/client/cmd"
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
 	"github.com/netbirdio/netbird/client/ui/preferences"
@@ -80,6 +82,16 @@ func init() {
 }
 
 func main() {
+	// When re-launched under a privilege prompt (pkexec/UAC/osascript) to apply
+	// the dangerous SSH settings, this binary is invoked as os.Executable().
+	// Delegate to the shared CLI command and exit before starting the GUI.
+	if len(os.Args) > 1 && os.Args[1] == cmd.SetSSHConfigCmdName {
+		if err := cmd.Execute(); err != nil {
+			os.Exit(1)
+		}
+		os.Exit(0)
+	}
+
 	daemonAddr, userSetLogFile := parseFlagsAndInitLog()
 	conn := NewConn(daemonAddr)
 

client/ui/services/settings.go

@@ -7,6 +7,10 @@ import (
 	"fmt"
 	"reflect"
 
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/cmd"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -190,9 +194,27 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
 	}
 	_, err = cli.SetConfig(ctx, req)
+	if err != nil && wantsDangerousSSHConfig(p) && status.Code(err) == codes.PermissionDenied {
+		// The daemon restricts enabling SSH root login / disabling SSH auth to
+		// root/administrator, and the UI runs as the unprivileged desktop user.
+		// Elevate (polkit/UAC/osascript) so a privileged helper applies just
+		// those flags.
+		if elevErr := cmd.ElevateSSHConfig(p.ProfileName, p.Username, p.EnableSSHRoot, p.DisableSSHAuth); elevErr != nil {
+			return elevErr
+		}
+		req.EnableSSHRoot = nil
+		req.DisableSSHAuth = nil
+		_, err = cli.SetConfig(ctx, req)
+	}
 	return err
 }
 
+// wantsDangerousSSHConfig reports whether p tries to enable SSH root login or
+// disable SSH authentication.
+func wantsDangerousSSHConfig(p SetConfigParams) bool {
+	return (p.EnableSSHRoot != nil && *p.EnableSSHRoot) || (p.DisableSSHAuth != nil && *p.DisableSSHAuth)
+}
+
 func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 	cli, err := s.conn.Client()
 	if err != nil {