1NM-SETTINGS-KEYFILE(5) Configuration NM-SETTINGS-KEYFILE(5)
2
6 nm-settings-keyfile - Description of keyfile settings plugin
7
9 NetworkManager is based on the concept of connection profiles that
10 contain network configuration (see nm-settings(5) for details). The
11 profiles can be stored in various formats. NetworkManager uses plugins
12 for reading and writing the data. The plugins can be configured in
13 NetworkManager.conf(5).
14 The keyfile plugin is the generic plugin that supports all the
16 connection types and capabilities that NetworkManager has. The files
17 are in a .ini-style format and located in
18 /etc/NetworkManager/system-connections/,
19 /usr/lib/NetworkManager/system-connections/ and
20 /run/NetworkManager/system-connections/. This plugin is always enabled
21 and will automatically be used to store any connections that are not
22 supported by any other active plugin. For security, it will ignore
23 files that are readable or writable by any user other than 'root' since
24 private keys and passphrases may be stored in plaintext inside the
25 file.
26
28 The keyfile config format is a simple .ini-style format. It consists of
29 sections (groups) of key-value pairs. Each section corresponds to a
30 setting name as described in the settings specification (nm-
31 settings(5)). Each configuration key/value pair in the section is one
32 of the properties listed in the settings specification. The majority of
33 properties of the specification is written in the same format into the
34 keyfile too. However some values are inconvenient for people to use.
35 These are stored in the files in more readable ways. These properties
36 are described below. An example could be IP addresses that are not
37 written as integer arrays, but more reasonably as "1.2.3.4/12
38 1.2.3.254". More information of the generic key file format can be
39 found at GLib key file format[1] (Lines beginning with a '#' are
40 comments, lists are separated by character ; etc.).
41 Users can create or modify the keyfile connection files manually, even
43 if that is not the recommended way of managing the profiles. However,
44 if they choose to do that, they must inform NetworkManager about their
45 changes (for example via nmcli con (re)load).
46 Examples of keyfile configuration.
48 A sample configuration for an ethernet network:
50 [connection]
51 id=Main eth0
52 uuid=27afa607-ee36-43f0-b8c3-9d245cdc4bb3
53 type=802-3-ethernet
54 autoconnect=true
55 [ipv4]
57 method=auto
58 [802-3-ethernet]
60 mac-address=00:23:5a:47:1f:71
61 A sample configuration for WPA-EAP (PEAP with MSCHAPv2) and always-ask secret:
65 [connection]
66 id=CompanyWIFI
67 uuid=cdac6154-a33b-4b15-9904-666772cfa5ee
68 type=wifi
69 autoconnect=false
70 [wifi]
72 ssid=CorpWLAN
73 mode=infrastructure
74 security=802-11-wireless-security
75 [wifi-security]
77 key-mgmt=wpa-eap
78 [ipv4]
80 method=auto
81 [ipv6]
83 method=auto
84 [802-1x]
86 eap=peap;
87 identity=joe
88 ca-cert=/home/joe/.cert/corp.crt
89 phase1-peapver=1
90 phase2-auth=mschapv2
91 password-flags=2
92 A sample configuration for openvpn:
96 [connection]
97 id=RedHat-openvpn
98 uuid=7f9b3356-b210-4c0e-8123-bd116c9c280f
99 type=vpn
100 timestamp=1385401165
101 [vpn]
103 service-type=org.freedesktop.NetworkManager.openvpn
104 connection-type=password
105 password-flags=3
106 remote=ovpn.my-company.com
107 cipher=AES-256-CBC
108 reneg-seconds=0
109 port=443
110 username=joe
111 ca=/etc/openvpn/ISCA.pem
112 tls-remote=ovpn.my-company.com
113 [ipv6]
115 method=auto
116 [ipv4]
118 method=auto
119 ignore-auto-dns=true
120 never-default=true
121 A sample configuration for a bridge and a bridge port:
125 [connection] [connection]
126 id=MainBridge id=br-port-1
127 uuid=171ae855-a0ab-42b6-bd0c-60f5812eea9d uuid=d6e8ae98-71f8-4b3d-9d2d-2e26048fe794
128 interface-name=MainBridge interface-name=em1
129 type=bridge type=ethernet
130 master=MainBridge
131 [bridge] slave-type=bridge
132 interface-name=MainBridge
133 A sample configuration for a VLAN:
137 [connection]
138 id=VLAN for building 4A
139 uuid=8ce1c9e0-ce7a-4d2c-aa28-077dda09dd7e
140 interface-name=VLAN-4A
141 type=vlan
142 [vlan]
144 interface-name=VLAN-4A
145 parent=eth0
146 id=4
147
150 keyfile plugin variables for the majority of NetworkManager properties
151 have one-to-one mapping. It means a NetworkManager property is stored
152 in the keyfile as a variable of the same name and in the same format.
153 There are several exceptions to this rule, mainly for making keyfile
154 syntax easier for humans. The exceptions handled specially by keyfile
155 plugin are listed below. Refer to nm-settings(5) for all available
156 settings and properties and their description.
157 Name aliases. Some of the NetworkManager setting names are somewhat
159 hard to type or remember. Therefore keyfile introduces aliases that can
160 be used instead of the names.
161 setting name keyfile alias
162 802-3-ethernet = ethernet
163 802-11-wireless = wifi
164 802-11-wireless-security = wifi-security
165 Table 1. bridge setting (section)
167 ┌────────────┬──────────────────┬───────────────────────┬──────────────────────────────────┐
168 │Property │ Keyfile Variable │ Format │ Description │
169 ├────────────┼──────────────────┼───────────────────────┼──────────────────────────────────┤
170 │mac-address │ mac-address │ usual │ MAC address in │
171 │ │ │ hex-digits-and-colons │ traditional │
172 │ │ │ notation │ hex-digits-and-colons │
173 │ │ │ │ notation, or │
174 │ │ │ │ semicolon │
175 │ │ │ │ separated list │
176 │ │ │ │ of 6 decimal │
177 │ │ │ │ bytes (obsolete) │
178 │ │ │ │ │
179 │ │ │ │ Example: │
180 │ │ │ │ mac-address=00:22:68:12:79:A2 │
181 │ │ │ │ mac-address=0;34;104;18;121;162; │
182 └────────────┴──────────────────┴───────────────────────┴──────────────────────────────────┘
183 Table 2. infiniband setting (section)
185 ┌────────────┬──────────────────┬───────────────────────┬─────────────────────────────────────────────────────────────┐
186 │Property │ Keyfile Variable │ Format │ Description │
187 ├────────────┼──────────────────┼───────────────────────┼─────────────────────────────────────────────────────────────┤
188 │mac-address │ mac-address │ usual │ MAC address in │
189 │ │ │ hex-digits-and-colons │ traditional │
190 │ │ │ notation │ hex-digits-and-colons │
191 │ │ │ │ notation, or or │
192 │ │ │ │ semicolon │
193 │ │ │ │ separated list │
194 │ │ │ │ of 20 decimal │
195 │ │ │ │ bytes (obsolete) │
196 │ │ │ │ │
197 │ │ │ │ Example: │
198 │ │ │ │ mac-address= │
199 │ │ │ │ 80:00:00:6d:fe:80:00:00:00:00:00:00:00:02:55:00:70:33:cf:01 │
200 └────────────┴──────────────────┴───────────────────────┴─────────────────────────────────────────────────────────────┘
201 Table 3. ipv4 setting (section)
203 ┌──────────┬──────────────────┬─────────────────────────────┬───────────────────────────────┐
204 │Property │ Keyfile Variable │ Format │ Description │
205 ├──────────┼──────────────────┼─────────────────────────────┼───────────────────────────────┤
206 │dns │ dns │ list of DNS IP │ List of DNS │
207 │ │ │ addresses │ servers. │
208 │ │ │ │ │
209 │ │ │ │ Example: │
210 │ │ │ │ dns=1.2.3.4;8.8.8.8;8.8.4.4; │
211 ├──────────┼──────────────────┼─────────────────────────────┼───────────────────────────────┤
212 │addresses │ address1, │ address/plen │ List of static IP addresses. │
213 │ │ address2, ... │ │ │
214 │ │ │ │ Example: │
215 │ │ │ │ address1=192.168.100.100/24 │
216 │ │ │ │ address2=10.1.1.5/24 │
217 ├──────────┼──────────────────┼─────────────────────────────┼───────────────────────────────┤
218 │gateway │ gateway │ string │ Gateway IP addresses as a │
219 │ │ │ │ string. │
220 │ │ │ │ │
221 │ │ │ │ Example: │
222 │ │ │ │ gateway=192.168.100.1 │
223 ├──────────┼──────────────────┼─────────────────────────────┼───────────────────────────────┤
224 │routes │ route1, route2, │ route/plen[,gateway,metric] │ List of IP routes. │
225 │ │ ... │ │ │
226 │ │ │ │ Example: │
227 │ │ │ │ route1=8.8.8.0/24,10.1.1.1,77 │
228 │ │ │ │ route2=7.7.0.0/16 │
229 └──────────┴──────────────────┴─────────────────────────────┴───────────────────────────────┘
230 Table 4. ipv6 setting (section)
232 ┌──────────┬──────────────────┬─────────────────────────────┬──────────────────────────────────────────────────────────────┐
233 │Property │ Keyfile Variable │ Format │ Description │
234 ├──────────┼──────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
235 │dns │ dns │ list of DNS IP │ List of DNS │
236 │ │ │ addresses │ servers. │
237 │ │ │ │ │
238 │ │ │ │ Example: │
239 │ │ │ │ dns=2001:4860:4860::8888;2001:4860:4860::8844; │
240 ├──────────┼──────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
241 │addresses │ address1, │ address/plen │ List of static IP addresses. │
242 │ │ address2, ... │ │ │
243 │ │ │ │ Example: address1=abbe::cafe/96 │
244 │ │ │ │ address2=2001::1234 │
245 ├──────────┼──────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
246 │gateway │ gateway │ string │ Gateway IP addresses as a string. │
247 │ │ │ │ │
248 │ │ │ │ Example: gateway=abbe::1 │
249 ├──────────┼──────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
250 │routes │ route1, route2, │ route/plen[,gateway,metric] │ List of IP routes. │
251 │ │ ... │ │ │
252 │ │ │ │ Example: │
253 │ │ │ │ route1=2001:4860:4860::/64,2620:52:0:2219:222:68ff:fe11:5403 │
254 └──────────┴──────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────────┘
255 Table 5. serial setting (section)
257 ┌─────────┬──────────────────┬──────────────────┬─────────────────┐
258 │Property │ Keyfile Variable │ Format │ Description │
259 ├─────────┼──────────────────┼──────────────────┼─────────────────┤
260 │parity │ parity │ 'e', 'o', or 'n' │ The connection │
261 │ │ │ │ parity; even, │
262 │ │ │ │ odd, or none. │
263 │ │ │ │ Note that older │
264 │ │ │ │ versions of │
265 │ │ │ │ NetworkManager │
266 │ │ │ │ stored this as │
267 │ │ │ │ an integer: 69 │
268 │ │ │ │ ('E') for even, │
269 │ │ │ │ 111 ('o') for │
270 │ │ │ │ odd, or 110 │
271 │ │ │ │ ('n') for none. │
272 │ │ │ │ │
273 │ │ │ │ Example: │
274 │ │ │ │ parity=n │
275 └─────────┴──────────────────┴──────────────────┴─────────────────┘
276 Table 6. vpn setting (section)
278 ┌─────────┬──────────────────┬────────┬───────────────────────┐
279 │Property │ Keyfile Variable │ Format │ Description │
280 ├─────────┼──────────────────┼────────┼───────────────────────┤
281 │data │ separate │ │ The keys of the │
282 │ │ variables named │ │ data dictionary │
283 │ │ after keys of │ │ are used as │
284 │ │ the dictionary │ │ variable names │
285 │ │ │ │ directly under │
286 │ │ │ │ [vpn] section. │
287 │ │ │ │ │
288 │ │ │ │ Example: │
289 │ │ │ │ remote=ovpn.corp.com │
290 │ │ │ │ cipher=AES-256-CBC │
291 │ │ │ │ username=joe │
292 ├─────────┼──────────────────┼────────┼───────────────────────┤
293 │secrets │ separate │ │ The keys of the │
294 │ │ variables named │ │ secrets dictionary │
295 │ │ after keys of │ │ are used as variable │
296 │ │ the dictionary │ │ names directly under │
297 │ │ │ │ [vpn-secrets] │
298 │ │ │ │ section. │
299 │ │ │ │ │
300 │ │ │ │ Example: │
301 │ │ │ │ password=Popocatepetl │
302 └─────────┴──────────────────┴────────┴───────────────────────┘
303 Table 7. wifi-p2p setting (section)
305 ┌─────────┬──────────────────┬───────────────────────┬───────────────────────┐
306 │Property │ Keyfile Variable │ Format │ Description │
307 ├─────────┼──────────────────┼───────────────────────┼───────────────────────┤
308 │peer │ peer │ usual │ MAC address in │
309 │ │ │ hex-digits-and-colons │ traditional │
310 │ │ │ notation │ hex-digits-and-colons │
311 │ │ │ │ notation (e.g. │
312 │ │ │ │ 00:22:68:12:79:A2), │
313 │ │ │ │ or semicolon │
314 │ │ │ │ separated list │
315 │ │ │ │ of 6 bytes │
316 │ │ │ │ (obsolete) (e.g. │
317 │ │ │ │ 0;34;104;18;121;162). │
318 └─────────┴──────────────────┴───────────────────────┴───────────────────────┘
319 Table 8. 802-3-ethernet setting (section)
321 ┌──────────────────────┬───────────────────────┬───────────────────────┬─────────────────────────────────────┐
322 │Property │ Keyfile Variable │ Format │ Description │
323 ├──────────────────────┼───────────────────────┼───────────────────────┼─────────────────────────────────────┤
324 │mac-address │ mac-address │ usual │ MAC address in │
325 │ │ │ hex-digits-and-colons │ traditional │
326 │ │ │ notation │ hex-digits-and-colons │
327 │ │ │ │ notation (e.g. │
328 │ │ │ │ 00:22:68:12:79:A2), │
329 │ │ │ │ or semicolon │
330 │ │ │ │ separated list │
331 │ │ │ │ of 6 bytes │
332 │ │ │ │ (obsolete) (e.g. │
333 │ │ │ │ 0;34;104;18;121;162) │
334 ├──────────────────────┼───────────────────────┼───────────────────────┼─────────────────────────────────────┤
335 │cloned-mac-address │ cloned-mac-address │ usual │ Cloned MAC address in │
336 │ │ │ hex-digits-and-colons │ traditional │
337 │ │ │ notation │ hex-digits-and-colons │
338 │ │ │ │ notation (e.g. │
339 │ │ │ │ 00:22:68:12:79:B2), │
340 │ │ │ │ or semicolon │
341 │ │ │ │ separated list of 6 │
342 │ │ │ │ bytes (obsolete) │
343 │ │ │ │ (e.g. │
344 │ │ │ │ 0;34;104;18;121;178). │
345 ├──────────────────────┼───────────────────────┼───────────────────────┼─────────────────────────────────────┤
346 │mac-address-blacklist │ mac-address-blacklist │ list of MACs │ MAC address │
347 │ │ │ (separated with │ blacklist. │
348 │ │ │ semicolons) │ │
349 │ │ │ │ Example: │
350 │ │ │ │ mac-address-blacklist= │
351 │ │ │ │ 00:22:68:12:79:A6;00:22:68:12:79:78 │
352 └──────────────────────┴───────────────────────┴───────────────────────┴─────────────────────────────────────┘
353 Table 9. 802-11-wireless setting (section)
355 ┌──────────────────────┬───────────────────────┬───────────────────────┬─────────────────────────────────────┐
356 │Property │ Keyfile Variable │ Format │ Description │
357 ├──────────────────────┼───────────────────────┼───────────────────────┼─────────────────────────────────────┤
358 │ssid │ ssid │ string (or │ SSID of Wi-Fi │
359 │ │ │ decimal-byte │ network. │
360 │ │ │ list - obsolete) │ │
361 │ │ │ │ Example: │
362 │ │ │ │ ssid=Quick Net │
363 ├──────────────────────┼───────────────────────┼───────────────────────┼─────────────────────────────────────┤
364 │mac-address │ mac-address │ usual │ MAC address in │
365 │ │ │ hex-digits-and-colons │ traditional │
366 │ │ │ notation │ hex-digits-and-colons │
367 │ │ │ │ notation (e.g. │
368 │ │ │ │ 00:22:68:12:79:A2), │
369 │ │ │ │ or semicolon │
370 │ │ │ │ separated list │
371 │ │ │ │ of 6 bytes │
372 │ │ │ │ (obsolete) (e.g. │
373 │ │ │ │ 0;34;104;18;121;162). │
374 ├──────────────────────┼───────────────────────┼───────────────────────┼─────────────────────────────────────┤
375 │cloned-mac-address │ cloned-mac-address │ usual │ Cloned MAC address in │
376 │ │ │ hex-digits-and-colons │ traditional │
377 │ │ │ notation │ hex-digits-and-colons │
378 │ │ │ │ notation (e.g. │
379 │ │ │ │ 00:22:68:12:79:B2), │
380 │ │ │ │ or semicolon │
381 │ │ │ │ separated list of 6 │
382 │ │ │ │ bytes (obsolete) │
383 │ │ │ │ (e.g. │
384 │ │ │ │ 0;34;104;18;121;178). │
385 ├──────────────────────┼───────────────────────┼───────────────────────┼─────────────────────────────────────┤
386 │mac-address-blacklist │ mac-address-blacklist │ list of MACs │ MAC address │
387 │ │ │ (separated with │ blacklist. │
388 │ │ │ semicolons) │ │
389 │ │ │ │ Example: │
390 │ │ │ │ mac-address-blacklist= │
391 │ │ │ │ 00:22:68:12:79:A6;00:22:68:12:79:78 │
392 └──────────────────────┴───────────────────────┴───────────────────────┴─────────────────────────────────────┘
393 Table 10. wpan setting (section)
395 ┌────────────┬──────────────────┬───────────────────────┬───────────────────────────┐
396 │Property │ Keyfile Variable │ Format │ Description │
397 ├────────────┼──────────────────┼───────────────────────┼───────────────────────────┤
398 │mac-address │ mac-address │ usual │ MAC address in │
399 │ │ │ hex-digits-and-colons │ hex-digits-and-colons │
400 │ │ │ notation │ notation (e.g. │
401 │ │ │ │ 76:d8:9b:87:66:60:84:ee). │
402 └────────────┴──────────────────┴───────────────────────┴───────────────────────────┘
403 Secret flags
405 Each secret property in a NetworkManager setting has an associated
406 flags property that describes how to handle that secret. In the keyfile
407 plugin, the value of -flags variable is a decimal number (0 - 7)
408 defined as a sum of the following values:
409 • 0 - (NM owned) - the system is responsible for providing and
411 storing this secret.
412 • 1 - (agent-owned) - a user-session secret agent is responsible for
414 providing and storing this secret; when it is required, agents will
415 be asked to provide it.
416 • 2 - (not-saved) - this secret should not be saved but should be
418 requested from the user each time it is required.
419 • 4 - (not-required) - in some situations it cannot be automatically
421 determined that a secret is required or not. This flag hints that
422 the secret is not required and should not be requested from the
423 user.
424
426 /etc/NetworkManager/system-connections/*
427
429 nm-settings(5), nm-settings-ifcfg-rh(5), NetworkManager(8),
430 NetworkManager.conf(5), nmcli(1), nmcli-examples(7)
431
433 1. GLib key file format
434 https://developer.gnome.org/glib/stable/glib-Key-value-file-parser.html#glib-Key-value-file-parser.description
435NetworkManager 1.32.12 NM-SETTINGS-KEYFILE(5)