diff options
Diffstat (limited to 'man/nm-settings-nmcli.5')
| -rw-r--r-- | man/nm-settings-nmcli.5 | 144 |
1 files changed, 102 insertions, 42 deletions
diff --git a/man/nm-settings-nmcli.5 b/man/nm-settings-nmcli.5 index d33da534..c55daf4e 100644 --- a/man/nm-settings-nmcli.5 +++ b/man/nm-settings-nmcli.5 @@ -2,12 +2,12 @@ .\" Title: nm-settings-nmcli .\" Author: .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> -.\" Date: 02/22/2024 +.\" Date: 05/03/2024 .\" Manual: Configuration -.\" Source: NetworkManager 1.46.0 +.\" Source: NetworkManager 1.47.90 .\" Language: English .\" -.TH "NM\-SETTINGS\-NMCLI" "5" "" "NetworkManager 1\&.46\&.0" "Configuration" +.TH "NM\-SETTINGS\-NMCLI" "5" "" "NetworkManager 1\&.47\&.90" "Configuration" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -131,6 +131,8 @@ Special values: default (\-1), forever (0) .RS 4 Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection\&. This only has a real effect for master connections\&. The properties "autoconnect", "autoconnect\-priority" and "autoconnect\-retries" are unrelated to this setting\&. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, \-1: default\&. If \-1 (default) is set, global connection\&.autoconnect\-slaves is read to determine the real value\&. If it is default as well, this fallbacks to 0\&. .sp +Deprecated 1\&.46\&. Use "autoconnect\-ports" instead, this is just an alias\&. +.sp Format: choice (NMSettingConnectionAutoconnectSlaves) .sp Valid values: default (\-1), no (0), yes (1) @@ -158,6 +160,15 @@ Format: choice (NMSettingConnectionDnsOverTls) Valid values: default (\-1), no (0), opportunistic (1), yes (2) .RE .PP +\fBconnection\&.down\-on\-poweroff\fR +.RS 4 +Whether the connection will be brought down before the system is powered off\&. The default value is "default" (\-1)\&. When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as "no" (0)\&. +.sp +Format: ternary +.sp +Valid values: true/yes/on, false/no/off, default/unknown +.RE +.PP \fBconnection\&.gateway\-ping\-timeout\fR .RS 4 If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping\&. @@ -226,9 +237,9 @@ Format: string .RS 4 Whether mDNS is enabled for the connection\&. .sp -The permitted values are: "yes" (2) register hostname and resolving for the connection, "no" (0) disable mDNS for the interface, "resolve" (1) do not register hostname but allow resolving of mDNS host names and "default" (\-1) to allow lookup of a global default in NetworkManager\&.conf\&. If unspecified, "default" ultimately depends on the DNS plugin (which for systemd\-resolved currently means "no")\&. +The permitted values are: "yes" (2) register hostname and resolving for the connection, "no" (0) disable mDNS for the interface, "resolve" (1) do not register hostname but allow resolving of mDNS host names and "default" (\-1) to allow lookup of a global default in NetworkManager\&.conf\&. If unspecified, "default" ultimately depends on the DNS plugin\&. .sp -This feature requires a plugin which supports mDNS\&. Otherwise, the setting has no effect\&. One such plugin is dns\-systemd\-resolved\&. +This feature requires a plugin which supports mDNS\&. Otherwise, the setting has no effect\&. Currently the only supported DNS plugin is systemd\-resolved\&. For systemd\-resolved, the default is configurable via MulticastDNS= setting in resolved\&.conf\&. .sp Format: choice (NMSettingConnectionMdns) .sp @@ -372,7 +383,7 @@ The connection\&.uuid is the real identifier of a profile\&. It cannot change an .sp The UUID cannot be changed, except in offline mode\&. In that case, the special values "new", "generate" and "" are allowed to generate a new random UUID\&. .sp -Format: string +Format: a valid RFC4122 universally unique identifier (UUID)\&. .RE .PP \fBconnection\&.wait\-activation\-delay\fR @@ -450,11 +461,11 @@ Valid values: 0 \- 2147483647 .PP \fB802\-1x\&.ca\-cert\fR .RS 4 -Contains the CA certificate if used by the EAP method specified in the "eap" property\&. +Contains the path to the CA certificate if used by the EAP method specified in the 802\-1x\&.eap property\&. .sp -Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL\&. When using the blob scheme this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. +This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. .sp -Note that enabling NMSetting8021x:system\-ca\-certs will override this setting to use the built\-in path, if the built\-in path is not a directory\&. +Note that enabling 802\-1x\&.system\-ca\-certs will override this setting to use the built\-in path, if the built\-in path is not a directory\&. .sp Format: filesystem path .RE @@ -486,9 +497,7 @@ Format: string .PP \fB802\-1x\&.client\-cert\fR .RS 4 -Contains the client certificate if used by the EAP method specified in the "eap" property\&. -.sp -Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. +Contains the path to the client certificate if used by the EAP method specified in the 802\-1x\&.eap property\&. .sp Format: filesystem path .RE @@ -539,6 +548,13 @@ Identity string for EAP authentication methods\&. Often the user\*(Aqs user or l Format: string .RE .PP +\fB802\-1x\&.openssl\-ciphers\fR +.RS 4 +Define openssl_ciphers for wpa_supplicant\&. Openssl sometimes moves ciphers among SECLEVELs, thus compiled\-in default value in wpa_supplicant (as modified by some linux distributions) sometimes prevents to connect to old servers that do not support new protocols\&. +.sp +Format: string +.RE +.PP \fB802\-1x\&.optional\fR .RS 4 Whether the 802\&.1X authentication is optional\&. If TRUE, the activation will continue even after a timeout or an authentication failure\&. Setting the property to TRUE is currently allowed only for Ethernet connections\&. If set to FALSE, the activation can continue only after a successful authentication\&. @@ -650,11 +666,11 @@ Valid values: md5, mschapv2, otp, gtc, tls .PP \fB802\-1x\&.phase2\-ca\-cert\fR .RS 4 -Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2\-auth" or "phase2\-autheap" properties\&. +Contains the path to the "phase 2" CA certificate if used by the EAP method specified in the 802\-1x\&.phase2\-auth or 802\-1x\&.phase2\-autheap properties\&. .sp -Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL\&. When using the blob scheme this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. +This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. .sp -Note that enabling NMSetting8021x:system\-ca\-certs will override this setting to use the built\-in path, if the built\-in path is not a directory\&. +Note that enabling 802\-1x\&.system\-ca\-certs will override this setting to use the built\-in path, if the built\-in path is not a directory\&. .sp Format: filesystem path .RE @@ -686,9 +702,7 @@ Format: filesystem path .PP \fB802\-1x\&.phase2\-client\-cert\fR .RS 4 -Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2\-auth" or "phase2\-autheap" properties\&. -.sp -Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. +Contains the path to the "phase 2" client certificate if used by the EAP method specified in the 802\-1x\&.phase2\-auth or 802\-1x\&.phase2\-autheap properties\&. .sp Format: filesystem path .RE @@ -725,16 +739,14 @@ Format: string .PP \fB802\-1x\&.phase2\-private\-key\fR .RS 4 -Contains the "phase 2" inner private key when the "phase2\-auth" or "phase2\-autheap" property is set to "tls"\&. -.sp -Key data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2\-private\-key\-password" property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "phase2\-private\-key\-password" property must be set to the password used to decode the PKCS#12 private key and certificate\&. +The path to the "phase 2" inner private key when the 802\-1x\&.phase2\-auth or 802\-1x\&.phase2\-autheap property is set to "tls"\&. .sp Format: filesystem path .RE .PP \fB802\-1x\&.phase2\-private\-key\-password\fR .RS 4 -The password used to decrypt the "phase 2" private key specified in the "phase2\-private\-key" property when the private key either uses the path scheme, or is a PKCS#12 format key\&. +The password used to decrypt the "phase 2" private key specified in the 802\-1x\&.phase2\-private\-key property\&. This is normally used by secret agents, not directly by users\&. .sp Format: string .RE @@ -775,18 +787,14 @@ Valid values: none (0x0), agent\-owned (0x1), not\-saved (0x2), not\-required (0 .PP \fB802\-1x\&.private\-key\fR .RS 4 -Contains the private key when the "eap" property is set to "tls"\&. -.sp -Key data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private\-key\-password" property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "private\-key\-password" property must be set to the password used to decode the PKCS#12 private key and certificate\&. -.sp -WARNING: "private\-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users\&. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data\&. +The path to the private key when the 802\-1\&.eap property is set to "tls"\&. .sp Format: filesystem path .RE .PP \fB802\-1x\&.private\-key\-password\fR .RS 4 -The password used to decrypt the private key specified in the "private\-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key\&. +The password used to decrypt the private key specified in the 802\-1x\&.private\-key property\&. This is normally used by secret agents, not directly by users\&. .sp Format: string .RE @@ -2327,7 +2335,7 @@ Alias: ip4 .sp A list of IPv4 addresses and their prefix length\&. Multiple addresses can be separated by comma\&. For example "192\&.168\&.1\&.5/24, 10\&.1\&.0\&.5/24"\&. The addresses are listed in decreasing priority, meaning the first address will be the primary address\&. .sp -Format: list of ipv4\&.addresses objects +Format: a comma separated list of addresses .RE .PP \fBipv4\&.auto\-route\-ext\-gw\fR @@ -2446,6 +2454,15 @@ Format: boolean Valid values: true/yes/on, false/no/off .RE .PP +\fBipv4\&.dhcp\-send\-release\fR +.RS 4 +Whether the DHCP client will send RELEASE message when bringing the connection down\&. The default value is "default" (\-1)\&. When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as FALSE\&. +.sp +Format: ternary +.sp +Valid values: true/yes/on, false/no/off, default/unknown +.RE +.PP \fBipv4\&.dhcp\-timeout\fR .RS 4 A timeout for a DHCP transaction in seconds\&. If zero (the default), a globally configured default is used\&. If still unspecified, a device specific timeout is used (usually 45 seconds)\&. @@ -2489,7 +2506,7 @@ When using a caching DNS plugin (dnsmasq or systemd\-resolved in NetworkManager\ .sp The valid "ipv4\&.dns\-options" and "ipv6\&.dns\-options" get merged together\&. .sp -Format: list of strings +Format: a comma separated list of DNS options .RE .PP \fBipv4\&.dns\-priority\fR @@ -2976,7 +2993,7 @@ Note that in NetworkManager, currently all nexthops of a ECMP route must share t .sp For details see also `man ip\-route`\&. .sp -Format: list of ipv4\&.routes objects +Format: a comma separated list of routes .RE .PP \fBipv4\&.routing\-rules\fR @@ -2988,7 +3005,7 @@ syntax and mostly compatible\&. One difference is that routing rules in NetworkM Example: priority 5 from 192\&.167\&.4\&.0/24 table 45 .sp -Format: list of ipv4\&.routing\-rules objects +Format: a comma separated list of routing rules .RE .SS "ipv6 setting" .PP @@ -3012,7 +3029,7 @@ If not specified, when creating a new profile the default is "default"\&. .sp Note that this setting is distinct from the Privacy Extensions as configured by "ip6\-privacy" property and it does not affect the temporary addresses configured with this option\&. .sp -Format: choice (NMSettingIP6ConfigAddrGenMode) +Format: one of "eui64" (0), "stable\-privacy" (1), "default" (3) or "default\-or\-eui64" (2) .sp Valid values: eui64 (0), stable\-privacy (1), default\-or\-eui64 (2), default (3) .RE @@ -3023,7 +3040,7 @@ Alias: ip6 .sp A list of IPv6 addresses and their prefix length\&. Multiple addresses can be separated by comma\&. For example "2001:db8:85a3::8a2e:370:7334/64, 2001:db8:85a3::5/64"\&. The addresses are listed in decreasing priority, meaning the first address will be the primary address\&. This can make a difference with IPv6 source address selection (RFC 6724, section 5)\&. .sp -Format: list of ipv6\&.addresses objects +Format: a comma separated list of addresses .RE .PP \fBipv6\&.auto\-route\-ext\-gw\fR @@ -3101,6 +3118,15 @@ Format: boolean Valid values: true/yes/on, false/no/off .RE .PP +\fBipv6\&.dhcp\-send\-release\fR +.RS 4 +Whether the DHCP client will send RELEASE message when bringing the connection down\&. The default value is "default" (\-1)\&. When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as FALSE\&. +.sp +Format: ternary +.sp +Valid values: true/yes/on, false/no/off, default/unknown +.RE +.PP \fBipv6\&.dhcp\-timeout\fR .RS 4 A timeout for a DHCP transaction in seconds\&. If zero (the default), a globally configured default is used\&. If still unspecified, a device specific timeout is used (usually 45 seconds)\&. @@ -3137,7 +3163,7 @@ When using a caching DNS plugin (dnsmasq or systemd\-resolved in NetworkManager\ .sp The valid "ipv4\&.dns\-options" and "ipv6\&.dns\-options" get merged together\&. .sp -Format: list of strings +Format: a comma separated list of DNS options .RE .PP \fBipv6\&.dns\-priority\fR @@ -3209,9 +3235,7 @@ Valid values: true/yes/on, false/no/off .RS 4 Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941\&. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI\-64\&. This enhances privacy, but could cause problems in some applications, on the other hand\&. The permitted values are: \-1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses)\&. .sp -Having a per\-connection setting set to "\-1" (unknown) means fallback to global configuration "ipv6\&.ip6\-privacy"\&. -.sp -If also global configuration is unspecified or set to "\-1", fallback to read "/proc/sys/net/ipv6/conf/default/use_tempaddr"\&. +If set to "\-1" (unknown) for a connection, the value is taken from the global "ipv6\&.ip6\-privacy" setting\&. If the global setting is unspecified or also set to "\-1", the value is set from the original value of "/proc/sys/net/ipv6/conf/<iface>/use_tempaddr" from before NetworkManager started\&. .sp Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the "addr\-gen\-mode" property\*(Aqs "stable\-privacy" setting as another way of avoiding host tracking with IPv6 addresses\&. .sp @@ -3651,7 +3675,7 @@ unicast\&. .sp For details see also `man ip\-route`\&. .sp -Format: list of ipv6\&.routes objects +Format: a comma separated list of routes .RE .PP \fBipv6\&.routing\-rules\fR @@ -3663,7 +3687,29 @@ syntax and mostly compatible\&. One difference is that routing rules in NetworkM Example: priority 5 from 1:2:3::5/128 table 45 .sp -Format: list of ipv6\&.routing\-rules objects +Format: a comma separated list of routing rules +.RE +.PP +\fBipv6\&.temp\-preferred\-lifetime\fR +.RS 4 +The preferred lifetime of autogenerated temporary addresses, in seconds\&. +.sp +If set to "0" (unknown) for a connection, the value is taken from the global "ipv6\&.temp\-preferred\-lifetime" setting\&. If the global setting is unspecified or also set to "0", the value is set from the original value of "/proc/sys/net/ipv6/conf/<iface>/temp_prefered_lft" from before NetworkManager started\&. +.sp +Format: integer +.sp +Valid values: 0 \- 2147483647 +.RE +.PP +\fBipv6\&.temp\-valid\-lifetime\fR +.RS 4 +The valid lifetime of autogenerated temporary addresses, in seconds\&. +.sp +If set to "0" (unknown) for a connection, the value is taken from the global "ipv6\&.temp\-valid\-lifetime" setting\&. If the global setting is unspecified or also set to "0", the value is set from the original value of "/proc/sys/net/ipv6/conf/<iface>/temp_valid_lft" from before NetworkManager started\&. +.sp +Format: integer +.sp +Valid values: 0 \- 2147483647 .RE .PP \fBipv6\&.token\fR @@ -4769,7 +4815,7 @@ Limit is the number of bytes that can be queued waiting for tokens to become ava specifies the maximum amount of time a packet can sit in the TBF\&. The latency calculation takes into account the size of the bucket, the rate and possibly the peakrate (if set)\&. The latency and limit are mutually exclusive\&. .RE .sp -Format: list of tc\&.qdiscs objects +Format: GPtrArray(NMTCQdisc) .RE .PP \fBtc\&.tfilters\fR @@ -4827,7 +4873,7 @@ Action for \*(Aqsimple\*(Aq: The actual string to print\&. .RE .sp -Format: list of tc\&.tfilters objects +Format: GPtrArray(NMTCTfilter) .RE .SS "team setting" .PP @@ -5570,6 +5616,13 @@ If specified, this connection will never apply to the Ethernet device whose perm Format: list of MAC addresses .RE .PP +\fB802\-3\-ethernet\&.mac\-address\-denylist\fR +.RS 4 +If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list\&. Each MAC address is in the standard hex\-digits\-and\-colons notation (00:11:22:33:44:55)\&. +.sp +Format: list of MAC addresses +.RE +.PP \fB802\-3\-ethernet\&.mtu\fR .RS 4 Alias: mtu @@ -5835,6 +5888,13 @@ A list of permanent MAC addresses of Wi\-Fi devices to which this connection sho Format: list of MAC addresses .RE .PP +\fB802\-11\-wireless\&.mac\-address\-denylist\fR +.RS 4 +A list of permanent MAC addresses of Wi\-Fi devices to which this connection should never apply\&. Each MAC address should be given in the standard hex\-digits\-and\-colons notation (eg "00:11:22:33:44:55")\&. +.sp +Format: list of MAC addresses +.RE +.PP \fB802\-11\-wireless\&.mac\-address\-randomization\fR .RS 4 One of "default" (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization), "never" (1) (never randomize the MAC address), or "always" (2) (always randomize the MAC address)\&. |