From 2c032d8f1c6292c1338a615e6ec40252889ba85c Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Thu, 22 Jan 2015 00:29:39 +0100 Subject: Imported Upstream version 1.0.0 --- man/Makefile.am | 88 +- man/Makefile.in | 126 ++- man/NetworkManager.8 | 17 +- man/NetworkManager.conf.5 | 46 +- man/NetworkManager.conf.xml.in | 560 ++++++++++ man/nm-settings-ifcfg-rh.5 | 2325 ++++++++++++++++++++++++++++++++++++++++ man/nm-settings-ifcfg-rh.xml | 335 ++++++ man/nm-settings-ifcfg-rh.xsl | 405 +++++++ man/nm-settings-keyfile.5 | 698 ++++++++++++ man/nm-settings-keyfile.xml | 233 ++++ man/nm-settings-keyfile.xsl | 308 ++++++ man/nm-settings.5 | 1631 +++++++++++++++------------- man/nm-settings.xml | 343 ++++++ man/nm-settings.xsl | 162 +++ man/nmcli-examples.5 | 43 +- man/nmcli.1.in | 96 +- man/nmtui.1.in | 66 ++ 17 files changed, 6623 insertions(+), 859 deletions(-) create mode 100644 man/NetworkManager.conf.xml.in create mode 100644 man/nm-settings-ifcfg-rh.5 create mode 100644 man/nm-settings-ifcfg-rh.xml create mode 100644 man/nm-settings-ifcfg-rh.xsl create mode 100644 man/nm-settings-keyfile.5 create mode 100644 man/nm-settings-keyfile.xml create mode 100644 man/nm-settings-keyfile.xsl create mode 100644 man/nm-settings.xml create mode 100644 man/nm-settings.xsl create mode 100644 man/nmtui.1.in (limited to 'man') diff --git a/man/Makefile.am b/man/Makefile.am index 64469685..4577cb41 100644 --- a/man/Makefile.am +++ b/man/Makefile.am @@ -4,16 +4,16 @@ EXTRA_DIST = XSLTPROC = xsltproc -XSLTPROC_FLAGS = \ - --xinclude \ - --nonet \ +XSLTPROC_FLAGS = --xinclude --nonet + +XSLTPROC_MAN_FLAGS = \ + $(XSLTPROC_FLAGS) \ --stringparam man.output.quietly 1 \ --stringparam funcsynopsis.style ansi \ --stringparam man.th.extra1.suppress 1 \ --stringparam man.authors.section.enabled 0 \ - --stringparam man.copyright.section.enabled 0 - -XSLTPROC_MAN_FLAGS = $(XSLTPROC_FLAGS) http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl + --stringparam man.copyright.section.enabled 0 \ + http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl if ENABLE_GTK_DOC @@ -23,14 +23,41 @@ if ENABLE_GTK_DOC %.5: %.xml $(AM_V_GEN) xsltproc $(XSLTPROC_MAN_FLAGS) $< -nm-settings.xml: $(top_builddir)/tools/generate-settings-spec $(top_builddir)/libnm-util/libnm-util.la - rm -f $(builddir)/$@ - $(top_builddir)/tools/generate-settings-spec refentry $(builddir)/$@ +endif + +if BUILD_SETTING_DOCS + +nm-settings.xml: nm-settings.xsl $(top_builddir)/libnm/nm-setting-docs.xml + $(AM_V_GEN) xsltproc \ + --output $@ \ + --stringparam version $(NM_VERSION) \ + --stringparam date "`date +'%d %B %Y'`" \ + $^ + +nm-settings-keyfile.xml: nm-settings-keyfile.xsl $(top_builddir)/libnm/nm-keyfile-docs.xml + $(AM_V_GEN) xsltproc \ + --output $@ \ + --stringparam version $(NM_VERSION) \ + --stringparam date "`date +'%d %B %Y'`" \ + $^ + +nm-settings-ifcfg-rh.xml: nm-settings-ifcfg-rh.xsl $(top_builddir)/libnm/nm-ifcfg-rh-docs.xml + $(AM_V_GEN) xsltproc \ + --output $@ \ + --stringparam version $(NM_VERSION) \ + --stringparam date "`date +'%d %B %Y'`" \ + $^ + +CLEANFILES += \ + nm-settings.xml \ + nm-settings-keyfile.xml \ + nm-settings-ifcfg-rh.xml endif configure_generated_man_pages = \ nmcli.1 \ + nmtui.1 \ nm-online.1 \ nm-system-settings.conf.5 @@ -40,29 +67,46 @@ docbook_generated_man_pages = \ nmcli-examples.5 docbook_autogenerated_man_pages = \ - nm-settings.5 - -generated_man_pages = \ - $(docbook_generated_man_pages) \ - $(docbook_autogenerated_man_pages) + nm-settings.5 \ + nm-settings-keyfile.5 \ + nm-settings-ifcfg-rh.5 EXTRA_DIST += \ + nm-settings.xml \ + nm-settings.xsl \ + nm-settings-keyfile.xml \ + nm-settings-keyfile.xsl \ + nm-settings-ifcfg-rh.xml \ + nm-settings-ifcfg-rh.xsl \ $(docbook_generated_man_pages:.%=.xml) \ $(docbook_autogenerated_man_pages) -CLEANFILES += \ - nm-settings.xml - man_MANS += $(configure_generated_man_pages) +links = nmtui-edit nmtui-connect nmtui-hostname + +install-data-hook: + for link in $(links); do \ + ln -f $(DESTDIR)$(mandir)/man1/nmtui.1 $(DESTDIR)$(mandir)/man1/$$link.1; \ + done + +uninstall-hook: + for link in $(links); do \ + rm -f $(DESTDIR)$(mandir)/man1/$$link.1; \ + done + if ENABLE_GTK_DOC -man_MANS += $(generated_man_pages) -CLEANFILES += \ - $(docbook_autogenerated_man_pages) \ - $(docbook_generated_man_pages) +man_MANS += $(docbook_generated_man_pages) +CLEANFILES += $(docbook_generated_man_pages) +if SETTING_DOCS_AVAILABLE +man_MANS += $(docbook_autogenerated_man_pages) +CLEANFILES += $(docbook_autogenerated_man_pages) +endif else if INSTALL_PREGEN_MANPAGES -man_MANS += $(generated_man_pages) +man_MANS += \ + $(docbook_generated_man_pages) \ + $(docbook_autogenerated_man_pages) endif endif diff --git a/man/Makefile.in b/man/Makefile.in index a48bf680..503b900c 100644 --- a/man/Makefile.in +++ b/man/Makefile.in @@ -77,16 +77,25 @@ PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ -@ENABLE_GTK_DOC_TRUE@am__append_1 = $(generated_man_pages) -@ENABLE_GTK_DOC_TRUE@am__append_2 = \ -@ENABLE_GTK_DOC_TRUE@ $(docbook_autogenerated_man_pages) \ -@ENABLE_GTK_DOC_TRUE@ $(docbook_generated_man_pages) +@BUILD_SETTING_DOCS_TRUE@am__append_1 = \ +@BUILD_SETTING_DOCS_TRUE@ nm-settings.xml \ +@BUILD_SETTING_DOCS_TRUE@ nm-settings-keyfile.xml \ +@BUILD_SETTING_DOCS_TRUE@ nm-settings-ifcfg-rh.xml + +@ENABLE_GTK_DOC_TRUE@am__append_2 = $(docbook_generated_man_pages) +@ENABLE_GTK_DOC_TRUE@am__append_3 = $(docbook_generated_man_pages) +@ENABLE_GTK_DOC_TRUE@@SETTING_DOCS_AVAILABLE_TRUE@am__append_4 = $(docbook_autogenerated_man_pages) +@ENABLE_GTK_DOC_TRUE@@SETTING_DOCS_AVAILABLE_TRUE@am__append_5 = $(docbook_autogenerated_man_pages) +@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@am__append_6 = \ +@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@ $(docbook_generated_man_pages) \ +@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@ $(docbook_autogenerated_man_pages) -@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@am__append_3 = $(generated_man_pages) subdir = man DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \ + $(srcdir)/NetworkManager.conf.xml.in \ $(srcdir)/nm-system-settings.conf.5.in \ - $(srcdir)/nm-online.1.in $(srcdir)/nmcli.1.in + $(srcdir)/nm-online.1.in $(srcdir)/nmcli.1.in \ + $(srcdir)/nmtui.1.in ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/ax_lib_readline.m4 \ $(top_srcdir)/m4/compiler_warnings.m4 \ @@ -105,7 +114,8 @@ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h -CONFIG_CLEAN_FILES = nm-system-settings.conf.5 nm-online.1 nmcli.1 +CONFIG_CLEAN_FILES = NetworkManager.conf.xml nm-system-settings.conf.5 \ + nm-online.1 nmcli.1 nmtui.1 CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) @@ -171,6 +181,8 @@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ +BLUEZ5_CFLAGS = @BLUEZ5_CFLAGS@ +BLUEZ5_LIBS = @BLUEZ5_LIBS@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ @@ -294,6 +306,7 @@ NEWT_CFLAGS = @NEWT_CFLAGS@ NEWT_LIBS = @NEWT_LIBS@ NM = @NM@ NMEDIT = @NMEDIT@ +NM_CONFIG_DEFAULT_AUTH_POLKIT_TEXT = @NM_CONFIG_DEFAULT_AUTH_POLKIT_TEXT@ NM_MAJOR_VERSION = @NM_MAJOR_VERSION@ NM_MICRO_VERSION = @NM_MICRO_VERSION@ NM_MINOR_VERSION = @NM_MINOR_VERSION@ @@ -313,6 +326,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ +PERL = @PERL@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ @@ -339,7 +353,7 @@ SYSTEMD_INHIBIT_LIBS = @SYSTEMD_INHIBIT_LIBS@ SYSTEMD_LOGIN_CFLAGS = @SYSTEMD_LOGIN_CFLAGS@ SYSTEMD_LOGIN_LIBS = @SYSTEMD_LOGIN_LIBS@ SYSTEM_CA_PATH = @SYSTEM_CA_PATH@ -UDEV_BASE_DIR = @UDEV_BASE_DIR@ +UDEV_DIR = @UDEV_DIR@ USE_NLS = @USE_NLS@ UUID_CFLAGS = @UUID_CFLAGS@ UUID_LIBS = @UUID_LIBS@ @@ -418,24 +432,28 @@ with_dhcpcd = @with_dhcpcd@ with_netconfig = @with_netconfig@ with_resolvconf = @with_resolvconf@ with_valgrind = @with_valgrind@ -man_MANS = $(configure_generated_man_pages) $(am__append_1) \ - $(am__append_3) -CLEANFILES = nm-settings.xml $(am__append_2) -EXTRA_DIST = $(docbook_generated_man_pages:.%=.xml) \ +man_MANS = $(configure_generated_man_pages) $(am__append_2) \ + $(am__append_4) $(am__append_6) +CLEANFILES = $(am__append_1) $(am__append_3) $(am__append_5) +EXTRA_DIST = nm-settings.xml nm-settings.xsl nm-settings-keyfile.xml \ + nm-settings-keyfile.xsl nm-settings-ifcfg-rh.xml \ + nm-settings-ifcfg-rh.xsl \ + $(docbook_generated_man_pages:.%=.xml) \ $(docbook_autogenerated_man_pages) XSLTPROC = xsltproc -XSLTPROC_FLAGS = \ - --xinclude \ - --nonet \ +XSLTPROC_FLAGS = --xinclude --nonet +XSLTPROC_MAN_FLAGS = \ + $(XSLTPROC_FLAGS) \ --stringparam man.output.quietly 1 \ --stringparam funcsynopsis.style ansi \ --stringparam man.th.extra1.suppress 1 \ --stringparam man.authors.section.enabled 0 \ - --stringparam man.copyright.section.enabled 0 + --stringparam man.copyright.section.enabled 0 \ + http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl -XSLTPROC_MAN_FLAGS = $(XSLTPROC_FLAGS) http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl configure_generated_man_pages = \ nmcli.1 \ + nmtui.1 \ nm-online.1 \ nm-system-settings.conf.5 @@ -445,12 +463,11 @@ docbook_generated_man_pages = \ nmcli-examples.5 docbook_autogenerated_man_pages = \ - nm-settings.5 - -generated_man_pages = \ - $(docbook_generated_man_pages) \ - $(docbook_autogenerated_man_pages) + nm-settings.5 \ + nm-settings-keyfile.5 \ + nm-settings-ifcfg-rh.5 +links = nmtui-edit nmtui-connect nmtui-hostname all: all-am .SUFFIXES: @@ -484,12 +501,16 @@ $(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps) $(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): +NetworkManager.conf.xml: $(top_builddir)/config.status $(srcdir)/NetworkManager.conf.xml.in + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ nm-system-settings.conf.5: $(top_builddir)/config.status $(srcdir)/nm-system-settings.conf.5.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ nm-online.1: $(top_builddir)/config.status $(srcdir)/nm-online.1.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ nmcli.1: $(top_builddir)/config.status $(srcdir)/nmcli.1.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ +nmtui.1: $(top_builddir)/config.status $(srcdir)/nmtui.1.in + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ mostlyclean-libtool: -rm -f *.lo @@ -721,7 +742,8 @@ info: info-am info-am: install-data-am: install-man - + @$(NORMAL_INSTALL) + $(MAKE) $(AM_MAKEFLAGS) install-data-hook install-dvi: install-dvi-am install-dvi-am: @@ -765,24 +787,25 @@ ps: ps-am ps-am: uninstall-am: uninstall-man - + @$(NORMAL_INSTALL) + $(MAKE) $(AM_MAKEFLAGS) uninstall-hook uninstall-man: uninstall-man1 uninstall-man5 uninstall-man8 -.MAKE: install-am install-strip +.MAKE: install-am install-data-am install-strip uninstall-am .PHONY: all all-am check check-am clean clean-generic clean-libtool \ cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distdir dvi dvi-am html html-am info info-am \ - install install-am install-data install-data-am install-dvi \ - install-dvi-am install-exec install-exec-am install-html \ - install-html-am install-info install-info-am install-man \ - install-man1 install-man5 install-man8 install-pdf \ - install-pdf-am install-ps install-ps-am install-strip \ - installcheck installcheck-am installdirs maintainer-clean \ - maintainer-clean-generic mostlyclean mostlyclean-generic \ - mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \ - uninstall-am uninstall-man uninstall-man1 uninstall-man5 \ - uninstall-man8 + install install-am install-data install-data-am \ + install-data-hook install-dvi install-dvi-am install-exec \ + install-exec-am install-html install-html-am install-info \ + install-info-am install-man install-man1 install-man5 \ + install-man8 install-pdf install-pdf-am install-ps \ + install-ps-am install-strip installcheck installcheck-am \ + installdirs maintainer-clean maintainer-clean-generic \ + mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ + ps ps-am tags-am uninstall uninstall-am uninstall-hook \ + uninstall-man uninstall-man1 uninstall-man5 uninstall-man8 @ENABLE_GTK_DOC_TRUE@%.8: %.xml @@ -791,9 +814,36 @@ uninstall-man: uninstall-man1 uninstall-man5 uninstall-man8 @ENABLE_GTK_DOC_TRUE@%.5: %.xml @ENABLE_GTK_DOC_TRUE@ $(AM_V_GEN) xsltproc $(XSLTPROC_MAN_FLAGS) $< -@ENABLE_GTK_DOC_TRUE@nm-settings.xml: $(top_builddir)/tools/generate-settings-spec $(top_builddir)/libnm-util/libnm-util.la -@ENABLE_GTK_DOC_TRUE@ rm -f $(builddir)/$@ -@ENABLE_GTK_DOC_TRUE@ $(top_builddir)/tools/generate-settings-spec refentry $(builddir)/$@ +@BUILD_SETTING_DOCS_TRUE@nm-settings.xml: nm-settings.xsl $(top_builddir)/libnm/nm-setting-docs.xml +@BUILD_SETTING_DOCS_TRUE@ $(AM_V_GEN) xsltproc \ +@BUILD_SETTING_DOCS_TRUE@ --output $@ \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam version $(NM_VERSION) \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam date "`date +'%d %B %Y'`" \ +@BUILD_SETTING_DOCS_TRUE@ $^ + +@BUILD_SETTING_DOCS_TRUE@nm-settings-keyfile.xml: nm-settings-keyfile.xsl $(top_builddir)/libnm/nm-keyfile-docs.xml +@BUILD_SETTING_DOCS_TRUE@ $(AM_V_GEN) xsltproc \ +@BUILD_SETTING_DOCS_TRUE@ --output $@ \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam version $(NM_VERSION) \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam date "`date +'%d %B %Y'`" \ +@BUILD_SETTING_DOCS_TRUE@ $^ + +@BUILD_SETTING_DOCS_TRUE@nm-settings-ifcfg-rh.xml: nm-settings-ifcfg-rh.xsl $(top_builddir)/libnm/nm-ifcfg-rh-docs.xml +@BUILD_SETTING_DOCS_TRUE@ $(AM_V_GEN) xsltproc \ +@BUILD_SETTING_DOCS_TRUE@ --output $@ \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam version $(NM_VERSION) \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam date "`date +'%d %B %Y'`" \ +@BUILD_SETTING_DOCS_TRUE@ $^ + +install-data-hook: + for link in $(links); do \ + ln -f $(DESTDIR)$(mandir)/man1/nmtui.1 $(DESTDIR)$(mandir)/man1/$$link.1; \ + done + +uninstall-hook: + for link in $(links); do \ + rm -f $(DESTDIR)$(mandir)/man1/$$link.1; \ + done # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. diff --git a/man/NetworkManager.8 b/man/NetworkManager.8 index 5022eadb..483f61a4 100644 --- a/man/NetworkManager.8 +++ b/man/NetworkManager.8 @@ -2,12 +2,12 @@ .\" Title: NetworkManager .\" Author: .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 07/03/2014 +.\" Date: 12/19/2014 .\" Manual: Network management daemons -.\" Source: NetworkManager 0.9.10 +.\" Source: NetworkManager 1.0 .\" Language: English .\" -.TH "NETWORKMANAGER" "8" "" "NetworkManager 0\&.9\&.10" "Network management daemons" +.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.0" "Network management daemons" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -122,7 +122,7 @@ The IP interface name of the device\&. .PP \fIIP4_ADDRESS_N\fR .RS 4 -The IPv4 address in the format "address/prefix gateway", where N is a number from 0 to (# IPv4 address \e\- 1)\&. +The IPv4 address in the format "address/prefix gateway", where N is a number from 0 to (# IPv4 addresses \- 1)\&. gateway item in this variable is deprecated, use IP4_GATEWAY instead\&. .RE .PP \fIIP4_NUM_ADDRESSES\fR @@ -130,9 +130,14 @@ The IPv4 address in the format "address/prefix gateway", where N is a number fro The variable contains the number of IPv4 addresses the script may expect\&. .RE .PP +\fIIP4_GATEWAY\fR +.RS 4 +The gateway IPv4 address in traditional numbers\-and\-dots notation\&. +.RE +.PP \fIIP4_ROUTE_N\fR .RS 4 -The IPv4 route in the format "address/prefix next\-hop metric", where N is a number from 0 to (# IPv4 routes \e\- 1)\&. +The IPv4 route in the format "address/prefix next\-hop metric", where N is a number from 0 to (# IPv4 routes \- 1)\&. .RE .PP \fIIP4_NUM_ROUTES\fR @@ -199,7 +204,7 @@ Specify file for storing state of the NetworkManager persistently\&. If not spec .PP \fB\-\-config\fR .RS 4 -Specify configuration file to set up various settings for NetworkManager\&. If not specified, the default value of /etc/NetworkManager/NetworkManager\&.conf is used with a fallback to the older \*(Aqnm\e\-system\e\-settings\&.conf\*(Aq if located in the same directory\&. See +Specify configuration file to set up various settings for NetworkManager\&. If not specified, the default value of /etc/NetworkManager/NetworkManager\&.conf is used with a fallback to the older \*(Aqnm\-system\-settings\&.conf\*(Aq if located in the same directory\&. See \fBNetworkManager.conf\fR(5) for more information on configuration file\&. .RE diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5 index ef7641bc..f34fa63a 100644 --- a/man/NetworkManager.conf.5 +++ b/man/NetworkManager.conf.5 @@ -2,12 +2,12 @@ .\" Title: NetworkManager.conf .\" Author: .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 07/03/2014 +.\" Date: 12/19/2014 .\" Manual: Configuration -.\" Source: NetworkManager 0.9.10 +.\" Source: NetworkManager 1.0 .\" Language: English .\" -.TH "NETWORKMANAGER\&.CON" "5" "" "NetworkManager 0\&.9\&.10" "Configuration" +.TH "NETWORKMANAGER\&.CON" "5" "" "NetworkManager 1\&.0" "Configuration" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -87,7 +87,7 @@ Lists system settings plugin names separated by \*(Aq,\*(Aq\&. These plugins are .sp If NetworkManager defines a distro\-specific network\-configuration plugin for your system, then that will normally be listed here\&. (See below for the available plugins\&.) Note that the keyfile -plugin is always appended to the end of this list (if it doesn\*(Aqt already appear earlier in the list), so if there is no distro\-specific plugin for your system then you can leave this key unset and NetworkManager will default to using +plugin is always appended to the end of this list (if it doesn\*(Aqt already appear earlier in the list), so if there is no distro\-specific plugin for your system then you can leave this key unset and NetworkManager will fall back to using keyfile\&. .RE .PP @@ -96,13 +96,31 @@ keyfile\&. Whether the configured settings plugin(s) should set up file monitors and immediately pick up changes made to connection files while NetworkManager is running\&. This is disabled by default; NetworkManager will only read the connection files at startup, and when explicitly requested via the ReloadConnections D\-Bus call\&. If this key is set to \*(Aqtrue\*(Aq, then NetworkManager will reload connection files any time they changed\&. .RE .PP +\fIauth\-polkit\fR +.RS 4 +Whether the system uses PolicyKit for authorization\&. If +false, all requests will be allowed\&. If +true, non\-root requests are authorized using PolicyKit\&. The default value is +true\&. +.RE +.PP \fIdhcp\fR .RS 4 -This key sets up what DHCP client NetworkManager will use\&. Presently +This key sets up what DHCP client NetworkManager will use\&. Allowed values are +dhclient, +dhcpcd, and +internal\&. The dhclient and dhcpcd -are supported\&. The client configured here should be available on your system too\&. If this key is missing, available DHCP clients are looked for in this order: dhclient, dhcpcd\&. +options require the indicated clients to be installed\&. The +internal +option uses a built\-in DHCP client which is not currently as featureful as the external clients (and in particular, does not yet support DHCPv6)\&. +.sp +If this key is missing, available DHCP clients are looked for in this order: +dhclient, +dhcpcd, +internal\&. .RE .PP \fIno\-auto\-default\fR @@ -143,6 +161,14 @@ to apply to all devices\&. Note that the "carrier" property of NMDevices and device D\-Bus interfaces will still reflect the actual device state; it\*(Aqs just that NetworkManager will not make use of that information\&. .RE .PP +\fIconfigure\-and\-quit\fR +.RS 4 +When set to +true, NetworkManager quits after performing initial network configuration but spawns small helpers to preserve DHCP leases and IPv6 addresses\&. This is useful in environments where network setup is more or less static or it is desirable to save process time but still handle some dynamic configurations\&. When this option is +true, network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE interfaces cannot be preserved due to their use of external services, and these devices will be deconfigured when NetworkManager quits even though other interface\*(Aqs configuration may be preserved\&. The default value is +false, meaning that NetworkManager will continue running after initial network configuration and continue responding to system and hardware events, D\-Bus requests, and user commands\&. +.RE +.PP \fIdns\fR .RS 4 Set the DNS (resolv\&.conf) processing mode\&. @@ -243,7 +269,8 @@ The default logging verbosity level\&. One of ERR, WARN, INFO, -DEBUG\&. The ERR level logs only critical errors\&. WARN logs warnings that may reflect operation\&. INFO logs various informational messages that are useful for tracking state and operations\&. DEBUG enables verbose logging for debugging purposes\&. Subsequent levels also log all messages from earlier levels; thus setting the log level to INFO also logs error and warning messages\&. +DEBUG, +TRACE\&. The ERR level logs only critical errors\&. WARN logs warnings that may reflect operation\&. INFO logs various informational messages that are useful for tracking state and operations\&. DEBUG enables verbose logging for debugging purposes\&. TRACE enables even more verbose logging then DEBUG level\&. Subsequent levels also log all messages from earlier levels; thus setting the log level to INFO also logs error and warning messages\&. .RE .PP \fIdomains\fR @@ -447,6 +474,11 @@ This plugin is read\-only; any connections (of any type) added from within Netwo keyfile plugin instead\&. .RE +.PP +\fIibft\fR +.RS 4 +This plugin allows to read iBFT configuration (iSCSI Boot Firmware Table)\&. The configuration is read using /sbin/iscsiadm\&. Users are expected to configure iBFT connections via the firmware interfaces\&. +.RE .SH "SEE ALSO" .PP \fBNetworkManager\fR(8), diff --git a/man/NetworkManager.conf.xml.in b/man/NetworkManager.conf.xml.in new file mode 100644 index 00000000..d9d51b84 --- /dev/null +++ b/man/NetworkManager.conf.xml.in @@ -0,0 +1,560 @@ + + + + + + + + NetworkManager.conf + NetworkManager developers + + + + NetworkManager.conf + 5 + NetworkManager + Configuration + 1.0 + + + + NetworkManager.conf + NetworkManager configuration file + + + + /etc/NetworkManager/NetworkManager.conf, + /etc/NetworkManager/conf.d/name.conf + + + + + Description + This is a configuration file for NetworkManager. It is used + to set up various aspects of NetworkManager's behavior. The + location of the file may be changed through use of the + argument for NetworkManager. + + If a default NetworkManager.conf is + provided by your distribution's packages, you should not modify + it, since your changes may get overwritten by package + updates. Instead, you can add additional .conf + files to the conf.d directory. These will be read in order, + with later files overriding earlier ones. + + + + + + File Format + + The configuration file format is so-called key file (sort of + ini-style format). It consists of sections (groups) of + key-value pairs. Lines beginning with a '#' and blank lines are + considered comments. Sections are started by a header line + containing the section enclosed in '[' and ']', and ended + implicitly by the start of the next section or the end of the + file. Each key-value pair must be contained in a section. + + + For keys that take a list of devices as their value, you can + specify devices by their MAC addresses or interface names, or + "*" to specify all devices. + + + Minimal system settings configuration file looks like this: + + [main] + plugins=keyfile + + + + As an extension to the normal keyfile format, you can also + append a value to a previously-set list-valued key by doing: + + plugins+=another-plugin + + + + + + <literal>main</literal> section + + + plugins + + + Lists system settings plugin names separated by ','. These + plugins are used to read and write system-wide + connections. When multiple plugins are specified, the + connections are read from all listed plugins. When writing + connections, the plugins will be asked to save the + connection in the order listed here; if the first plugin + cannot write out that connection type (or can't write out + any connections) the next plugin is tried, etc. If none of + the plugins can save the connection, an error is returned + to the user. + + + If NetworkManager defines a distro-specific + network-configuration plugin for your system, then that + will normally be listed here. (See below for the available + plugins.) Note that the keyfile plugin + is always appended to the end of this list (if it doesn't + already appear earlier in the list), so if there is no + distro-specific plugin for your system then you can leave + this key unset and NetworkManager will fall back to using + keyfile. + + + + + monitor-connection-files + Whether the configured settings plugin(s) + should set up file monitors and immediately pick up changes + made to connection files while NetworkManager is running. This + is disabled by default; NetworkManager will only read + the connection files at startup, and when explicitly requested + via the ReloadConnections D-Bus call. If this key is set to + 'true', then NetworkManager will reload + connection files any time they changed. + + + auth-polkit + Whether the system uses PolicyKit for authorization. + If false, all requests will be allowed. If + true, non-root requests are authorized using PolicyKit. + The default value is @NM_CONFIG_DEFAULT_AUTH_POLKIT_TEXT@. + + + + dhcp + This key sets up what DHCP client + NetworkManager will use. Allowed values are + dhclient, dhcpcd, and + internal. The dhclient + and dhcpcd options require the indicated + clients to be installed. The internal + option uses a built-in DHCP client which is not currently as + featureful as the external clients (and in particular, does + not yet support DHCPv6). + If this key is missing, available DHCP clients are + looked for in this order: dhclient, + dhcpcd, + internal. + + + no-auto-default + Comma-separated list of devices for which + NetworkManager shouldn't create default wired connection + (Auto eth0). By default, NetworkManager creates a temporary + wired connection for any Ethernet device that is managed and + doesn't have a connection configured. List a device in this + option to inhibit creating the default connection for the + device. May have the special value * to + apply to all devices. + When the default wired connection is deleted or saved + to a new persistent connection by a plugin, the device is + added to a list in the file + /var/run/NetworkManager/no-auto-default.state + to prevent creating the default connection for that device + again. + + + no-auto-default=00:22:68:5c:5d:c4,00:1e:65:ff:aa:ee + no-auto-default=eth0,eth1 + no-auto-default=* + + + + + + + ignore-carrier + + + Comma-separated list of devices for which NetworkManager + will (partially) ignore the carrier state. Normally, for + device types that support carrier-detect, such as Ethernet + and InfiniBand, NetworkManager will only allow a + connection to be activated on the device if carrier is + present (ie, a cable is plugged in), and it will + deactivate the device if carrier drops for more than a few + seconds. + + + Listing a device here will allow activating connections on + that device even when it does not have carrier, provided + that the connection uses only statically-configured IP + addresses. Additionally, it will allow any active + connection (whether static or dynamic) to remain active on + the device when carrier is lost. + + + May have the special value * to apply + to all devices. + + + Note that the "carrier" property of NMDevices and device D-Bus + interfaces will still reflect the actual device state; it's just + that NetworkManager will not make use of that information. + + + + + + configure-and-quit + + + When set to true, NetworkManager quits after + performing initial network configuration but spawns small helpers + to preserve DHCP leases and IPv6 addresses. This is useful in + environments where network setup is more or less static or it is + desirable to save process time but still handle some dynamic + configurations. When this option is true, + network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE + interfaces cannot be preserved due to their use of external + services, and these devices will be deconfigured when NetworkManager + quits even though other interface's configuration may be preserved. + The default value is false, meaning that + NetworkManager will continue running after initial network + configuration and continue responding to system and hardware events, + D-Bus requests, and user commands. + + + + + + dns + Set the DNS (resolv.conf) processing mode. + default: The default if the key is + not specified. NetworkManager will update + resolv.conf to reflect the nameservers + provided by currently active connections. + dnsmasq: NetworkManager will run + dnsmasq as a local caching nameserver, using a "split DNS" + configuration if you are connected to a VPN, and then update + resolv.conf to point to the local + nameserver. + unbound: NetworkManager will talk + to unbound and dnssec-triggerd, providing a "split DNS" + configuration with DNSSEC support. The /etc/resolv.conf + will be managed by dnssec-trigger daemon. + none: NetworkManager will not + modify resolv.conf. + + + + + debug + Comma separated list of options to aid + debugging. This value will be combined with the environment + variable NM_DEBUG. Currently the following + values are supported: + + RLIMIT_CORE: set ulimit -c unlimited + to write out core dumps. + + + + + + + + + <literal>keyfile</literal> section + This section contains keyfile-plugin-specific options, and + is normally only used when you are not using any other + distro-specific plugin. + + + + + hostname + Set a persistent hostname. + + + unmanaged-devices + Set devices that should be ignored by + NetworkManager when using the keyfile + plugin. Devices are specified in the following + format: + mac:<hwaddr> or + interface-name:<ifname>. Here + hwaddr is the MAC address of the device + to be ignored, in hex-digits-and-colons notation. + ifname is the interface name of the + ignored device. + Multiple entries are separated with semicolons. No + spaces are allowed in the value. + + Example: + +unmanaged-devices=interface-name:em4 +unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth2 + + + + + + + + + + <literal>ifupdown</literal> section + This section contains ifupdown-specific options and thus only + has effect when using the ifupdown plugin. + + + + + managed + If set to true, then + interfaces listed in + /etc/network/interfaces are managed by + NetworkManager. If set to false, then + any interface listed in + /etc/network/interfaces will be ignored + by NetworkManager. Remember that NetworkManager controls the + default route, so because the interface is ignored, + NetworkManager may assign the default route to some other + interface. + + The default value is false. + + + + + + + + + <literal>logging</literal> section + This section controls NetworkManager's logging. Any + settings here are overridden by the + and command-line options. + + + + + level + The default logging verbosity level. + One of ERR, + WARN, INFO, + DEBUG, TRACE. The ERR + level logs only critical errors. WARN logs warnings that may + reflect operation. INFO logs various informational messages that + are useful for tracking state and operations. DEBUG enables + verbose logging for debugging purposes. TRACE enables even more + verbose logging then DEBUG level. Subsequent levels also log + all messages from earlier levels; thus setting the log level + to INFO also logs error and warning messages. + + + domains + The following log domains are available: + PLATFORM, RFKILL, ETHER, WIFI, BT, MB, DHCP4, DHCP6, PPP, + WIFI_SCAN, IP4, IP6, AUTOIP4, DNS, VPN, SHARING, SUPPLICANT, + AGENTS, SETTINGS, SUSPEND, CORE, DEVICE, OLPC, WIMAX, + INFINIBAND, FIREWALL, ADSL, BOND, VLAN, BRIDGE, DBUS_PROPS, + TEAM, CONCHECK, DCB, DISPATCH. + In addition, these special domains can be used: NONE, + ALL, DEFAULT, DHCP, IP. + You can specify per-domain log level overrides by + adding a colon and a log level to any domain. E.g., + "WIFI:DEBUG". + + + Domain descriptions: + + PLATFORM : OS (platform) operations + RFKILL : RFKill subsystem operations + ETHER : Ethernet device operations + WIFI : Wi-Fi device operations + BT : Bluetooth operations + MB : Mobile broadband operations + DHCP4 : DHCP for IPv4 + DHCP6 : DHCP for IPv6 + PPP : Point-to-point protocol operations + WIFI_SCAN : Wi-Fi scanning operations + IP4 : IPv4-related operations + IP6 : IPv6-related operations + AUTOIP4 : AutoIP (avahi) operations + DNS : Domain Name System related operations + VPN : Virtual Private Network connections and operations + SHARING : Connection sharing + SUPPLICANT : WPA supplicant related operations + AGENTS : Secret agents operations and communication + SETTINGS : Settings/config service operations + SUSPEND : Suspend/resume + CORE : Core daemon and policy operations + DEVICE : Activation and general interface operations + OLPC : OLPC Mesh device operations + WIMAX : WiMAX device operations + INFINIBAND : InfiniBand device operations + FIREWALL : FirewallD related operations + ADSL : ADSL device operations + BOND : Bonding operations + VLAN : VLAN operations + BRIDGE : Bridging operations + DBUS_PROPS : D-Bus property changes + TEAM : Teaming operations + CONCHECK : Connectivity check + DCB : Data Center Bridging (DCB) operations + DISPATCH : Dispatcher scripts + + NONE : when given by itself logging is disabled + ALL : all log domains + DEFAULT : default log domains + DHCP : shortcut for "DHCP4,DHCP6" + IP : shortcut for "IP4,IP6" + + HW : deprecated alias for "PLATFORM" + + + + + + + + + <literal>connectivity</literal> section + This section controls NetworkManager's optional connectivity + checking functionality. This allows NetworkManager to detect + whether or not the system can actually access the internet or + whether it is behind a captive portal. + + + + + uri + The URI of a web page to periodically + request when connectivity is being checked. This page + should return the header "X-NetworkManager-Status" with a + value of "online". Alternatively, it's body content should + be set to "NetworkManager is online". The body content + check can be controlled by the response + option. If this option is blank or missing, connectivity + checking is disabled. + + + + interval + Specified in seconds; controls how often + connectivity is checked when a network connection exists. If + set to 0 connectivity checking is disabled. If missing, the + default is 300 seconds. + + + response + If set controls what body content + NetworkManager checks for when requesting the URI for + connectivity checking. If missing, defaults to + "NetworkManager is online" + + + + + + + Plugins + + + + keyfile + + + The keyfile plugin is the generic + plugin that supports all the connection types and + capabilities that NetworkManager has. It writes files out + in an .ini-style format in + /etc/NetworkManager/system-connections. + + + The stored connection file may contain passwords and + private keys, so it will be made readable only to root, + and the plugin will ignore files that are readable or + writeable by any user or group other than root. + + + This plugin is always active, and will automatically be + used to store any connections that aren't supported by any + other active plugin. + + + + + ifcfg-rh + + + This plugin is used on the Fedora and Red Hat Enterprise + Linux distributions to read and write configuration from + the standard + /etc/sysconfig/network-scripts/ifcfg-* + files. It currently supports reading Ethernet, Wi-Fi, + InfiniBand, VLAN, Bond, Bridge, and Team connections. + + + + + + ifcfg-suse + + + This plugin is only provided for simple backward + compatibility with SUSE and OpenSUSE configuration. Most + setups should be using the keyfile + plugin instead. The ifcfg-suse plugin + supports reading Ethernet and Wi-Fi connections, but does + not support saving any connection types. + + + + + + ifupdown + + + This plugin is used on the Debian and Ubuntu + distributions, and reads Ethernet and Wi-Fi connections + from /etc/network/interfaces. + + + This plugin is read-only; any connections (of any type) + added from within NetworkManager when you are using this + plugin will be saved using the keyfile + plugin instead. + + + + + + ibft + + + This plugin allows to read iBFT configuration (iSCSI Boot Firmware Table). + The configuration is read using /sbin/iscsiadm. Users are expected to + configure iBFT connections via the firmware interfaces. + + + + + + + + + See Also + + NetworkManager8, + nmcli1, + nmcli-examples5, + nm-online1, + nm-settings5, + nm-applet1, + nm-connection-editor1 + + + diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5 new file mode 100644 index 00000000..6dea364c --- /dev/null +++ b/man/nm-settings-ifcfg-rh.5 @@ -0,0 +1,2325 @@ +'\" t +.\" Title: nm-settings-ifcfg-rh +.\" Author: [see the "AUTHOR" section] +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 19 December 2014 +.\" Manual: Configuration +.\" Source: NetworkManager 1.0.0 +.\" Language: English +.\" +.TH "NM\-SETTINGS\-IFCFG\" "5" "" "NetworkManager 1\&.0\&.0" "Configuration" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +nm-settings-ifcfg-rh \- Description of \fIifcfg\-rh\fR settings plugin +.SH "DESCRIPTION" +.PP +NetworkManager is based on the concept of connection profiles that contain network configuration (see +\fBnm-settings\fR(5) +for details)\&. The profiles can be stored in various formats\&. NetworkManager uses plugins for reading and writing the data\&. The plugins can be configured in +\fBNetworkManager.conf\fR(5)\&. +.PP +The +\fIifcfg\-rh\fR +plugin is used on the Fedora and Red Hat Enterprise Linux distributions to read/write configuration from/to the standard +/etc/sysconfig/network\-scripts/ifcfg\-* +files\&. Each NetworkManager connection maps to one +ifcfg\-* +file, with possible usage of +keys\-* +for passwords, +route\-* +for static IPv4 routes and +route6\-* +for static IPv6 routes\&. The plugin currently supports reading and writing Ethernet, Wi\-Fi, InfiniBand, VLAN, Bond, Bridge, and Team connections\&. Unsupported connection types (such as WWAN, PPPoE, VPN, or ADSL are handled by +\fIkeyfile\fR +plugin (\fBnm-settings-keyfile\fR(5))\&. The main reason for using +\fIifcfg\-rh\fR +plugin is the compatibility with legacy configurations for +\fIifup\fR +and +\fIifdown\fR +(initscripts)\&. +.SH "FILE FORMAT" +.PP +The +\fIifcfg\-rh\fR +config format is a simple text file containing VARIABLE="value" lines\&. The format is described in +sysconfig\&.txt +of +\fIinitscripts\fR +package\&. Note that the configuration files may be sourced by +\fIinitscripts\fR, so they must be valid shell scripts\&. That means, for instance, that +# +character can be used for comments, strings with spaces must be quoted, special characters must be escaped, etc\&. +.PP +Users can create or modify the +\fIifcfg\-rh\fR +connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (see +\fImonitor\-connection\-file\fR +in +\fBnm-settings\fR(5), and +\fInmcli con (re)load\fR)\&. +.PP +\fBSome ifcfg-rh configuration examples:\fR. +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBSimple DHCP ethernet configuration:\fR +NAME=ethernet +UUID=1c4ddf70\-01bf\-46d6\-b04f\-47e842bd98da +TYPE=Ethernet +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +ONBOOT=yes + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBSimple ethernet configuration with static IP:\fR +TYPE=Ethernet +BOOTPROTO=none +IPADDR=10\&.1\&.0\&.25 +PREFIX=24 +GATEWAY=10\&.1\&.0\&.1 +DEFROUTE=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=yes +IPV6_AUTOCONF=yes +IPV6_DEFROUTE=yes +IPV6_PEERDNS=yes +IPV6_PEERROUTES=yes +IPV6_FAILURE_FATAL=no +NAME=ethernet\-em2 +UUID=51bb3904\-c0fc\-4dfe\-83b2\-0a71e7928c13 +DEVICE=em2 +ONBOOT=yes + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBWPA2 Enterprise WLAN (TTLS with inner MSCHAPV2 authentication):\fR +ESSID="CompanyWLAN" +MODE=Managed +KEY_MGMT=WPA\-EAP +TYPE=Wireless +IEEE_8021X_EAP_METHODS=TTLS +IEEE_8021X_IDENTITY=joe +IEEE_8021X_PASSWORD_FLAGS=ask +IEEE_8021X_INNER_AUTH_METHODS=MSCHAPV2 +IEEE_8021X_CA_CERT=/home/joe/\&.cert/company\&.crt +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=no +NAME=MyCompany +UUID=f79848ff\-11a6\-4810\-9e1a\-99039dea84c4 +ONBOOT=yes + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBBridge and bridge port configuration:\fR +ifcfg\-bridge: ifcfg\-bridge\-port: +NAME=bridge NAME=bridge007\-port\-eth0 +UUID=4be99ce0\-c5b2\-4764\-8b77\-ec226e440125 UUID=3ad56c4a\-47e1\-419b\-b0d4\-8ad86eb967a3 +DEVICE=bridge007 DEVICE=eth0 +STP=yes ONBOOT=yes +TYPE=Bridge TYPE=Ethernet +BRIDGING_OPTS=priority=32768 BRIDGE=bridge007 +ONBOOT=yes +BOOTPROTO=dhcp + + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBBonding configuration:\fR +ifcfg\-BOND: ifcfg\-BOND\-slave: +NAME=BOND NAME=BOND\-slave +UUID=b41888aa\-924c\-450c\-b0f8\-85a4f0a51b4a UUID=9bb048e4\-286a\-4cc3\-b104\-007dbd20decb +DEVICE=bond100 DEVICE=eth0 +BONDING_OPTS="mode=balance\-rr miimon=100" ONBOOT=yes +TYPE=Bond TYPE=Ethernet +BONDING_MASTER=yes MASTER=bond100 +ONBOOT=yes SLAVE=yes +BOOTPROTO=dhcp + + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBTeam and team port configuration:\fR +ifcfg\-my_team0: +DEVICE=team0 +TEAM_CONFIG="{ \e"device\e": \e"team0\e", \e"runner\e": {\e"name\e": \e"roundrobin\e"}, \e"ports\e": {\e"eth1\e": {}, \e"eth2\e": {}} }" +DEVICETYPE=Team +BOOTPROTO=dhcp +NAME=team0\-profile +UUID=1d3460a0\-7b37\-457f\-a300\-fe8d92da4807 +ONBOOT=yes + +ifcfg\-my_team0_slave1: +NAME=team0\-slave1 +UUID=d5aed298\-c567\-4cc1\-b808\-6d38ecef9e64 +DEVICE=eth1 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +ifcfg\-my_team0_slave2: +NAME=team0\-slave2 +UUID=94e75f4e\-e5ad\-401c\-8962\-31e0ae5d2215 +DEVICE=eth2 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +.fi +.if n \{\ +.RE +.\} + +The UUID values in the config files must be unique\&. You can use +\fIuuidgen\fR +command line tool to generate such values\&. Alternatively, you can leave out UUID entirely\&. In that case NetworkManager will generate a UUID based on the file name\&. +.SH "DIFFERENCES AGAINST INITSCRIPTS" +.PP +The main differences of NetworkManager ifcfg\-rh plugin and traditional initscripts are: +.PP +\fBNM_CONTROLLED=yes|no\fR +.RS 4 +NM_CONTROLLED is NetworkManager\-specific variable used by NetworkManager for determining whether the device of the +\fIifcfg\fR +file should be managed\&. NM_CONTROLLED=yes is supposed if the variable is not present in the file\&. Note that if you have more +\fIifcfg\fR +files for a single device, NM_CONTROLLED=no in one of the files will cause the device not to be managed\&. The profile may not even be the active one\&. +.RE +.PP +\fBNew variables\fR +.RS 4 +NetworkManager has introduced some new variable, not present in initscripts, to be able to store data for its new features\&. The variables are marked as extensions in the tables bellows\&. +.RE +.PP +\fBSemantic change of variables\fR +.RS 4 +NetworkManager had to slightly change the semantic for a few variables\&. +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +PEERDNS +\- initscripts interpret PEERDNS=no to mean "never touch resolv\&.conf"\&. NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc\&.) nameservers to resolv\&.conf"\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +ONBOOT +\- initscripts use ONBOOT=yes to mark the devices that are to be activated during boot\&. NetworkManager extents this to also mean that this profile can be used for auto\-connecting at any time\&. +.RE +.RE +.PP +See the next section for detailed mapping of NetworkManager properties and +\fIifcfg\-rh\fR +variables\&. Variable names, format and usage differences in NetworkManager and initscripts are documented in the tables bellow\&. +.SH "DETAILS" +.PP +\fIifcfg\-rh\fR +plugin variables marked with +\fI(+)\fR +are NetworkManager specific extensions not understood by traditional initscripts\&. +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&1.\ \&802-1x setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +eap +T}:T{ +IEEE_8021X_EAP_METHODS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +EAP method for 802\&.1X authentication\&.\fB + +Example: \fRIEEE_8021X_EAP_METHODS=PEAP\fB + +Allowed values: \fR"LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST" +T} +T{ +identity +T}:T{ +IEEE_8021X_IDENTITY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Identity for EAP authentication methods\&.\fB + +Example: \fRIEEE_8021X_IDENTITY=itsme +T} +T{ +anonymous\-identity +T}:T{ +IEEE_8021X_ANON_IDENTITY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Anonymous identity for EAP authentication methods\&. +T} +T{ +pac\-file +T}:T{ +IEEE_8021X_PAC_FILE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +File with PAC (Protected Access Credential) for EAP\-FAST\&.\fB + +Example: \fRIEEE_8021X_PAC_FILE=/home/joe/my\-fast\&.pac +T} +T{ +ca\-cert +T}:T{ +IEEE_8021X_CA_CERT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +CA certificate for EAP\&.\fB + +Example: \fRIEEE_8021X_CA_CERT=/home/joe/cacert\&.crt +T} +T{ +ca\-path +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +subject\-match +T}:T{ +IEEE_8021X_SUBJECT_MATCH\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Substring to match subject of server certificate against\&.\fB + +Example: \fRIEEE_8021X_SUBJECT_MATCH="Red Hat" +T} +T{ +altubject\-matches +T}:T{ +IEEE_8021X_AlTSUBJECT_MATCHES\fI(+)\fR +T}:T{ +\ \& +T}:T{ +List of strings to be matched against the altSubjectName\&.\fB + +Example: \fRIEEE_8021X_ALTSUBJECT_MATCHES="s1\&.domain\&.cc" +T} +T{ +client\-cert +T}:T{ +IEEE_8021X_CLIENT_CERT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Client certificate for EAP\&.\fB + +Example: \fRIEEE_8021X_CLIENT_CERT=/home/joe/mycert\&.crt +T} +T{ +phase1\-peapver +T}:T{ +IEEE_8021X_PEAP_VERSION\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Use to force a specific PEAP version\&.\fB + +Allowed values: \fR0, 1 +T} +T{ +phase1\-peaplabel +T}:T{ +IEEE_8021X_PEAP_FORCE_NEW_LABEL\fI(+)\fR +T}:T{ +no +T}:T{ +Use to force the new PEAP label during key derivation\&.\fB + +Allowed values: \fRyes, no +T} +T{ +phase1\-fast\-provisioning +T}:T{ +IEEE_8021X_FAST_PROVISIONING\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Enable in\-line provisioning of EAP\-FAST credentials\&.\fB + +Example: \fRIEEE_8021X_FAST_PROVISIONING="allow\-auth allow\-unauth"\fB + +Allowed values: \fRspace\-separated list of these values [allow\-auth, allow\-unauth] +T} +T{ +phase2\-auth +T}:T{ +IEEE_8021X_INNER_AUTH_METHODS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Inner non\-EAP authentication methods\&. IEEE_8021X_INNER_AUTH_METHODS can contain values both for \*(Aqphase2\-auth\*(Aq and \*(Aqphase2\-autheap\*(Aq properties\&.\fB + +Example: \fRIEEE_8021X_INNER_AUTH_METHODS=PAP\fB + +Allowed values: \fR"PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS" +T} +T{ +phase2\-autheap +T}:T{ +IEEE_8021X_INNER_AUTH_METHODS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Inner EAP\-based authentication methods\&. Note that IEEE_8021X_INNER_AUTH_METHODS is also used for \*(Aqphase2\-auth\*(Aq values\&.\fB + +Example: \fRIEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP\-TLS"\fB + +Allowed values: \fR"EAP\-MD5", "EAP\-MSCHAPV2", "EAP\-GTC", "EAP\-OTP" and "EAP\-TLS" +T} +T{ +phase2\-subject\-match +T}:T{ +IEEE_8021X_PHASE2_SUBJECT_MATCH\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Substring to match subject of server certificate against\&.\fB + +Example: \fRIEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat" +T} +T{ +phase2\-altsubject\-matches +T}:T{ +IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES\fI(+)\fR +T}:T{ +\ \& +T}:T{ +\ \& +T} +T{ +phase2\-client\-cert +T}:T{ +IEEE_8021X_INNER_CLIENT_CERT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Client certificate for inner EAP method\&.\fB + +Example: \fRIEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert\&.crt +T} +T{ +password +T}:T{ +IEEE_8021X_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +UTF\-8 encoded password used for EAP\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +password\-flags +T}:T{ +IEEE_8021X_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_PASSWORD password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +password\-raw +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +password\-raw\-flags +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +private\-key +T}:T{ +IEEE_8021X_PRIVATE_KEY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Private key for EAP\-TLS\&.\fB + +Example: \fRIEEE_8021X_PRIVATE_KEY=/home/joe/mykey\&.p12 +T} +T{ +private\-key\-password +T}:T{ +IEEE_8021X_PRIVATE_KEY_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password for IEEE_8021X_PRIVATE_KEY\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +private\-key\-password\-flags +T}:T{ +IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +phase2\-private\-key +T}:T{ +IEEE_8021X_INNER_PRIVATE_KEY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Private key for inner authentication method for EAP\-TLS\&. +T} +T{ +phase2\-private\-key\-password +T}:T{ +IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password for IEEE_8021X_INNER_PRIVATE_KEY\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +phase2\-private\-key\-password\-flags +T}:T{ +IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +pin +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +pin\-flags +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +system\-ca\-certs +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&2.\ \&bond setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l. +T{ +options +T}:T{ +BONDING_OPTS +T}:T{ +\ \& +T}:T{ +Bonding options\&.\fB + +Example: \fRBONDING_OPTS="miimon=100 mode=broadcast" +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&3.\ \&bridge-port setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l. +T{ +priority +T}:T{ +BRIDGING_OPTS: priority= +T}:T{ +32 +T}:T{ +STP priority\&.\fB + +Allowed values: \fR0 \- 63 +T} +T{ +path\-cost +T}:T{ +BRIDGING_OPTS: path_cost= +T}:T{ +100 +T}:T{ +STP cost\&.\fB + +Allowed values: \fR1 \- 65535 +T} +T{ +hairpin\-mode +T}:T{ +BRIDGING_OPTS: hairpin_mode= +T}:T{ +yes +T}:T{ +Hairpin mode of the bridge port\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&4.\ \&bridge setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +mac\-address +T}:T{ +MACADDR\fI(+)\fR +T}:T{ +\ \& +T}:T{ +MAC address of the bridge\&. Note that this requires a recent kernel support, originally introduced in 3\&.15 upstream kernel) MACADDR for bridges is an NM extension\&. +T} +T{ +stp +T}:T{ +STP +T}:T{ +no +T}:T{ +Span tree protocol participation\&. +T} +T{ +priority +T}:T{ +BRIDGING_OPTS: priority= +T}:T{ +32768 +T}:T{ +STP priority\&.\fB + +Allowed values: \fR0 \- 32768 +T} +T{ +forward\-delay +T}:T{ +DELAY +T}:T{ +15 +T}:T{ +STP forwarding delay\&.\fB + +Allowed values: \fR2 \- 30 +T} +T{ +hello\-time +T}:T{ +BRIDGING_OPTS: hello_time= +T}:T{ +2 +T}:T{ +STP hello time\&.\fB + +Allowed values: \fR1 \- 10 +T} +T{ +max\-age +T}:T{ +BRIDGING_OPTS: max_age= +T}:T{ +20 +T}:T{ +STP maximum message age\&.\fB + +Allowed values: \fR6 \- 40 +T} +T{ +ageing\-time +T}:T{ +BRIDGING_OPTS: ageing_time= +T}:T{ +300 +T}:T{ +Ethernet MAC ageing time\&.\fB + +Allowed values: \fR0 \- 1000000 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&5.\ \&connection setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +id +T}:T{ +NAME\fI(+)\fR +T}:T{ +\ \& +T}:T{ +User friendly name for the connection profile\&. +T} +T{ +uuid +T}:T{ +UUID\fI(+)\fR +T}:T{ +\ \& +T}:T{ +UUID for the connection profile\&. When missing, NetworkManager creates the UUID itself (by hashing the file)\&. +T} +T{ +interface\-name +T}:T{ +DEVICE +T}:T{ +\ \& +T}:T{ +Interface name of the device this profile is bound to\&. The variable can be left out when the profile should apply for more devices\&. Note that DEVICE can be required for some connection types\&. +T} +T{ +type +T}:T{ +TYPE (DEVICETYPE, DEVICE) +T}:T{ +\ \& +T}:T{ +Base type of the connection\&. DEVICETYPE is used for teaming connections\&.\fB + +Example: \fRTYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort\fB + +Allowed values: \fREthernet, Wireless, InfiniBand, Bridge, Bond, Vlan, Team, TeamPort +T} +T{ +permissions +T}:T{ +USERS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +USERS restrict the access for this conenction to certain users only\&.\fB + +Example: \fRUSERS="joe bob" +T} +T{ +autoconnect +T}:T{ +ONBOOT +T}:T{ +yes +T}:T{ +Whether the connection should be autoconnected (not only while booting)\&. +T} +T{ +autoconnect\-priority +T}:T{ +AUTOCONNECT_PRIORITY\fI(+)\fR +T}:T{ +0 +T}:T{ +Connection priority for automatic activation\&. Connections with higher numbers are preferred when selecting profiles for automatic activation\&.\fB + +Example: \fRAUTOCONNECT_PRIORITY=20\fB + +Allowed values: \fR\-999 to 999 +T} +T{ +zone +T}:T{ +ZONE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Trust level of this connection\&. The string is usually used for a firewall\&.\fB + +Example: \fRZONE=Work +T} +T{ +master +T}:T{ +MASTER, TEAM_MASTER, BRIDGE +T}:T{ +\ \& +T}:T{ +Reference to master connection\&. The variable used depends on the connection type\&. +T} +T{ +slave\-type +T}:T{ +MASTER, TEAM_MASTER, DEVICETYPE, BRIDGE +T}:T{ +\ \& +T}:T{ +Slave type doesn\*(Aqt map directly to a variable, but it is recognized using different variables\&. MASTER for bonding, TEAM_MASTER and DEVICETYPE for teaming, BRIDGE for bridging\&. +T} +T{ +secondaries +T}:T{ +SECONDARY_UUIDS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +UUID of VPN connections that should be activated together with this connection\&. +T} +T{ +gateway\-ping\-timeout +T}:T{ +GATEWAY_PING_TIMEOUT\fI(+)\fR +T}:T{ +0 +T}:T{ +If greater than zero, the IP connectivity will be checked by pinging the gateway and waiting for the specified timeout (in seconds)\&.\fB + +Example: \fRGATEWAY_PING_TIMEOUT=5 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&6.\ \&dcb setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +app\-fcoe\-flags +T}:T{ +DCB_APP_FCOE_ENABLE, DCB_APP_FCOE_ADVERTISE, DCB_APP_FCOE_WILLING +T}:T{ +no +T}:T{ +FCOE flags\&.\fB + +Example: \fRDCB_APP_FCOE_ENABLE=yes DCB_APP_FCOE_ADVERTISE=yes +T} +T{ +app\-fcoe\-priority +T}:T{ +DCB_APP_FCOE_PRIORITY +T}:T{ +\ \& +T}:T{ +Priority of FCoE frames\&.\fB + +Allowed values: \fR0 \- 7 +T} +T{ +app\-fcoe\-mode +T}:T{ +DCB_APP_FCOE_MODE +T}:T{ +fabric +T}:T{ +FCoE controller mode\&.\fB + +Allowed values: \fRfabric, vn2vn +T} +T{ +app\-iscsi\-flags +T}:T{ +DCB_APP_ISCSI_ENABLE, DCB_APP_ISCSI_ADVERTISE, DCB_APP_ISCSI_WILLING +T}:T{ +no +T}:T{ +iSCSI flags\&. +T} +T{ +app\-iscsi\-priority +T}:T{ +DCB_APP_ISCSI_PRIORITY +T}:T{ +\ \& +T}:T{ +Priority of iSCSI frames\&.\fB + +Allowed values: \fR0 \- 7 +T} +T{ +app\-fip\-flags +T}:T{ +DCB_APP_FIP_ENABLE, DCB_APP_FIP_ADVERTISE, DCB_APP_FIP_WILLING +T}:T{ +no +T}:T{ +FIP flags\&. +T} +T{ +app\-fip\-priority +T}:T{ +DCB_APP_FIP_PRIORITY +T}:T{ +\ \& +T}:T{ +Priority of FIP frames\&.\fB + +Allowed values: \fR0 \- 7 +T} +T{ +priority\-flow\-control\-flags +T}:T{ +DCB_PFC_ENABLE, DCB_PFC_ADVERTISE, DCB_PFC_WILLING +T}:T{ +no +T}:T{ +Priority flow control flags\&. +T} +T{ +priority\-flow\-control +T}:T{ +DCB_PFC_UP +T}:T{ +\ \& +T}:T{ +Priority flow control values\&. String of 8 "0" and "1", where "0"\&. means "do not transmit priority pause", "1" means "transmit pause"\&.\fB + +Example: \fRDCB_PFC_UP=01101110 +T} +T{ +priority\-group\-flags +T}:T{ +DCB_PG_ENABLE, DCB_PG_ADVERTISE, DCB_PG_WILLING +T}:T{ +no +T}:T{ +Priority groups flags\&. +T} +T{ +priority\-group\-id +T}:T{ +DCB_PG_ID +T}:T{ +\ \& +T}:T{ +Priority groups values\&. String of eight priorities (0 \- 7) or "f" (unrestricted)\&.\fB + +Example: \fRDCB_PG_ID=1205f173 +T} +T{ +priority\-group\-bandwidth +T}:T{ +DCB_PG_PCT +T}:T{ +\ \& +T}:T{ +Priority groups values\&. Eight bandwidths (in percent), separated with commas\&.\fB + +Example: \fRDCB_PG_PCT=10,5,10,15,10,10,10,30 +T} +T{ +priority\-bandwidth +T}:T{ +DCB_PG_UPPCT +T}:T{ +\ \& +T}:T{ +Priority values\&. Eight bandwidths (in percent), separated with commas\&. The sum of the numbers must be 100\&.\fB + +Example: \fRDCB_PG_UPPCT=7,13,10,10,15,15,10,20 +T} +T{ +priority\-strict\-bandwidth +T}:T{ +DCB_PG_STRICT +T}:T{ +\ \& +T}:T{ +Priority values\&. String of eight "0" or "1", where "0" means "may not utilize all bandwidth", "1" means "may utilize all bandwidth"\&.\fB + +Example: \fRDCB_PG_STRICT=01101110 +T} +T{ +priority\-traffic\-class +T}:T{ +DCB_PG_UP2TC +T}:T{ +\ \& +T}:T{ +Priority values\&. String of eight trafic class values (0 \- 7)\&.\fB + +Example: \fRDCB_PG_UP2TC=01623701 +T} +.TE +.sp 1 +.PP +All DCB related configuration is a NetworkManager extention\&. DCB=yes must be used explicitly to enable DCB so that the rest of the DCB_* variables can apply\&. +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&7.\ \&infiniband setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +mac\-address +T}:T{ +HWADDR +T}:T{ +\ \& +T}:T{ +IBoIP 20\-byte hardware address of the device (in traditional hex\-digits\-and\-colons notation)\&.\fB + +Example: \fRHWADDR=01:02:03:04:05:06:07:08:09:0A:01:02:03:04:05:06:07:08:09:11 +T} +T{ +mtu +T}:T{ +MTU +T}:T{ +\ \& +T}:T{ +MTU of the interface\&. +T} +T{ +transport\-mode +T}:T{ +CONNECTED_MODE +T}:T{ +CONNECTED_MODE=no +T}:T{ +CONNECTED_MODE=yes for "connected" mode, CONNECTED_MODE=no for "datagram" mode +T} +T{ +p\-key +T}:T{ +PKEY_ID (and PKEY=yes) +T}:T{ +PKEY=no +T}:T{ +InfiniBand P_Key\&. The value can be a hex number prefixed with "0x" or a decimal number\&. When PKEY_ID is specified, PHYSDEV and DEVICE also must be specified\&.\fB + +Example: \fRPKEY=yes PKEY_ID=2 PHYSDEV=mlx4_ib0 DEVICE=mlx4_ib0\&.8002 +T} +T{ +parent +T}:T{ +PHYSDEV (PKEY=yes) +T}:T{ +PKEY=no +T}:T{ +InfiniBand parent device\&.\fB + +Example: \fRPHYSDEV=ib0 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&8.\ \&ipv4 setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +method +T}:T{ +BOOTPROTO +T}:T{ +none +T}:T{ +Method used for IPv4 protocol configuration\&.\fB + +Allowed values: \fRnone, dhcp (bootp), static, ibft, autoip, shared +T} +T{ +dns +T}:T{ +DNS1, DNS2, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of DNS servers\&. Even if NetworkManager supports many DNS servers, initscripts and resolver only care about the first three, usually\&.\fB + +Example: \fRDNS1=1\&.2\&.3\&.4 DNS2=10\&.0\&.0\&.254 DNS3=8\&.8\&.8\&.8 +T} +T{ +dns\-search +T}:T{ +DOMAIN +T}:T{ +\ \& +T}:T{ +List of DNS search domains\&. +T} +T{ +addresses +T}:T{ +IPADDR, PREFIX, IPADDR1, PREFIX1, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRIPADDR=10\&.5\&.5\&.23 PREFIX=24 IPADDR1=1\&.1\&.1\&.2 PREFIX1=16 +T} +T{ +gateway +T}:T{ +GATEWAY +T}:T{ +\ \& +T}:T{ +Gateway IP address\&.\fB + +Example: \fRGATEWAY=10\&.5\&.5\&.1 +T} +T{ +routes +T}:T{ +ADDRESS1, NETMASK1, GATEWAY1, METRIC1, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of static routes\&. They are not stored in ifcfg\-* file, but in route\-* file instead\&. +T} +T{ +ignore\-auto\-routes +T}:T{ +PEERROUTES\fI(+)\fR +T}:T{ +yes +T}:T{ +PEERROUTES has the opposite meaning as \*(Aqignore\-auto\-routes\*(Aq property\&. +T} +T{ +ignore\-auto\-dns +T}:T{ +PEERDNS +T}:T{ +yes +T}:T{ +PEERDNS has the opposite meaning as \*(Aqignore\-auto\-dns\*(Aq property\&. +T} +T{ +dhcp\-send\-hostname +T}:T{ +DHCP_SEND_HOSTNAME\fI(+)\fR +T}:T{ +yes +T}:T{ +Whether DHCP_HOSTNAME should be sent to the DHCP server\&. +T} +T{ +dhcp\-hostname +T}:T{ +DHCP_HOSTNAME +T}:T{ +\ \& +T}:T{ +Hostname to send to the DHCP server\&. +T} +T{ +never\-default +T}:T{ +DEFROUTE (GATEWAYDEV in /etc/sysconfig/network) +T}:T{ +yes +T}:T{ +DEFROUTE=no tells NetworkManager that this connection should not be assigned the default route\&. DEFROUTE has the opposite meaning as \*(Aqnever\-default\*(Aq property\&. +T} +T{ +may\-fail +T}:T{ +IPV4_FAILURE_FATAL\fI(+)\fR +T}:T{ +no +T}:T{ +IPV4_FAILURE_FATAL has the opposite meaning as \*(Aqmay\-fail\*(Aq property\&. +T} +T{ +dhcp\-client\-id +T}:T{ +DHCP_CLIENT_ID\fI(+)\fR +T}:T{ +\ \& +T}:T{ +A string sent to the DHCP server to identify the local machine\&.\fB + +Example: \fRDHCP_CLIENT_ID=ax\-srv\-1 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&9.\ \&ipv6 setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +method +T}:T{ +IPV6INIT, IPV6FORWARDING, IPV6_AUTOCONF, DHCPV6C +T}:T{ +IPV6INIT=yes; IPV6FORWARDING=no; IPV6_AUTOCONF=!IPV6FORWARDING, DHCPV6=no +T}:T{ +Method used for IPv6 protocol configuration\&. ignore ~ IPV6INIT=no; auto ~ IPV6_AUTOCONF=yes; dhcp ~ IPV6_AUTOCONF=no and DHCPV6C=yes +T} +T{ +dns +T}:T{ +DNS1, DNS2, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of DNS servers\&. NetworkManager uses the variables both for IPv4 and IPv6\&. +T} +T{ +dns\-search +T}:T{ +DOMAIN +T}:T{ +\ \& +T}:T{ +List of DNS search domains\&. +T} +T{ +addresses +T}:T{ +IPV6ADDR, IPV6ADDR_SECONDARIES +T}:T{ +\ \& +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRIPV6ADDR=ab12:9876::1 IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3" +T} +T{ +gateway +T}:T{ +IPV6_DEFAULTGW +T}:T{ +\ \& +T}:T{ +Gateway IP address\&.\fB + +Example: \fRIPV6_DEFAULTGW=abbe::1 +T} +T{ +routes +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +List of static routes\&. They are not stored in ifcfg\-* file, but in route6\-* file instead in the form of command line for \*(Aqip route add\*(Aq\&. +T} +T{ +ignore\-auto\-routes +T}:T{ +IPV6_PEERROUTES\fI(+)\fR +T}:T{ +yes +T}:T{ +IPV6_PEERROUTES has the opposite meaning as \*(Aqignore\-auto\-routes\*(Aq property\&. +T} +T{ +ignore\-auto\-dns +T}:T{ +IPV6_PEERDNS\fI(+)\fR +T}:T{ +yes +T}:T{ +IPV6_PEERDNS has the opposite meaning as \*(Aqignore\-auto\-dns\*(Aq property\&. +T} +T{ +dhcp\-hostname +T}:T{ +DHCP_HOSTNAME +T}:T{ +\ \& +T}:T{ +Hostname to send the DHCP server\&. +T} +T{ +never\-default +T}:T{ +IPV6_DEFROUTE\fI(+)\fR, (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network) +T}:T{ +IPV6_DEFROUTE=yes (when no variable specified) +T}:T{ +IPV6_DEFROUTE=no tells NetworkManager that this connection should not be assigned the default IPv6 route\&. IPV6_DEFROUTE has the opposite meaning as \*(Aqnever\-default\*(Aq property\&. +T} +T{ +may\-fail +T}:T{ +IPV6_FAILURE_FATAL\fI(+)\fR +T}:T{ +no +T}:T{ +IPV6_FAILURE_FATAL has the opposite meaning as \*(Aqmay\-fail\*(Aq property\&. +T} +T{ +ip6\-privacy +T}:T{ +IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP\fI(+)\fR +T}:T{ +no +T}:T{ +Configure IPv6 Privacy Extensions for SLAAC (RFC4941)\&.\fB + +Example: \fRIPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes\fB + +Allowed values: \fRIPV6_PRIVACY: no, yes (rfc3041 or rfc4941); IPV6_PRIVACY_PREFER_PUBLIC_IP: yes, no +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&10.\ \&team-port setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l. +T{ +config +T}:T{ +TEAM_PORT_CONFIG +T}:T{ +\ \& +T}:T{ +Team port configuration in JSON\&. See man teamd\&.conf for details\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&11.\ \&team setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l. +T{ +config +T}:T{ +TEAM_CONFIG +T}:T{ +\ \& +T}:T{ +Team configuration in JSON\&. See man teamd\&.conf for details\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&12.\ \&vlan setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +parent +T}:T{ +DEVICE or PHYSDEV +T}:T{ +\ \& +T}:T{ +Parent interface of the VLAN\&. +T} +T{ +id +T}:T{ +VLAN_ID or DEVICE +T}:T{ +\ \& +T}:T{ +VLAN identifier\&. +T} +T{ +flags +T}:T{ +VLAN_FLAGS, REORDER_HDR +T}:T{ +\ \& +T}:T{ +Parent interface of the VLAN\&.\fB + +Allowed values: \fR"GVRP", "LOOSE_BINDING" for VLAN_FLAGS; 0 or 1 for REORDER_HDR +T} +T{ +ingress\-property\-map +T}:T{ +VLAN_INGRESS_PRIORITY_MAP +T}:T{ +\ \& +T}:T{ +Ingress priority mapping\&.\fB + +Example: \fRVLAN_INGRESS_PRIORITY_MAP=4:2,3:5 +T} +T{ +egress\-property\-map +T}:T{ +VLAN_EGRESS_PRIORITY_MAP +T}:T{ +\ \& +T}:T{ +Egress priority mapping\&.\fB + +Example: \fRVLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7 +T} +T{ +interface\-name +T}:T{ +PHYSDEV and VLAN_ID, or DEVICE +T}:T{ +\ \& +T}:T{ +VLAN interface name\&. If all variables are set, parent device from PHYSDEV takes precedence over DEVICE, but VLAN id from DEVICE takes precedence over VLAN_ID\&.\fB + +Example: \fRPHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0\&.12 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&13.\ \&802-3-ethernet setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +port +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +speed +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +duplex +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +auto\-negotiate +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +mac\-address +T}:T{ +HWADDR +T}:T{ +\ \& +T}:T{ +Hardware address of the device in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:05)\&. +T} +T{ +cloned\-mac\-address +T}:T{ +MACADDR +T}:T{ +\ \& +T}:T{ +Cloned (spoofed) MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:99)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +HWADDR_BLACKLIST\fI(+)\fR +T}:T{ +\ \& +T}:T{ +It denies usage of the connection for any device whose address is listed\&.\fB + +Example: \fRHWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55" +T} +T{ +mtu +T}:T{ +MTU +T}:T{ +\ \& +T}:T{ +MTU of the interface\&. +T} +T{ +s390\-subchannels +T}:T{ +SUBCHANNELS +T}:T{ +\ \& +T}:T{ +Subchannels for IBM S390 hosts\&.\fB + +Example: \fRSUBCHANNELS=0\&.0\&.b00a,0\&.0\&.b00b,0\&.0\&.b00c +T} +T{ +s390\-nettype +T}:T{ +NETTYPE +T}:T{ +\ \& +T}:T{ +Network type of the S390 host\&.\fB + +Example: \fRNETTYPE=qeth\fB + +Allowed values: \fR"qeth", "lcs" or "ctc" +T} +T{ +s390\-options +T}:T{ +OPTIONS and PORTNAME, CTCPROTO, +T}:T{ +\ \& +T}:T{ +S390 device options\&. All options go to OPTIONS, except for "portname" and "ctcprot" that have their own variables\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&14.\ \&802-11-wireless-security setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +key\-mgmt +T}:T{ +KEY_MGMT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Key management menthod\&.\fB + +Allowed values: \fRIEEE8021X, WPA\-PSK, WPA\-EAP +T} +T{ +wep\-tx\-keyidx +T}:T{ +DEFAULTKEY +T}:T{ +1 +T}:T{ +Index of active WEP key\&.\fB + +Allowed values: \fR1, 2, 3, 4 +T} +T{ +auth\-alg +T}:T{ +SECURITYMODE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Authentication algorithm for WEP\&.\fB + +Allowed values: \fRrestricted, open, leap +T} +T{ +proto +T}:T{ +WPA_ALLOW_WPA\fI(+)\fR, WPA_ALLOW_WPA2\fI(+)\fR +T}:T{ +no +T}:T{ +Allowed WPA protocols, WPA and WPA2 (RSN)\&.\fB + +Allowed values: \fRyes, no +T} +T{ +pairwise +T}:T{ +CIPHER_PAIRWISE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Restrict pairwise encryption algorithms, specified as a space separated list\&.\fB + +Allowed values: \fRCCMP, TKIP +T} +T{ +group +T}:T{ +CIPHER_GROUP\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Restrict group/broadcast encryption algorithms, specified as a space separated list\&.\fB + +Allowed values: \fRCCMP, TKIP, WEP40, WEP104 +T} +T{ +leap\-username +T}:T{ +IEEE_8021X_IDENTITY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Login name for LEAP\&. +T} +T{ +wep\-key0 +T}:T{ +KEY1, KEY_PASSPHRASE1\fI(+)\fR +T}:T{ +\ \& +T}:T{ +The first WEP key (used in most networks)\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key1 +T}:T{ +KEY2, KEY_PASSPHRASE2\fI(+)\fR +T}:T{ +\ \& +T}:T{ +WEP key with index 1\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key2 +T}:T{ +KEY3, KEY_PASSPHRASE3\fI(+)\fR +T}:T{ +\ \& +T}:T{ +WEP key with index 2\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key3 +T}:T{ +KEY4, KEY_PASSPHRASE4\fI(+)\fR +T}:T{ +\ \& +T}:T{ +WEP key with index 3\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key\-flags +T}:T{ +WEP_KEY_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for KEY, KEY_PASSPHRASE password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +psk +T}:T{ +WPA_PSK +T}:T{ +\ \& +T}:T{ +Pre\-Shared\-Key for WPA networks\&. +T} +T{ +psk\-flags +T}:T{ +WPA_PSK_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for WPA_PSK_FLAGS\&. (see the section called \(lqSecret flags\(rq for _FLAGS values)\fB + +Example: \fRWPA_PSK_FLAGS=user +T} +T{ +leap\-password +T}:T{ +IEEE_8021X_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password for LEAP\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +leap\-password\-flags +T}:T{ +IEEE_8021X_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_PASSWORD_FLAGS\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +wep\-key\-type +T}:T{ +KEY or KEY_PASSPHRASE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +KEY is used for "key" type (10 or 26 hexadecimal characters, or 5 or 13 character string prefixed with "s:")\&. KEY_PASSPHRASE is used for WEP passphrases\&.\fB + +Example: \fRKEY1=s:ahoj, KEY1=0a1c45bc02, KEY_PASSPHRASE1=mysupersecretkey +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&15.\ \&802-11-wireless setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +ssid +T}:T{ +ESSID +T}:T{ +\ \& +T}:T{ +SSID of Wi\-Fi network\&.\fB + +Example: \fRESSID="Quick Net" +T} +T{ +mode +T}:T{ +MODE +T}:T{ +\ \& +T}:T{ +Wi\-Fi network mode\&.\fB + +Allowed values: \fRAd\-Hoc, Managed (Auto) [case insensitive] +T} +T{ +band +T}:T{ +BAND\fI(+)\fR +T}:T{ +\ \& +T}:T{ +BAND alone is honored, but CHANNEL overrides BAND since it implies a band\&.\fB + +Example: \fRBAND=bg\fB + +Allowed values: \fRa, bg +T} +T{ +channel +T}:T{ +CHANNEL +T}:T{ +\ \& +T}:T{ +Channel used for the Wi\-Fi communication\&. Channels greater than 14 mean "a" band, otherwise the band is "bg"\&.\fB + +Example: \fRCHANNEL=6 +T} +T{ +bssid +T}:T{ +BSSID\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Restricts association only to a single AP\&.\fB + +Example: \fRBSSID=00:1E:BD:64:83:21 +T} +T{ +rate +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is not handled by ifcfg\-rh plugin\&. +T} +T{ +tx\-power +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is not handled by ifcfg\-rh plugin\&. +T} +T{ +mac\-address +T}:T{ +HWADDR +T}:T{ +\ \& +T}:T{ +Hardware address of the device in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:05)\&. +T} +T{ +cloned\-mac\-address +T}:T{ +MACADDR +T}:T{ +\ \& +T}:T{ +Cloned (spoofed) MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:99)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +HWADDR_BLACKLIST\fI(+)\fR +T}:T{ +\ \& +T}:T{ +It denies usage of the connection for any device whose address is listed\&. +T} +T{ +seen\-bssids +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is not handled by ifcfg\-rh plugin\&. +T} +T{ +mtu +T}:T{ +MTU +T}:T{ +\ \& +T}:T{ +MTU of the wireless interface\&. +T} +T{ +hidden +T}:T{ +SSID_HIDDEN\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Whether the network hides the SSID\&. +T} +T{ +security +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is deprecated and not handled by ifcfg\-rh\-plugin\&. +T} +.TE +.sp 1 +.PP +The following settings are not supported by +\fIifcfg\-rh\fR +plugin: +.PP +adsl, bluetooth, ppp, pppoe, serial, generic, gsm, cdma, 802\-11\-olpc\-mesh, wimax, vpn +.SS "Secret flags" +.PP +Each secret property in a NetworkManager setting has an associated +\fIflags\fR +property that describes how to handle that secret\&. In the +\fIfcfg\-rh\fR +plugin variables for secret flags have a +\fI_FLAGS\fR +suffix\&. The variables contain one or more of the folowing values (space separated)\&. Missing (or empty) *_FLAGS variable means that the password is owned by NetworkManager\&. +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +user +\- a user\-session secret agent is responsible for providing and storing this secret; when it is required, agents will be asked to provide it\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +ask +\- the associated password is not saved but it will be requested from the user each time it is required\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +unused +\- in some situations it cannot be automatically determined that a secret is required or not\&. This flag hints that the secret is not required and should not be requested from the user\&. +.RE +.SH "AUTHOR" +.PP +NetworkManager developers +.SH "FILES" +.PP +/etc/sysconfig/network\-scripts/ifcfg\-* +.PP +/etc/sysconfig/network\-scripts/keys\-* +.PP +/etc/sysconfig/network\-scripts/route\-* +.PP +/etc/sysconfig/network\-scripts/route6\-* +.PP +/usr/share/doc/initscripts/sysconfig\&.txt +.SH "SEE ALSO" +.PP +https://developer\&.gnome\&.org/NetworkManager/unstable/ref\-settings\&.html +.PP +nm\-settings(5), nm\-settings\-keyfile(5), NetworkManager(8), NetworkManager\&.conf(5), nmcli(1), nmcli\-examples(5) diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml new file mode 100644 index 00000000..e578442a --- /dev/null +++ b/man/nm-settings-ifcfg-rh.xml @@ -0,0 +1,335 @@ + + +19 December 2014nm-settings-ifcfg-rh5NetworkManagerConfiguration1.0.0nm-settings-ifcfg-rhDescription of ifcfg-rh settings pluginDESCRIPTION + NetworkManager is based on the concept of connection profiles that contain + network configuration (see nm-settings5 for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in NetworkManager.conf5. + + The ifcfg-rh plugin is used on the Fedora and Red Hat + Enterprise Linux distributions to read/write configuration from/to + the standard /etc/sysconfig/network-scripts/ifcfg-* files. + Each NetworkManager connection maps to one ifcfg-* file, with + possible usage of keys-* for passwords, route-* + for static IPv4 routes and route6-* for static IPv6 routes. + The plugin currently supports reading and writing Ethernet, Wi-Fi, InfiniBand, + VLAN, Bond, Bridge, and Team connections. Unsupported connection types (such as + WWAN, PPPoE, VPN, or ADSL are handled by keyfile plugin + (nm-settings-keyfile5). + The main reason for using ifcfg-rh plugin is the compatibility + with legacy configurations for ifup and ifdown + (initscripts). + File Format + The ifcfg-rh config format is a simple text file containing + VARIABLE="value" lines. The format is described in sysconfig.txt + of initscripts package. Note that the configuration files + may be sourced by initscripts, so they must be valid shell + scripts. That means, for instance, that # character can be used + for comments, strings with spaces must be quoted, special characters must be escaped, + etc. + + Users can create or modify the ifcfg-rh connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see monitor-connection-file in + nm-settings5, and nmcli con (re)load). + Some <emphasis>ifcfg-rh</emphasis> configuration examples:Simple DHCP ethernet configuration: +NAME=ethernet +UUID=1c4ddf70-01bf-46d6-b04f-47e842bd98da +TYPE=Ethernet +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +ONBOOT=yes + Simple ethernet configuration with static IP: +TYPE=Ethernet +BOOTPROTO=none +IPADDR=10.1.0.25 +PREFIX=24 +GATEWAY=10.1.0.1 +DEFROUTE=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=yes +IPV6_AUTOCONF=yes +IPV6_DEFROUTE=yes +IPV6_PEERDNS=yes +IPV6_PEERROUTES=yes +IPV6_FAILURE_FATAL=no +NAME=ethernet-em2 +UUID=51bb3904-c0fc-4dfe-83b2-0a71e7928c13 +DEVICE=em2 +ONBOOT=yes + WPA2 Enterprise WLAN (TTLS with inner MSCHAPV2 authentication): +ESSID="CompanyWLAN" +MODE=Managed +KEY_MGMT=WPA-EAP +TYPE=Wireless +IEEE_8021X_EAP_METHODS=TTLS +IEEE_8021X_IDENTITY=joe +IEEE_8021X_PASSWORD_FLAGS=ask +IEEE_8021X_INNER_AUTH_METHODS=MSCHAPV2 +IEEE_8021X_CA_CERT=/home/joe/.cert/company.crt +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=no +NAME=MyCompany +UUID=f79848ff-11a6-4810-9e1a-99039dea84c4 +ONBOOT=yes + Bridge and bridge port configuration: +ifcfg-bridge: ifcfg-bridge-port: +NAME=bridge NAME=bridge007-port-eth0 +UUID=4be99ce0-c5b2-4764-8b77-ec226e440125 UUID=3ad56c4a-47e1-419b-b0d4-8ad86eb967a3 +DEVICE=bridge007 DEVICE=eth0 +STP=yes ONBOOT=yes +TYPE=Bridge TYPE=Ethernet +BRIDGING_OPTS=priority=32768 BRIDGE=bridge007 +ONBOOT=yes +BOOTPROTO=dhcp + + Bonding configuration: +ifcfg-BOND: ifcfg-BOND-slave: +NAME=BOND NAME=BOND-slave +UUID=b41888aa-924c-450c-b0f8-85a4f0a51b4a UUID=9bb048e4-286a-4cc3-b104-007dbd20decb +DEVICE=bond100 DEVICE=eth0 +BONDING_OPTS="mode=balance-rr miimon=100" ONBOOT=yes +TYPE=Bond TYPE=Ethernet +BONDING_MASTER=yes MASTER=bond100 +ONBOOT=yes SLAVE=yes +BOOTPROTO=dhcp + + Team and team port configuration: +ifcfg-my_team0: +DEVICE=team0 +TEAM_CONFIG="{ \"device\": \"team0\", \"runner\": {\"name\": \"roundrobin\"}, \"ports\": {\"eth1\": {}, \"eth2\": {}} }" +DEVICETYPE=Team +BOOTPROTO=dhcp +NAME=team0-profile +UUID=1d3460a0-7b37-457f-a300-fe8d92da4807 +ONBOOT=yes + +ifcfg-my_team0_slave1: +NAME=team0-slave1 +UUID=d5aed298-c567-4cc1-b808-6d38ecef9e64 +DEVICE=eth1 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +ifcfg-my_team0_slave2: +NAME=team0-slave2 +UUID=94e75f4e-e5ad-401c-8962-31e0ae5d2215 +DEVICE=eth2 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + + The UUID values in the config files must be unique. You can use uuidgen + command line tool to generate such values. Alternatively, you can leave out UUID + entirely. In that case NetworkManager will generate a UUID based on the file name. + Differences against initscripts + The main differences of NetworkManager ifcfg-rh plugin and traditional + initscripts are: + NM_CONTROLLED=yes|no + NM_CONTROLLED is NetworkManager-specific variable used by NetworkManager + for determining whether the device of the ifcfg file + should be managed. NM_CONTROLLED=yes is supposed if the variable is not + present in the file. + Note that if you have more ifcfg files for a single + device, NM_CONTROLLED=no in one of the files will cause the device not + to be managed. The profile may not even be the active one. + New variables + NetworkManager has introduced some new variable, not present in initscripts, + to be able to store data for its new features. The variables are marked + as extensions in the tables bellows. + Semantic change of variables + NetworkManager had to slightly change the semantic for a few variables. + PEERDNS - + initscripts interpret PEERDNS=no to mean "never touch resolv.conf". + NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc.) + nameservers to resolv.conf".ONBOOT - + initscripts use ONBOOT=yes to mark the devices that are to be activated + during boot. NetworkManager extents this to also mean that this profile + can be used for auto-connecting at any time. + See the next section for detailed mapping of NetworkManager properties and + ifcfg-rh variables. Variable names, format and usage + differences in NetworkManager and initscripts are documented in the tables bellow. + DETAILSifcfg-rh plugin variables marked with (+) + are NetworkManager specific extensions not understood by traditional initscripts. + 802-1x settingPropertyIfcfg-rh VariableDefaultDescriptioneapIEEE_8021X_EAP_METHODS(+)EAP method for 802.1X authentication. + +Example: IEEE_8021X_EAP_METHODS=PEAP + +Allowed values: "LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST"identityIEEE_8021X_IDENTITY(+)Identity for EAP authentication methods. + +Example: IEEE_8021X_IDENTITY=itsmeanonymous-identityIEEE_8021X_ANON_IDENTITY(+)Anonymous identity for EAP authentication methods.pac-fileIEEE_8021X_PAC_FILE(+)File with PAC (Protected Access Credential) for EAP-FAST. + +Example: IEEE_8021X_PAC_FILE=/home/joe/my-fast.pacca-certIEEE_8021X_CA_CERT(+)CA certificate for EAP. + +Example: IEEE_8021X_CA_CERT=/home/joe/cacert.crtca-path(none)The property is not handled by ifcfg-rh plugin.subject-matchIEEE_8021X_SUBJECT_MATCH(+)Substring to match subject of server certificate against. + +Example: IEEE_8021X_SUBJECT_MATCH="Red Hat"altubject-matchesIEEE_8021X_AlTSUBJECT_MATCHES(+)List of strings to be matched against the altSubjectName. + +Example: IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc"client-certIEEE_8021X_CLIENT_CERT(+)Client certificate for EAP. + +Example: IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crtphase1-peapverIEEE_8021X_PEAP_VERSION(+)Use to force a specific PEAP version. + +Allowed values: 0, 1phase1-peaplabelIEEE_8021X_PEAP_FORCE_NEW_LABEL(+)noUse to force the new PEAP label during key derivation. + +Allowed values: yes, nophase1-fast-provisioningIEEE_8021X_FAST_PROVISIONING(+)Enable in-line provisioning of EAP-FAST credentials. + +Example: IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth" + +Allowed values: space-separated list of these values [allow-auth, allow-unauth]phase2-authIEEE_8021X_INNER_AUTH_METHODS(+)Inner non-EAP authentication methods. IEEE_8021X_INNER_AUTH_METHODS can contain values both for 'phase2-auth' and 'phase2-autheap' properties. + +Example: IEEE_8021X_INNER_AUTH_METHODS=PAP + +Allowed values: "PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS"phase2-autheapIEEE_8021X_INNER_AUTH_METHODS(+)Inner EAP-based authentication methods. Note that IEEE_8021X_INNER_AUTH_METHODS is also used for 'phase2-auth' values. + +Example: IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS" + +Allowed values: "EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS"phase2-subject-matchIEEE_8021X_PHASE2_SUBJECT_MATCH(+)Substring to match subject of server certificate against. + +Example: IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"phase2-altsubject-matchesIEEE_8021X_PHASE2_ALTSUBJECT_MATCHES(+)phase2-client-certIEEE_8021X_INNER_CLIENT_CERT(+)Client certificate for inner EAP method. + +Example: IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crtpasswordIEEE_8021X_PASSWORD(+)UTF-8 encoded password used for EAP. It can also go to "key-" lookaside file, or it can be owned by a secret agent.password-flagsIEEE_8021X_PASSWORD_FLAGS(+)Password flags for IEEE_8021X_PASSWORD password. (see for _FLAGS values)password-raw(none)The property is not handled by ifcfg-rh plugin.password-raw-flags(none)The property is not handled by ifcfg-rh plugin.private-keyIEEE_8021X_PRIVATE_KEY(+)Private key for EAP-TLS. + +Example: IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12private-key-passwordIEEE_8021X_PRIVATE_KEY_PASSWORD(+)Password for IEEE_8021X_PRIVATE_KEY. It can also go to "key-" lookaside file, or it can be owned by a secret agent.private-key-password-flagsIEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS(+)Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password. (see for _FLAGS values)phase2-private-keyIEEE_8021X_INNER_PRIVATE_KEY(+)Private key for inner authentication method for EAP-TLS.phase2-private-key-passwordIEEE_8021X_INNER_PRIVATE_KEY_PASSWORD(+)Password for IEEE_8021X_INNER_PRIVATE_KEY. It can also go to "key-" lookaside file, or it can be owned by a secret agent.phase2-private-key-password-flagsIEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS(+)Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password. (see for _FLAGS values)pin(none)The property is not handled by ifcfg-rh plugin.pin-flags(none)The property is not handled by ifcfg-rh plugin.system-ca-certs(none)The property is not handled by ifcfg-rh plugin.
bond settingPropertyIfcfg-rh VariableDefaultDescriptionoptionsBONDING_OPTSBonding options. + +Example: BONDING_OPTS="miimon=100 mode=broadcast"
bridge-port settingPropertyIfcfg-rh VariableDefaultDescriptionpriorityBRIDGING_OPTS: priority=32STP priority. + +Allowed values: 0 - 63path-costBRIDGING_OPTS: path_cost=100STP cost. + +Allowed values: 1 - 65535hairpin-modeBRIDGING_OPTS: hairpin_mode=yesHairpin mode of the bridge port.
bridge settingPropertyIfcfg-rh VariableDefaultDescriptionmac-addressMACADDR(+)MAC address of the bridge. Note that this requires a recent kernel support, originally introduced in 3.15 upstream kernel) MACADDR for bridges is an NM extension.stpSTPnoSpan tree protocol participation.priorityBRIDGING_OPTS: priority=32768STP priority. + +Allowed values: 0 - 32768forward-delayDELAY15STP forwarding delay. + +Allowed values: 2 - 30hello-timeBRIDGING_OPTS: hello_time=2STP hello time. + +Allowed values: 1 - 10max-ageBRIDGING_OPTS: max_age=20STP maximum message age. + +Allowed values: 6 - 40ageing-timeBRIDGING_OPTS: ageing_time=300Ethernet MAC ageing time. + +Allowed values: 0 - 1000000
connection settingPropertyIfcfg-rh VariableDefaultDescriptionidNAME(+)User friendly name for the connection profile.uuidUUID(+)UUID for the connection profile. When missing, NetworkManager creates the UUID itself (by hashing the file).interface-nameDEVICEInterface name of the device this profile is bound to. The variable can be left out when the profile should apply for more devices. Note that DEVICE can be required for some connection types.typeTYPE (DEVICETYPE, DEVICE)Base type of the connection. DEVICETYPE is used for teaming connections. + +Example: TYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort + +Allowed values: Ethernet, Wireless, InfiniBand, Bridge, Bond, Vlan, Team, TeamPortpermissionsUSERS(+)USERS restrict the access for this conenction to certain users only. + +Example: USERS="joe bob"autoconnectONBOOTyesWhether the connection should be autoconnected (not only while booting).autoconnect-priorityAUTOCONNECT_PRIORITY(+)0Connection priority for automatic activation. Connections with higher numbers are preferred when selecting profiles for automatic activation. + +Example: AUTOCONNECT_PRIORITY=20 + +Allowed values: -999 to 999zoneZONE(+)Trust level of this connection. The string is usually used for a firewall. + +Example: ZONE=WorkmasterMASTER, TEAM_MASTER, BRIDGEReference to master connection. The variable used depends on the connection type.slave-typeMASTER, TEAM_MASTER, DEVICETYPE, BRIDGESlave type doesn't map directly to a variable, but it is recognized using different variables. MASTER for bonding, TEAM_MASTER and DEVICETYPE for teaming, BRIDGE for bridging.secondariesSECONDARY_UUIDS(+)UUID of VPN connections that should be activated together with this connection.gateway-ping-timeoutGATEWAY_PING_TIMEOUT(+)0If greater than zero, the IP connectivity will be checked by pinging the gateway and waiting for the specified timeout (in seconds). + +Example: GATEWAY_PING_TIMEOUT=5
dcb settingPropertyIfcfg-rh VariableDefaultDescriptionapp-fcoe-flagsDCB_APP_FCOE_ENABLE, DCB_APP_FCOE_ADVERTISE, DCB_APP_FCOE_WILLINGnoFCOE flags. + +Example: DCB_APP_FCOE_ENABLE=yes DCB_APP_FCOE_ADVERTISE=yesapp-fcoe-priorityDCB_APP_FCOE_PRIORITYPriority of FCoE frames. + +Allowed values: 0 - 7app-fcoe-modeDCB_APP_FCOE_MODEfabricFCoE controller mode. + +Allowed values: fabric, vn2vnapp-iscsi-flagsDCB_APP_ISCSI_ENABLE, DCB_APP_ISCSI_ADVERTISE, DCB_APP_ISCSI_WILLINGnoiSCSI flags.app-iscsi-priorityDCB_APP_ISCSI_PRIORITYPriority of iSCSI frames. + +Allowed values: 0 - 7app-fip-flagsDCB_APP_FIP_ENABLE, DCB_APP_FIP_ADVERTISE, DCB_APP_FIP_WILLINGnoFIP flags.app-fip-priorityDCB_APP_FIP_PRIORITYPriority of FIP frames. + +Allowed values: 0 - 7priority-flow-control-flagsDCB_PFC_ENABLE, DCB_PFC_ADVERTISE, DCB_PFC_WILLINGnoPriority flow control flags.priority-flow-controlDCB_PFC_UPPriority flow control values. String of 8 "0" and "1", where "0". means "do not transmit priority pause", "1" means "transmit pause". + +Example: DCB_PFC_UP=01101110priority-group-flagsDCB_PG_ENABLE, DCB_PG_ADVERTISE, DCB_PG_WILLINGnoPriority groups flags.priority-group-idDCB_PG_IDPriority groups values. String of eight priorities (0 - 7) or "f" (unrestricted). + +Example: DCB_PG_ID=1205f173priority-group-bandwidthDCB_PG_PCTPriority groups values. Eight bandwidths (in percent), separated with commas. + +Example: DCB_PG_PCT=10,5,10,15,10,10,10,30priority-bandwidthDCB_PG_UPPCTPriority values. Eight bandwidths (in percent), separated with commas. The sum of the numbers must be 100. + +Example: DCB_PG_UPPCT=7,13,10,10,15,15,10,20priority-strict-bandwidthDCB_PG_STRICTPriority values. String of eight "0" or "1", where "0" means "may not utilize all bandwidth", "1" means "may utilize all bandwidth". + +Example: DCB_PG_STRICT=01101110priority-traffic-classDCB_PG_UP2TCPriority values. String of eight trafic class values (0 - 7). + +Example: DCB_PG_UP2TC=01623701
+ All DCB related configuration is a NetworkManager extention. DCB=yes must be + used explicitly to enable DCB so that the rest of the DCB_* variables can apply. + infiniband settingPropertyIfcfg-rh VariableDefaultDescriptionmac-addressHWADDRIBoIP 20-byte hardware address of the device (in traditional hex-digits-and-colons notation). + +Example: HWADDR=01:02:03:04:05:06:07:08:09:0A:01:02:03:04:05:06:07:08:09:11mtuMTUMTU of the interface.transport-modeCONNECTED_MODECONNECTED_MODE=noCONNECTED_MODE=yes for "connected" mode, CONNECTED_MODE=no for "datagram" modep-keyPKEY_ID (and PKEY=yes)PKEY=noInfiniBand P_Key. The value can be a hex number prefixed with "0x" or a decimal number. When PKEY_ID is specified, PHYSDEV and DEVICE also must be specified. + +Example: PKEY=yes PKEY_ID=2 PHYSDEV=mlx4_ib0 DEVICE=mlx4_ib0.8002parentPHYSDEV (PKEY=yes)PKEY=noInfiniBand parent device. + +Example: PHYSDEV=ib0
ipv4 settingPropertyIfcfg-rh VariableDefaultDescriptionmethodBOOTPROTOnoneMethod used for IPv4 protocol configuration. + +Allowed values: none, dhcp (bootp), static, ibft, autoip, shareddnsDNS1, DNS2, ...List of DNS servers. Even if NetworkManager supports many DNS servers, initscripts and resolver only care about the first three, usually. + +Example: DNS1=1.2.3.4 DNS2=10.0.0.254 DNS3=8.8.8.8dns-searchDOMAINList of DNS search domains.addressesIPADDR, PREFIX, IPADDR1, PREFIX1, ...List of static IP addresses. + +Example: IPADDR=10.5.5.23 PREFIX=24 IPADDR1=1.1.1.2 PREFIX1=16gatewayGATEWAYGateway IP address. + +Example: GATEWAY=10.5.5.1routesADDRESS1, NETMASK1, GATEWAY1, METRIC1, ...List of static routes. They are not stored in ifcfg-* file, but in route-* file instead.ignore-auto-routesPEERROUTES(+)yesPEERROUTES has the opposite meaning as 'ignore-auto-routes' property.ignore-auto-dnsPEERDNSyesPEERDNS has the opposite meaning as 'ignore-auto-dns' property.dhcp-send-hostnameDHCP_SEND_HOSTNAME(+)yesWhether DHCP_HOSTNAME should be sent to the DHCP server.dhcp-hostnameDHCP_HOSTNAMEHostname to send to the DHCP server.never-defaultDEFROUTE (GATEWAYDEV in /etc/sysconfig/network)yesDEFROUTE=no tells NetworkManager that this connection should not be assigned the default route. DEFROUTE has the opposite meaning as 'never-default' property.may-failIPV4_FAILURE_FATAL(+)noIPV4_FAILURE_FATAL has the opposite meaning as 'may-fail' property.dhcp-client-idDHCP_CLIENT_ID(+)A string sent to the DHCP server to identify the local machine. + +Example: DHCP_CLIENT_ID=ax-srv-1
ipv6 settingPropertyIfcfg-rh VariableDefaultDescriptionmethodIPV6INIT, IPV6FORWARDING, IPV6_AUTOCONF, DHCPV6CIPV6INIT=yes; IPV6FORWARDING=no; IPV6_AUTOCONF=!IPV6FORWARDING, DHCPV6=noMethod used for IPv6 protocol configuration. ignore ~ IPV6INIT=no; auto ~ IPV6_AUTOCONF=yes; dhcp ~ IPV6_AUTOCONF=no and DHCPV6C=yesdnsDNS1, DNS2, ...List of DNS servers. NetworkManager uses the variables both for IPv4 and IPv6.dns-searchDOMAINList of DNS search domains.addressesIPV6ADDR, IPV6ADDR_SECONDARIESList of static IP addresses. + +Example: IPV6ADDR=ab12:9876::1 IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3"gatewayIPV6_DEFAULTGWGateway IP address. + +Example: IPV6_DEFAULTGW=abbe::1routes(none)List of static routes. They are not stored in ifcfg-* file, but in route6-* file instead in the form of command line for 'ip route add'.ignore-auto-routesIPV6_PEERROUTES(+)yesIPV6_PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.ignore-auto-dnsIPV6_PEERDNS(+)yesIPV6_PEERDNS has the opposite meaning as 'ignore-auto-dns' property.dhcp-hostnameDHCP_HOSTNAMEHostname to send the DHCP server.never-defaultIPV6_DEFROUTE(+), (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network)IPV6_DEFROUTE=yes (when no variable specified)IPV6_DEFROUTE=no tells NetworkManager that this connection should not be assigned the default IPv6 route. IPV6_DEFROUTE has the opposite meaning as 'never-default' property.may-failIPV6_FAILURE_FATAL(+)noIPV6_FAILURE_FATAL has the opposite meaning as 'may-fail' property.ip6-privacyIPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP(+)noConfigure IPv6 Privacy Extensions for SLAAC (RFC4941). + +Example: IPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes + +Allowed values: IPV6_PRIVACY: no, yes (rfc3041 or rfc4941); IPV6_PRIVACY_PREFER_PUBLIC_IP: yes, no
team-port settingPropertyIfcfg-rh VariableDefaultDescriptionconfigTEAM_PORT_CONFIGTeam port configuration in JSON. See man teamd.conf for details.
team settingPropertyIfcfg-rh VariableDefaultDescriptionconfigTEAM_CONFIGTeam configuration in JSON. See man teamd.conf for details.
vlan settingPropertyIfcfg-rh VariableDefaultDescriptionparentDEVICE or PHYSDEVParent interface of the VLAN.idVLAN_ID or DEVICEVLAN identifier.flagsVLAN_FLAGS, REORDER_HDRParent interface of the VLAN. + +Allowed values: "GVRP", "LOOSE_BINDING" for VLAN_FLAGS; 0 or 1 for REORDER_HDRingress-property-mapVLAN_INGRESS_PRIORITY_MAPIngress priority mapping. + +Example: VLAN_INGRESS_PRIORITY_MAP=4:2,3:5egress-property-mapVLAN_EGRESS_PRIORITY_MAPEgress priority mapping. + +Example: VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7interface-namePHYSDEV and VLAN_ID, or DEVICEVLAN interface name. If all variables are set, parent device from PHYSDEV takes precedence over DEVICE, but VLAN id from DEVICE takes precedence over VLAN_ID. + +Example: PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12
802-3-ethernet settingPropertyIfcfg-rh VariableDefaultDescriptionport(none)The property is not saved by the plugin.speed(none)The property is not saved by the plugin.duplex(none)The property is not saved by the plugin.auto-negotiate(none)The property is not saved by the plugin.mac-addressHWADDRHardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).cloned-mac-addressMACADDRCloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).mac-address-blacklistHWADDR_BLACKLIST(+)It denies usage of the connection for any device whose address is listed. + +Example: HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"mtuMTUMTU of the interface.s390-subchannelsSUBCHANNELSSubchannels for IBM S390 hosts. + +Example: SUBCHANNELS=0.0.b00a,0.0.b00b,0.0.b00cs390-nettypeNETTYPENetwork type of the S390 host. + +Example: NETTYPE=qeth + +Allowed values: "qeth", "lcs" or "ctc"s390-optionsOPTIONS and PORTNAME, CTCPROTO,S390 device options. All options go to OPTIONS, except for "portname" and "ctcprot" that have their own variables.
802-11-wireless-security settingPropertyIfcfg-rh VariableDefaultDescriptionkey-mgmtKEY_MGMT(+)Key management menthod. + +Allowed values: IEEE8021X, WPA-PSK, WPA-EAPwep-tx-keyidxDEFAULTKEY1Index of active WEP key. + +Allowed values: 1, 2, 3, 4auth-algSECURITYMODE(+)Authentication algorithm for WEP. + +Allowed values: restricted, open, leapprotoWPA_ALLOW_WPA(+), WPA_ALLOW_WPA2(+)noAllowed WPA protocols, WPA and WPA2 (RSN). + +Allowed values: yes, nopairwiseCIPHER_PAIRWISE(+)Restrict pairwise encryption algorithms, specified as a space separated list. + +Allowed values: CCMP, TKIPgroupCIPHER_GROUP(+)Restrict group/broadcast encryption algorithms, specified as a space separated list. + +Allowed values: CCMP, TKIP, WEP40, WEP104leap-usernameIEEE_8021X_IDENTITY(+)Login name for LEAP.wep-key0KEY1, KEY_PASSPHRASE1(+)The first WEP key (used in most networks). See also DEFAULTKEY for key index.wep-key1KEY2, KEY_PASSPHRASE2(+)WEP key with index 1. See also DEFAULTKEY for key index.wep-key2KEY3, KEY_PASSPHRASE3(+)WEP key with index 2. See also DEFAULTKEY for key index.wep-key3KEY4, KEY_PASSPHRASE4(+)WEP key with index 3. See also DEFAULTKEY for key index.wep-key-flagsWEP_KEY_FLAGS(+)Password flags for KEY<i>, KEY_PASSPHRASE<i> password. (see for _FLAGS values)pskWPA_PSKPre-Shared-Key for WPA networks.psk-flagsWPA_PSK_FLAGS(+)Password flags for WPA_PSK_FLAGS. (see for _FLAGS values) + +Example: WPA_PSK_FLAGS=userleap-passwordIEEE_8021X_PASSWORD(+)Password for LEAP. It can also go to "key-" lookaside file, or it can be owned by a secret agent.leap-password-flagsIEEE_8021X_PASSWORD_FLAGS(+)Password flags for IEEE_8021X_PASSWORD_FLAGS. (see for _FLAGS values)wep-key-typeKEY<i> or KEY_PASSPHRASE<i>(+)KEY is used for "key" type (10 or 26 hexadecimal characters, or 5 or 13 character string prefixed with "s:"). KEY_PASSPHRASE is used for WEP passphrases. + +Example: KEY1=s:ahoj, KEY1=0a1c45bc02, KEY_PASSPHRASE1=mysupersecretkey
802-11-wireless settingPropertyIfcfg-rh VariableDefaultDescriptionssidESSIDSSID of Wi-Fi network. + +Example: ESSID="Quick Net"modeMODEWi-Fi network mode. + +Allowed values: Ad-Hoc, Managed (Auto) [case insensitive]bandBAND(+)BAND alone is honored, but CHANNEL overrides BAND since it implies a band. + +Example: BAND=bg + +Allowed values: a, bgchannelCHANNELChannel used for the Wi-Fi communication. Channels greater than 14 mean "a" band, otherwise the band is "bg". + +Example: CHANNEL=6bssidBSSID(+)Restricts association only to a single AP. + +Example: BSSID=00:1E:BD:64:83:21rate(none)This property is not handled by ifcfg-rh plugin.tx-power(none)This property is not handled by ifcfg-rh plugin.mac-addressHWADDRHardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).cloned-mac-addressMACADDRCloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).mac-address-blacklistHWADDR_BLACKLIST(+)It denies usage of the connection for any device whose address is listed.seen-bssids(none)This property is not handled by ifcfg-rh plugin.mtuMTUMTU of the wireless interface.hiddenSSID_HIDDEN(+)Whether the network hides the SSID.security(none)This property is deprecated and not handled by ifcfg-rh-plugin.
The following settings are not supported by ifcfg-rh plugin:adsl, bluetooth, ppp, pppoe, serial, generic, gsm, cdma, 802-11-olpc-mesh, wimax, vpnSecret flags + Each secret property in a NetworkManager setting has an associated + flags property that describes how to handle that secret. + In the fcfg-rh plugin variables for secret flags have a + _FLAGS suffix. The variables contain one or more of the + folowing values (space separated). Missing (or empty) *_FLAGS variable means + that the password is owned by NetworkManager. + user - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it.ask - the associated password is not saved but it will be + requested from the user each time it is required.unused - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required and should + not be requested from the user.AUTHORNetworkManager developersFILES/etc/sysconfig/network-scripts/ifcfg-*/etc/sysconfig/network-scripts/keys-*/etc/sysconfig/network-scripts/route-*/etc/sysconfig/network-scripts/route6-*/usr/share/doc/initscripts/sysconfig.txtSEE ALSOhttps://developer.gnome.org/NetworkManager/unstable/ref-settings.htmlnm-settings(5), nm-settings-keyfile(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5) diff --git a/man/nm-settings-ifcfg-rh.xsl b/man/nm-settings-ifcfg-rh.xsl new file mode 100644 index 00000000..f76dee75 --- /dev/null +++ b/man/nm-settings-ifcfg-rh.xsl @@ -0,0 +1,405 @@ + + + + + + + + + + + + + + + + + + + nm-settings-ifcfg-rh + 5 + NetworkManager + Configuration + + + + nm-settings-ifcfg-rh + Description of ifcfg-rh settings plugin + + + DESCRIPTION + + NetworkManager is based on the concept of connection profiles that contain + network configuration (see nm-settings + 5 for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in + NetworkManager.conf5. + + + The ifcfg-rh plugin is used on the Fedora and Red Hat + Enterprise Linux distributions to read/write configuration from/to + the standard /etc/sysconfig/network-scripts/ifcfg-* files. + Each NetworkManager connection maps to one ifcfg-* file, with + possible usage of keys-* for passwords, route-* + for static IPv4 routes and route6-* for static IPv6 routes. + The plugin currently supports reading and writing Ethernet, Wi-Fi, InfiniBand, + VLAN, Bond, Bridge, and Team connections. Unsupported connection types (such as + WWAN, PPPoE, VPN, or ADSL are handled by keyfile plugin + (nm-settings-keyfile5). + The main reason for using ifcfg-rh plugin is the compatibility + with legacy configurations for ifup and ifdown + (initscripts). + + + + File Format + + The ifcfg-rh config format is a simple text file containing + VARIABLE="value" lines. The format is described in sysconfig.txt + of initscripts package. Note that the configuration files + may be sourced by initscripts, so they must be valid shell + scripts. That means, for instance, that # character can be used + for comments, strings with spaces must be quoted, special characters must be escaped, + etc. + + + Users can create or modify the ifcfg-rh connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see monitor-connection-file in + nm-settings5 + , and nmcli con (re)load). + + + Some <emphasis>ifcfg-rh</emphasis> configuration examples: + + + Simple DHCP ethernet configuration: +NAME=ethernet +UUID=1c4ddf70-01bf-46d6-b04f-47e842bd98da +TYPE=Ethernet +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +ONBOOT=yes + + + + + Simple ethernet configuration with static IP: +TYPE=Ethernet +BOOTPROTO=none +IPADDR=10.1.0.25 +PREFIX=24 +GATEWAY=10.1.0.1 +DEFROUTE=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=yes +IPV6_AUTOCONF=yes +IPV6_DEFROUTE=yes +IPV6_PEERDNS=yes +IPV6_PEERROUTES=yes +IPV6_FAILURE_FATAL=no +NAME=ethernet-em2 +UUID=51bb3904-c0fc-4dfe-83b2-0a71e7928c13 +DEVICE=em2 +ONBOOT=yes + + + + + WPA2 Enterprise WLAN (TTLS with inner MSCHAPV2 authentication): +ESSID="CompanyWLAN" +MODE=Managed +KEY_MGMT=WPA-EAP +TYPE=Wireless +IEEE_8021X_EAP_METHODS=TTLS +IEEE_8021X_IDENTITY=joe +IEEE_8021X_PASSWORD_FLAGS=ask +IEEE_8021X_INNER_AUTH_METHODS=MSCHAPV2 +IEEE_8021X_CA_CERT=/home/joe/.cert/company.crt +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=no +NAME=MyCompany +UUID=f79848ff-11a6-4810-9e1a-99039dea84c4 +ONBOOT=yes + + + + + Bridge and bridge port configuration: +ifcfg-bridge: ifcfg-bridge-port: +NAME=bridge NAME=bridge007-port-eth0 +UUID=4be99ce0-c5b2-4764-8b77-ec226e440125 UUID=3ad56c4a-47e1-419b-b0d4-8ad86eb967a3 +DEVICE=bridge007 DEVICE=eth0 +STP=yes ONBOOT=yes +TYPE=Bridge TYPE=Ethernet +BRIDGING_OPTS=priority=32768 BRIDGE=bridge007 +ONBOOT=yes +BOOTPROTO=dhcp + + + + + + Bonding configuration: +ifcfg-BOND: ifcfg-BOND-slave: +NAME=BOND NAME=BOND-slave +UUID=b41888aa-924c-450c-b0f8-85a4f0a51b4a UUID=9bb048e4-286a-4cc3-b104-007dbd20decb +DEVICE=bond100 DEVICE=eth0 +BONDING_OPTS="mode=balance-rr miimon=100" ONBOOT=yes +TYPE=Bond TYPE=Ethernet +BONDING_MASTER=yes MASTER=bond100 +ONBOOT=yes SLAVE=yes +BOOTPROTO=dhcp + + + + + + Team and team port configuration: +ifcfg-my_team0: +DEVICE=team0 +TEAM_CONFIG="{ \"device\": \"team0\", \"runner\": {\"name\": \"roundrobin\"}, \"ports\": {\"eth1\": {}, \"eth2\": {}} }" +DEVICETYPE=Team +BOOTPROTO=dhcp +NAME=team0-profile +UUID=1d3460a0-7b37-457f-a300-fe8d92da4807 +ONBOOT=yes + +ifcfg-my_team0_slave1: +NAME=team0-slave1 +UUID=d5aed298-c567-4cc1-b808-6d38ecef9e64 +DEVICE=eth1 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +ifcfg-my_team0_slave2: +NAME=team0-slave2 +UUID=94e75f4e-e5ad-401c-8962-31e0ae5d2215 +DEVICE=eth2 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + + + + The UUID values in the config files must be unique. You can use uuidgen + command line tool to generate such values. Alternatively, you can leave out UUID + entirely. In that case NetworkManager will generate a UUID based on the file name. + + + + + + Differences against initscripts + + The main differences of NetworkManager ifcfg-rh plugin and traditional + initscripts are: + + + NM_CONTROLLED=yes|no + + NM_CONTROLLED is NetworkManager-specific variable used by NetworkManager + for determining whether the device of the ifcfg file + should be managed. NM_CONTROLLED=yes is supposed if the variable is not + present in the file. + Note that if you have more ifcfg files for a single + device, NM_CONTROLLED=no in one of the files will cause the device not + to be managed. The profile may not even be the active one. + + + + New variables + + NetworkManager has introduced some new variable, not present in initscripts, + to be able to store data for its new features. The variables are marked + as extensions in the tables bellows. + + + + Semantic change of variables + + NetworkManager had to slightly change the semantic for a few variables. + + + PEERDNS - + initscripts interpret PEERDNS=no to mean "never touch resolv.conf". + NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc.) + nameservers to resolv.conf". + + + ONBOOT - + initscripts use ONBOOT=yes to mark the devices that are to be activated + during boot. NetworkManager extents this to also mean that this profile + can be used for auto-connecting at any time. + + + + + + + + See the next section for detailed mapping of NetworkManager properties and + ifcfg-rh variables. Variable names, format and usage + differences in NetworkManager and initscripts are documented in the tables bellow. + + + + + DETAILS + + ifcfg-rh plugin variables marked with (+) + are NetworkManager specific extensions not understood by traditional initscripts. + + + + Secret flags + + Each secret property in a NetworkManager setting has an associated + flags property that describes how to handle that secret. + In the fcfg-rh plugin variables for secret flags have a + _FLAGS suffix. The variables contain one or more of the + folowing values (space separated). Missing (or empty) *_FLAGS variable means + that the password is owned by NetworkManager. + + + + user - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it. + + + ask - the associated password is not saved but it will be + requested from the user each time it is required. + + + unused - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required and should + not be requested from the user. + + + + + + + AUTHOR + + + NetworkManager developers + + + + + FILES + /etc/sysconfig/network-scripts/ifcfg-* + /etc/sysconfig/network-scripts/keys-* + /etc/sysconfig/network-scripts/route-* + /etc/sysconfig/network-scripts/route6-* + /usr/share/doc/initscripts/sysconfig.txt + + + SEE ALSO + https://developer.gnome.org/NetworkManager/unstable/ref-settings.html + nm-settings(5), nm-settings-keyfile(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5) + + + + + + + + + + <xsl:value-of select="@name"/> setting + + + + Property + Ifcfg-rh Variable + Default + Description + + + + + + +
+ + + + + All DCB related configuration is a NetworkManager extention. DCB=yes must be + used explicitly to enable DCB so that the rest of the DCB_* variables can apply. + + + + + The following settings are not supported by ifcfg-rh plugin: + + + + + + + + + + + + + + + + + + + (see for _FLAGS values) + + + + +Example: + + + + +Allowed values: + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5 new file mode 100644 index 00000000..53e9165f --- /dev/null +++ b/man/nm-settings-keyfile.5 @@ -0,0 +1,698 @@ +'\" t +.\" Title: nm-settings-keyfile +.\" Author: [see the "AUTHOR" section] +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 19 December 2014 +.\" Manual: Configuration +.\" Source: NetworkManager 1.0.0 +.\" Language: English +.\" +.TH "NM\-SETTINGS\-KEYFIL" "5" "" "NetworkManager 1\&.0\&.0" "Configuration" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +nm-settings-keyfile \- Description of \fIkeyfile\fR settings plugin +.SH "DESCRIPTION" +.PP +NetworkManager is based on the concept of connection profiles that contain network configuration (see +\fBnm-settings\fR(5) +for details)\&. The profiles can be stored in various formats\&. NetworkManager uses plugins for reading and writing the data\&. The plugins can be configured in +\fBNetworkManager.conf\fR(5)\&. +.PP +The +\fIkeyfile\fR +plugin is the generic plugin that supports all the connection types and capabilities that NetworkManager has\&. It writes files out in a \&.ini\-style format in +/etc/NetworkManager/system\-connections/\&. This plugin is always enabled and will automatically be used to store any connections that are not supported by any other active plugin\&. For security, it will ignore files that are readable or writeable by any user or group other than \*(Aqroot\*(Aq since private keys and passphrases may be stored in plaintext inside the file\&. +.SH "FILE FORMAT" +.PP +The +\fIkeyfile\fR +config format is a simple \&.ini\-style format\&. It consists of sections (groups) of key\-value pairs\&. Each section corresponds to a setting name as described in the settings specification (\fBnm-settings\fR(5))\&. Each configuration key/value pair in the section is one of the properties listed in the settings specification\&. The majority of properties of the specification is written in the same format into the +\fIkeyfile\fR +too\&. However some values are inconvenient for people to use\&. These are stored in the files in more readable ways\&. These properties are described bellow\&. An example could be IP addresses that are not written as integer arrays, but more reasonably as "1\&.2\&.3\&.4/12 1\&.2\&.3\&.254"\&. More information of the generic key file format can be found at +\m[blue]\fBGLib key file format\fR\m[]\&\s-2\u[1]\d\s+2 +(Lines beginning with a \*(Aq#\*(Aq are comments, lists are separated by character +; +etc\&.)\&. +.PP +Users can create or modify the +\fIkeyfile\fR +connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (see +\fImonitor\-connection\-file\fR +in +\fBnm-settings\fR(5) +and +\fInmcli con (re)load\fR)\&. +.PP +\fBExamples of keyfile configuration\fR. +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for an ethernet network:\fR +[connection] +id=Main eth0 +uuid=27afa607\-ee36\-43f0\-b8c3\-9d245cdc4bb3 +type=802\-3\-ethernet +autoconnect=true + +[ipv4] +method=auto + +[802\-3\-ethernet] +mac\-address=00:23:5a:47:1f:71 + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for WPA\-EAP (PEAP with MSCHAPv2) and always\-ask secret:\fR +[connection] +id=CompanyWIFI +uuid=cdac6154\-a33b\-4b15\-9904\-666772cfa5ee +type=wifi +autoconnect=false + +[wifi] +ssid=CorpWLAN +mode=infrastructure +security=802\-11\-wireless\-security + +[wifi\-security] +key\-mgmt=wpa\-eap + +[ipv4] +method=auto + +[ipv6] +method=auto + +[802\-1x] +eap=peap; +identity=joe +ca\-cert=/home/joe/\&.cert/corp\&.crt +phase1\-peapver=1 +phase2\-auth=mschapv2 +password\-flags=2 + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for openvpn:\fR +[connection] +id=RedHat\-openvpn +uuid=7f9b3356\-b210\-4c0e\-8123\-bd116c9c280f +type=vpn +timestamp=1385401165 + +[vpn] +service\-type=org\&.freedesktop\&.NetworkManager\&.openvpn +connection\-type=password +password\-flags=3 +remote=ovpn\&.my\-company\&.com +cipher=AES\-256\-CBC +reneg\-seconds=0 +port=443 +username=joe +ca=/etc/openvpn/ISCA\&.pem +tls\-remote=ovpn\&.my\-company\&.com + +[ipv6] +method=auto + +[ipv4] +method=auto +ignore\-auto\-dns=true +never\-default=true + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for a bridge and a bridge port:\fR +[connection] [connection] +id=MainBridge id=br\-port\-1 +uuid=171ae855\-a0ab\-42b6\-bd0c\-60f5812eea9d uuid=d6e8ae98\-71f8\-4b3d\-9d2d\-2e26048fe794 +interface\-name=MainBridge interface\-name=em1 +type=bridge type=ethernet + master=MainBridge +[bridge] slave\-type=bridge +interface\-name=MainBridge + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for a VLAN:\fR +[connection] +id=VLAN for building 4A +uuid=8ce1c9e0\-ce7a\-4d2c\-aa28\-077dda09dd7e +interface\-name=VLAN\-4A +type=vlan + +[vlan] +interface\-name=VLAN\-4A +parent=eth0 +id=4 + +.fi +.if n \{\ +.RE +.\} +.SH "DETAILS" +.PP +\fIkeyfile\fR +plugin variables for the majority of NetworkManager properties have one\-to\-one mapping\&. It means a NetworkManager property is stored in the keyfile as a variable of the same name and in the same format\&. There are several exceptions to this rule, mainly for making keyfile syntax easier for humans\&. The exceptions handled specially by +\fIkeyfile\fR +plugin are listed bellow\&. Refer to +\fBnm-settings\fR(5) +for all available settings and properties and their description\&. +.PP +\fBName aliases\fR. Some of the NetworkManager setting names are somewhat hard to type or remember\&. Therefore +\fIkeyfile\fR +introduces aliases that can be used instead of the names\&. +.RS 4 +\fIsetting name keyfile alias\fR +.RE +.RS 4 +802\-3\-ethernet = ethernet +.RE +.RS 4 +802\-11\-wireless = wifi +.RE +.RS 4 +802\-11\-wireless\-security = wifi\-security +.RE +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&1.\ \&bridge setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l. +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation, or semicolon separated list of 6 decimal bytes (obsolete)\fB + +Example: \fRmac\-address=00:22:68:12:79:A2 mac\-address=0;34;104;18;121;162; +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&2.\ \&infiniband setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l. +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation, or or semicolon separated list of 20 decimal bytes (obsolete)\fB + +Example: \fRmac\-address= 80:00:00:6d:fe:80:00:00:00:00:00:00:00:02:55:00:70:33:cf:01 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&3.\ \&ipv4 setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l. +T{ +dns +T}:T{ +dns +T}:T{ +list of DNS IP addresses +T}:T{ +List of DNS servers\&.\fB + +Example: \fRdns=1\&.2\&.3\&.4;8\&.8\&.8\&.8;8\&.8\&.4\&.4; +T} +T{ +addresses +T}:T{ +address1, address2, \&.\&.\&. +T}:T{ +address/plen +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRaddress1=192\&.168\&.100\&.100/24 address2=10\&.1\&.1\&.5/24 +T} +T{ +gateway +T}:T{ +gateway +T}:T{ +string +T}:T{ +Gateway IP addresses as a string\&.\fB + +Example: \fRgateway=192\&.168\&.100\&.1 +T} +T{ +routes +T}:T{ +route1, route2, \&.\&.\&. +T}:T{ +route/plen[,gateway,metric] +T}:T{ +List of IP routes\&.\fB + +Example: \fRroute1=8\&.8\&.8\&.0/24,10\&.1\&.1\&.1,77 route2=7\&.7\&.0\&.0/16 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&4.\ \&ipv6 setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l. +T{ +dns +T}:T{ +dns +T}:T{ +list of DNS IP addresses +T}:T{ +List of DNS servers\&.\fB + +Example: \fRdns=2001:4860:4860::8888;2001:4860:4860::8844; +T} +T{ +addresses +T}:T{ +address1, address2, \&.\&.\&. +T}:T{ +address/plen +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRaddress1=abbe::cafe/96 address2=2001::1234 +T} +T{ +gateway +T}:T{ +gateway +T}:T{ +string +T}:T{ +Gateway IP addresses as a string\&.\fB + +Example: \fRgateway=abbe::1 +T} +T{ +routes +T}:T{ +route1, route2, \&.\&.\&. +T}:T{ +route/plen[,gateway,metric] +T}:T{ +List of IP routes\&.\fB + +Example: \fRroute1=2001:4860:4860::/64,2620:52:0:2219:222:68ff:fe11:5403 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&5.\ \&serial setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l. +T{ +parity +T}:T{ +parity +T}:T{ +\*(Aqe\*(Aq, \*(Aqo\*(Aq, or \*(Aqn\*(Aq +T}:T{ +The connection parity; even, odd, or none\&. Note that older versions of NetworkManager stored this as an integer: 69 (\*(AqE\*(Aq) for even, 111 (\*(Aqo\*(Aq) for odd, or 110 (\*(Aqn\*(Aq) for none\&.\fB + +Example: \fRparity=n +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&6.\ \&vpn setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l. +T{ +data +T}:T{ +separate variables named after keys of the dictionary +T}:T{ +\ \& +T}:T{ +The keys of the data dictionary are used as variable names directly under [vpn] section\&.\fB + +Example: \fRremote=ovpn\&.corp\&.com cipher=AES\-256\-CBC username=joe +T} +T{ +secrets +T}:T{ +separate variables named after keys of the dictionary +T}:T{ +\ \& +T}:T{ +The keys of the secrets dictionary are used as variable names directly under [vpn\-secrets] section\&.\fB + +Example: \fRpassword=Popocatepetl +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&7.\ \&802-3-ethernet setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l. +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;162) +T} +T{ +cloned\-mac\-address +T}:T{ +cloned\-mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +Cloned MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;178)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +mac\-address\-blacklist +T}:T{ +list of MACs (separated with semicolons) +T}:T{ +MAC address blacklist\&.\fB + +Example: \fRmac\-address\-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&8.\ \&802-11-wireless setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l. +T{ +ssid +T}:T{ +ssid +T}:T{ +string (or decimal\-byte list \- obsolete) +T}:T{ +SSID of Wi\-Fi network\&.\fB + +Example: \fRssid=Quick Net +T} +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;162)\&. +T} +T{ +cloned\-mac\-address +T}:T{ +cloned\-mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +Cloned MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;178)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +mac\-address\-blacklist +T}:T{ +list of MACs (separated with semicolons) +T}:T{ +MAC address blacklist\&.\fB + +Example: \fRmac\-address\-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78 +T} +.TE +.sp 1 +.SS "Secret flags" +.PP +Each secret property in a NetworkManager setting has an associated +\fIflags\fR +property that describes how to handle that secret\&. In the +\fIkeyfile\fR +plugin, the value of +\fI\-flags\fR +variable is a decimal number (0 \- 7) defined as a sum of the following values: +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +0 \- (NM owned) \- the system is responsible for providing and storing this secret\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +1 \- (agent\-owned) \- a user\-session secret agent is responsible for providing and storing this secret; when it is required, agents will be asked to provide it\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +2 \- (not\-saved) \- this secret should not be saved but should be requested from the user each time it is required\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +4 \- (not\-required) \- in some situations it cannot be automatically determined that a secret is required or not\&. This flag hints that the secret is not required and should not be requested from the user\&. +.RE +.SH "AUTHOR" +.PP +NetworkManager developers +.SH "FILES" +.PP +/etc/NetworkManager/system\-connections/* +.SH "SEE ALSO" +.PP +https://developer\&.gnome\&.org/NetworkManager/unstable/ref\-settings\&.html +.PP +nm\-settings(5), nm\-settings\-ifcfg\-rh(5), NetworkManager(8), NetworkManager\&.conf(5), nmcli(1), nmcli\-examples(5) +.SH "NOTES" +.IP " 1." 4 +GLib key file format +.RS 4 +\%https://developer.gnome.org/glib/stable/glib-Key-value-file-parser.html#glib-Key-value-file-parser.description +.RE diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml new file mode 100644 index 00000000..45bc472b --- /dev/null +++ b/man/nm-settings-keyfile.xml @@ -0,0 +1,233 @@ + + +19 December 2014nm-settings-keyfile5NetworkManagerConfiguration1.0.0nm-settings-keyfileDescription of keyfile settings pluginDESCRIPTION + NetworkManager is based on the concept of connection profiles that contain + network configuration (see nm-settings5 for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in NetworkManager.conf5. + + The keyfile plugin is the generic plugin that supports all + the connection types and capabilities that NetworkManager has. It writes files + out in a .ini-style format in /etc/NetworkManager/system-connections/. + This plugin is always enabled and will automatically be used to store + any connections that are not supported by any other active plugin. + For security, it will ignore files that are readable or writeable by any user + or group other than 'root' since private keys and passphrases may be stored + in plaintext inside the file. + File Format + The keyfile config format is a simple .ini-style + format. It consists of sections (groups) of key-value pairs. Each section + corresponds to a setting name as described in the settings specification + (nm-settings5). Each configuration key/value + pair in the section is one of the properties listed in the settings + specification. The majority of properties of the specification is written + in the same format into the keyfile too. However + some values are inconvenient for people to use. These are stored in the + files in more readable ways. These properties are described bellow. + An example could be IP addresses that are not written as integer arrays, + but more reasonably as "1.2.3.4/12 1.2.3.254". + More information of the generic key file format can be found at + + GLib key file format (Lines beginning with a '#' are comments, + lists are separated by character ; etc.). + + Users can create or modify the keyfile connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see monitor-connection-file in + nm-settings5 and nmcli con (re)load). + Examples of <emphasis>keyfile</emphasis> configurationA sample configuration for an ethernet network: +[connection] +id=Main eth0 +uuid=27afa607-ee36-43f0-b8c3-9d245cdc4bb3 +type=802-3-ethernet +autoconnect=true + +[ipv4] +method=auto + +[802-3-ethernet] +mac-address=00:23:5a:47:1f:71 + A sample configuration for WPA-EAP (PEAP with MSCHAPv2) and always-ask secret: +[connection] +id=CompanyWIFI +uuid=cdac6154-a33b-4b15-9904-666772cfa5ee +type=wifi +autoconnect=false + +[wifi] +ssid=CorpWLAN +mode=infrastructure +security=802-11-wireless-security + +[wifi-security] +key-mgmt=wpa-eap + +[ipv4] +method=auto + +[ipv6] +method=auto + +[802-1x] +eap=peap; +identity=joe +ca-cert=/home/joe/.cert/corp.crt +phase1-peapver=1 +phase2-auth=mschapv2 +password-flags=2 + A sample configuration for openvpn: +[connection] +id=RedHat-openvpn +uuid=7f9b3356-b210-4c0e-8123-bd116c9c280f +type=vpn +timestamp=1385401165 + +[vpn] +service-type=org.freedesktop.NetworkManager.openvpn +connection-type=password +password-flags=3 +remote=ovpn.my-company.com +cipher=AES-256-CBC +reneg-seconds=0 +port=443 +username=joe +ca=/etc/openvpn/ISCA.pem +tls-remote=ovpn.my-company.com + +[ipv6] +method=auto + +[ipv4] +method=auto +ignore-auto-dns=true +never-default=true + A sample configuration for a bridge and a bridge port: +[connection] [connection] +id=MainBridge id=br-port-1 +uuid=171ae855-a0ab-42b6-bd0c-60f5812eea9d uuid=d6e8ae98-71f8-4b3d-9d2d-2e26048fe794 +interface-name=MainBridge interface-name=em1 +type=bridge type=ethernet + master=MainBridge +[bridge] slave-type=bridge +interface-name=MainBridge + A sample configuration for a VLAN: +[connection] +id=VLAN for building 4A +uuid=8ce1c9e0-ce7a-4d2c-aa28-077dda09dd7e +interface-name=VLAN-4A +type=vlan + +[vlan] +interface-name=VLAN-4A +parent=eth0 +id=4 + DETAILSkeyfile plugin variables for the majority of NetworkManager + properties have one-to-one mapping. It means a NetworkManager property is stored + in the keyfile as a variable of the same name and in the same format. + There are several exceptions to this rule, mainly for making keyfile syntax easier + for humans. The exceptions handled specially by keyfile + plugin are listed bellow. Refer to + nm-settings5 + for all available settings and properties and their description. + Name aliases + Some of the NetworkManager setting names are somewhat hard to type or remember. Therefore + keyfile introduces aliases that can be used instead of the names. + setting name keyfile alias802-3-ethernet = ethernet802-11-wireless = wifi802-11-wireless-security = wifi-security + + + + + +bridge setting (section)PropertyKeyfile VariableFormatDescription +mac-addressmac-addressususal hex-digits-and-colons notationMAC address in traditional hex-digits-and-colons notation, or semicolon separated list of 6 decimal bytes (obsolete) + +Example: mac-address=00:22:68:12:79:A2 mac-address=0;34;104;18;121;162; +
+ + + + + +infiniband setting (section)PropertyKeyfile VariableFormatDescription +mac-addressmac-addressususal hex-digits-and-colons notationMAC address in traditional hex-digits-and-colons notation, or or semicolon separated list of 20 decimal bytes (obsolete) + +Example: mac-address= 80:00:00:6d:fe:80:00:00:00:00:00:00:00:02:55:00:70:33:cf:01 +
+ +ipv4 setting (section)PropertyKeyfile VariableFormatDescription +dnsdnslist of DNS IP addressesList of DNS servers. + +Example: dns=1.2.3.4;8.8.8.8;8.8.4.4; +addressesaddress1, address2, ...address/plenList of static IP addresses. + +Example: address1=192.168.100.100/24 address2=10.1.1.5/24 +gatewaygatewaystringGateway IP addresses as a string. + +Example: gateway=192.168.100.1 +routesroute1, route2, ...route/plen[,gateway,metric]List of IP routes. + +Example: route1=8.8.8.0/24,10.1.1.1,77 route2=7.7.0.0/16 +
+ipv6 setting (section)PropertyKeyfile VariableFormatDescription +dnsdnslist of DNS IP addressesList of DNS servers. + +Example: dns=2001:4860:4860::8888;2001:4860:4860::8844; +addressesaddress1, address2, ...address/plenList of static IP addresses. + +Example: address1=abbe::cafe/96 address2=2001::1234 +gatewaygatewaystringGateway IP addresses as a string. + +Example: gateway=abbe::1 +routesroute1, route2, ...route/plen[,gateway,metric]List of IP routes. + +Example: route1=2001:4860:4860::/64,2620:52:0:2219:222:68ff:fe11:5403 +
+ + + +serial setting (section)PropertyKeyfile VariableFormatDescription +parityparity'e', 'o', or 'n'The connection parity; even, odd, or none. Note that older versions of NetworkManager stored this as an integer: 69 ('E') for even, 111 ('o') for odd, or 110 ('n') for none. + +Example: parity=n +
+ + + +vpn setting (section)PropertyKeyfile VariableFormatDescription +dataseparate variables named after keys of the dictionaryThe keys of the data dictionary are used as variable names directly under [vpn] section. + +Example: remote=ovpn.corp.com cipher=AES-256-CBC username=joe +secretsseparate variables named after keys of the dictionaryThe keys of the secrets dictionary are used as variable names directly under [vpn-secrets] section. + +Example: password=Popocatepetl +
+ +802-3-ethernet setting (section)PropertyKeyfile VariableFormatDescription +mac-addressmac-addressususal hex-digits-and-colons notationMAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;162) +cloned-mac-addresscloned-mac-addressususal hex-digits-and-colons notationCloned MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;178). +mac-address-blacklistmac-address-blacklistlist of MACs (separated with semicolons)MAC address blacklist. + +Example: mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78 +
+ +802-11-wireless setting (section)PropertyKeyfile VariableFormatDescription +ssidssidstring (or decimal-byte list - obsolete)SSID of Wi-Fi network. + +Example: ssid=Quick Net +mac-addressmac-addressususal hex-digits-and-colons notationMAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;162). +cloned-mac-addresscloned-mac-addressususal hex-digits-and-colons notationCloned MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;178). +mac-address-blacklistmac-address-blacklistlist of MACs (separated with semicolons)MAC address blacklist. + +Example: mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78 +
+Secret flags + Each secret property in a NetworkManager setting has an associated flags + property that describes how to handle that secret. In the keyfile plugin, + the value of -flags variable is a decimal number (0 - 7) defined as a sum + of the following values: + 0 - (NM owned) - the system is responsible for providing and storing this secret.1 - (agent-owned) - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it.2 - (not-saved) - this secret should not be saved but should be requested + from the user each time it is required.4 - (not-required) - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required + and should not be requested from the user.AUTHORNetworkManager developersFILES/etc/NetworkManager/system-connections/*SEE ALSOhttps://developer.gnome.org/NetworkManager/unstable/ref-settings.htmlnm-settings(5), nm-settings-ifcfg-rh(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5) diff --git a/man/nm-settings-keyfile.xsl b/man/nm-settings-keyfile.xsl new file mode 100644 index 00000000..b6e01a23 --- /dev/null +++ b/man/nm-settings-keyfile.xsl @@ -0,0 +1,308 @@ + + + + + + + + + + + + + + + nm-settings-keyfile + 5 + NetworkManager + Configuration + + + + nm-settings-keyfile + Description of keyfile settings plugin + + + DESCRIPTION + + NetworkManager is based on the concept of connection profiles that contain + network configuration (see nm-settings + 5 for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in + NetworkManager.conf5. + + + The keyfile plugin is the generic plugin that supports all + the connection types and capabilities that NetworkManager has. It writes files + out in a .ini-style format in /etc/NetworkManager/system-connections/. + This plugin is always enabled and will automatically be used to store + any connections that are not supported by any other active plugin. + For security, it will ignore files that are readable or writeable by any user + or group other than 'root' since private keys and passphrases may be stored + in plaintext inside the file. + + + + File Format + + The keyfile config format is a simple .ini-style + format. It consists of sections (groups) of key-value pairs. Each section + corresponds to a setting name as described in the settings specification + (nm-settings + 5). Each configuration key/value + pair in the section is one of the properties listed in the settings + specification. The majority of properties of the specification is written + in the same format into the keyfile too. However + some values are inconvenient for people to use. These are stored in the + files in more readable ways. These properties are described bellow. + An example could be IP addresses that are not written as integer arrays, + but more reasonably as "1.2.3.4/12 1.2.3.254". + More information of the generic key file format can be found at + + GLib key file format (Lines beginning with a '#' are comments, + lists are separated by character ; etc.). + + + Users can create or modify the keyfile connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see monitor-connection-file in + nm-settings5 + and nmcli con (re)load). + + + Examples of <emphasis>keyfile</emphasis> configuration + + + A sample configuration for an ethernet network: +[connection] +id=Main eth0 +uuid=27afa607-ee36-43f0-b8c3-9d245cdc4bb3 +type=802-3-ethernet +autoconnect=true + +[ipv4] +method=auto + +[802-3-ethernet] +mac-address=00:23:5a:47:1f:71 + + + + + A sample configuration for WPA-EAP (PEAP with MSCHAPv2) and always-ask secret: +[connection] +id=CompanyWIFI +uuid=cdac6154-a33b-4b15-9904-666772cfa5ee +type=wifi +autoconnect=false + +[wifi] +ssid=CorpWLAN +mode=infrastructure +security=802-11-wireless-security + +[wifi-security] +key-mgmt=wpa-eap + +[ipv4] +method=auto + +[ipv6] +method=auto + +[802-1x] +eap=peap; +identity=joe +ca-cert=/home/joe/.cert/corp.crt +phase1-peapver=1 +phase2-auth=mschapv2 +password-flags=2 + + + + + A sample configuration for openvpn: +[connection] +id=RedHat-openvpn +uuid=7f9b3356-b210-4c0e-8123-bd116c9c280f +type=vpn +timestamp=1385401165 + +[vpn] +service-type=org.freedesktop.NetworkManager.openvpn +connection-type=password +password-flags=3 +remote=ovpn.my-company.com +cipher=AES-256-CBC +reneg-seconds=0 +port=443 +username=joe +ca=/etc/openvpn/ISCA.pem +tls-remote=ovpn.my-company.com + +[ipv6] +method=auto + +[ipv4] +method=auto +ignore-auto-dns=true +never-default=true + + + + + A sample configuration for a bridge and a bridge port: +[connection] [connection] +id=MainBridge id=br-port-1 +uuid=171ae855-a0ab-42b6-bd0c-60f5812eea9d uuid=d6e8ae98-71f8-4b3d-9d2d-2e26048fe794 +interface-name=MainBridge interface-name=em1 +type=bridge type=ethernet + master=MainBridge +[bridge] slave-type=bridge +interface-name=MainBridge + + + + + A sample configuration for a VLAN: +[connection] +id=VLAN for building 4A +uuid=8ce1c9e0-ce7a-4d2c-aa28-077dda09dd7e +interface-name=VLAN-4A +type=vlan + +[vlan] +interface-name=VLAN-4A +parent=eth0 +id=4 + + + + + + + DETAILS + + keyfile plugin variables for the majority of NetworkManager + properties have one-to-one mapping. It means a NetworkManager property is stored + in the keyfile as a variable of the same name and in the same format. + There are several exceptions to this rule, mainly for making keyfile syntax easier + for humans. The exceptions handled specially by keyfile + plugin are listed bellow. Refer to + nm-settings5 + for all available settings and properties and their description. + + Name aliases + + Some of the NetworkManager setting names are somewhat hard to type or remember. Therefore + keyfile introduces aliases that can be used instead of the names. + + + setting name keyfile alias + 802-3-ethernet = ethernet + 802-11-wireless = wifi + 802-11-wireless-security = wifi-security + + + + + + Secret flags + + Each secret property in a NetworkManager setting has an associated flags + property that describes how to handle that secret. In the keyfile plugin, + the value of -flags variable is a decimal number (0 - 7) defined as a sum + of the following values: + + + + 0 - (NM owned) - the system is responsible for providing and storing this secret. + + + 1 - (agent-owned) - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it. + + + 2 - (not-saved) - this secret should not be saved but should be requested + from the user each time it is required. + + + 4 - (not-required) - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required + and should not be requested from the user. + + + + + + + AUTHOR + + + NetworkManager developers + + + + + FILES + /etc/NetworkManager/system-connections/* + + + SEE ALSO + https://developer.gnome.org/NetworkManager/unstable/ref-settings.html + nm-settings(5), nm-settings-ifcfg-rh(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5) + + + + + + + + + <xsl:value-of select="@name"/> setting (section) + + + + Property + Keyfile Variable + Format + Description + + + + + + +
+ + + + + + + + + + + + + +Example: + + + + +Allowed values: + + + + + + diff --git a/man/nm-settings.5 b/man/nm-settings.5 index 6f6aaf8e..0a90098a 100644 --- a/man/nm-settings.5 +++ b/man/nm-settings.5 @@ -2,12 +2,12 @@ .\" Title: nm-settings .\" Author: [see the "AUTHOR" section] .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 03 July 2014 +.\" Date: 19 December 2014 .\" Manual: Configuration -.\" Source: NetworkManager 0.9.10.0 +.\" Source: NetworkManager 1.0.0 .\" Language: English .\" -.TH "NM\-SETTINGS" "5" "" "NetworkManager 0\&.9\&.10\&.0" "Configuration" +.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.0\&.0" "Configuration" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -111,112 +111,121 @@ l l l l l l l l l l l l. T{ -name +altsubject\-matches T}:T{ -string +array of string T}:T{ -802\-1x +[] T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +List of strings to be matched against the altSubjectName of the certificate presented by the authentication server\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. T} T{ -eap +anonymous\-identity T}:T{ -array of string +string T}:T{ \ \& T}:T{ -The allowed EAP method to be used when authenticating to the network with 802\&.1x\&. Valid methods are: \*(Aqleap\*(Aq, \*(Aqmd5\*(Aq, \*(Aqtls\*(Aq, \*(Aqpeap\*(Aq, \*(Aqttls\*(Aq, \*(Aqpwd\*(Aq, and \*(Aqfast\*(Aq\&. Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations\&. +Anonymous identity string for EAP authentication methods\&. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP\-TTLS\&. T} T{ -identity +ca\-cert T}:T{ -string +byte array T}:T{ \ \& T}:T{ -Identity string for EAP authentication methods\&. Often the user\*(Aqs user or login name\&. +Contains the CA certificate if used by the EAP method specified in the "eap" property\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. T} T{ -anonymous\-identity +ca\-path T}:T{ string T}:T{ \ \& T}:T{ -Anonymous identity string for EAP authentication methods\&. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP\-TTLS\&. +UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca\-cert" property\&. T} T{ -pac\-file +client\-cert T}:T{ -string +byte array T}:T{ \ \& T}:T{ -UTF\-8 encoded file path containing PAC for EAP\-FAST\&. +Contains the client certificate if used by the EAP method specified in the "eap" property\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. T} T{ -ca\-cert +eap T}:T{ -byte array +array of string T}:T{ [] T}:T{ -Contains the CA certificate if used by the EAP method specified in the \*(Aqeap\*(Aq property\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. +The allowed EAP method to be used when authenticating to the network with 802\&.1x\&. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast"\&. Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations\&. T} T{ -ca\-path +identity T}:T{ string T}:T{ \ \& T}:T{ -UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the \*(Aqca\-cert\*(Aq property\&. +Identity string for EAP authentication methods\&. Often the user\*(Aqs user or login name\&. +T} +T{ +name +T}:T{ +string +T}:T{ +802\-1x +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -subject\-match +pac\-file T}:T{ string T}:T{ \ \& T}:T{ -Substring to be matched against the subject of the certificate presented by the authentication server\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. +UTF\-8 encoded file path containing PAC for EAP\-FAST\&. T} T{ -altsubject\-matches +password T}:T{ -array of string +string T}:T{ \ \& T}:T{ -List of strings to be matched against the altSubjectName of the certificate presented by the authentication server\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. +UTF\-8 encoded password used for EAP authentication methods\&. If both the "password" property and the "password\-raw" property are specified, "password" is preferred\&. T} T{ -client\-cert +password\-flags T}:T{ -byte array +NMSettingSecretFlags (uint32) T}:T{ -[] +\ \& T}:T{ -Contains the client certificate if used by the EAP method specified in the \*(Aqeap\*(Aq property\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -phase1\-peapver +password\-raw T}:T{ -string +byte array T}:T{ \ \& T}:T{ -Forces which PEAP version is used when PEAP is set as the EAP method in \*(Aqeap\*(Aq property\&. When unset, the version reported by the server will be used\&. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version\&. To do so, this property may be set to \*(Aq0\*(Aq or \*(Aq1\*(Aq to force that specific PEAP version\&. +Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF\-8 to be used\&. If both the "password" property and the "password\-raw" property are specified, "password" is preferred\&. T} T{ -phase1\-peaplabel +password\-raw\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Forces use of the new PEAP label during key derivation\&. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1\&. Set to \*(Aq1\*(Aq to force use of the new PEAP label\&. See the wpa_supplicant documentation for more details\&. +Flags indicating how to handle the "password\-raw" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ phase1\-fast\-provisioning @@ -225,178 +234,169 @@ string T}:T{ \ \& T}:T{ -Enables or disables in\-line provisioning of EAP\-FAST credentials when FAST is specified as the EAP method in the #NMSetting8021x:eap property\&. Allowed values are \*(Aq0\*(Aq (disabled), \*(Aq1\*(Aq (allow unauthenticated provisioning), \*(Aq2\*(Aq (allow authenticated provisioning), and \*(Aq3\*(Aq (allow both authenticated and unauthenticated provisioning)\&. See the wpa_supplicant documentation for more details\&. +Enables or disables in\-line provisioning of EAP\-FAST credentials when FAST is specified as the EAP method in the "eap" property\&. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning)\&. See the wpa_supplicant documentation for more details\&. T} T{ -phase2\-auth +phase1\-peaplabel T}:T{ string T}:T{ \ \& T}:T{ -Specifies the allowed \*(Aqphase 2\*(Aq inner non\-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the \*(Aqeap\*(Aq property\&. Recognized non\-EAP phase2 methods are \*(Aqpap\*(Aq, \*(Aqchap\*(Aq, \*(Aqmschap\*(Aq, \*(Aqmschapv2\*(Aq, \*(Aqgtc\*(Aq, \*(Aqotp\*(Aq, \*(Aqmd5\*(Aq, and \*(Aqtls\*(Aq\&. Each \*(Aqphase 2\*(Aq inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. +Forces use of the new PEAP label during key derivation\&. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1\&. Set to "1" to force use of the new PEAP label\&. See the wpa_supplicant documentation for more details\&. T} T{ -phase2\-autheap +phase1\-peapver T}:T{ string T}:T{ \ \& T}:T{ -Specifies the allowed \*(Aqphase 2\*(Aq inner EAP\-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the \*(Aqeap\*(Aq property\&. Recognized EAP\-based \*(Aqphase 2\*(Aq methods are \*(Aqmd5\*(Aq, \*(Aqmschapv2\*(Aq, \*(Aqotp\*(Aq, \*(Aqgtc\*(Aq, and \*(Aqtls\*(Aq\&. Each \*(Aqphase 2\*(Aq inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. +Forces which PEAP version is used when PEAP is set as the EAP method in the "eap" property\&. When unset, the version reported by the server will be used\&. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version\&. To do so, this property may be set to "0" or "1" to force that specific PEAP version\&. T} T{ -phase2\-ca\-cert +phase2\-altsubject\-matches T}:T{ -byte array +array of string T}:T{ [] T}:T{ -Contains the \*(Aqphase 2\*(Aq CA certificate if used by the EAP method specified in the \*(Aqphase2\-auth\*(Aq or \*(Aqphase2\-autheap\*(Aq properties\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currentlysupported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. +List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. T} T{ -phase2\-ca\-path +phase2\-auth T}:T{ string T}:T{ \ \& T}:T{ -UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the \*(Aqphase2\-ca\-cert\*(Aq property\&. +Specifies the allowed "phase 2" inner non\-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property\&. Recognized non\-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls"\&. Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. T} T{ -phase2\-subject\-match +phase2\-autheap T}:T{ string T}:T{ \ \& T}:T{ -Substring to be matched against the subject of the certificate presented by the authentication server during the inner \*(Aqphase2\*(Aq authentication\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. +Specifies the allowed "phase 2" inner EAP\-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property\&. Recognized EAP\-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls"\&. Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. T} T{ -phase2\-altsubject\-matches +phase2\-ca\-cert T}:T{ -array of string +byte array T}:T{ \ \& T}:T{ -List of strings to be matched against List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner \*(Aqphase 2\*(Aq authentication\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. +Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2\-auth" or "phase2\-autheap" properties\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. T} T{ -phase2\-client\-cert +phase2\-ca\-path T}:T{ -byte array +string T}:T{ -[] +\ \& T}:T{ -Contains the \*(Aqphase 2\*(Aq client certificate if used by the EAP method specified in the \*(Aqphase2\-auth\*(Aq or \*(Aqphase2\-autheap\*(Aq properties\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. +UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2\-ca\-cert" property\&. T} T{ -password +phase2\-client\-cert T}:T{ -string +byte array T}:T{ \ \& T}:T{ -UTF\-8 encoded password used for EAP authentication methods\&. +Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2\-auth" or "phase2\-autheap" properties\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. T} T{ -password\-flags +phase2\-private\-key T}:T{ -uint32 +byte array T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Contains the "phase 2" inner private key when the "phase2\-auth" or "phase2\-autheap" property is set to "tls"\&. Key data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2\-private\-key\-password" property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "phase2\-private\-key\-password" property must be set to the password used to decode the PKCS#12 private key and certificate\&. T} T{ -password\-raw +phase2\-private\-key\-password T}:T{ -byte array +string T}:T{ -[] +\ \& T}:T{ -Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF\-8 to be used\&. If both \*(Aqpassword\*(Aq and \*(Aqpassword\-raw\*(Aq are given, \*(Aqpassword\*(Aq is preferred\&. +The password used to decrypt the "phase 2" private key specified in the "phase2\-private\-key" property when the private key either uses the path scheme, or is a PKCS#12 format key\&. T} T{ -password\-raw\-flags +phase2\-private\-key\-password\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x password byte array\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "phase2\-private\-key\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -private\-key +phase2\-subject\-match T}:T{ -byte array +string T}:T{ -[] +\ \& T}:T{ -Contains the private key when the \*(Aqeap\*(Aq property is set to \*(Aqtls\*(Aq\&. Key data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the \*(Aqprivate\-key\-password\*(Aq property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and and ending with a terminating NULL byte, and as with the blob scheme the \*(Aqprivate\-key\-password\*(Aq property must be set to the password used to decode the PKCS#12 private key and certificate\&. +Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. T} T{ -private\-key\-password +pin T}:T{ string T}:T{ \ \& T}:T{ -The password used to decrypt the private key specified in the \*(Aqprivate\-key\*(Aq property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key\&. +PIN used for EAP authentication methods\&. T} T{ -private\-key\-password\-flags +pin\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x private key password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "pin" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -phase2\-private\-key +private\-key T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -Contains the \*(Aqphase 2\*(Aq inner private key when the \*(Aqphase2\-auth\*(Aq or \*(Aqphase2\-autheap\*(Aq property is set to \*(Aqtls\*(Aq\&. Key data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the \*(Aqphase2\-private\-key\-password\*(Aq property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and and ending with a terminating NULL byte, and as with the blob scheme the \*(Aqphase2\-private\-key\-password\*(Aq property must be set to the password used to decode the PKCS#12 private key and certificate\&. +Contains the private key when the "eap" property is set to "tls"\&. Key data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private\-key\-password" property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "private\-key\-password" property must be set to the password used to decode the PKCS#12 private key and certificate\&. WARNING: "private\-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users\&. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data\&. T} T{ -phase2\-private\-key\-password +private\-key\-password T}:T{ string T}:T{ \ \& T}:T{ -The password used to decrypt the \*(Aqphase 2\*(Aq private key specified in the \*(Aqprivate\-key\*(Aq property when the phase2 private key either uses the path scheme, or if the phase2 private key is a PKCS#12 format key\&. +The password used to decrypt the private key specified in the "private\-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key\&. T} T{ -phase2\-private\-key\-password\-flags +private\-key\-password\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x phase2 private key password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "private\-key\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -pin +subject\-match T}:T{ string T}:T{ \ \& T}:T{ -PIN used for EAP authentication methods\&. -T} -T{ -pin\-flags -T}:T{ -uint32 -T}:T{ -0 -T}:T{ -Flags indicating how to handle the 802\&.1x PIN\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Substring to be matched against the subject of the certificate presented by the authentication server\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. T} T{ system\-ca\-certs @@ -405,7 +405,7 @@ boolean T}:T{ FALSE T}:T{ -When TRUE, overrides \*(Aqca\-path\*(Aq and \*(Aqphase2\-ca\-path\*(Aq properties using the system CA directory specified at configure time with the \-\-system\-ca\-path switch\&. The certificates in this directory are added to the verification chain in addition to any certificates specified by the \*(Aqca\-cert\*(Aq and \*(Aqphase2\-ca\-cert\*(Aq properties\&. +When TRUE, overrides the "ca\-path" and "phase2\-ca\-path" properties using the system CA directory specified at configure time with the \-\-system\-ca\-path switch\&. The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca\-cert" and "phase2\-ca\-cert" properties\&. T} .TE .sp 1 @@ -437,22 +437,22 @@ l l l l l l l l l l l l. T{ -name +encapsulation T}:T{ string T}:T{ -adsl +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Encapsulation of ADSL connection\&. Can be "vcmux" or "llc"\&. T} T{ -username +name T}:T{ string T}:T{ -\ \& +adsl T}:T{ -Username used to authenticate with the pppoa service\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ password @@ -461,16 +461,16 @@ string T}:T{ \ \& T}:T{ -Password used to authenticate with the pppoa service\&. +Password used to authenticate with the ADSL service\&. T} T{ password\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the ADSL password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ protocol @@ -479,34 +479,34 @@ string T}:T{ \ \& T}:T{ -ADSL connection protocol\&. +ADSL connection protocol\&. Can be "pppoa", "pppoe" or "ipoatm"\&. T} T{ -encapsulation +username T}:T{ string T}:T{ \ \& T}:T{ -Encapsulation of ADSL connection +Username used to authenticate with the ADSL service\&. T} T{ -vpi +vci T}:T{ uint32 T}:T{ 0 T}:T{ -VPI of ADSL connection +VCI of ADSL connection T} T{ -vci +vpi T}:T{ uint32 T}:T{ 0 T}:T{ -VCI of ADSL connection +VPI of ADSL connection T} .TE .sp 1 @@ -533,22 +533,22 @@ l l l l l l l l l l l l. T{ -name +bdaddr T}:T{ -string +byte array T}:T{ -bluetooth +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The Bluetooth address of the device\&. T} T{ -bdaddr +name T}:T{ -byte array +string T}:T{ -[] +bluetooth T}:T{ -The Bluetooth address of the device +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ type @@ -557,7 +557,7 @@ string T}:T{ \ \& T}:T{ -Either \*(Aqdun\*(Aq for Dial\-Up Networking connections or \*(Aqpanu\*(Aq for Personal Area Networking connections\&. +Either "dun" for Dial\-Up Networking connections or "panu" for Personal Area Networking connections to devices supporting the NAP profile\&. T} .TE .sp 1 @@ -584,31 +584,31 @@ l l l l l l l l l l l l. T{ -name +interface\-name T}:T{ string T}:T{ -bond +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the bond\*(Aqs interface name\&. T} T{ -interface\-name +name T}:T{ string T}:T{ -\ \& +bond T}:T{ -The name of the virtual in\-kernel bonding network interface +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ options T}:T{ -dict of (string::string) +dict of string to string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of bonding options\&. Both keys and values must be strings\&. Option names must contain only alphanumeric characters (ie, [a\-zA\-Z0\-9])\&. +Dictionary of key/value pairs of bonding options\&. Both keys and values must be strings\&. Option names must contain only alphanumeric characters (ie, [a\-zA\-Z0\-9])\&. T} .TE .sp 1 @@ -641,85 +641,85 @@ l l l l l l l l l l l l. T{ -name +ageing\-time T}:T{ -string +uint32 T}:T{ -bridge +300 T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The Ethernet MAC address aging time, in seconds\&. T} T{ -interface\-name +forward\-delay T}:T{ -string +uint32 T}:T{ -\ \& +15 T}:T{ -The name of the virtual in\-kernel bridging network interface +The Spanning Tree Protocol (STP) forwarding delay, in seconds\&. T} T{ -mac\-address +hello\-time T}:T{ -byte array +uint32 T}:T{ -[] +2 T}:T{ -The MAC address of the bridge +The Spanning Tree Protocol (STP) hello time, in seconds\&. T} T{ -stp +interface\-name T}:T{ -boolean +string T}:T{ -TRUE +\ \& T}:T{ -Controls whether Spanning Tree Protocol (STP) is enabled for this bridge\&. +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the bridge\*(Aqs interface name\&. T} T{ -priority +mac\-address T}:T{ -uint32 +byte array T}:T{ -32768 +\ \& T}:T{ -Sets the Spanning Tree Protocol (STP) priority for this bridge\&. Lower values are \*(Aqbetter\*(Aq; the lowest priority bridge will be elected the root bridge\&. +If specified, the MAC address of bridge\&. When creating a new bridge, this MAC address will be set\&. When matching an existing (outside NetworkManager created) bridge, this MAC address must match\&. T} T{ -forward\-delay +max\-age T}:T{ uint32 T}:T{ -15 +20 T}:T{ -The Spanning Tree Protocol (STP) forwarding delay, in seconds\&. +The Spanning Tree Protocol (STP) maximum message age, in seconds\&. T} T{ -hello\-time +name T}:T{ -uint32 +string T}:T{ -2 +bridge T}:T{ -The Spanning Tree Protocol (STP) hello time, in seconds\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -max\-age +priority T}:T{ uint32 T}:T{ -20 +32768 T}:T{ -The Spanning Tree Protocol (STP) maximum message age, in seconds\&. +Sets the Spanning Tree Protocol (STP) priority for this bridge\&. Lower values are "better"; the lowest priority bridge will be elected the root bridge\&. T} T{ -ageing\-time +stp T}:T{ -uint32 +boolean T}:T{ -300 +TRUE T}:T{ -The Ethernet MAC address aging time, in seconds\&. +Controls whether Spanning Tree Protocol (STP) is enabled for this bridge\&. T} .TE .sp 1 @@ -747,22 +747,22 @@ l l l l l l l l l l l l. T{ -name +hairpin\-mode T}:T{ -string +boolean T}:T{ -bridge\-port +FALSE T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Enables or disabled "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on\&. T} T{ -priority +name T}:T{ -uint32 +string T}:T{ -32 +bridge\-port T}:T{ -The Spanning Tree Protocol (STP) priority of this bridge port +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ path\-cost @@ -774,13 +774,13 @@ T}:T{ The Spanning Tree Protocol (STP) port cost for destinations via this port\&. T} T{ -hairpin\-mode +priority T}:T{ -boolean +uint32 T}:T{ -FALSE +32 T}:T{ -Enables or disabled \*(Aqhairpin mode\*(Aq for the port, which allows frames to be sent back out through the port the frame was received on\&. +The Spanning Tree Protocol (STP) priority of this bridge port\&. T} .TE .sp 1 @@ -815,7 +815,7 @@ string T}:T{ cdma T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ number @@ -824,34 +824,34 @@ string T}:T{ \ \& T}:T{ -Number to dial when establishing a PPP data session with the CDMA\-based mobile broadband network\&. If not specified, the default number (#777) is used when required\&. +The number to dial to establish the connection to the CDMA\-based mobile broadband network, if any\&. If not specified, the default number (#777) is used when required\&. T} T{ -username +password T}:T{ string T}:T{ \ \& T}:T{ -Username used to authenticate with the network, if required\&. Note that many providers do not require a username or accept any username\&. +The password used to authenticate with the network, if required\&. Many providers do not require a password, or accept any password\&. But if a password is required, it is specified here\&. T} T{ -password +password\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Password used to authenticate with the network, if required\&. Note that many providers do not require a password or accept any password\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -password\-flags +username T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the CDMA password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +The username used to authenticate with the network, if required\&. Many providers do not require a username, or accept any username\&. But if a username is required, it is specified here\&. T} .TE .sp 1 @@ -887,78 +887,79 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ -name +autoconnect T}:T{ -string +boolean T}:T{ -connection +TRUE T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available\&. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection\&. T} T{ -id +autoconnect\-priority T}:T{ -string +int32 T}:T{ -\ \& +0 T}:T{ -User\-readable connection identifier/name\&. Must be one or more characters and may change over the lifetime of the connection if the user decides to rename it\&. +The autoconnect priority\&. If the connection is set to autoconnect, connections with higher priority will be preferred\&. Defaults to 0\&. The higher number means higher priority\&. T} T{ -uuid +gateway\-ping\-timeout T}:T{ -string +uint32 T}:T{ -\ \& +0 T}:T{ -Universally unique connection identifier\&. Must be in the format \*(Aq2815492f\-7e56\-435e\-b2e9\-246bd7cdc664\*(Aq (ie, contains only hexadecimal characters and \*(Aq\-\*(Aq)\&. The UUID should be assigned when the connection is created and never changed as long as the connection still applies to the same network\&. For example, it should not be changed when the user changes the connection\*(Aqs \*(Aqid\*(Aq, but should be recreated when the Wi\-Fi SSID, mobile broadband network provider, or the connection type changes\&. +If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping\&. T} T{ -interface\-name +id T}:T{ string T}:T{ \ \& T}:T{ -Interface name this connection is bound to\&. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings)\&. For connection types where interface names cannot easily be made persistent (e\&.g\&. mobile broadband or USB Ethernet), this property should not be used\&. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface\&. +A human readable unique identifier for the connection, like "Work Wi\-Fi" or "T\-Mobile 3G"\&. T} T{ -type +interface\-name T}:T{ string T}:T{ \ \& T}:T{ -Base type of the connection\&. For hardware\-dependent connections, should contain the setting name of the hardware\-type specific setting (ie, \*(Aq802\-3\-ethernet\*(Aq or \*(Aq802\-11\-wireless\*(Aq or \*(Aqbluetooth\*(Aq, etc), and for non\-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, \*(Aqvpn\*(Aq or \*(Aqbridge\*(Aq, etc)\&. +The name of the network interface this connection is bound to\&. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings)\&. For software devices this specifies the name of the created device\&. For connection types where interface names cannot easily be made persistent (e\&.g\&. mobile broadband or USB Ethernet), this property should not be used\&. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface\&. T} T{ -permissions +master T}:T{ -array of string +string T}:T{ \ \& T}:T{ -An array of strings defining what access a given user has to this connection\&. If this is NULL or empty, all users are allowed to access this connection\&. Otherwise a user is allowed to access this connection if and only if they are in this array\&. Each entry is of the form "[type]:[id]:[reserved]", for example: "user:dcbw:blah" At this time only the \*(Aquser\*(Aq [type] is allowed\&. Any other values are ignored and reserved for future use\&. [id] is the username that this permission refers to, which may not contain the \*(Aq:\*(Aq character\&. Any [reserved] information (if present) must be ignored and is reserved for future use\&. All of [type], [id], and [reserved] must be valid UTF\-8\&. +Interface name of the master device or UUID of the master connection\&. T} T{ -autoconnect +name T}:T{ -boolean +string T}:T{ -TRUE +connection T}:T{ -If TRUE, NetworkManager will activate this connection when its network resources are available\&. If FALSE, the connection must be manually activated by the user or some other mechanism\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -timestamp +permissions T}:T{ -uint64 +array of string T}:T{ -0 +[] T}:T{ -Timestamp (in seconds since the Unix Epoch) that the connection was last successfully activated\&. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp\&. The property is only meant for reading (changes to this property will not be preserved)\&. +An array of strings defining what access a given user has to this connection\&. If this is NULL or empty, all users are allowed to access this connection\&. Otherwise a user is allowed to access this connection if and only if they are in this list\&. Each entry is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah"\&. At this time only the "user" [type] is allowed\&. Any other values are ignored and reserved for future use\&. [id] is the username that this permission refers to, which may not contain the ":" character\&. Any [reserved] information present must be ignored and is reserved for future use\&. All of [type], [id], and [reserved] must be valid UTF\-8\&. T} T{ read\-only @@ -967,52 +968,61 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, the connection is read\-only and cannot be changed by the user or any other mechanism\&. This is normally set for system connections whose plugin cannot yet write updated connections back out\&. +FALSE if the connection can be modified using the provided settings service\*(Aqs D\-Bus interface with the right privileges, or TRUE if the connection is read\-only and cannot be modified\&. T} T{ -zone +secondaries T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -The trust level of a the connection\&.Free form case\-insensitive string (for example "Home", "Work", "Public")\&. NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall\&. +List of connection UUIDs that should be activated when the base connection itself is activated\&. Currently only VPN connections are supported\&. T} T{ -master +slave\-type T}:T{ string T}:T{ \ \& T}:T{ -Interface name of the master device or UUID of the master connection +Setting name of the device type of this slave\*(Aqs master connection (eg, "bond"), or NULL if this connection is not a slave\&. T} T{ -slave\-type +timestamp +T}:T{ +uint64 +T}:T{ +0 +T}:T{ +The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated\&. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp\&. The property is only meant for reading (changes to this property will not be preserved)\&. +T} +T{ +type T}:T{ string T}:T{ \ \& T}:T{ -Setting name describing the type of slave this connection is (ie, \*(Aqbond\*(Aq) or NULL if this connection is not a slave\&. +Base type of the connection\&. For hardware\-dependent connections, should contain the setting name of the hardware\-type specific setting (ie, "802\-3\-ethernet" or "802\-11\-wireless" or "bluetooth", etc), and for non\-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc)\&. T} T{ -secondaries +uuid T}:T{ -array of string +string T}:T{ \ \& T}:T{ -List of connection UUIDs that should be activated when the base connection itself is activated\&. Currently only VPN connections are supported\&. +A universally unique identifier for the connection, for example generated with libuuid\&. It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network\&. For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re\-created when the Wi\-Fi SSID, mobile broadband network provider, or "type" property changes\&. The UUID must be in the format "2815492f\-7e56\-435e\-b2e9\-246bd7cdc664" (ie, contains only hexadecimal characters and "\-")\&. T} T{ -gateway\-ping\-timeout +zone T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping\&. +The trust level of a the connection\&. Free form case\-insensitive string (for example "Home", "Work", "Public")\&. NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall\&. T} .TE .sp 1 @@ -1052,22 +1062,22 @@ l l l l l l l l l l l l. T{ -name +app\-fcoe\-flags T}:T{ -string +NMSettingDcbFlags (uint32) T}:T{ -dcb +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Specifies the NMSettingDcbFlags for the DCB FCoE application\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ -app\-fcoe\-flags +app\-fcoe\-mode T}:T{ -uint32 +string T}:T{ -0 +"fabric" T}:T{ -Specifies the flags for the DCB FCoE application\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +The FCoE controller mode; either "fabric" (default) or "vn2vn"\&. T} T{ app\-fcoe\-priority @@ -1076,88 +1086,79 @@ int32 T}:T{ \-1 T}:T{ -The highest User Priority (0 \- 7) which FCoE frames should use, or \-1 for default priority\&. Only used when the \*(Aqapp\-fcoe\-flags\*(Aq property includes the \*(Aqenabled\*(Aq flag\&. -T} -T{ -app\-fcoe\-mode -T}:T{ -string -T}:T{ -"fabric" -T}:T{ -The FCoe controller mode; either \*(Aqfabric\*(Aq (default) or \*(Aqvn2vn\*(Aq\&. +The highest User Priority (0 \- 7) which FCoE frames should use, or \-1 for default priority\&. Only used when the "app\-fcoe\-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag\&. T} T{ -app\-iscsi\-flags +app\-fip\-flags T}:T{ -uint32 +NMSettingDcbFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Specifies the flags for the DCB iSCSI application\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Specifies the NMSettingDcbFlags for the DCB FIP application\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ -app\-iscsi\-priority +app\-fip\-priority T}:T{ int32 T}:T{ \-1 T}:T{ -The highest User Priority (0 \- 7) which iSCSI frames should use, or \-1 for default priority\&. Only used when the \*(Aqapp\-iscsi\-flags\*(Aq property includes the \*(Aqenabled\*(Aq flag\&. +The highest User Priority (0 \- 7) which FIP frames should use, or \-1 for default priority\&. Only used when the "app\-fip\-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag\&. T} T{ -app\-fip\-flags +app\-iscsi\-flags T}:T{ -uint32 +NMSettingDcbFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Specifies the flags for the DCB FIP application\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Specifies the NMSettingDcbFlags for the DCB iSCSI application\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ -app\-fip\-priority +app\-iscsi\-priority T}:T{ int32 T}:T{ \-1 T}:T{ -The highest User Priority (0 \- 7) which FIP frames should use, or \-1 for default priority\&. Only used when the \*(Aqapp\-fip\-flags\*(Aq property includes the \*(Aqenabled\*(Aq flag\&. +The highest User Priority (0 \- 7) which iSCSI frames should use, or \-1 for default priority\&. Only used when the "app\-iscsi\-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag\&. T} T{ -priority\-flow\-control\-flags +name T}:T{ -uint32 +string T}:T{ -0 +dcb T}:T{ -Specifies the flags for DCB Priority Flow Control\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -priority\-flow\-control +priority\-bandwidth T}:T{ array of uint32 T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the corresponding priority should transmit priority pause\&. Allowed values are 0 (do not transmit pause) and 1 (transmit pause)\&. +An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the percentage of bandwidth of the priority\*(Aqs assigned group that the priority may use\&. The sum of all percentages for priorities which belong to the same group must total 100 percent\&. T} T{ -priority\-group\-flags +priority\-flow\-control T}:T{ -uint32 +array of uint32 T}:T{ -0 +\ \& T}:T{ -Specifies the flags for DCB Priority Groups\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +An array of 8 boolean values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the corresponding priority should transmit priority pause\&. T} T{ -priority\-group\-id +priority\-flow\-control\-flags T}:T{ -array of uint32 +NMSettingDcbFlags (uint32) T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the Priority Group ID\&. Allowed Priority Group ID values are 0 \- 7 or 15 for the unrestricted group\&. +Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC)\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ priority\-group\-bandwidth @@ -1169,13 +1170,22 @@ T}:T{ An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 \- 7) and the value indicates the percentage of link bandwidth allocated to that group\&. Allowed values are 0 \- 100, and the sum of all values must total 100 percent\&. T} T{ -priority\-bandwidth +priority\-group\-flags +T}:T{ +NMSettingDcbFlags (uint32) +T}:T{ +\ \& +T}:T{ +Specifies the NMSettingDcbFlags for DCB Priority Groups\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. +T} +T{ +priority\-group\-id T}:T{ array of uint32 T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the percentage of bandwidth of the priority\*(Aqs assigned group that the priority may use\&. The sum of all percentages for priorities which belong to the same group must total 100 percent\&. +An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the Priority Group ID\&. Allowed Priority Group ID values are 0 \- 7 or 15 for the unrestricted group\&. T} T{ priority\-strict\-bandwidth @@ -1184,7 +1194,7 @@ array of uint32 T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group\&. Allowed values are 0 (the priority may not utilize all bandwidth) or 1 (the priority may utilize all bandwidth)\&. +An array of 8 boolean values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group\&. T} T{ priority\-traffic\-class @@ -1202,7 +1212,38 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&10.\ \&gsm setting +.B Table\ \&10.\ \&generic setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Key Name +T}:T{ +Value Type +T}:T{ +Default Value +T}:T{ +Value Description +T} +.T& +l l l l. +T{ +name +T}:T{ +string +T}:T{ +generic +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&11.\ \&gsm setting .TS allbox tab(:); lB lB lB lB. @@ -1216,8 +1257,6 @@ T}:T{ Value Description T} .T& -l l l l -l l l l l l l l l l l l l l l l @@ -1229,76 +1268,67 @@ l l l l l l l l l l l l. T{ -name +apn T}:T{ string T}:T{ -gsm +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM\-based network\&. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider\-specific walled\-garden, so it is important to use the correct APN for the user\*(Aqs mobile broadband plan\&. The APN may only be composed of the characters a\-z, 0\-9, \&., and \- per GSM 03\&.60 Section 14\&.9\&. T} T{ -number +home\-only T}:T{ -string +boolean T}:T{ -\ \& +FALSE T}:T{ -Number to dial when establishing a PPP data session with the GSM\-based mobile broadband network\&. Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically\&. +When TRUE, only connections to the home network will be allowed\&. Connections to roaming networks will not be made\&. T} T{ -username +name T}:T{ string T}:T{ -\ \& +gsm T}:T{ -Username used to authenticate with the network, if required\&. Note that many providers do not require a username or accept any username\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -password +network\-id T}:T{ string T}:T{ \ \& T}:T{ -Password used to authenticate with the network, if required\&. Note that many providers do not require a password or accept any password\&. -T} -T{ -password\-flags -T}:T{ -uint32 -T}:T{ -0 -T}:T{ -Flags indicating how to handle the GSM password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +The Network ID (GSM LAI format, ie MCC\-MNC) to force specific network registration\&. If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network\&. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible\&. T} T{ -apn +number T}:T{ string T}:T{ \ \& T}:T{ -The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM\-based network\&. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider\-specific walled\-garden, so it is important to use the correct APN for the user\*(Aqs mobile broadband plan\&. The APN may only be composed of the characters a\-z, 0\-9, \&., and \- per GSM 03\&.60 Section 14\&.9\&. +Number to dial when establishing a PPP data session with the GSM\-based mobile broadband network\&. Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically\&. T} T{ -network\-id +password T}:T{ string T}:T{ \ \& T}:T{ -The Network ID (GSM LAI format, ie MCC\-MNC) to force specific network registration\&. If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network\&. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible\&. +The password used to authenticate with the network, if required\&. Many providers do not require a password, or accept any password\&. But if a password is required, it is specified here\&. T} T{ -network\-type +password\-flags T}:T{ -int32 +NMSettingSecretFlags (uint32) T}:T{ -\-1 +\ \& T}:T{ -Network preference to force the device to only use specific network technologies\&. The permitted values are: \-1: any, 0: 3G only, 1: GPRS/EDGE only, 2: prefer 3G, 3: prefer 2G, 4: prefer 4G/LTE, 5: 4G/LTE only\&. Notes: This property is deprecated and NetworkManager from 0\&.9\&.10 onwards doesn\*(Aqt use this property when talking to ModemManager\&.Also, not all devices allow network preference control\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ pin @@ -1312,29 +1342,20 @@ T} T{ pin\-flags T}:T{ -uint32 -T}:T{ -0 -T}:T{ -Flags indicating how to handle the GSM SIM PIN\&. (see the section called \(lqSecret flag types:\(rq for flag values) -T} -T{ -allowed\-bands -T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -1 +\ \& T}:T{ -Bitfield of allowed frequency bands\&.Notes: This property is deprecated and NetworkManager from 0\&.9\&.10 onwards doesn\*(Aqt use this property when talking to ModemManager\&.Also, not all devices allow frequency band control\&. +Flags indicating how to handle the "pin" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -home\-only +username T}:T{ -boolean +string T}:T{ -FALSE +\ \& T}:T{ -When TRUE, only connections to the home network will be allowed\&. Connections to roaming networks will not be made\&. +The username used to authenticate with the network, if required\&. Many providers do not require a username, or accept any username\&. But if a username is required, it is specified here\&. T} .TE .sp 1 @@ -1343,7 +1364,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&11.\ \&infiniband setting +.B Table\ \&12.\ \&infiniband setting .TS allbox tab(:); lB lB lB lB. @@ -1364,22 +1385,13 @@ l l l l l l l l l l l l. T{ -name -T}:T{ -string -T}:T{ -infiniband -T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. -T} -T{ mac\-address T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. +If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. T} T{ mtu @@ -1391,13 +1403,13 @@ T}:T{ If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames\&. T} T{ -transport\-mode +name T}:T{ string T}:T{ -\ \& +infiniband T}:T{ -The IPoIB transport mode\&. Either \*(Aqdatagram\*(Aq or \*(Aqconnected\*(Aq\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ p\-key @@ -1406,7 +1418,7 @@ int32 T}:T{ \-1 T}:T{ -The InfiniBand P_Key\&. Either \-1 for the default, or a 16\-bit unsigned integer\&. +The InfiniBand P_Key to use for this device\&. A value of \-1 means to use the default P_Key (aka "the P_Key at index 0")\&. Otherwise it is a 16\-bit unsigned integer, whose high bit is set if it is a "full membership" P_Key\&. T} T{ parent @@ -1415,7 +1427,16 @@ string T}:T{ \ \& T}:T{ -The interface name of the parent device, or NULL +The interface name of the parent device of this device\&. Normally NULL, but if the "p_key" property is set, then you must specify the base device by setting either this property or "mac\-address"\&. +T} +T{ +transport\-mode +T}:T{ +string +T}:T{ +\ \& +T}:T{ +The IP\-over\-InfiniBand transport mode\&. Either "datagram" or "connected"\&. T} .TE .sp 1 @@ -1424,7 +1445,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&12.\ \&ipv4 setting +.B Table\ \&13.\ \&ipv4 setting .TS allbox tab(:); lB lB lB lB. @@ -1451,78 +1472,81 @@ l l l l l l l l l l l l l l l l +l l l l +l l l l +l l l l l l l l. T{ -name +address\-data T}:T{ -string +array of vardict T}:T{ -ipv4 +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Array of IPv4 addresses\&. Each address dictionary contains at least \*(Aqaddress\*(Aq and \*(Aqprefix\*(Aq entries, containing the IP address as a string, and the prefix length as a uint32\&. Additional attributes may also exist on some addresses\&. T} T{ -method +addresses T}:T{ -string +array of array of uint32 T}:T{ \ \& T}:T{ -IPv4 configuration method\&. If \*(Aqauto\*(Aq is specified then the appropriate automatic method (DHCP, PPP, etc) is used for the interface and most other properties can be left unset\&. If \*(Aqlink\-local\*(Aq is specified, then a link\-local address in the 169\&.254/16 range will be assigned to the interface\&. If \*(Aqmanual\*(Aq is specified, static IP addressing is used and at least one IP address must be given in the \*(Aqaddresses\*(Aq property\&. If \*(Aqshared\*(Aq is specified (indicating that this connection will provide network access to other computers) then the interface is assigned an address in the 10\&.42\&.x\&.1/24 range and a DHCP and forwarding DNS server are started, and the interface is NAT\-ed to the current default network connection\&. \*(Aqdisabled\*(Aq means IPv4 will not be used on this connection\&. This property must be set\&. +Deprecated in favor of the \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq properties, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq\&. Array of IPv4 address structures\&. Each IPv4 address structure is composed of 3 32\-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 \- 32), and last the IPv4 gateway (network byte order)\&. The gateway may be left as 0 if no gateway exists for that subnet\&. T} T{ -dns +dhcp\-client\-id T}:T{ -array of uint32 +string T}:T{ \ \& T}:T{ -List of DNS servers (network byte order)\&. For the \*(Aqauto\*(Aq method, these DNS servers are appended to those (if any) returned by automatic configuration\&. DNS servers cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as there is no upstream network\&. In all other methods, these DNS servers are used as the only DNS servers for this connection\&. +A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options\&. T} T{ -dns\-search +dhcp\-hostname T}:T{ -array of string +string T}:T{ \ \& T}:T{ -List of DNS search domains\&. For the \*(Aqauto\*(Aq method, these search domains are appended to those returned by automatic configuration\&. Search domains cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as there is no upstream network\&. In all other methods, these search domains are used as the only search domains for this connection\&. +If the "dhcp\-send\-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease\&. T} T{ -addresses +dhcp\-send\-hostname T}:T{ -array of array of uint32 +boolean T}:T{ -\ \& +TRUE T}:T{ -Array of IPv4 address structures\&. Each IPv4 address structure is composed of 3 32\-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 \- 32), and last the IPv4 gateway (network byte order)\&. The gateway may be left as 0 if no gateway exists for that subnet\&. For the \*(Aqauto\*(Aq method, given IP addresses are appended to those returned by automatic configuration\&. Addresses cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as addressing is either automatic or disabled with these methods\&. +If TRUE, a hostname is sent to the DHCP server when acquiring a lease\&. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer\&. If the "dhcp\-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent\&. T} T{ -address\-labels +dns T}:T{ -array of string +array of uint32 T}:T{ -\ \& +[] T}:T{ -Internal use only +Array of IP addresses of DNS servers (as network\-byte\-order integers) T} T{ -routes +dns\-search T}:T{ -array of array of uint32 +array of string T}:T{ -\ \& +[] T}:T{ -Array of IPv4 route structures\&. Each IPv4 route structure is composed of 4 32\-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 \- 32), the third being the next\-hop (network byte order) if any, and the fourth being the route metric\&. For the \*(Aqauto\*(Aq method, given IP routes are appended to those returned by automatic configuration\&. Routes cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq, methods as there is no upstream network\&. +Array of DNS search domains\&. T} T{ -ignore\-auto\-routes +gateway T}:T{ -boolean +string T}:T{ -FALSE +\ \& T}:T{ -When the method is set to \*(Aqauto\*(Aq and this property to TRUE, automatically configured routes are ignored and only routes specified in the \*(Aqroutes\*(Aq property, if any, are used\&. +The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&. T} T{ ignore\-auto\-dns @@ -1531,34 +1555,43 @@ boolean T}:T{ FALSE T}:T{ -When the method is set to \*(Aqauto\*(Aq and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the \*(Aqdns\*(Aq and \*(Aqdns\-search\*(Aq properties, if any, are used\&. +When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns\-search" properties, if any, are used\&. T} T{ -dhcp\-client\-id +ignore\-auto\-routes T}:T{ -string +boolean T}:T{ -\ \& +FALSE T}:T{ -A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options\&. +When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used\&. T} T{ -dhcp\-send\-hostname +may\-fail T}:T{ boolean T}:T{ TRUE T}:T{ -If TRUE, a hostname is sent to the DHCP server when acquiring a lease\&. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer\&. If the \*(Aqdhcp\-hostname\*(Aq property is empty and this property is TRUE, the current persistent hostname of the computer is sent\&. +If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv6\-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully\&. T} T{ -dhcp\-hostname +method T}:T{ string T}:T{ \ \& T}:T{ -If the \*(Aqdhcp\-send\-hostname\*(Aq property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease\&. +IP configuration method\&. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link\-local"\&. See the subclass\-specific documentation for other values\&. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration\&. The "ignore\-auto\-routes" and "ignore\-auto\-dns" properties modify this behavior\&. For methods that imply no upstream network, such as "shared" or "link\-local", these properties must be empty\&. +T} +T{ +name +T}:T{ +string +T}:T{ +ipv4 +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ never\-default @@ -1567,16 +1600,34 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, this connection will never be the default IPv4 connection, meaning it will never be assigned the default route by NetworkManager\&. +If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager\&. T} T{ -may\-fail +route\-data T}:T{ -boolean +array of vardict T}:T{ -TRUE +\ \& T}:T{ -If TRUE, allow overall network configuration to proceed even if IPv4 configuration times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv6\-only networks, setting this property to TRUE allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully\&. +Array of IPv4 routes\&. Each route dictionary contains at least \*(Aqdest\*(Aq and \*(Aqprefix\*(Aq entries, containing the destination IP address as a string, and the prefix length as a uint32\&. Most routes will also have a \*(Aqgateway\*(Aq entry, containing the gateway IP address as a string\&. If the route has a \*(Aqmetric\*(Aq entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device)\&. Additional attributes may also exist on some routes\&. +T} +T{ +route\-metric +T}:T{ +int64 +T}:T{ +\-1 +T}:T{ +The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is choosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +T} +T{ +routes +T}:T{ +array of array of uint32 +T}:T{ +\ \& +T}:T{ +Deprecated in favor of the \*(Aqroute\-data\*(Aq property, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqroute\-data\*(Aq\&. Array of IPv4 route structures\&. Each IPv4 route structure is composed of 4 32\-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 \- 32), the third being the next\-hop (network byte order) if any, and the fourth being the route metric\&. If the metric is 0, NM will choose an appropriate default metric for the device\&. (There is no way to explicitly specify an actual metric of 0 with this property\&.) T} .TE .sp 1 @@ -1585,7 +1636,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&13.\ \&ipv6 setting +.B Table\ \&14.\ \&ipv6 setting .TS allbox tab(:); lB lB lB lB. @@ -1610,24 +1661,29 @@ l l l l l l l l l l l l l l l l +l l l l +l l l l +l l l l +l l l l +l l l l l l l l. T{ -name +address\-data T}:T{ -string +array of vardict T}:T{ -ipv6 +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Array of IPv6 addresses\&. Each address dictionary contains at least \*(Aqaddress\*(Aq and \*(Aqprefix\*(Aq entries, containing the IP address as a string, and the prefix length as a uint32\&. Additional attributes may also exist on some addresses\&. T} T{ -method +addresses T}:T{ -string +array of legacy IPv6 address struct (a(ayuay)) T}:T{ \ \& T}:T{ -IPv6 configuration method\&. If \*(Aqauto\*(Aq is specified then the appropriate automatic method (PPP, router advertisement, etc) is used for the device and most other properties can be left unset\&. To force the use of DHCP only, specify \*(Aqdhcp\*(Aq; this method is only valid for Ethernet\-based hardware\&. If \*(Aqlink\-local\*(Aq is specified, then an IPv6 link\-local address will be assigned to the interface\&. If \*(Aqmanual\*(Aq is specified, static IP addressing is used and at least one IP address must be given in the \*(Aqaddresses\*(Aq property\&. If \*(Aqignore\*(Aq is specified, IPv6 configuration is not done\&. This property must be set\&. Note: the \*(Aqshared\*(Aq method is not yet supported\&. +Deprecated in favor of the \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq properties, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq\&. Array of IPv6 address structures\&. Each IPv6 address structure is composed of an IPv6 address, a prefix length (1 \- 128), and an IPv6 gateway address\&. The gateway may be zeroed out if no gateway exists for that subnet\&. T} T{ dhcp\-hostname @@ -1636,43 +1692,52 @@ string T}:T{ \ \& T}:T{ -The specified name will be sent to the DHCP server when acquiring a lease\&. +If the "dhcp\-send\-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease\&. +T} +T{ +dhcp\-send\-hostname +T}:T{ +boolean +T}:T{ +TRUE +T}:T{ +If TRUE, a hostname is sent to the DHCP server when acquiring a lease\&. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer\&. If the "dhcp\-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent\&. T} T{ dns T}:T{ array of byte array T}:T{ -\ \& +[] T}:T{ -Array of DNS servers, where each member of the array is a byte array containing the IPv6 address of the DNS server (in network byte order)\&. For the \*(Aqauto\*(Aq method, these DNS servers are appended to those (if any) returned by automatic configuration\&. DNS servers cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods as there is no usptream network\&. In all other methods, these DNS servers are used as the only DNS servers for this connection\&. +Array of IP addresses of DNS servers (in network byte order) T} T{ dns\-search T}:T{ array of string T}:T{ -\ \& +[] T}:T{ -List of DNS search domains\&. For the \*(Aqauto\*(Aq method, these search domains are appended to those returned by automatic configuration\&. Search domains cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods as there is no upstream network\&. In all other methods, these search domains are used as the only search domains for this connection\&. +Array of DNS search domains\&. T} T{ -addresses +gateway T}:T{ -array of (byte array, uint32, byte array) +string T}:T{ \ \& T}:T{ -Array of IPv6 address structures\&. Each IPv6 address structure is composed of 3 members, the first being a byte array containing the IPv6 address (network byte order), the second a 32\-bit integer containing the IPv6 address prefix, and the third a byte array containing the IPv6 address (network byte order) of the gateway associated with this address, if any\&. If no gateway is given, the third element should be given as all zeros\&. For the \*(Aqauto\*(Aq method, given IP addresses are appended to those returned by automatic configuration\&. Addresses cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods as the interface is automatically assigned an address with these methods\&. +The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&. T} T{ -routes +ignore\-auto\-dns T}:T{ -array of (byte array, uint32, byte array, uint32) +boolean T}:T{ -\ \& +FALSE T}:T{ -Array of IPv6 route structures\&. Each IPv6 route structure is composed of 4 members; the first being the destination IPv6 network or address (network byte order) as a byte array, the second the destination network or address IPv6 prefix, the third being the next\-hop IPv6 address (network byte order) if any, and the fourth being the route metric\&. For the \*(Aqauto\*(Aq method, given IP routes are appended to those returned by automatic configuration\&. Routes cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods because there is no upstream network\&. +When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns\-search" properties, if any, are used\&. T} T{ ignore\-auto\-routes @@ -1681,16 +1746,43 @@ boolean T}:T{ FALSE T}:T{ -When the method is set to \*(Aqauto\*(Aq or \*(Aqdhcp\*(Aq and this property is set to TRUE, automatically configured routes are ignored and only routes specified in the \*(Aqroutes\*(Aq property, if any, are used\&. +When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used\&. T} T{ -ignore\-auto\-dns +ip6\-privacy +T}:T{ +NMSettingIP6ConfigPrivacy (int32) +T}:T{ +\ \& +T}:T{ +Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941\&. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI\-64\&. This enhances privacy, but could cause problems in some applications, on the other hand\&. The permitted values are: 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses)\&. +T} +T{ +may\-fail T}:T{ boolean T}:T{ -FALSE +TRUE +T}:T{ +If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv6\-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully\&. +T} +T{ +method +T}:T{ +string +T}:T{ +\ \& +T}:T{ +IP configuration method\&. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link\-local"\&. See the subclass\-specific documentation for other values\&. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration\&. The "ignore\-auto\-routes" and "ignore\-auto\-dns" properties modify this behavior\&. For methods that imply no upstream network, such as "shared" or "link\-local", these properties must be empty\&. +T} +T{ +name +T}:T{ +string +T}:T{ +ipv6 T}:T{ -When the method is set to \*(Aqauto\*(Aq or \*(Aqdhcp\*(Aq and this property is set to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the \*(Aqdns\*(Aq and \*(Aqdns\-search\*(Aq properties, if any, are used\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ never\-default @@ -1699,25 +1791,34 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, this connection will never be the default IPv6 connection, meaning it will never be assigned the default IPv6 route by NetworkManager\&. +If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager\&. T} T{ -may\-fail +route\-data T}:T{ -boolean +array of vardict T}:T{ -TRUE +\ \& T}:T{ -If TRUE, allow overall network configuration to proceed even if IPv6 configuration times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv4\-only networks, setting this property to TRUE allows the overall network configuration to succeed if IPv6 configuration fails but IPv4 configuration completes successfully\&. +Array of IPv6 routes\&. Each route dictionary contains at least \*(Aqdest\*(Aq and \*(Aqprefix\*(Aq entries, containing the destination IP address as a string, and the prefix length as a uint32\&. Most routes will also have a \*(Aqnext\-hop\*(Aq entry, containing the next hop IP address as a string\&. If the route has a \*(Aqmetric\*(Aq entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device)\&. Additional attributes may also exist on some routes\&. T} T{ -ip6\-privacy +route\-metric T}:T{ -int32 +int64 T}:T{ \-1 T}:T{ -Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941\&. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI\-64\&. This enhances privacy, but could cause problems in some applications, on the other hand\&. The permitted values are: 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses)\&. +The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is choosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +T} +T{ +routes +T}:T{ +array of legacy IPv6 route struct (a(ayuayu)) +T}:T{ +\ \& +T}:T{ +Deprecated in favor of the \*(Aqroute\-data\*(Aq property, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqroute\-data\*(Aq\&. Array of IPv6 route structures\&. Each IPv6 route structure is composed of an IPv6 address, a prefix length (1 \- 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric\&. If the metric is 0, NM will choose an appropriate default metric for the device\&. T} .TE .sp 1 @@ -1726,7 +1827,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&14.\ \&802-11-olpc-mesh setting +.B Table\ \&15.\ \&802-11-olpc-mesh setting .TS allbox tab(:); lB lB lB lB. @@ -1745,40 +1846,40 @@ l l l l l l l l l l l l. T{ -name +channel T}:T{ -string +uint32 T}:T{ -802\-11\-olpc\-mesh +0 T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Channel on which the mesh network to join is located\&. T} T{ -ssid +dhcp\-anycast\-address T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -SSID of the mesh network to join\&. +Anycast DHCP MAC address used when requesting an IP address via DHCP\&. The specific anycast address used determines which DHCP server class answers the request\&. T} T{ -channel +name T}:T{ -uint32 +string T}:T{ -0 +802\-11\-olpc\-mesh T}:T{ -Channel on which the mesh network to join is located\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -dhcp\-anycast\-address +ssid T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -Anycast DHCP MAC address used when requesting an IP address via DHCP\&. The specific anycast address used determines which DHCP server class answers the the request\&. +SSID of the mesh network to join\&. T} .TE .sp 1 @@ -1787,7 +1888,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&15.\ \&ppp setting +.B Table\ \&16.\ \&ppp setting .TS allbox tab(:); lB lB lB lB. @@ -1821,175 +1922,175 @@ l l l l l l l l l l l l. T{ -name +baud T}:T{ -string +uint32 T}:T{ -ppp +0 T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +If non\-zero, instruct pppd to set the serial port to the specified baudrate\&. This value should normally be left as 0 to automatically choose the speed\&. T} T{ -noauth +crtscts T}:T{ boolean T}:T{ -TRUE +FALSE T}:T{ -If TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client\&. If FALSE, require authentication from the remote side\&. In almost all cases, this should be TRUE\&. +If TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals\&. This value should normally be set to FALSE\&. T} T{ -refuse\-eap +lcp\-echo\-failure T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the EAP authentication method will not be used\&. +If non\-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo\-requests go unanswered by the peer\&. The "lcp\-echo\-interval" property must also be set to a non\-zero value if this property is used\&. T} T{ -refuse\-pap +lcp\-echo\-interval T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the PAP authentication method will not be used\&. +If non\-zero, instruct pppd to send an LCP echo\-request frame to the peer every n seconds (where n is the specified value)\&. Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this\&. T} T{ -refuse\-chap +mppe\-stateful T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, the CHAP authentication method will not be used\&. +If TRUE, stateful MPPE is used\&. See pppd documentation for more information on stateful MPPE\&. T} T{ -refuse\-mschap +mru T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the MSCHAP authentication method will not be used\&. +If non\-zero, instruct pppd to request that the peer send packets no larger than the specified size\&. If non\-zero, the MRU should be between 128 and 16384\&. T} T{ -refuse\-mschapv2 +mtu T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the MSCHAPv2 authentication method will not be used\&. +If non\-zero, instruct pppd to send packets no larger than the specified size\&. T} T{ -nobsdcomp +name T}:T{ -boolean +string T}:T{ -FALSE +ppp T}:T{ -If TRUE, BSD compression will not be requested\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -nodeflate +no\-vj\-comp T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, \*(Aqdeflate\*(Aq compression will not be requested\&. +If TRUE, Van Jacobsen TCP header compression will not be requested\&. T} T{ -no\-vj\-comp +noauth T}:T{ boolean T}:T{ -FALSE +TRUE T}:T{ -If TRUE, Van Jacobsen TCP header compression will not be requested\&. +If TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client\&. If FALSE, require authentication from the remote side\&. In almost all cases, this should be TRUE\&. T} T{ -require\-mppe +nobsdcomp T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session\&. If either 64\-bit or 128\-bit MPPE is not available the session will fail\&. Note that MPPE is not used on mobile broadband connections\&. +If TRUE, BSD compression will not be requested\&. T} T{ -require\-mppe\-128 +nodeflate T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, 128\-bit MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session, and the \*(Aqrequire\-mppe\*(Aq property must also be set to TRUE\&. If 128\-bit MPPE is not available the session will fail\&. +If TRUE, "deflate" compression will not be requested\&. T} T{ -mppe\-stateful +refuse\-chap T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, stateful MPPE is used\&. See pppd documentation for more information on stateful MPPE\&. +If TRUE, the CHAP authentication method will not be used\&. T} T{ -crtscts +refuse\-eap T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals\&. This value should normally be set to FALSE\&. +If TRUE, the EAP authentication method will not be used\&. T} T{ -baud +refuse\-mschap T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to set the serial port to the specified baudrate\&. This value should normally be left as 0 to automatically choose the speed\&. +If TRUE, the MSCHAP authentication method will not be used\&. T} T{ -mru +refuse\-mschapv2 T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to request that the peer send packets no larger than the specified size\&. If non\-zero, the MRU should be between 128 and 16384\&. +If TRUE, the MSCHAPv2 authentication method will not be used\&. T} T{ -mtu +refuse\-pap T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to send packets no larger than the specified size\&. +If TRUE, the PAP authentication method will not be used\&. T} T{ -lcp\-echo\-failure +require\-mppe T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo\-requests go unanswered by the peer\&. The \*(Aqlcp\-echo\-interval\*(Aq property must also be set to a non\-zero value if this property is used\&. +If TRUE, MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session\&. If either 64\-bit or 128\-bit MPPE is not available the session will fail\&. Note that MPPE is not used on mobile broadband connections\&. T} T{ -lcp\-echo\-interval +require\-mppe\-128 T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to send an LCP echo\-request frame to the peer every n seconds (where n is the specified value)\&. Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this\&. +If TRUE, 128\-bit MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session, and the "require\-mppe" property must also be set to TRUE\&. If 128\-bit MPPE is not available the session will fail\&. T} .TE .sp 1 @@ -1998,7 +2099,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&16.\ \&pppoe setting +.B Table\ \&17.\ \&pppoe setting .TS allbox tab(:); lB lB lB lB. @@ -2024,43 +2125,43 @@ string T}:T{ pppoe T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -service +password T}:T{ string T}:T{ \ \& T}:T{ -If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service\&. For most providers, this should be left blank\&. It is only required if there are multiple access concentrators or a specific service is known to be required\&. +Password used to authenticate with the PPPoE service\&. T} T{ -username +password\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Username used to authenticate with the PPPoE service\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -password +service T}:T{ string T}:T{ \ \& T}:T{ -Password used to authenticate with the PPPoE service\&. +If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service\&. For most providers, this should be left blank\&. It is only required if there are multiple access concentrators or a specific service is known to be required\&. T} T{ -password\-flags +username T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the PPPoE password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Username used to authenticate with the PPPoE service\&. T} .TE .sp 1 @@ -2069,7 +2170,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&17.\ \&serial setting +.B Table\ \&18.\ \&serial setting .TS allbox tab(:); lB lB lB lB. @@ -2090,15 +2191,6 @@ l l l l l l l l l l l l. T{ -name -T}:T{ -string -T}:T{ -serial -T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. -T} -T{ baud T}:T{ uint32 @@ -2114,25 +2206,25 @@ uint32 T}:T{ 8 T}:T{ -Byte\-width of the serial communication\&. The 8 in \*(Aq8n1\*(Aq for example\&. +Byte\-width of the serial communication\&. The 8 in "8n1" for example\&. T} T{ -parity +name T}:T{ -gchar +string T}:T{ -110 +serial T}:T{ -Parity setting of the serial port\&. Either \*(AqE\*(Aq for even parity, \*(Aqo\*(Aq for odd parity, or \*(Aqn\*(Aq for no parity\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -stopbits +parity T}:T{ -uint32 +byte T}:T{ -1 +\ \& T}:T{ -Number of stop bits for communication on the serial port\&. Either 1 or 2\&. The 1 in \*(Aq8n1\*(Aq for example\&. +The connection parity: 69 (ASCII \*(AqE\*(Aq) for even parity, 111 (ASCII \*(Aqo\*(Aq) for odd, 110 (ASCII \*(Aqn\*(Aq) for none\&. T} T{ send\-delay @@ -2143,6 +2235,15 @@ T}:T{ T}:T{ Time to delay between each byte sent to the modem, in microseconds\&. T} +T{ +stopbits +T}:T{ +uint32 +T}:T{ +1 +T}:T{ +Number of stop bits for communication on the serial port\&. Either 1 or 2\&. The 1 in "8n1" for example\&. +T} .TE .sp 1 .sp @@ -2150,7 +2251,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&18.\ \&team setting +.B Table\ \&19.\ \&team setting .TS allbox tab(:); lB lB lB lB. @@ -2168,13 +2269,13 @@ l l l l l l l l l l l l. T{ -name +config T}:T{ string T}:T{ -team +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The JSON configuration for the team network interface\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the default configuration is used\&. See man teamd\&.conf for the format details\&. T} T{ interface\-name @@ -2183,16 +2284,16 @@ string T}:T{ \ \& T}:T{ -The name of the virtual in\-kernel team network interface +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the team\*(Aqs interface name\&. T} T{ -config +name T}:T{ string T}:T{ -\ \& +team T}:T{ -JSON configuration for the team network interface\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the default configuration is used\&. See man teamd\&.conf for the format details\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} .TE .sp 1 @@ -2201,7 +2302,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&19.\ \&team-port setting +.B Table\ \&20.\ \&team-port setting .TS allbox tab(:); lB lB lB lB. @@ -2218,22 +2319,22 @@ T} l l l l l l l l. T{ -name +config T}:T{ string T}:T{ -team\-port +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The JSON configuration for the team port\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the default configuration is used\&. See man teamd\&.conf for the format details\&. T} T{ -config +name T}:T{ string T}:T{ -\ \& +team\-port T}:T{ -JSON configuration for the team port\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the dafault configuration is used\&. See man teamd\&.conf for the format details\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} .TE .sp 1 @@ -2242,7 +2343,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&20.\ \&vlan setting +.B Table\ \&21.\ \&vlan setting .TS allbox tab(:); lB lB lB lB. @@ -2264,67 +2365,67 @@ l l l l l l l l l l l l. T{ -name +egress\-priority\-map T}:T{ -string +array of string T}:T{ -vlan +[] T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +For outgoing packets, a list of mappings from Linux SKB priorities to 802\&.1p priorities\&. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3"\&. T} T{ -interface\-name +flags T}:T{ -string +NMVlanFlags (uint32) T}:T{ \ \& T}:T{ -If given, specifies the kernel name of the VLAN interface\&. If not given, a default name will be constructed from the interface described by the parent interface and the \*(Aqid\*(Aq property, ex \*(Aqeth2\&.1\*(Aq\&. The parent interface may be given by the \*(Aqparent\*(Aq property or by the \*(Aqmac\-address\*(Aq property of a \*(Aqwired\*(Aq setting\&. +One or more flags which control the behavior and features of the VLAN interface\&. Flags include NM_VLAN_FLAG_REORDER_HEADERS (0x1) (reordering of output packet headers), NM_VLAN_FLAG_GVRP (0x2) (use of the GVRP protocol), and NM_VLAN_FLAG_LOOSE_BINDING (0x4) (loose binding of the interface to its master device\*(Aqs operating state)\&. T} T{ -parent +id T}:T{ -string +uint32 T}:T{ -\ \& +0 T}:T{ -If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created\&. If this property is not specified, the connection must contain a \*(Aqwired\*(Aq setting with a \*(Aqmac\-address\*(Aq property\&. +The VLAN identifier that the interface created by this connection should be assigned\&. T} T{ -id +ingress\-priority\-map T}:T{ -uint32 +array of string T}:T{ -0 +[] T}:T{ -The VLAN indentifier the interface created by this connection should be assigned\&. +For incoming packets, a list of mappings from 802\&.1p priorities to Linux SKB priorities\&. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3"\&. T} T{ -flags +interface\-name T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -One or more flags which control the behavior and features of the VLAN interface\&. Flags include reordering of output packet headers (0x01), use of the GVRP protocol (0x02), and loose binding of the interface to its master device\*(Aqs operating state (0x04)\&. +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the vlan\*(Aqs interface name\&. T} T{ -ingress\-priority\-map +name T}:T{ -array of string +string T}:T{ -\ \& +vlan T}:T{ -For incoming packets, a list of mappings from 802\&.1p priorities to Linux SKB priorities\&. The mapping is given in the format \*(Aqfrom:to\*(Aq where both \*(Aqfrom\*(Aq and \*(Aqto\*(Aq are unsigned integers, ie \*(Aq7:3\*(Aq\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -egress\-priority\-map +parent T}:T{ -array of string +string T}:T{ \ \& T}:T{ -For outgoing packets, a list of mappings from Linux SKB priorities to 802\&.1p priorities\&. The mapping is given in the format \*(Aqfrom:to\*(Aq where both \*(Aqfrom\*(Aq and \*(Aqto\*(Aq are unsigned integers, ie \*(Aq7:3\*(Aq\&. +If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created\&. If this property is not specified, the connection must contain an "802\-3\-ethernet" setting with a "mac\-address" property\&. T} .TE .sp 1 @@ -2333,7 +2434,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&21.\ \&vpn setting +.B Table\ \&22.\ \&vpn setting .TS allbox tab(:); lB lB lB lB. @@ -2351,51 +2452,61 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ +data +T}:T{ +dict of string to string +T}:T{ +\ \& +T}:T{ +Dictionary of key/value pairs of VPN plugin specific data\&. Both keys and values must be strings\&. +T} +T{ name T}:T{ string T}:T{ vpn T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -service\-type +persistent T}:T{ -string +boolean T}:T{ -\ \& +FALSE T}:T{ -D\-Bus service name of the VPN plugin that this setting uses to connect to its network\&. i\&.e\&. org\&.freedesktop\&.NetworkManager\&.vpnc for the vpnc plugin\&. +If the VPN service supports persistence, and this property is TRUE, the VPN will attempt to stay connected across link changes and outages, until explicitly disconnected\&. T} T{ -user\-name +secrets T}:T{ -string +dict of string to string T}:T{ \ \& T}:T{ -If the VPN connection requires a user name for authentication, that name should be provided here\&. If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty\&. If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection\&. +Dictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys\&. Both keys and values must be strings\&. T} T{ -data +service\-type T}:T{ -dict of (string::string) +string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of VPN plugin specific data\&. Both keys and values must be strings\&. +D\-Bus service name of the VPN plugin that this setting uses to connect to its network\&. i\&.e\&. org\&.freedesktop\&.NetworkManager\&.vpnc for the vpnc plugin\&. T} T{ -secrets +user\-name T}:T{ -dict of (string::string) +string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys\&. Both keys and values must be strings\&. +If the VPN connection requires a user name for authentication, that name should be provided here\&. If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty\&. If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection\&. T} .TE .sp 1 @@ -2404,7 +2515,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&22.\ \&wimax setting +.B Table\ \&23.\ \&wimax setting .TS allbox tab(:); lB lB lB lB. @@ -2422,13 +2533,22 @@ l l l l l l l l l l l l. T{ +mac\-address +T}:T{ +byte array +T}:T{ +\ \& +T}:T{ +If specified, this connection will only apply to the WiMAX device whose MAC address matches\&. This property does not change the MAC address of the device (known as MAC spoofing)\&. +T} +T{ name T}:T{ string T}:T{ wimax T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ network\-name @@ -2439,15 +2559,6 @@ T}:T{ T}:T{ Network Service Provider (NSP) name of the WiMAX network this connection should use\&. T} -T{ -mac\-address -T}:T{ -byte array -T}:T{ -[] -T}:T{ -If specified, this connection will only apply to the WiMAX device whose MAC address matches\&. This property does not change the MAC address of the device (known as MAC spoofing)\&. -T} .TE .sp 1 .sp @@ -2455,7 +2566,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&23.\ \&802-3-ethernet setting +.B Table\ \&24.\ \&802-3-ethernet setting .TS allbox tab(:); lB lB lB lB. @@ -2482,31 +2593,22 @@ l l l l l l l l l l l l. T{ -name +auto\-negotiate T}:T{ -string +boolean T}:T{ -802\-3\-ethernet +TRUE T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +If TRUE, allow auto\-negotiation of port speed and duplex mode\&. If FALSE, do not allow auto\-negotiation, in which case the "speed" and "duplex" properties should be set\&. T} T{ -port +cloned\-mac\-address T}:T{ -string +byte array T}:T{ \ \& T}:T{ -Specific port type to use if multiple the device supports multiple attachment methods\&. One of \*(Aqtp\*(Aq (Twisted Pair), \*(Aqaui\*(Aq (Attachment Unit Interface), \*(Aqbnc\*(Aq (Thin Ethernet) or \*(Aqmii\*(Aq (Media Independent Interface\&. If the device supports only one port type, this setting is ignored\&. -T} -T{ -speed -T}:T{ -uint32 -T}:T{ -0 -T}:T{ -If non\-zero, request that the device use only the specified speed\&. In Mbit/s, ie 100 == 100Mbit/s\&. +If specified, request that the device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. T} T{ duplex @@ -2515,41 +2617,23 @@ string T}:T{ \ \& T}:T{ -If specified, request that the device only use the specified duplex mode\&. Either \*(Aqhalf\*(Aq or \*(Aqfull\*(Aq\&. -T} -T{ -auto\-negotiate -T}:T{ -boolean -T}:T{ -TRUE -T}:T{ -If TRUE, allow auto\-negotiation of port speed and duplex mode\&. If FALSE, do not allow auto\-negotiation,in which case the \*(Aqspeed\*(Aq and \*(Aqduplex\*(Aq properties should be set\&. +If specified, request that the device only use the specified duplex mode\&. Either "half" or "full"\&. T} T{ mac\-address T}:T{ byte array T}:T{ -[] -T}:T{ -If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. -T} -T{ -cloned\-mac\-address -T}:T{ -byte array -T}:T{ -[] +\ \& T}:T{ -If specified, request that the device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. +If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. T} T{ mac\-address\-blacklist T}:T{ array of string T}:T{ -\ \& +[] T}:T{ If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list\&. Each MAC address is in the standard hex\-digits\-and\-colons notation (00:11:22:33:44:55)\&. T} @@ -2563,13 +2647,22 @@ T}:T{ If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames\&. T} T{ -s390\-subchannels +name T}:T{ -array of string +string +T}:T{ +802\-3\-ethernet +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +T{ +port +T}:T{ +string T}:T{ \ \& T}:T{ -Identifies specific subchannels that this network device uses for communcation with z/VM or s390 host\&. Like the \*(Aqmac\-address\*(Aq property for non\-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels\&. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (\&.) character\&. +Specific port type to use if multiple the device supports multiple attachment methods\&. One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface\&. If the device supports only one port type, this setting is ignored\&. T} T{ s390\-nettype @@ -2578,16 +2671,34 @@ string T}:T{ \ \& T}:T{ -s390 network device type; one of \*(Aqqeth\*(Aq, \*(Aqlcs\*(Aq, or \*(Aqctc\*(Aq, representing the different types of virtual network devices available on s390 systems\&. +s390 network device type; one of "qeth", "lcs", or "ctc", representing the different types of virtual network devices available on s390 systems\&. T} T{ s390\-options T}:T{ -dict of (string::string) +dict of string to string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of s390\-specific device options\&. Both keys and values must be strings\&. Allowed keys include \*(Aqportno\*(Aq, \*(Aqlayer2\*(Aq, \*(Aqportname\*(Aq, \*(Aqprotocol\*(Aq, among others\&. +Dictionary of key/value pairs of s390\-specific device options\&. Both keys and values must be strings\&. Allowed keys include "portno", "layer2", "portname", "protocol", among others\&. Key names must contain only alphanumeric characters (ie, [a\-zA\-Z0\-9])\&. +T} +T{ +s390\-subchannels +T}:T{ +array of string +T}:T{ +[] +T}:T{ +Identifies specific subchannels that this network device uses for communication with z/VM or s390 host\&. Like the "mac\-address" property for non\-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels\&. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (\&.) character\&. +T} +T{ +speed +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +If non\-zero, request that the device use only the specified speed\&. In Mbit/s, ie 100 == 100Mbit/s\&. T} .TE .sp 1 @@ -2596,7 +2707,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&24.\ \&802-11-wireless setting +.B Table\ \&25.\ \&802-11-wireless setting .TS allbox tab(:); lB lB lB lB. @@ -2626,139 +2737,139 @@ l l l l l l l l l l l l. T{ -name +band T}:T{ string T}:T{ -802\-11\-wireless +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +802\&.11 frequency band of the network\&. One of "a" for 5GHz 802\&.11a or "bg" for 2\&.4GHz 802\&.11\&. This will lock associations to the Wi\-Fi network to the specific band, i\&.e\&. if "a" is specified, the device will not associate with the same network in the 2\&.4GHz band even if the network\*(Aqs settings are compatible\&. This setting depends on specific driver capability and may not work with all drivers\&. T} T{ -ssid +bssid T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -SSID of the Wi\-Fi network\&. Must be specified\&. +If specified, directs the device to only associate with the given access point\&. This capability is highly driver dependent and not supported by all devices\&. Note: this property does not control the BSSID used when creating an Ad\-Hoc network and is unlikely to in the future\&. T} T{ -mode +channel T}:T{ -string +uint32 T}:T{ -\ \& +0 T}:T{ -Wi\-Fi network mode; one of \*(Aqinfrastructure\*(Aq, \*(Aqadhoc\*(Aq or \*(Aqap\*(Aq\&. If blank, infrastructure is assumed\&. +Wireless channel to use for the Wi\-Fi connection\&. The device will only join (or create for Ad\-Hoc networks) a Wi\-Fi network on the specified channel\&. Because channel numbers overlap between bands, this property also requires the "band" property to be set\&. T} T{ -band +cloned\-mac\-address T}:T{ -string +byte array T}:T{ \ \& T}:T{ -802\&.11 frequency band of the network\&. One of \*(Aqa\*(Aq for 5GHz 802\&.11a or \*(Aqbg\*(Aq for 2\&.4GHz 802\&.11\&. This will lock associations to the Wi\-Fi network to the specific band, i\&.e\&. if \*(Aqa\*(Aq is specified, the device will not associate with the same network in the 2\&.4GHz band even if the network\*(Aqs settings are compatible\&. This setting depends on specific driver capability and may not work with all drivers\&. +If specified, request that the Wi\-Fi device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. T} T{ -channel +hidden T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -Wireless channel to use for the Wi\-Fi connection\&. The device will only join (or create for Ad\-Hoc networks) a Wi\-Fi network on the specified channel\&. Because channel numbers overlap between bands, this property also requires the \*(Aqband\*(Aq property to be set\&. +If TRUE, indicates this network is a non\-broadcasting network that hides its SSID\&. In this case various workarounds may take place, such as probe\-scanning the SSID for more reliable network discovery\&. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution\&. T} T{ -bssid +mac\-address T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -If specified, directs the device to only associate with the given access point\&. This capability is highly driver dependent and not supported by all devices\&. Note: this property does not control the BSSID used when creating an Ad\-Hoc network and is unlikely to in the future\&. +If specified, this connection will only apply to the Wi\-Fi device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. T} T{ -rate +mac\-address\-blacklist T}:T{ -uint32 +array of string T}:T{ -0 +[] T}:T{ -If non\-zero, directs the device to only use the specified bitrate for communication with the access point\&. Units are in Kb/s, ie 5500 = 5\&.5 Mbit/s\&. This property is highly driver dependent and not all devices support setting a static bitrate\&. +A list of permanent MAC addresses of Wi\-Fi devices to which this connection should never apply\&. Each MAC address should be given in the standard hex\-digits\-and\-colons notation (eg "00:11:22:33:44:55")\&. T} T{ -tx\-power +mode T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -If non\-zero, directs the device to use the specified transmit power\&. Units are dBm\&. This property is highly driver dependent and not all devices support setting a static transmit power\&. +Wi\-Fi network mode; one of "infrastructure", "adhoc" or "ap"\&. If blank, infrastructure is assumed\&. T} T{ -mac\-address +mtu T}:T{ -byte array +uint32 T}:T{ -[] +0 T}:T{ -If specified, this connection will only apply to the Wi\-Fi device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. +If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames\&. T} T{ -cloned\-mac\-address +name T}:T{ -byte array +string T}:T{ -[] +802\-11\-wireless T}:T{ -If specified, request that the Wi\-Fi device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -mac\-address\-blacklist +rate T}:T{ -array of string +uint32 T}:T{ -\ \& +0 T}:T{ -A list of permanent MAC addresses of Wi\-Fi devices to which this connection should never apply\&. Each MAC address should be given in the standard hex\-digits\-and\-colons notation (eg \*(Aq00:11:22:33:44:55\*(Aq)\&. +If non\-zero, directs the device to only use the specified bitrate for communication with the access point\&. Units are in Kb/s, ie 5500 = 5\&.5 Mbit/s\&. This property is highly driver dependent and not all devices support setting a static bitrate\&. T} T{ -mtu +security T}:T{ -uint32 +None T}:T{ -0 +\ \& T}:T{ -If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames\&. +This property is deprecated, but can be set to the value \*(Aq802\-11\-wireless\-security\*(Aq when a wireless security setting is also present in the connection dictionary, for compatibility with very old NetworkManager daemons\&. T} T{ seen\-bssids T}:T{ array of string T}:T{ -\ \& +[] T}:T{ -A list of BSSIDs (each BSSID formatted as a MAC address like 00:11:22:33:44:55\*(Aq) that have been detected as part of the Wi\-Fi network\&. NetworkManager internally tracks previously seen BSSIDs\&. The property is only meant for reading and reflects the BSSID list of NetworkManager\&. The changes you make to this property will not be preserved\&. +A list of BSSIDs (each BSSID formatted as a MAC address like "00:11:22:33:44:55") that have been detected as part of the Wi\-Fi network\&. NetworkManager internally tracks previously seen BSSIDs\&. The property is only meant for reading and reflects the BSSID list of NetworkManager\&. The changes you make to this property will not be preserved\&. T} T{ -security +ssid T}:T{ -string +byte array T}:T{ \ \& T}:T{ -If the wireless connection has any security restrictions, like 802\&.1x, WEP, or WPA, set this property to \*(Aq802\-11\-wireless\-security\*(Aq and ensure the connection contains a valid 802\-11\-wireless\-security setting\&. +SSID of the Wi\-Fi network\&. Must be specified\&. T} T{ -hidden +tx\-power T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, indicates this network is a non\-broadcasting network that hides its SSID\&. In this case various workarounds may take place, such as probe\-scanning the SSID for more reliable network discovery\&. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution\&. +If non\-zero, directs the device to use the specified transmit power\&. Units are dBm\&. This property is highly driver dependent and not all devices support setting a static transmit power\&. T} .TE .sp 1 @@ -2767,7 +2878,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&25.\ \&802-11-wireless-security setting +.B Table\ \&26.\ \&802-11-wireless-security setting .TS allbox tab(:); lB lB lB lB. @@ -2800,166 +2911,166 @@ l l l l l l l l l l l l. T{ -name +auth\-alg T}:T{ string T}:T{ -802\-11\-wireless\-security +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +When WEP is used (ie, key\-mgmt = "none" or "ieee8021x") indicate the 802\&.11 authentication algorithm required by the AP here\&. One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP\&. When using Cisco LEAP (ie, key\-mgmt = "ieee8021x" and auth\-alg = "leap") the "leap\-username" and "leap\-password" properties must be specified\&. T} T{ -key\-mgmt +group T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -Key management used for the connection\&. One of \*(Aqnone\*(Aq (WEP), \*(Aqieee8021x\*(Aq (Dynamic WEP), \*(Aqwpa\-none\*(Aq (WPA\-PSK Ad\-Hoc), \*(Aqwpa\-psk\*(Aq (infrastructure WPA\-PSK), or \*(Aqwpa\-eap\*(Aq (WPA\-Enterprise)\&. This property must be set for any Wi\-Fi connection that uses security\&. +A list of group/broadcast encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of "wep40", "wep104", "tkip", or "ccmp"\&. T} T{ -wep\-tx\-keyidx +key\-mgmt T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -When static WEP is used (ie, key\-mgmt = \*(Aqnone\*(Aq) and a non\-default WEP key index is used by the AP, put that WEP key index here\&. Valid values are 0 (default key) through 3\&. Note that some consumer access points (like the Linksys WRT54G) number the keys 1 \- 4\&. +Key management used for the connection\&. One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa\-none" (Ad\-Hoc WPA\-PSK), "wpa\-psk" (infrastructure WPA\-PSK), or "wpa\-eap" (WPA\-Enterprise)\&. This property must be set for any Wi\-Fi connection that uses security\&. T} T{ -auth\-alg +leap\-password T}:T{ string T}:T{ \ \& T}:T{ -When WEP is used (ie, key\-mgmt = \*(Aqnone\*(Aq or \*(Aqieee8021x\*(Aq) indicate the 802\&.11 authentication algorithm required by the AP here\&. One of \*(Aqopen\*(Aq for Open System, \*(Aqshared\*(Aq for Shared Key, or \*(Aqleap\*(Aq for Cisco LEAP\&. When using Cisco LEAP (ie, key\-mgmt = \*(Aqieee8021x\*(Aq and auth\-alg = \*(Aqleap\*(Aq) the \*(Aqleap\-username\*(Aq and \*(Aqleap\-password\*(Aq properties must be specified\&. +The login password for legacy LEAP connections (ie, key\-mgmt = "ieee8021x" and auth\-alg = "leap")\&. T} T{ -proto +leap\-password\-flags T}:T{ -array of string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -List of strings specifying the allowed WPA protocol versions to use\&. Each element may be one \*(Aqwpa\*(Aq (allow WPA) or \*(Aqrsn\*(Aq (allow WPA2/RSN)\&. If not specified, both WPA and RSN connections are allowed\&. +Flags indicating how to handle the "leap\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -pairwise +leap\-username T}:T{ -array of string +string T}:T{ \ \& T}:T{ -A list of pairwise encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of \*(Aqtkip\*(Aq or \*(Aqccmp\*(Aq\&. +The login username for legacy LEAP connections (ie, key\-mgmt = "ieee8021x" and auth\-alg = "leap")\&. T} T{ -group +name T}:T{ -array of string +string T}:T{ -\ \& +802\-11\-wireless\-security T}:T{ -A list of group/broadcast encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of \*(Aqwep40\*(Aq, \*(Aqwep104\*(Aq, \*(Aqtkip\*(Aq, or \*(Aqccmp\*(Aq\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -leap\-username +pairwise T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -The login username for legacy LEAP connections (ie, key\-mgmt = \*(Aqieee8021x\*(Aq and auth\-alg = \*(Aqleap\*(Aq)\&. +A list of pairwise encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of "tkip" or "ccmp"\&. T} T{ -wep\-key0 +proto T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -Index 0 WEP key\&. This is the WEP key used in most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +List of strings specifying the allowed WPA protocol versions to use\&. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN)\&. If not specified, both WPA and RSN connections are allowed\&. T} T{ -wep\-key1 +psk T}:T{ string T}:T{ \ \& T}:T{ -Index 1 WEP key\&. This WEP index is not used by most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +Pre\-Shared\-Key for WPA networks\&. If the key is 64\-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key\&. Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802\&.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA\-PSK used when connecting to the Wi\-Fi network\&. T} T{ -wep\-key2 +psk\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Index 2 WEP key\&. This WEP index is not used by most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +Flags indicating how to handle the "psk" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -wep\-key3 +wep\-key\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Index 3 WEP key\&. This WEP index is not used by most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +Flags indicating how to handle the "wep\-key0", "wep\-key1", "wep\-key2", and "wep\-key3" properties\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -wep\-key\-flags +wep\-key\-type T}:T{ -uint32 +NMWepKeyType (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the WEP keys\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Controls the interpretation of WEP keys\&. Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10\- or 26\-character hexadecimal string, or a 5\- or 13\-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de\-facto MD5 method to derive the actual WEP key\&. T} T{ -wep\-key\-type +wep\-key0 T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Controls the interpretation of WEP keys\&. Allowed values are 1 (interpret WEP keys as hexadecimal or ASCII keys) or 2 (interpret WEP keys as WEP Passphrases)\&. If set to 1 and the keys are hexadecimal, they must be either 10 or 26 characters in length\&. If set to 1 and the keys are ASCII keys, they must be either 5 or 13 characters in length\&. If set to 2, the passphrase is hashed using the de\-facto MD5 method to derive the actual WEP key\&. +Index 0 WEP key\&. This is the WEP key used in most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -psk +wep\-key1 T}:T{ string T}:T{ \ \& T}:T{ -Pre\-Shared\-Key for WPA networks\&. If the key is 64\-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key\&. Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802\&.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA\-PSK used when connecting to the Wi\-Fi network\&. +Index 1 WEP key\&. This WEP index is not used by most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -psk\-flags +wep\-key2 T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the WPA PSK key\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Index 2 WEP key\&. This WEP index is not used by most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -leap\-password +wep\-key3 T}:T{ string T}:T{ \ \& T}:T{ -The login password for legacy LEAP connections (ie, key\-mgmt = \*(Aqieee8021x\*(Aq and auth\-alg = \*(Aqleap\*(Aq)\&. +Index 3 WEP key\&. This WEP index is not used by most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -leap\-password\-flags +wep\-tx\-keyidx T}:T{ uint32 T}:T{ 0 T}:T{ -Flags indicating how to handle the LEAP password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +When static WEP is used (ie, key\-mgmt = "none") and a non\-default WEP key index is used by the AP, put that WEP key index here\&. Valid values are 0 (default key) through 3\&. Note that some consumer access points (like the Linksys WRT54G) number the keys 1 \- 4\&. T} .TE .sp 1 @@ -3024,6 +3135,6 @@ NetworkManager developers or distro plugin\-specific location .SH "SEE ALSO" .PP -https://live\&.gnome\&.org/NetworkManagerConfiguration +https://wiki\&.gnome\&.org/Projects/NetworkManager/ConfigurationSpecification .PP NetworkManager(8), nmcli(1), nmcli\-examples(5), NetworkManager\&.conf(5) diff --git a/man/nm-settings.xml b/man/nm-settings.xml new file mode 100644 index 00000000..7c3dd96a --- /dev/null +++ b/man/nm-settings.xml @@ -0,0 +1,343 @@ + + +19 December 2014nm-settings5NetworkManagerConfiguration1.0.0nm-settingsDescription of settings and properties of NetworkManager connection profilesDESCRIPTION + NetworkManager is based on a concept of connection profiles, sometimes referred to as + connections only. These connection profiles contain a network configuration. When + NetworkManager activates a connection profile on a network device the configuration will + be applied and an active network connection will be established. Users are free to create + as many connection profiles as they see fit. Thus they are flexible in having various network + configurations for different networking needs. The connection profiles are handled by + NetworkManager via settings service and are exported on D-Bus + (/org/freedesktop/NetworkManager/Settings/<num> objects). + The conceptual objects can be described as follows: + Connection (profile) + A specific, encapsulated, independent group of settings describing + all the configuration required to connect to a specific network. + It is referred to by a unique identifier called the UUID. A connection + is tied to a one specific device type, but not necessarily a specific + hardware device. It is composed of one or more Settings + objects. + Setting + A group of related key/value pairs describing a specific piece of a + Connection (profile). Settings keys and allowed values are + described in the tables below. Keys are also reffered to as properties. + Developers can find the setting objects and their properties in the libnm-util + sources. Look for the class_init functions near the bottom of + each setting source file. + + The settings and properties shown in tables below list all available connection + configuration options. However, note that not all settings are applicable to all + connection types. NetworkManager provides a command-line tool nmcli + that allows direct configuration of the settings and properties according to a connection + profile type. nmcli connection editor has also a built-in + describe command that can display description of particular settings + and properties of this page. + + 802-1x settingKey NameValue TypeDefault ValueValue Description + altsubject-matchesarray of string[]List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed. + anonymous-identitystringAnonymous identity string for EAP authentication methods. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS. + ca-certbyte arrayContains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. + ca-pathstringUTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property. + client-certbyte arrayContains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. + eaparray of string[]The allowed EAP method to be used when authenticating to the network with 802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast". Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations. + identitystringIdentity string for EAP authentication methods. Often the user's user or login name. + namestring802-1xThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + pac-filestringUTF-8 encoded file path containing PAC for EAP-FAST. + passwordstringUTF-8 encoded password used for EAP authentication methods. If both the "password" property and the "password-raw" property are specified, "password" is preferred. + password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "password" property. (see for flag values) + password-rawbyte arrayPassword used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF-8 to be used. If both the "password" property and the "password-raw" property are specified, "password" is preferred. + password-raw-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "password-raw" property. (see for flag values) + phase1-fast-provisioningstringEnables or disables in-line provisioning of EAP-FAST credentials when FAST is specified as the EAP method in the "eap" property. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning). See the wpa_supplicant documentation for more details. + phase1-peaplabelstringForces use of the new PEAP label during key derivation. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1. Set to "1" to force use of the new PEAP label. See the wpa_supplicant documentation for more details. + phase1-peapverstringForces which PEAP version is used when PEAP is set as the EAP method in the "eap" property. When unset, the version reported by the server will be used. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version. To do so, this property may be set to "0" or "1" to force that specific PEAP version. + phase2-altsubject-matchesarray of string[]List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed. + phase2-authstringSpecifies the allowed "phase 2" inner non-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized non-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details. + phase2-autheapstringSpecifies the allowed "phase 2" inner EAP-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized EAP-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details. + phase2-ca-certbyte arrayContains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. + phase2-ca-pathstringUTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property. + phase2-client-certbyte arrayContains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. + phase2-private-keybyte arrayContains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. + phase2-private-key-passwordstringThe password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key. + phase2-private-key-password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "phase2-private-key-password" property. (see for flag values) + phase2-subject-matchstringSubstring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication. When unset, no verification of the authentication server certificate's subject is performed. + pinstringPIN used for EAP authentication methods. + pin-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "pin" property. (see for flag values) + private-keybyte arrayContains the private key when the "eap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data. + private-key-passwordstringThe password used to decrypt the private key specified in the "private-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key. + private-key-password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "private-key-password" property. (see for flag values) + subject-matchstringSubstring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed. + system-ca-certsbooleanFALSEWhen TRUE, overrides the "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch. The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca-cert" and "phase2-ca-cert" properties. +
+ adsl settingKey NameValue TypeDefault ValueValue Description + encapsulationstringEncapsulation of ADSL connection. Can be "vcmux" or "llc". + namestringadslThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + passwordstringPassword used to authenticate with the ADSL service. + password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "password" property. (see for flag values) + protocolstringADSL connection protocol. Can be "pppoa", "pppoe" or "ipoatm". + usernamestringUsername used to authenticate with the ADSL service. + vciuint320VCI of ADSL connection + vpiuint320VPI of ADSL connection +
+ bluetooth settingKey NameValue TypeDefault ValueValue Description + bdaddrbyte arrayThe Bluetooth address of the device. + namestringbluetoothThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + typestringEither "dun" for Dial-Up Networking connections or "panu" for Personal Area Networking connections to devices supporting the NAP profile. +
+ bond settingKey NameValue TypeDefault ValueValue Description + interface-namestringDeprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bond's interface name. + namestringbondThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + optionsdict of string to stringDictionary of key/value pairs of bonding options. Both keys and values must be strings. Option names must contain only alphanumeric characters (ie, [a-zA-Z0-9]). +
+ bridge settingKey NameValue TypeDefault ValueValue Description + ageing-timeuint32300The Ethernet MAC address aging time, in seconds. + forward-delayuint3215The Spanning Tree Protocol (STP) forwarding delay, in seconds. + hello-timeuint322The Spanning Tree Protocol (STP) hello time, in seconds. + interface-namestringDeprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bridge's interface name. + mac-addressbyte arrayIf specified, the MAC address of bridge. When creating a new bridge, this MAC address will be set. When matching an existing (outside NetworkManager created) bridge, this MAC address must match. + max-ageuint3220The Spanning Tree Protocol (STP) maximum message age, in seconds. + namestringbridgeThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + priorityuint3232768Sets the Spanning Tree Protocol (STP) priority for this bridge. Lower values are "better"; the lowest priority bridge will be elected the root bridge. + stpbooleanTRUEControls whether Spanning Tree Protocol (STP) is enabled for this bridge. +
+ bridge-port settingKey NameValue TypeDefault ValueValue Description + hairpin-modebooleanFALSEEnables or disabled "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on. + namestringbridge-portThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + path-costuint32100The Spanning Tree Protocol (STP) port cost for destinations via this port. + priorityuint3232The Spanning Tree Protocol (STP) priority of this bridge port. +
+ cdma settingKey NameValue TypeDefault ValueValue Description + namestringcdmaThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + numberstringThe number to dial to establish the connection to the CDMA-based mobile broadband network, if any. If not specified, the default number (#777) is used when required. + passwordstringThe password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here. + password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "password" property. (see for flag values) + usernamestringThe username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here. +
+ connection settingKey NameValue TypeDefault ValueValue Description + autoconnectbooleanTRUEWhether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection. + autoconnect-priorityint320The autoconnect priority. If the connection is set to autoconnect, connections with higher priority will be preferred. Defaults to 0. The higher number means higher priority. + gateway-ping-timeoutuint320If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping. + idstringA human readable unique identifier for the connection, like "Work Wi-Fi" or "T-Mobile 3G". + interface-namestringThe name of the network interface this connection is bound to. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings). For software devices this specifies the name of the created device. For connection types where interface names cannot easily be made persistent (e.g. mobile broadband or USB Ethernet), this property should not be used. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface. + masterstringInterface name of the master device or UUID of the master connection. + namestringconnectionThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + permissionsarray of string[]An array of strings defining what access a given user has to this connection. If this is NULL or empty, all users are allowed to access this connection. Otherwise a user is allowed to access this connection if and only if they are in this list. Each entry is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah". At this time only the "user" [type] is allowed. Any other values are ignored and reserved for future use. [id] is the username that this permission refers to, which may not contain the ":" character. Any [reserved] information present must be ignored and is reserved for future use. All of [type], [id], and [reserved] must be valid UTF-8. + read-onlybooleanFALSEFALSE if the connection can be modified using the provided settings service's D-Bus interface with the right privileges, or TRUE if the connection is read-only and cannot be modified. + secondariesarray of string[]List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported. + slave-typestringSetting name of the device type of this slave's master connection (eg, "bond"), or NULL if this connection is not a slave. + timestampuint640The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved). + typestringBase type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc). + uuidstringA universally unique identifier for the connection, for example generated with libuuid. It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network. For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re-created when the Wi-Fi SSID, mobile broadband network provider, or "type" property changes. The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664" (ie, contains only hexadecimal characters and "-"). + zonestringThe trust level of a the connection. Free form case-insensitive string (for example "Home", "Work", "Public"). NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall. +
+ dcb settingKey NameValue TypeDefault ValueValue Description + app-fcoe-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB FCoE application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4). + app-fcoe-modestring"fabric"The FCoE controller mode; either "fabric" (default) or "vn2vn". + app-fcoe-priorityint32-1The highest User Priority (0 - 7) which FCoE frames should use, or -1 for default priority. Only used when the "app-fcoe-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag. + app-fip-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB FIP application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4). + app-fip-priorityint32-1The highest User Priority (0 - 7) which FIP frames should use, or -1 for default priority. Only used when the "app-fip-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag. + app-iscsi-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB iSCSI application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4). + app-iscsi-priorityint32-1The highest User Priority (0 - 7) which iSCSI frames should use, or -1 for default priority. Only used when the "app-iscsi-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag. + namestringdcbThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + priority-bandwidtharray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the percentage of bandwidth of the priority's assigned group that the priority may use. The sum of all percentages for priorities which belong to the same group must total 100 percent. + priority-flow-controlarray of uint32An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the corresponding priority should transmit priority pause. + priority-flow-control-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC). Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4). + priority-group-bandwidtharray of uint32An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 - 7) and the value indicates the percentage of link bandwidth allocated to that group. Allowed values are 0 - 100, and the sum of all values must total 100 percent. + priority-group-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for DCB Priority Groups. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4). + priority-group-idarray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID. Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group. + priority-strict-bandwidtharray of uint32An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group. + priority-traffic-classarray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped. +
+ generic settingKey NameValue TypeDefault ValueValue Description + namestringgenericThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". +
+ gsm settingKey NameValue TypeDefault ValueValue Description + apnstringThe GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9. + home-onlybooleanFALSEWhen TRUE, only connections to the home network will be allowed. Connections to roaming networks will not be made. + namestringgsmThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + network-idstringThe Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration. If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible. + numberstringNumber to dial when establishing a PPP data session with the GSM-based mobile broadband network. Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically. + passwordstringThe password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here. + password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "password" property. (see for flag values) + pinstringIf the SIM is locked with a PIN it must be unlocked before any other operations are requested. Specify the PIN here to allow operation of the device. + pin-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "pin" property. (see for flag values) + usernamestringThe username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here. +
+ infiniband settingKey NameValue TypeDefault ValueValue Description + mac-addressbyte arrayIf specified, this connection will only apply to the IPoIB device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing). + mtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames. + namestringinfinibandThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + p-keyint32-1The InfiniBand P_Key to use for this device. A value of -1 means to use the default P_Key (aka "the P_Key at index 0"). Otherwise it is a 16-bit unsigned integer, whose high bit is set if it is a "full membership" P_Key. + parentstringThe interface name of the parent device of this device. Normally NULL, but if the "p_key" property is set, then you must specify the base device by setting either this property or "mac-address". + transport-modestringThe IP-over-InfiniBand transport mode. Either "datagram" or "connected". +
+ ipv4 settingKey NameValue TypeDefault ValueValue Description + address-dataarray of vardictArray of IPv4 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses. + addressesarray of array of uint32Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'. Array of IPv4 address structures. Each IPv4 address structure is composed of 3 32-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 - 32), and last the IPv4 gateway (network byte order). The gateway may be left as 0 if no gateway exists for that subnet. + dhcp-client-idstringA string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options. + dhcp-hostnamestringIf the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. + dhcp-send-hostnamebooleanTRUEIf TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer. If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent. + dnsarray of uint32[]Array of IP addresses of DNS servers (as network-byte-order integers) + dns-searcharray of string[]Array of DNS search domains. + gatewaystringThe gateway associated with this configuration. This is only meaningful if "addresses" is also set. + ignore-auto-dnsbooleanFALSEWhen "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used. + ignore-auto-routesbooleanFALSEWhen "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used. + may-failbooleanTRUEIf TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out. Note that at least one IP configuration must succeed or overall network configuration will still fail. For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully. + methodstringIP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration. The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty. + namestringipv4The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + never-defaultbooleanFALSEIf TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager. + route-dataarray of vardictArray of IPv4 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'gateway' entry, containing the gateway IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes. + route-metricint64-1The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric. + routesarray of array of uint32Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'. Array of IPv4 route structures. Each IPv4 route structure is composed of 4 32-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 - 32), the third being the next-hop (network byte order) if any, and the fourth being the route metric. If the metric is 0, NM will choose an appropriate default metric for the device. (There is no way to explicitly specify an actual metric of 0 with this property.) +
+ ipv6 settingKey NameValue TypeDefault ValueValue Description + address-dataarray of vardictArray of IPv6 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses. + addressesarray of legacy IPv6 address struct (a(ayuay))Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'. Array of IPv6 address structures. Each IPv6 address structure is composed of an IPv6 address, a prefix length (1 - 128), and an IPv6 gateway address. The gateway may be zeroed out if no gateway exists for that subnet. + dhcp-hostnamestringIf the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. + dhcp-send-hostnamebooleanTRUEIf TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer. If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent. + dnsarray of byte array[]Array of IP addresses of DNS servers (in network byte order) + dns-searcharray of string[]Array of DNS search domains. + gatewaystringThe gateway associated with this configuration. This is only meaningful if "addresses" is also set. + ignore-auto-dnsbooleanFALSEWhen "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used. + ignore-auto-routesbooleanFALSEWhen "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used. + ip6-privacyNMSettingIP6ConfigPrivacy (int32)Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64. This enhances privacy, but could cause problems in some applications, on the other hand. The permitted values are: 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). + may-failbooleanTRUEIf TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out. Note that at least one IP configuration must succeed or overall network configuration will still fail. For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully. + methodstringIP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration. The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty. + namestringipv6The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + never-defaultbooleanFALSEIf TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager. + route-dataarray of vardictArray of IPv6 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'next-hop' entry, containing the next hop IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes. + route-metricint64-1The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric. + routesarray of legacy IPv6 route struct (a(ayuayu))Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'. Array of IPv6 route structures. Each IPv6 route structure is composed of an IPv6 address, a prefix length (1 - 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric. If the metric is 0, NM will choose an appropriate default metric for the device. +
+ 802-11-olpc-mesh settingKey NameValue TypeDefault ValueValue Description + channeluint320Channel on which the mesh network to join is located. + dhcp-anycast-addressbyte arrayAnycast DHCP MAC address used when requesting an IP address via DHCP. The specific anycast address used determines which DHCP server class answers the request. + namestring802-11-olpc-meshThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + ssidbyte arraySSID of the mesh network to join. +
+ ppp settingKey NameValue TypeDefault ValueValue Description + bauduint320If non-zero, instruct pppd to set the serial port to the specified baudrate. This value should normally be left as 0 to automatically choose the speed. + crtsctsbooleanFALSEIf TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals. This value should normally be set to FALSE. + lcp-echo-failureuint320If non-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo-requests go unanswered by the peer. The "lcp-echo-interval" property must also be set to a non-zero value if this property is used. + lcp-echo-intervaluint320If non-zero, instruct pppd to send an LCP echo-request frame to the peer every n seconds (where n is the specified value). Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this. + mppe-statefulbooleanFALSEIf TRUE, stateful MPPE is used. See pppd documentation for more information on stateful MPPE. + mruuint320If non-zero, instruct pppd to request that the peer send packets no larger than the specified size. If non-zero, the MRU should be between 128 and 16384. + mtuuint320If non-zero, instruct pppd to send packets no larger than the specified size. + namestringpppThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + no-vj-compbooleanFALSEIf TRUE, Van Jacobsen TCP header compression will not be requested. + noauthbooleanTRUEIf TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client. If FALSE, require authentication from the remote side. In almost all cases, this should be TRUE. + nobsdcompbooleanFALSEIf TRUE, BSD compression will not be requested. + nodeflatebooleanFALSEIf TRUE, "deflate" compression will not be requested. + refuse-chapbooleanFALSEIf TRUE, the CHAP authentication method will not be used. + refuse-eapbooleanFALSEIf TRUE, the EAP authentication method will not be used. + refuse-mschapbooleanFALSEIf TRUE, the MSCHAP authentication method will not be used. + refuse-mschapv2booleanFALSEIf TRUE, the MSCHAPv2 authentication method will not be used. + refuse-papbooleanFALSEIf TRUE, the PAP authentication method will not be used. + require-mppebooleanFALSEIf TRUE, MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session. If either 64-bit or 128-bit MPPE is not available the session will fail. Note that MPPE is not used on mobile broadband connections. + require-mppe-128booleanFALSEIf TRUE, 128-bit MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session, and the "require-mppe" property must also be set to TRUE. If 128-bit MPPE is not available the session will fail. +
+ pppoe settingKey NameValue TypeDefault ValueValue Description + namestringpppoeThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + passwordstringPassword used to authenticate with the PPPoE service. + password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "password" property. (see for flag values) + servicestringIf specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service. For most providers, this should be left blank. It is only required if there are multiple access concentrators or a specific service is known to be required. + usernamestringUsername used to authenticate with the PPPoE service. +
+ serial settingKey NameValue TypeDefault ValueValue Description + bauduint3257600Speed to use for communication over the serial port. Note that this value usually has no effect for mobile broadband modems as they generally ignore speed settings and use the highest available speed. + bitsuint328Byte-width of the serial communication. The 8 in "8n1" for example. + namestringserialThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + paritybyteThe connection parity: 69 (ASCII 'E') for even parity, 111 (ASCII 'o') for odd, 110 (ASCII 'n') for none. + send-delayuint640Time to delay between each byte sent to the modem, in microseconds. + stopbitsuint321Number of stop bits for communication on the serial port. Either 1 or 2. The 1 in "8n1" for example. +
+ team settingKey NameValue TypeDefault ValueValue Description + configstringThe JSON configuration for the team network interface. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details. + interface-namestringDeprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the team's interface name. + namestringteamThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". +
+ team-port settingKey NameValue TypeDefault ValueValue Description + configstringThe JSON configuration for the team port. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details. + namestringteam-portThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". +
+ vlan settingKey NameValue TypeDefault ValueValue Description + egress-priority-maparray of string[]For outgoing packets, a list of mappings from Linux SKB priorities to 802.1p priorities. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3". + flagsNMVlanFlags (uint32)One or more flags which control the behavior and features of the VLAN interface. Flags include NM_VLAN_FLAG_REORDER_HEADERS (0x1) (reordering of output packet headers), NM_VLAN_FLAG_GVRP (0x2) (use of the GVRP protocol), and NM_VLAN_FLAG_LOOSE_BINDING (0x4) (loose binding of the interface to its master device's operating state). + iduint320The VLAN identifier that the interface created by this connection should be assigned. + ingress-priority-maparray of string[]For incoming packets, a list of mappings from 802.1p priorities to Linux SKB priorities. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3". + interface-namestringDeprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the vlan's interface name. + namestringvlanThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + parentstringIf given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created. If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property. +
+ vpn settingKey NameValue TypeDefault ValueValue Description + datadict of string to stringDictionary of key/value pairs of VPN plugin specific data. Both keys and values must be strings. + namestringvpnThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + persistentbooleanFALSEIf the VPN service supports persistence, and this property is TRUE, the VPN will attempt to stay connected across link changes and outages, until explicitly disconnected. + secretsdict of string to stringDictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys. Both keys and values must be strings. + service-typestringD-Bus service name of the VPN plugin that this setting uses to connect to its network. i.e. org.freedesktop.NetworkManager.vpnc for the vpnc plugin. + user-namestringIf the VPN connection requires a user name for authentication, that name should be provided here. If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty. If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection. +
+ wimax settingKey NameValue TypeDefault ValueValue Description + mac-addressbyte arrayIf specified, this connection will only apply to the WiMAX device whose MAC address matches. This property does not change the MAC address of the device (known as MAC spoofing). + namestringwimaxThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + network-namestringNetwork Service Provider (NSP) name of the WiMAX network this connection should use. +
+ 802-3-ethernet settingKey NameValue TypeDefault ValueValue Description + auto-negotiatebooleanTRUEIf TRUE, allow auto-negotiation of port speed and duplex mode. If FALSE, do not allow auto-negotiation, in which case the "speed" and "duplex" properties should be set. + cloned-mac-addressbyte arrayIf specified, request that the device use this MAC address instead of its permanent MAC address. This is known as MAC cloning or spoofing. + duplexstringIf specified, request that the device only use the specified duplex mode. Either "half" or "full". + mac-addressbyte arrayIf specified, this connection will only apply to the Ethernet device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing). + mac-address-blacklistarray of string[]If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list. Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55). + mtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames. + namestring802-3-ethernetThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + portstringSpecific port type to use if multiple the device supports multiple attachment methods. One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface. If the device supports only one port type, this setting is ignored. + s390-nettypestrings390 network device type; one of "qeth", "lcs", or "ctc", representing the different types of virtual network devices available on s390 systems. + s390-optionsdict of string to stringDictionary of key/value pairs of s390-specific device options. Both keys and values must be strings. Allowed keys include "portno", "layer2", "portname", "protocol", among others. Key names must contain only alphanumeric characters (ie, [a-zA-Z0-9]). + s390-subchannelsarray of string[]Identifies specific subchannels that this network device uses for communication with z/VM or s390 host. Like the "mac-address" property for non-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (.) character. + speeduint320If non-zero, request that the device use only the specified speed. In Mbit/s, ie 100 == 100Mbit/s. +
+ 802-11-wireless settingKey NameValue TypeDefault ValueValue Description + bandstring802.11 frequency band of the network. One of "a" for 5GHz 802.11a or "bg" for 2.4GHz 802.11. This will lock associations to the Wi-Fi network to the specific band, i.e. if "a" is specified, the device will not associate with the same network in the 2.4GHz band even if the network's settings are compatible. This setting depends on specific driver capability and may not work with all drivers. + bssidbyte arrayIf specified, directs the device to only associate with the given access point. This capability is highly driver dependent and not supported by all devices. Note: this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future. + channeluint320Wireless channel to use for the Wi-Fi connection. The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel. Because channel numbers overlap between bands, this property also requires the "band" property to be set. + cloned-mac-addressbyte arrayIf specified, request that the Wi-Fi device use this MAC address instead of its permanent MAC address. This is known as MAC cloning or spoofing. + hiddenbooleanFALSEIf TRUE, indicates this network is a non-broadcasting network that hides its SSID. In this case various workarounds may take place, such as probe-scanning the SSID for more reliable network discovery. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution. + mac-addressbyte arrayIf specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing). + mac-address-blacklistarray of string[]A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply. Each MAC address should be given in the standard hex-digits-and-colons notation (eg "00:11:22:33:44:55"). + modestringWi-Fi network mode; one of "infrastructure", "adhoc" or "ap". If blank, infrastructure is assumed. + mtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames. + namestring802-11-wirelessThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + rateuint320If non-zero, directs the device to only use the specified bitrate for communication with the access point. Units are in Kb/s, ie 5500 = 5.5 Mbit/s. This property is highly driver dependent and not all devices support setting a static bitrate. + securityNoneThis property is deprecated, but can be set to the value '802-11-wireless-security' when a wireless security setting is also present in the connection dictionary, for compatibility with very old NetworkManager daemons. + seen-bssidsarray of string[]A list of BSSIDs (each BSSID formatted as a MAC address like "00:11:22:33:44:55") that have been detected as part of the Wi-Fi network. NetworkManager internally tracks previously seen BSSIDs. The property is only meant for reading and reflects the BSSID list of NetworkManager. The changes you make to this property will not be preserved. + ssidbyte arraySSID of the Wi-Fi network. Must be specified. + tx-poweruint320If non-zero, directs the device to use the specified transmit power. Units are dBm. This property is highly driver dependent and not all devices support setting a static transmit power. +
+ 802-11-wireless-security settingKey NameValue TypeDefault ValueValue Description + auth-algstringWhen WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the 802.11 authentication algorithm required by the AP here. One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP. When using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the "leap-username" and "leap-password" properties must be specified. + grouparray of string[]A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty. Each list element may be one of "wep40", "wep104", "tkip", or "ccmp". + key-mgmtstringKey management used for the connection. One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-none" (Ad-Hoc WPA-PSK), "wpa-psk" (infrastructure WPA-PSK), or "wpa-eap" (WPA-Enterprise). This property must be set for any Wi-Fi connection that uses security. + leap-passwordstringThe login password for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap"). + leap-password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "leap-password" property. (see for flag values) + leap-usernamestringThe login username for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap"). + namestring802-11-wireless-securityThe setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired". + pairwisearray of string[]A list of pairwise encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty. Each list element may be one of "tkip" or "ccmp". + protoarray of string[]List of strings specifying the allowed WPA protocol versions to use. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN). If not specified, both WPA and RSN connections are allowed. + pskstringPre-Shared-Key for WPA networks. If the key is 64-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key. Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA-PSK used when connecting to the Wi-Fi network. + psk-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "psk" property. (see for flag values) + wep-key-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "wep-key0", "wep-key1", "wep-key2", and "wep-key3" properties. (see for flag values) + wep-key-typeNMWepKeyType (uint32)Controls the interpretation of WEP keys. Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10- or 26-character hexadecimal string, or a 5- or 13-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de-facto MD5 method to derive the actual WEP key. + wep-key0stringIndex 0 WEP key. This is the WEP key used in most networks. See the "wep-key-type" property for a description of how this key is interpreted. + wep-key1stringIndex 1 WEP key. This WEP index is not used by most networks. See the "wep-key-type" property for a description of how this key is interpreted. + wep-key2stringIndex 2 WEP key. This WEP index is not used by most networks. See the "wep-key-type" property for a description of how this key is interpreted. + wep-key3stringIndex 3 WEP key. This WEP index is not used by most networks. See the "wep-key-type" property for a description of how this key is interpreted. + wep-tx-keyidxuint320When static WEP is used (ie, key-mgmt = "none") and a non-default WEP key index is used by the AP, put that WEP key index here. Valid values are 0 (default key) through 3. Note that some consumer access points (like the Linksys WRT54G) number the keys 1 - 4. +
+Secret flag types: + Each secret property in a setting has an associated flags property + that describes how to handle that secret. The flags property is a bitfield + that contains zero or more of the following values logically OR-ed together. + 0x0 (none) - the system is responsible for providing and storing this secret.0x1 (agent-owned) - a user-session secret agent is responsible for providing and storing + this secret; when it is required, agents will be asked to provide it.0x2 (not-saved) - this secret should not be saved but should be requested from the user + each time it is required. This flag should be used for One-Time-Pad secrets, PIN codes from hardware tokens, + or if the user simply does not want to save the secret.0x4 (not-required) - in some situations it cannot be automatically determined that a secret + is required or not. This flag hints that the secret is not required and should not be requested from the user.AUTHORNetworkManager developersFILES/etc/NetworkManager/system-connectionsor distro plugin-specific locationSEE ALSOhttps://wiki.gnome.org/Projects/NetworkManager/ConfigurationSpecificationNetworkManager(8), nmcli(1), nmcli-examples(5), NetworkManager.conf(5) diff --git a/man/nm-settings.xsl b/man/nm-settings.xsl new file mode 100644 index 00000000..24e41535 --- /dev/null +++ b/man/nm-settings.xsl @@ -0,0 +1,162 @@ + + + + + + + + + + + + + + + nm-settings + 5 + NetworkManager + Configuration + + + + nm-settings + Description of settings and properties of NetworkManager connection profiles + + + DESCRIPTION + + NetworkManager is based on a concept of connection profiles, sometimes referred to as + connections only. These connection profiles contain a network configuration. When + NetworkManager activates a connection profile on a network device the configuration will + be applied and an active network connection will be established. Users are free to create + as many connection profiles as they see fit. Thus they are flexible in having various network + configurations for different networking needs. The connection profiles are handled by + NetworkManager via settings service and are exported on D-Bus + (/org/freedesktop/NetworkManager/Settings/<num> objects). + The conceptual objects can be described as follows: + + + Connection (profile) + + + A specific, encapsulated, independent group of settings describing + all the configuration required to connect to a specific network. + It is referred to by a unique identifier called the UUID. A connection + is tied to a one specific device type, but not necessarily a specific + hardware device. It is composed of one or more Settings + objects. + + + + + + + Setting + + + A group of related key/value pairs describing a specific piece of a + Connection (profile). Settings keys and allowed values are + described in the tables below. Keys are also reffered to as properties. + Developers can find the setting objects and their properties in the libnm-util + sources. Look for the class_init functions near the bottom of + each setting source file. + + + + + + + The settings and properties shown in tables below list all available connection + configuration options. However, note that not all settings are applicable to all + connection types. NetworkManager provides a command-line tool nmcli + that allows direct configuration of the settings and properties according to a connection + profile type. nmcli connection editor has also a built-in + describe command that can display description of particular settings + and properties of this page. + + + + + + Secret flag types: + + Each secret property in a setting has an associated flags property + that describes how to handle that secret. The flags property is a bitfield + that contains zero or more of the following values logically OR-ed together. + + + + 0x0 (none) - the system is responsible for providing and storing this secret. + + + 0x1 (agent-owned) - a user-session secret agent is responsible for providing and storing + this secret; when it is required, agents will be asked to provide it. + + + 0x2 (not-saved) - this secret should not be saved but should be requested from the user + each time it is required. This flag should be used for One-Time-Pad secrets, PIN codes from hardware tokens, + or if the user simply does not want to save the secret. + + + 0x4 (not-required) - in some situations it cannot be automatically determined that a secret + is required or not. This flag hints that the secret is not required and should not be requested from the user. + + + + + + AUTHOR + + + NetworkManager developers + + + + + FILES + /etc/NetworkManager/system-connections + or distro plugin-specific location + + + SEE ALSO + https://wiki.gnome.org/Projects/NetworkManager/ConfigurationSpecification + NetworkManager(8), nmcli(1), nmcli-examples(5), NetworkManager.conf(5) + + + + + + + <xsl:value-of select="@name"/> setting + + + + Key Name + Value Type + Default Value + Value Description + + + + + + +
+ + + + + + + + + (see for flag values) + + + + diff --git a/man/nmcli-examples.5 b/man/nmcli-examples.5 index 7145d682..23045ecd 100644 --- a/man/nmcli-examples.5 +++ b/man/nmcli-examples.5 @@ -2,12 +2,12 @@ .\" Title: nmcli-examples .\" Author: .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 16 June 2014 +.\" Date: 19 November 2014 .\" Manual: Examples -.\" Source: NetworkManager 0.9.10 +.\" Source: NetworkManager 1.0 .\" Language: English .\" -.TH "NMCLI\-EXAMPLES" "5" "" "NetworkManager 0\&.9\&.10" "Examples" +.TH "NMCLI\-EXAMPLES" "5" "" "NetworkManager 1\&.0" "Examples" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -121,6 +121,7 @@ GENERAL\&.STATE: 100 (connected) GENERAL\&.REASON: 0 (No reason given) GENERAL\&.UDI: /sys/devices/pci0000:00/0000:00:1c\&.1/0000:03:00\&.0/net/wlan0 GENERAL\&.IP\-IFACE: wlan0 +GENERAL\&.IS\-SOFTWARE: no GENERAL\&.NM\-MANAGED: yes GENERAL\&.AUTOCONNECT: yes GENERAL\&.FIRMWARE\-MISSING: no @@ -350,6 +351,7 @@ interface, the second to \fB $ nmcli con add con\-name my\-con\-em1 ifname em1 type ethernet ip4 192\&.168\&.100\&.100/24 gw4 192\&.168\&.100\&.1 ip4 1\&.2\&.3\&.4 ip6 abbe::cafe $ nmcli con mod my\-con\-em1 ipv4\&.dns "8\&.8\&.8\&.8 8\&.8\&.4\&.4" +$ nmcli con mod my\-con\-em1 +ipv4\&.dns 1\&.2\&.3\&.4 $ nmcli con mod my\-con\-em1 ipv6\&.dns "2001:4860:4860::8888 2001:4860:4860::8844" $ nmcli \-p con show my\-con\-em1 \fR @@ -362,7 +364,7 @@ $ nmcli \-p con show my\-con\-em1 The first command adds an Ethernet connection profile named \fImy\-con\-em1\fR that is bound to interface name -\fIem1\fR\&. The profile is configured with static IP addresses\&. Three addresses are added, two IPv4 addresses and one IPv6\&. The first IP 192\&.168\&.100\&.100 has a prefix of 24 (netmask equivalent of 255\&.255\&.255\&.0)\&. Gateway entry for the first IP address will become the default route if this profile is activated on em1 interface (and there is no connection with higher priority)\&. The second two addresses don\*(Aqt specify a prefix, so a default prefix will be used, i\&.e\&. 32 for IPv4 and 128 for IPv6\&. The second and third commands modify DNS parameters of the new connection profile\&. The last +\fIem1\fR\&. The profile is configured with static IP addresses\&. Three addresses are added, two IPv4 addresses and one IPv6\&. The first IP 192\&.168\&.100\&.100 has a prefix of 24 (netmask equivalent of 255\&.255\&.255\&.0)\&. Gateway entry will become the default route if this profile is activated on em1 interface (and there is no connection with higher priority)\&. The next two addresses do not specify a prefix, so a default prefix will be used, i\&.e\&. 32 for IPv4 and 128 for IPv6\&. The second, third and fourth commands modify DNS parameters of the new connection profile\&. The last \fIcon show\fR command displays the profile so that all parameters can be reviewed\&. .PP @@ -469,6 +471,7 @@ connection\&.uuid: de89cdeb\-a3e1\-4d53\-8fa0\-c22546c775 connection\&.interface\-name: \-\- connection\&.type: 802\-3\-ethernet connection\&.autoconnect: yes +connection\&.autoconnect\-priority: 0 connection\&.timestamp: 0 connection\&.read\-only: no connection\&.permissions: @@ -494,7 +497,9 @@ ipv4\&.method: auto ipv4\&.dns: ipv4\&.dns\-search: ipv4\&.addresses: +ipv4\&.gateway: \-\- ipv4\&.routes: +ipv4\&.route\-metric: \-1 ipv4\&.ignore\-auto\-routes: no ipv4\&.ignore\-auto\-dns: no ipv4\&.dhcp\-client\-id: \-\- @@ -507,7 +512,9 @@ ipv6\&.method: auto ipv6\&.dns: ipv6\&.dns\-search: ipv6\&.addresses: +ipv6\&.gateway: \-\- ipv6\&.routes: +ipv6\&.route\-metric: \-1 ipv6\&.ignore\-auto\-routes: no ipv6\&.ignore\-auto\-dns: no ipv6\&.never\-default: no @@ -524,22 +531,23 @@ nmcli ipv4\&.addresses> desc === [addresses] === [NM property description] -Array of IPv4 address structures\&. Each IPv4 address structure is composed of 3 32\-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 \- 32), and last the IPv4 gateway (network byte order)\&. The gateway may be left as 0 if no gateway exists for that subnet\&. For the \*(Aqauto\*(Aq method, given IP addresses are appended to those returned by automatic configuration\&. Addresses cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as addressing is either automatic or disabled with these methods\&. +Array of IP addresses\&. [nmcli specific description] Enter a list of IPv4 addresses formatted as: - ip[/prefix] [gateway], ip[/prefix] [gateway],\&.\&.\&. + ip[/prefix], ip[/prefix],\&.\&.\&. Missing prefix is regarded as prefix of 32\&. -Example: 192\&.168\&.1\&.5/24 192\&.168\&.1\&.1, 10\&.0\&.0\&.11/24 +Example: 192\&.168\&.1\&.5/24, 10\&.0\&.0\&.11/24 -nmcli ipv4\&.addresses> set 192\&.168\&.1\&.100/24 192\&.168\&.1\&.1 +nmcli ipv4\&.addresses> set 192\&.168\&.1\&.100/24 Do you also want to set \*(Aqipv4\&.method\*(Aq to \*(Aqmanual\*(Aq? [yes]: yes nmcli ipv4\&.addresses> nmcli ipv4\&.addresses> print -addresses: { ip = 192\&.168\&.1\&.100/24, gw = 192\&.168\&.1\&.1 } +addresses: 192\&.168\&.1\&.100/24 nmcli ipv4\&.addresses> back nmcli ipv4> b +nmcli> set ipv4\&.gateway 192\&.168\&.1\&.1 nmcli> verify Verify connection: OK nmcli> print @@ -551,6 +559,7 @@ connection\&.uuid: de89cdeb\-a3e1\-4d53\-8fa0\-c22546c775 connection\&.interface\-name: \-\- connection\&.type: 802\-3\-ethernet connection\&.autoconnect: yes +connection\&.autoconnect\-priority: 0 connection\&.timestamp: 0 connection\&.read\-only: no connection\&.permissions: @@ -575,8 +584,10 @@ connection\&.gateway\-ping\-timeout: 0 ipv4\&.method: manual ipv4\&.dns: ipv4\&.dns\-search: -ipv4\&.addresses: { ip = 192\&.168\&.1\&.100/24, gw = 192\&.168\&.1\&.1 } +ipv4\&.addresses: 192\&.168\&.1\&.100/24 +ipv4\&.gateway: 192\&.168\&.1\&.1 ipv4\&.routes: +ipv4\&.route\-metric: \-1 ipv4\&.ignore\-auto\-routes: no ipv4\&.ignore\-auto\-dns: no ipv4\&.dhcp\-client\-id: \-\- @@ -590,6 +601,7 @@ ipv6\&.dns: ipv6\&.dns\-search: ipv6\&.addresses: ipv6\&.routes: +ipv6\&.route\-metric: \-1 ipv6\&.ignore\-auto\-routes: no ipv6\&.ignore\-auto\-dns: no ipv6\&.never\-default: no @@ -607,6 +619,7 @@ connection\&.uuid: de89cdeb\-a3e1\-4d53\-8fa0\-c22546c775 connection\&.interface\-name: \-\- connection\&.type: 802\-3\-ethernet connection\&.autoconnect: yes +connection\&.autoconnect\-priority: 0 connection\&.timestamp: 0 connection\&.read\-only: no connection\&.permissions: @@ -629,10 +642,12 @@ connection\&.gateway\-ping\-timeout: 0 802\-3\-ethernet\&.s390\-options: \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- ipv4\&.method: manual -ipv4\&.dns: 8\&.8\&.8\&.8, 8\&.8\&.4\&.4 +ipv4\&.dns: 8\&.8\&.8\&.8,8\&.8\&.4\&.4 ipv4\&.dns\-search: -ipv4\&.addresses: { ip = 192\&.168\&.1\&.100/24, gw = 192\&.168\&.1\&.1 } +ipv4\&.addresses: 192\&.168\&.1\&.100/24 +ipv4\&.gateway: 192\&.168\&.1\&.1 ipv4\&.routes: +ipv4\&.route\-metric: \-1 ipv4\&.ignore\-auto\-routes: no ipv4\&.ignore\-auto\-dns: no ipv4\&.dhcp\-client\-id: \-\- @@ -645,7 +660,9 @@ ipv6\&.method: auto ipv6\&.dns: ipv6\&.dns\-search: ipv6\&.addresses: +ipv6\&.gateway: \-\- ipv6\&.routes: +ipv6\&.route\-metric: \-1 ipv6\&.ignore\-auto\-routes: no ipv6\&.ignore\-auto\-dns: no ipv6\&.never\-default: no @@ -664,7 +681,7 @@ nmcli> quit .RE .\} .PP -Example session in the nmcli interactive connection editor\&. The scenario creates an Ethernet connection (configuration) with static addressing (IPs and DNS)\&. +Example session in the nmcli interactive connection editor\&. The scenario creates an Ethernet connection profile with static addressing (IPs and DNS)\&. .SH "SEE ALSO" .PP \fBnmcli\fR(1), diff --git a/man/nmcli.1.in b/man/nmcli.1.in index 08f07b4a..c9a69cb9 100644 --- a/man/nmcli.1.in +++ b/man/nmcli.1.in @@ -19,9 +19,9 @@ .\" with this manual; if not, write to the Free Software Foundation, Inc., .\" 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. .\" -.\" Copyright (C) 2010 - 2014 Red Hat, Inc. +.\" Copyright 2010 - 2014 Red Hat, Inc. .\" -.TH NMCLI "1" "28 February 2014" +.TH NMCLI "1" "3 December 2014" .SH NAME nmcli \- command\(hyline tool for controlling NetworkManager @@ -33,7 +33,7 @@ nmcli \- command\(hyline tool for controlling NetworkManager .sp .IR OBJECT " := { " -.BR general " | " networking " | " radio " | " connection " | " device +.BR general " | " networking " | " radio " | " connection " | " device " | " agent .RI " }" .sp @@ -131,6 +131,8 @@ incompatible versions may produce incorrect results. .B \-a, \-\-ask When using this option \fInmcli\fP will stop and ask for any missing required arguments, so do not use this option for non-interactive purposes like scripts. +This option controls, for example, whether you will be prompted for a password +if it is required for connecting to a network. .TP .B \-w, \-\-wait This option sets a timeout period for which \fInmcli\fP will wait for \fINetworkManager\fP @@ -287,12 +289,12 @@ active if a device is using that connection profile. Without a parameter, all profiles are listed. When --active option is specified, only the active profiles are shown. .TP -.B show [--active] [ id | uuid | path | apath ] ... +.B show [--active] [--show-secrets] [ id | uuid | path | apath ] ... .br Show details for specified connections. By default, both static configuration and active connection data are displayed. When --active option is specified, -only the active profiles are taken into -account. +only the active profiles are taken into account. When --show-secrets option is +specified, secrets associated with the profile will be revealed too. \fIid\fP, \fIuuid\fP, \fIpath\fP and \fIapath\fP keywords can be used if \fI\fP is ambiguous. .RS @@ -327,10 +329,10 @@ When no command is given to the \fIconnection\fP object, the default action is 'nmcli connection show'. .RE .TP -.B up [ id | uuid | path ] [ifname ] [ap ] [nsp ] +.B up [ id | uuid | path ] [ifname ] [ap ] [nsp ] [passwd ] .RE .RS -.B up ifname [ap ] [nsp ] +.B up ifname [ap ] [nsp ] [passwd ] .RS .br Activate a connection. The connection is identified by its name, UUID or D-Bus @@ -355,18 +357,38 @@ Available options are: \(en BSSID of the AP which the command should connect to (for Wi\(hyFi connections) .IP \fInsp\fP 13 \(en NSP (Network Service Provider) which the command should connect to (for WiMAX connections) +.IP \fIpasswd-file\fP 13 +\(en some networks may require credentials during activation. You can give these +credentials using this option. +Each line of the file should contain one password in the form of +.br +\fBsetting_name.property_name:the password\fP +.br +For example, for WPA Wi-Fi with PSK, the line would be +.br +\fI802-11-wireless-security.psk:secret12345\fP +.br +For 802.1X password, the line would be +.br +\fI802-1x.password:my 1X password\fP +.br +nmcli also accepts "wifi-sec" and "wifi" strings instead of "802-11-wireless-security". +When NetworkManager requires a password and it is not given, nmcli will ask for it +when run with --ask. If --ask was not passed, NetworkManager can ask another secret +agent that may be running (typically a GUI secret agent, such as nm-applet or +gnome-shell). .RE .RE .TP -.B down [ id | uuid | path | apath ] +.B down [ id | uuid | path | apath ] ... .br Deactivate a connection from a device without preventing the device from -further auto-activation. +further auto-activation. Multiple connections can be passed to the command. .sp -Be aware that this command deactivates the specified active connection. The device +Be aware that this command deactivates the specified active connection, but the device on which the connection was active, is still ready to connect and will perform auto-activation by looking for a suitable connection that has the 'autoconnect' -flag set. This includes the just deactivated connection, so if the connection is set +flag set. This includes the just deactivated connection. So if the connection is set to auto-connect, it will be automatically started on the disconnected device again. .br In most cases you may want to use \fIdevice disconnect\fP command instead. @@ -418,6 +440,8 @@ Note: use quotes around \fB*\fP to suppress shell expansion. \(en MAC address of the device this connection is locked to .IP "\fI[cloned-mac ]\fP" 42 \(en cloned MAC +.IP "\fI[mode infrastructure|ap|adhoc]\fP" 42 +\(en Wi-Fi network mode. If blank, \fIinfrastructure\fP is assumed. .IP "\fI[mtu ]\fP" 42 \(en MTU .RE @@ -683,7 +707,7 @@ of its latest state. .B device - show and manage network interfaces .br .TP -.SS \fICOMMAND\fP := { status | show | connect | disconnect | wifi | wimax } +.SS \fICOMMAND\fP := { status | show | connect | disconnect | delete | wifi | wimax } .sp .RS .TP @@ -713,6 +737,14 @@ connections without user/manual intervention. .br If '--wait' option is not specified, the default timeout will be 10 seconds. .TP +.B delete +.br +Delete a device. The command removes the interface from the system. Note that +this only works for software devices like bonds, bridges, teams, etc. +Hardware devices (like Ethernet) cannot be deleted by the command. +.br +If '--wait' option is not specified, the default timeout will be 10 seconds. +.TP .B wifi [list [ifname ] [bssid ]] .br List available Wi\(hyFi access points. The \fIifname\fP and \fIbssid\fP options @@ -761,6 +793,39 @@ This command does not show the APs, use 'nmcli device wifi list' for that. List available WiMAX NSP. The \fIifname\fP and \fInsp\fP options can be used to list networks for a particular interface or with a specific NSP, respectively. +.RE + +.TP +.B agent \- run nmcli as a NetworkManager secret agent, or polkit agent +.br +.TP +.SS \fICOMMAND\fP := { secret | polkit | all } +.sp +.RS +.TP +.B secret +.br +Register nmcli as a NetworkManager secret agent and listen for secret requests. +You do usually not need this command, because nmcli can handle secrets when +connecting to networks. However, you may find the command useful when you use +another tool for activating connections and you do not have a secret agent +available (like nm-applet). +.TP +.B polkit +.br +Register nmcli as a polkit agent for the user session and listen for +authorization requests. You do not usually need this command, because nmcli can +handle polkit actions related to NetworkManager operations (when run with +--ask). However, you may find the command useful when you want to run a simple +text based polkit agent and you do not have an agent of a desktop environment. +Note that running this command makes nmcli handle all polkit requests, not only +NetworkManager related ones, because only one polkit agent can run for the +session. +.TP +.B all +.br +Runs nmcli as both NetworkManager secret and a polkit agent. +.RE .SH ENVIRONMENT VARIABLES \fInmcli\fP's behavior is affected by the following environment variables. @@ -851,6 +916,11 @@ shows all connection profile names and their auto-connect property. .IP shows details for "My default em1" connection profile. +.IP "\fB\f(CWnmcli connection show --show-secrets \(dq\&My Home WiFi\(dq\&\fP\fP" +.IP +shows details for "My Home WiFi" connection profile with all passwords. +Without \fI--show-secrets\fP option, secrets would not be displayed. + .IP "\fB\f(CWnmcli \-f active connection show \(dq\&My default em1\(dq\&\fP\fP" .IP shows details for "My default em1" active connection, like IP, DHCP diff --git a/man/nmtui.1.in b/man/nmtui.1.in new file mode 100644 index 00000000..32b76954 --- /dev/null +++ b/man/nmtui.1.in @@ -0,0 +1,66 @@ +.\" nmtui (1) manual page +.\" +.\" This is free documentation; you can redistribute it and/or +.\" modify it under the terms of the GNU General Public License as +.\" published by the Free Software Foundation; either version 2 of +.\" the License, or (at your option) any later version. +.\" +.\" The GNU General Public License's references to "object code" +.\" and "executables" are to be interpreted as the output of any +.\" document formatting or typesetting system, including +.\" intermediate and printed output. +.\" +.\" This manual is distributed in the hope that it will be useful, +.\" but WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +.\" GNU General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public Licence along +.\" with this manual; if not, write to the Free Software Foundation, Inc., +.\" 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +.\" +.\" Copyright 2014 Red Hat, Inc. +.\" +.TH NMTUI "1" "6 November 2014" + +.SH NAME +nmtui \- Text User Interface for controlling NetworkManager +.SH SYNOPSIS +.B nmtui +.RI " [ " edit " | " connect " | " hostname " ] [ ... ] " +.P +.B nmtui\-edit +.RI " [ " connection-id " | " connection-name " ] " +.P +.B nmtui\-connect +.RI " [ " connection-name " | " connection-uuid " | " device-name " | " Wi-Fi-SSID " ] " +.P +.B nmtui\-hostname + +.SH DESCRIPTION +.B nmtui +is a curses\(hybased TUI application for interacting with \fINetworkManager\fP. +.P +When starting \fInmtui\fP, the user is prompted to choose the activity to perform +unless it was specified as the first argument. +.P +The supported activities are: +.IP \(em 4 +\fIedit\fP: show a connection editor that supports adding, modifying, viewing and deleting +connections. It provides similar functionality as \fInm\-connection\-editor\fP. +.IP \(em 4 +\fIconnect\fP: show a list of available connections, with the option to activate or deactivate +them. It provides similar functionality as \fInm\-applet\fP. +.IP \(em 4 +\fIhostname\fP: set the system hostname. + +.P +Corresponding to above activities, \fInmtui\fP also comes with binaries named +\fInmtui\-edit\fP, \fInmtui\-connect\fP, and \fInmtui-hostname\fP to skip the selection +of the activities. + +.SH SEE ALSO +.BR NetworkManager(8), +.BR nmcli(1). +.BR nm\-applet(1). +.BR nm\-connection\-editor(1). -- cgit 1.3.0-6-gf8a5