nm-settings-keyfile - Man Page

NetworkManager is based on the concept of connection profiles that contain network configuration (see nm-settings-nmcli(5) for details)​. The profiles can be stored in various formats​. NetworkManager uses plugins for reading and writing the data​. The plugins can be configured in NetworkManager.conf(5)​.

The keyfile plugin is the generic plugin that supports all the connection types and capabilities that NetworkManager has​. The files are in a ​.ini-style format and located in /etc/NetworkManager/system-connections/, /usr/lib/NetworkManager/system-connections/ and /run/NetworkManager/system-connections/​. This plugin is always enabled and will automatically be used to store any connections that are not supported by any other active plugin​. For security, it will ignore files that are readable or writable by any user other than 'root' since private keys and passphrases may be stored in plaintext inside the file​.

The keyfile config format is a simple ​.ini-style format​. It consists of sections (groups) of key-value pairs​. More information of the generic key file format can be found at GLib key file format​^[1] (Lines beginning with a '#' are comments, lists are separated by character ; etc​.)​.

Each section corresponds to a setting name as described in the settings specification (nm-settings-nmcli(5))​. Each key/value pair in a section is one of the properties from the specification​.

The majority of properties are written in the same format as the specification into the keyfile​. However, some values are inconvenient for people to use so they are stored in the keyfile in more readable ways​. These properties that differ from the specification are described below​. An example could be IP addresses that are not written as integer arrays, but more reasonably as "1​.2​.3​.4/12 1​.2​.3​.254"​. Also, some lists of complex values (addresses, routes, routing-rules), instead of using a semicolon separated list, use one key-value pair per list element, with the key being the singular of the property name followed by the numeric index (i​.e address1, address2, ​.​.​.)​.

Users can create or modify the keyfile connection files manually, even if that is not the recommended way of managing the profiles​. However, if they choose to do that, they must inform NetworkManager about their changes (for example via nmcli con (re)load)​.

Examples of keyfile configuration.

A sample configuration for an ethernet network:
[connection]
id=Main eth0
uuid=27afa607-ee36-43f0-b8c3-9d245cdc4bb3
type=802-3-ethernet
autoconnect=true

[ipv4]
method=auto

[802-3-ethernet]
mac-address=00:23:5a:47:1f:71

A sample configuration for WPA-EAP (PEAP with MSCHAPv2) and always-ask secret:
[connection]
id=CompanyWIFI
uuid=cdac6154-a33b-4b15-9904-666772cfa5ee
type=wifi
autoconnect=false

[wifi]
ssid=CorpWLAN
mode=infrastructure
security=802-11-wireless-security

[wifi-security]
key-mgmt=wpa-eap

[ipv4]
method=auto

[ipv6]
method=auto

[802-1x]
eap=peap;
identity=joe
ca-cert=/home/joe/​.cert/corp​.crt
phase1-peapver=1
phase2-auth=mschapv2
password-flags=2

A sample configuration for openvpn:
[connection]
id=RedHat-openvpn
uuid=7f9b3356-b210-4c0e-8123-bd116c9c280f
type=vpn
timestamp=1385401165

[vpn]
service-type=org​.freedesktop​.NetworkManager​.openvpn
connection-type=password
password-flags=3
remote=ovpn​.my-company​.com
cipher=AES-256-CBC
reneg-seconds=0
port=443
username=joe
ca=/etc/openvpn/ISCA​.pem
tls-remote=ovpn​.my-company​.com

[ipv6]
method=auto

[ipv4]
method=auto
ignore-auto-dns=true
never-default=true

A sample configuration for a bridge and a bridge port:
[connection]                                 [connection]
id=MainBridge                                id=br-port-1
uuid=171ae855-a0ab-42b6-bd0c-60f5812eea9d    uuid=d6e8ae98-71f8-4b3d-9d2d-2e26048fe794
interface-name=MainBridge                    interface-name=em1
type=bridge                                  type=ethernet
                                             controller=MainBridge
[bridge]                                     port-type=bridge
interface-name=MainBridge

A sample configuration for a VLAN:
[connection]
id=VLAN for building 4A
uuid=8ce1c9e0-ce7a-4d2c-aa28-077dda09dd7e
interface-name=VLAN-4A
type=vlan

[vlan]
interface-name=VLAN-4A
parent=eth0
id=4

keyfile plugin variables for the majority of NetworkManager properties have one-to-one mapping​. It means a NetworkManager property is stored in the keyfile as a variable of the same name and in the same format​. There are several exceptions to this rule, mainly for making keyfile syntax easier for humans​. The exceptions handled specially by keyfile plugin are listed below​. Refer to nm-settings-nmcli(5) for all available settings and properties and their description​.

Name aliases. Some of the NetworkManager setting names are somewhat hard to type or remember​. Therefore keyfile introduces aliases that can be used instead of the names​.

Table ​1. ​802-11-wireless setting (section)

Table ​2. ​802-3-ethernet setting (section)

Table ​3. ​bridge setting (section)

Table ​4. ​connection setting (section)

Table ​5. ​infiniband setting (section)

Table ​6. ​ipv4 setting (section)

Table ​7. ​ipv6 setting (section)

Table ​8. ​serial setting (section)

Table ​9. ​vpn setting (section)

Table ​10. ​wifi-p2p setting (section)

Table ​11. ​wpan setting (section)

/etc/NetworkManager/system-connections/*

nm-settings-nmcli(5), nm-settings-ifcfg-rh(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(7)

1.

GLib key file format
https://developer.gnome.org/glib/stable/glib-Key-value-file-parser.html#glib-Key-value-file-parser.description

NetworkManager.conf(5), nmcli(1), nm-settings(5), nm-settings-dbus(5).