Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I am able to connect to 802.1 networks via the nm-applet. I do not like doing this as I am running without a nm most of the time and I would hate to load up one just to connect to a wireless network.
When connecting to an 802.1 network I get the following error:
Error: Failed to add/activate new connection: (32) Failed to determine AP security information
I do not know how to work around this as nmcli does not seem to provide any means of specifying the network type.
You can create a WPA2 Enterprise connection using an nmcli command line like (substitute your own wifi device name for wlp3s0, and so forth):
nmcli connection add \
type wifi con-name "MySSID" ifname wlp3s0 ssid "MySSID" -- \
wifi-sec.key-mgmt wpa-eap 802-1x.eap tls 802-1x.identity "USERNAME" \
802-1x.ca-cert ~/ca.pem 802-1x.client-cert ~/cert.pem \
802-1x.private-key-password "..." 802-1x.private-key ~/key.pem
It will then be listed under nmcli connection, and can be brought up using nmcli connection up MySSID.
(This section was helpfully added by a contributor editing the post:)
Or if you use a username/password auth (likely via RADIUS) you can use the command below to add it (use the correct 802-1x.eap option for your network, the example of ttls as below doesn't require a certificate to be defined) and then use --ask the first time you go to connect to save the password into the connection file.
nmcli connection add \
type wifi con-name "MySSID" ifname wlp3s0 ssid "MySSID" -- \
wifi-sec.key-mgmt wpa-eap 802-1x.eap ttls \
802-1x.phase2-auth mschapv2 802-1x.identity "USERNAME"
If using the username/password option you should add --ask after nmcli the first time you bring it up to save the password without leaving it in your command history. It will give you an error message saying as much when you attempt to bring it up otherwise. You will probably get prompted about additional wireless settings when using --ask, you can type no for them unless you need to specify a static IP, in which case answer yes for that option and set the correct information, and in the future you shouldn't need to use --ask unless your password changes.
In general, the space of possible nmcli settings can be explored by adding the words asdf.asdf asdf to the end of the command line to produce an error message stating what words are possible substitutions for the first asdf. Choose one, and then you will get an error message listing the possible sub-settings for the second asdf. Choose one of those, and you will see the possible settings:
$ nmcli connection add ... asdf.asdf asdf
Error: invalid or not allowed setting 'asdf': 'asdf' not among [connection, 802-11-wireless (wifi), 802-11-wireless-security (wifi-sec), 802-1x, ipv4, ipv6].
$ nmcli connection add ... wifi-sec.asdf asdf
Error: invalid property 'asdf': 'asdf' not among [key-mgmt, wep-tx-keyidx, auth-alg, proto, pairwise, group, leap-username, wep-key0, wep-key1, wep-key2, wep-key3, wep-key-flags, wep-key-type, psk, psk-flags, leap-password, leap-password-flags].
$ nmcli connection add ... wifi-sec.proto asdf
Error: failed to modify wifi-sec.proto: 'asdf' not among [wpa, rsn].
By iterating through all of the sub-settings, I was able to piece together the successful command line shown above. The one surprise was that the password must precede the private key path — if you put the password later, it has no effect!
nmcli d show | head and then using --ask for the password: nmcli con up --ask "MySSID"
nmcli Wifi
Get Wifi status
nmcli radio wifi
Turn wifi on or off
nmcli radio wifi <on|off>
List available access points(AP) to connect to
nmcli device wifi list
Refresh previous list
nmcli device wifi rescan
Create a new connection to an open AP
nmcli device wifi connect <SSID|BSSID>
Create a new connection to a password protected AP
nmcli device wifi connect <SSID|BSSID> password <password>
NetworkManager can generate WPA2 Enterprise profiles with graphical front ends. nmcli and nmtui do not support this, but may use existing profiles.
nmcli does not allow complex passwords containing special characters; however, nmtui allows this and much more :) --Thank you @hurst
It seems that nmcli is unable connect to WPA2-enterprise networks. The networks have to either be manually configured or created via the various applets.
nmcli con up 'connection-uuid', but i must have this connection in my NetworkManager first.nmcli con editcommand.