In an 802.1x enterprise network, I can use NetworkManager to configure 802.1x parameters, including the password. This all works, but requires storing the password in cleartext.

We are trying to use Netplan to store the credentials more securely (as a hashed password), but we cannot make the 802.1x connections authenticate.

I haven't been able to find a good guide for building a Netplan configuration that includes 802.1x credentials.

(UPDATE: There is a bug in Netplan about hashed password, https://github.com/CanonicalLtd/netplan/pull/78), which seems to be the main issue)

Here is a file that does not work

  version: 2
  renderer: networkd
        key-management: 802.1x
        password: hash:some-stuff-here
        method: peap
        identity: ghewett
      dhcp4: false
        search: [cisco.com, otherdomain]

(IP's and credentials changed )

This gives us

DEBUG:command generate: running ['/lib/netplan/generate']
** (generate:19354): DEBUG: 09:23:41.614: Processing input file /etc/netplan/01-netcfg.yaml..
** (generate:19354): DEBUG: 09:23:41.614: starting new processing pass
Error in network definition /etc/netplan/01-netcfg.yaml line 7 column 6: unknown key auth

2 Answers 2


See https://netplan.io/examples, and the https://netplan.io site in general has good info. Make sure to sudo netplan --debug generate to check .yaml files, and generate config files, and then sudo netplan apply to make them active.


Netplan supports advanced authentication settings for ethernet and wifi interfaces, as well as individual wifi networks, by means of the auth block.

auth (mapping)

    Specifies authentication settings for a device of type ethernets:, or an access-points: entry on a wifis: device.

    The auth block supports the following properties:

    key-management (scalar)
        The supported key management modes are none (no key management); psk (WPA with pre-shared key, common for home wifi); eap (WPA with EAP, common for enterprise wifi); and 802.1x (used primarily for wired Ethernet connections).
    password (scalar)
        The password string for EAP, or the pre-shared key for WPA-PSK.

    The following properties can be used if key-management is eap or 802.1x:

    method (scalar)
        The EAP method to use. The supported EAP methods are tls (TLS), peap (Protected EAP), and ttls (Tunneled TLS).
    identity (scalar)
        The identity to use for EAP.
    anonymous-identity (scalar)
        The identity to pass over the unencrypted channel if the chosen EAP method supports passing a different tunnelled identity.
    ca-certificate (scalar)
        Path to a file with one or more trusted certificate authority (CA) certificates.
    client-certificate (scalar)
        Path to a file containing the certificate to be used by the client during authentication.
    client-key (scalar)
        Path to a file containing the private key corresponding to client-certificate.
    client-key-password (scalar)
        Password to use to decrypt the private key specified in client-key if it is encrypted.

Source: https://netplan.io/reference#authentication

Update #1:

Note: make sure there are no TABS in your .yaml file...

Add your certs, restore the IP's, and try this...

  version: 2
  renderer: networkd
        key-management: 802.1x
        method: peap
        identity: "[email protected]"
        ca-certificate: my_ca.pem
        client-certificate: my_cert.pem
        client-key: my_key.pem
        search: [cisco.com, otherdomain]
  • 1
    @PhillipRemaker edit your question to include the .yaml file that you're running with and we'll take a look. No promises, but we'll take a look for you. Each .yaml is custom to every site, so you may not get a plug 'n play answer.
    – heynnema
    Mar 9, 2019 at 13:40
  • 1
    That above files gets the following error This gives us DEBUG:command generate: running ['/lib/netplan/generate'] ** (generate:19354): DEBUG: 09:23:41.614: Processing input file /etc/netplan/01-netcfg.yaml.. ** (generate:19354): DEBUG: 09:23:41.614: starting new processing pass Error in network definition /etc/netplan/01-netcfg.yaml line 7 column 6: unknown key auth Mar 11, 2019 at 17:26
  • 1
    Sorry for formatting of file in comment above - you can find the file at in a formatted version at gist.github.com/fluffy/ff23a868071781c90e5cd6a99ff2736f Mar 11, 2019 at 17:32
  • 1
    @PhillipRemaker See Update #1 in my answer. Report back.
    – heynnema
    Mar 11, 2019 at 20:53
  • 1
    @heynnema - Thanks - I will try and out and let you know how it goes. Due to a couple other things going on it will take me a bit of time to get back to this but very much appreciate your help. Mar 12, 2019 at 22:17

The default netplan that ship with Ubuntu 18.04.02 does not support wired authentication so there is not chance of if working. The latest version on github in early March 2019 does support authentication but it is lacking other things that are required. The WPA supplicant requires a CLI flag to use the wired driver for it to work with and I wrote a PR to add this to netplan. Netplan also handle hashed passwords in a way that breaks them so there is another PR to fix that.

If you want to try these, PR, the instructions are:

  1. Have a server install of Ubuntu 18.04.02

  2. Install supplicant

    • sudo apt install wpasupplicant"
  3. Install needed build tools with

    • sudo apt install make cpp pkg-config libyaml-dev uuid-dev libgio2.0-cil-dev libglib2.0-dev pandoc
  4. Get the patched netplan software with

  5. Build and install it with

    • make
    • sudo make install
  6. Generate a hashed version of your password

    • echo -n 'MyPassword' | iconv -t UTF-16LE | openssl md4 -binary | xxd -p
    • history -c
  7. Edit the netplan config file

    • cd /etc/netplan
    • sudo mv 50-cloud-init.yaml config.yaml
    • sudo emacs /etc/netplan/config.yaml
  8. Get it to look something like:

    version: 2
            dhcp4: true
            optional: true
                key-management: 802.1x
                wired: true
                method: ttls
                identity: [email protected]
                password: hash:83...11

  1. Apply it with

    • sudo netplan apply
  2. At this point if you reboot, it should work but some things to check to help debug

  3. Check the WPA supplicant config file

    • sudo cat /run/netplan/wpa-enp0s31f6.conf

and it should look like

  identity="[email protected]"

Make sure there are not quotes around the password if using hashed passwords.

  1. Check the systemd template

    • ls /run/systemd/system/systemd-networkd.service.wants/netplan*enp0s31f6.service

It should return something like

/run/systemd/system/systemd-networkd.service.wants/[email protected]

The key thing is to check that it as wpa-wired in it

  1. Test the auth works with passwords and all

    • kill any running version of wpa_supplicant then do

    • sudo wpa_supplicant -c /run/netplan/wpa-enp0s31f6.conf -i enp0s31f6 -D wired

You will see a flow of info about the 802.1x messages and near the end there should be a "Authentication succeeded"

You will need to Ctrl^C this kill it.

  1. Reboot and enjoy ....
  • That's kind of insane. Please update the answer with the right version when the Netplan team rolls in the patch. Also, remind me what year this is that such a fundamental fumble could happen. Mar 16, 2019 at 5:36
  • I've updated netplan.io to the latest version (netplan.io/bionic-updates 0.99-0ubuntu3~18.04.4 amd64) and it works now for me.
    – croc
    Jul 6, 2021 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .