This question has been updated. Please see the tail end of this post.

I am trying to set up my Mythbuntu computer to connect to a VPN service when it starts up. My hope is that the Mythbuntu computer will always use the VPN for all of its internet connections.

I found a script that will supposedly do that, and it looks like this:

while [ "true" ]
    VPNCON=$(nmcli con status)
    if [[ $VPNCON != "*MyVPNConnectionName*" ]]; then
        echo "Disconnected, trying to reconnect..."
        (sleep 1s && nmcli con up uuid df648abc-d8f7-4ce4-bdd6-3e12cdf0f494)
        echo "Already connected !"
    sleep 30

When I run this script on my machine, I get the following error:

$ /home/mythbuntu/VPN_start.sh
Disconnected, trying to reconnect...
Error: Connection activation failed: Not authorized to control networking.

I thought it might be a permission issue, so I tried running it with sudo:

$ sudo /home/mythbuntu/VPN_start.sh
[sudo] password for mythbuntu: 
Disconnected, trying to reconnect...
Active connection state: unknown
Active connection path: /org/freedesktop/NetworkManager/ActiveConnection/1
state: VPN connecting (need authentication) (2)
Error: Connection activation failed: no valid VPN secrets.

How do I get this script to run without errors so that I can run it at boot or login so that I can make sure I'm always connecting by VPN.

If anyone has a better script or method, that would also suffice as an answer.

These are the contents of my /etc/NetworkManager/system-connections/MyVPN file (some details replaced with x characters for privacy):





Also, I just want to add that when I turn on the VPN using the applet in top right corner the Xfce panel, it connects no problem. So the issue doesn't seem to me to be one of incorrect authorization, but of the configuration when trying to do this from the command line.


I'm not entirely sure what has changed - possibly something in the upgrade to 12.10 - but I can now start my VPN service from the command line. However, this command only works once when I very first start the computer, and also it needs to be run with sudo.

mythbuntu@mythbuntu:~$ nmcli con up id "Private Internet Access SSL"
Error: Connection activation failed: Not authorized to control networking.
mythbuntu@mythbuntu:~$ sudo nmcli con up id "Private Internet Access SSL"
[sudo] password for mythbuntu: 

Since I need to use sudo to run this, I can't run it automatically at startup.

How do I get it so that I can start my VPN without super user permissions?


The problem seems to be, that your password in keyring is not accessible.


Solution mentioned there is to open file /etc/NetworkManager/system-connections/ConnectionName and set the


and add the below lines to the file


Then restart network manager to pick up the change:

 sudo restart network-manager

For more info refer the source

  • Thank you for that helpful information. One part I'm stuck on though is that I didn't have a /etc/NetworkManager/system-connections/ConnectionName file, so when it says to "edit under [vpn]", I'm not sure how to handle that. Can I just create the file?
    – Questioner
    Oct 9 '12 at 10:31
  • yes /etc/NetworkManager/system-connections/<name-of-your-vpn-connection> and change password-flags form 1 to 0. Use nmcli con to list the connections.
    – devav2
    Oct 9 '12 at 10:58
  • Okay, I got it now. I realized I was making a mistake in finding the right file. However, now I've made all the edits suggested, I'm unfortunately still getting the same Not authorized to control networking error.
    – Questioner
    Oct 9 '12 at 11:14
  • Try to re-open the NetworkManager connection editor and re-enter the VPN passwords or secrets.
    – devav2
    Oct 9 '12 at 11:25
  • I opened Network Manager and re-entered the password (it was blank when I opened the interface). I didn't see anything else that related to "secrets". I saved and then retried the script. Still the same error message.
    – Questioner
    Oct 9 '12 at 11:51

To start VPN automatically at startup

Assuming you have your credentials files working, you should be able to use a dispatcher.d script like you originally had to start your VPN. I've modified your script a bit to get it working with 2 connections (Wireless router at home, and wired connection at work). The reason for this is that I want it to start the VPN if it's not started when either of my required internet connections are alive. In my example, I've configured them with default names, but you should change them to match your own names.

Put this in the file /etc/NetworkManager/dispatcher.d/vpn-up, and make executable with chmod +x

#! /bin/bash

REQUIRED_CONNECTION2_NAME="Wired connection 1"

activ_con=$(nmcli con status | grep "${REQUIRED_CONNECTION1_NAME}\|${REQUIRED_CONNECTION2_NAME}")
activ_vpn=$(nmcli con status | grep "${VPN_CONNECTION_NAME}")
if [ "${activ_con}" -a ! "${activ_vpn}" ];
    nmcli con up id "${VPN_CONNECTION_NAME}"

To configure client certificates in NetworkManager

If you are using a client cert with password to authenticate to your VPN, it is a bit undocumented.

After browsing through the NetworkManager 0.9 settings specification, I was unable to determine how to specify a vpn cert pass in the config file. I opened up seahorse and found my 'VPN secret' (certificate password).

It was listed as something like 'VPN cert-pass secret for My VPN/org.freedesktop.NetworkManager.openvpn/vpn'. Clicking on the details tab gave me a clue for the setting-key name:

setting-name: vpn
setting-key: cert-pass
connection-uuid: 0badcafe-f00d-dead-beef-feedfacef00d

To start a VPN automatically as root on Ubuntu 12.04 (Precise Pangolin) using NetworkManager

Open /etc/NetworkManager/system-connections/My VPN and add the cert-pass VPN secret so the file looks like:

id=My VPN


  • Thank you for this answer. My system-connections differs from yours, though, so I'm unsure about applying your edits. I don't have a key or timestamp, and my connection type is password, not tls. I've added my file to my question.
    – Questioner
    Oct 11 '12 at 18:12
  • If you are using connection-type=password you should probably be using password-flags=0 and password=YourPassword under the [vpn-secrets] heading as suggested by devav2.
    – TrinitronX
    Oct 16 '12 at 16:16
  • However, the error you're getting suggests that the user you are running VPN_start.sh as does not have permissions to manage networking. If you want to manage VPN connections as a non-root user that does not have permissions, you may need to add some policies to the /etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf file.
    – TrinitronX
    Oct 16 '12 at 16:25
  • If it were just a matter of permissions, wouldn't the script work if I ran it with sudo? As noted in my question, it fails when I run it with sudo as well.
    – Questioner
    Oct 17 '12 at 2:42
  • Good point! I'm not sure why it would be giving you this error if you are running with sudo. I haven't been able to test your VPN type myself, as my router doesn't appear be easily configurable for that. If the VPN connection works ok when started via the NetworkManager applet, then I don't know what else to check.
    – TrinitronX
    Oct 17 '12 at 16:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.