13

There are many posts about putting VPN passwords into /etc/NetworkManager/system-connections/<connection>. I can't get any of them working on Ubuntu 12.04. The fields in the questions and answers seem subtly different from mine. The one that came closest seemed to be: How to save VPN passwords with NetworkManger.

I'd prefer to have nmcli ask for passwords on the console instead of in a GUI widget on the desktop, but that seems impossible.

So two questions:

  1. Are the /etc/NetworkManager/system-connections/<connection> files and their fields officially documented anywhere? There seem to be many 404s for NetworkManager documentation links.
  2. What is wrong with my connection file?

Here is my conneciton file. I've tried many variations of settings in this file, but this is as close to good as I could come up with (anonymized of course):

[connection]
# Not sure if this helps or breaks anything. Fails regardless.
permissions=user:peter:;
id=My VPNC
uuid=a2cd97d5-7df1-4391-91d8-7e72931ec2de
type=vpn
autoconnect=false
timestamp=1396942441

[vpn]
service-type=org.freedesktop.NetworkManager.vpnc
NAT Traversal Mode=natt
ipSec-secret-type=save
IPSec secret-flags=0
xauth-password-type=save
Vendor=cisco
Xauth username=user
IPSec gateway=1.2.3.4
XAuth password-flags=0
IPSec ID=Ipsec
Perfect Forward Secrecy=server
IKE DH Group=dh2

[vpn-secrets]
XAuth password=password
IPSec secret=grouppassword

[ipv4]
method=auto

Permissons:

> ls -l /etc/NetworkManager/system-connections/My\ VPNC 
-rw------- 1 root root 527 Apr  8 10:11 /etc/NetworkManager/system-connections/My VPNC

Running it gives:

> sudo nmcli con up id  'My VPNC'
Active connection state: unknown
Active connection path: /org/freedesktop/NetworkManager/ActiveConnection/44
state: VPN connecting (need authentication) (2)
Error: Connection activation failed: no valid VPN secrets.

Edit: Here is another similar post (about Openconnect VPN though): How can I get NetworkManager to autoconnect to a Openconnect VPN via nmcli without prompting for a user and password

11

When you set up your VPN connection through the GUI the password is saved in the key-ring. If you save your password in the connection file, like this:

sudoedit /etc/NetworkManager/system-connections/MyConnectionExampleName

in this file:

    # 1 here means key-ring I  think, but with 0, the password below is  used
    [vpn]
    password-flags=0
    cert-pass-flags=0

    [vpn-secrets]
    password=my_secret_password
    cert-pass=my_secret_certificate_password
  • 1
    Didn't work for me here on now 15.04. If I ran nmcli con up id MyVPN as my own user, the password dialog still appears on the remote machine's desktop. Running sudo nmcli con up id MyVPN gave first (process:3320): libnm-glib-WARNING **: async_got_type: could not read properties for /org/freedesktop/NetworkManager/ActiveConnection/7: Method "Get" with signature "ss" on interface "org.freedesktop.DBus.Properties" doesn't existand then Error: Connection activation failed: Creating object for path '/org/freedesktop/NetworkManager/ActiveConnection/7' failed in libnm-glib. – Peter V. Mørch Aug 18 '15 at 18:43
4

I had the same problem, /var/log/messages was registering a message where NetworkManager complained about invalid properties. After I removed the flag and type properties and left only [vpn-secrets] records, connection could be established.

ipSec-secret-type=save
IPSec secret-flags=0
xauth-password-type=save
XAuth password-flags=0

Package I have installed:

NetworkManager-0.8.1-66.el6.x86_64

Result:

[connection]
id=My VPNC
uuid=a2cd97d5-7df1-4391-91d8-7e72931ec2de
type=vpn
autoconnect=false
timestamp=1396942441

[vpn]
service-type=org.freedesktop.NetworkManager.vpnc
NAT Traversal Mode=natt
Vendor=cisco
Xauth username=user
IPSec gateway=1.2.3.4
IPSec ID=Ipsec
Perfect Forward Secrecy=server
IKE DH Group=dh2

[vpn-secrets]
XAuth password=password
IPSec secret=grouppassword

[ipv4]
method=auto
  • Didn't work for me. As root I got: (process:2034): libnm-glib-WARNING **: async_got_type: could not read properties for /org/freedesktop/NetworkManager/ActiveConnection/4: Method "Get" with signature "ss" on interface "org.freedesktop.DBus.Properties" doesn't exist Error: Connection activation failed: Creating object for path '/org/freedesktop/NetworkManager/ActiveConnection/4' failed in libnm-glib. As user "me", it opened the login dialog on the remote desktop. – Peter V. Mørch Aug 18 '15 at 18:55
  • 1
    I can confirm this works for Ubuntu 14.04 on a cisco VPN. – Dale Anderson Dec 9 '15 at 18:13
  • Works with Fritzbox 5490 and Ubuntu 16.04. Where IPSec secret is the IPSec Pre-Shared Key and Xauth password is the password you have chosen on the Fritzbox. Be sure to not mess up the spelling and upper-/lower case keyword of IPSec secret and Xauth password. – MadMike Sep 26 '17 at 12:06
3

In terms of resolving the simple password secret error in 16.04, you only need the two lines:

[vpn-secrets]
password=my_secret_password

I'd only touch/add other lines if necessary

  • 1
    I also needed to set password-flags=0 – Pierre François Jul 12 '17 at 9:12
2

I would not change GUI generated config-files. Next time you make a click in the GUI your manual entries are gone. Also a system update may brake it.

You could try the following:

  • Allow to run sudo nmcli without password:

    Create a file /etc/sudores.d/mynmcli (filename doesn't matter)

    Host_Alias HOST = YOURHOSTNAME
    Cmnd_Alias NMCLI    = /usr/bin/nmcli
    YOURHOSTNAME HOST=(root) NOPASSWD:NMCLI
    
  • Create a password file with:

    vpn.secrets.Xauth password:PASSWORD
    vpn.secrets.IPSec secret:SHAREDSECRET
    

    Now you can run the following line in a script which is handled by corn:

    sudo nmcli con up id YOURVPN passwd-file /path/to/your/file
    

    (To find YOURVPN type "nmcli con")

Works for me on Ubuntu 16.10.

1

Do what Wolf said. Save the file.

Then type

sudo service network-manager restart

and hit Enter.

Now your changes are in effect.

0

Edit your VPNC connection using the Network Connections dialog.

On the VPN tab, the password inputs have an icon inside the input on the right side. Click this icon and select "Store the password only for this user".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.