Provide password to `nmcli con up` in terminal 14.04

Question

I am trying to connect to my VPN using terminal. My VPN password is a TOTP, so cannot save it to the connection conf file. When I try to connect, a dialog appear to enter password. I want to do it in terminal itself as I can generate my TOTP from a script. I just couldn't figure out any way. Is there a way to specify password in command line or send password from command line to the dialog?

Answer 1

You can write-update a password to a seperate file. This works for me:

echo "vpn.secrets.password:MY_PASSWORD" > /my/vpn/password
nmcli con up uuid MY_UUID passwd-file /my/vpn/password

Answer 2

In case you need to create the password with a script or similar and then pass it to nmcli without storing it on the disk, the following works for me (nmcli 1.30.0) and might be possible to be adapted:

echo vpn.secrets.password:$PW | /usr/bin/nmcli c up $VPN_CON_NAME passwd-file /dev/fd/0

It unfortunately does not support the standard linux - for standard input...

Answer 3

There is a more elegant and secure way to work around this. Store your password in gnome-keyring:

~$ sudo apt install libsecret-tools
~$ secret-tool store --label='vpn' vpn_name your_unique_vpn_name

Now let’s have a script to bring up the vpn. The key to be provided by the way may differ. In my example it is vpn.secrets.cert-pass. The script should be put into ~/bin/.

#!/bin/sh -e

vpn=your_vpn_connections_name

tmp=$(mktemp)
chmod 600 $tmp
printf "vpn.secrets.cert-pass:$(secret-tool lookup vpn_name your_unique_vpn_name)">$tmp
nmcli c u "$vpn" passwd-file $tmp
rm $tmp

Answer 4

You can set the password using the following command:

nmcli con mod VPNID vpn.secrets "password=VPNPASS"

where VPNPASS is the VPN password.

In order for this to work, you have to enable the pasword storage option in NetworkManager, as shown in this picture:

I am using Ubuntu 16.04.

Answer 5

The latest network-manager in Ubuntu 14.04 is 0.9.8.8 and as you said doesn't support that feature. The feature to accept a password appears to have been introduced in 1.11.1-dev, at least in the docs. https://github.com/NetworkManager/NetworkManager/commit/b19e4d37b6272834cb98a000cfa7bc247607e2f7#diff-a86a2b799f258f5c584a76d830e845db

I haven't found another way to pass in the password either, it appears one needs to update network manager or update Ubuntu.