Chapter 11. Managing wifi connections

Procedure

1. If the wifi radio has been disabled in NetworkManager, enable this feature:

   # nmcli radio wifi on

2. Optional: Display the available wifi networks:

   # nmcli device wifi list
   IN-USE  BSSID              SSID          MODE   CHAN  RATE        SIGNAL  BARS  SECURITY
           00:53:00:2F:3B:08  Office        Infra  44    270 Mbit/s  57      ▂▄▆_  WPA2 WPA3
           00:53:00:15:03:BF  --            Infra  1     130 Mbit/s  48      ▂▄__  WPA2 WPA3

   The service set identifier (SSID) column contains the names of the networks. If the column shows --, the access point of this network does not broadcast an SSID.

3. Connect to the wifi network:

   # nmcli device wifi connect Office --ask
   Password: wifi-password

   If you prefer to set the password in the command instead of entering it interactively, use the password <wifi_password> option in the command instead of --ask:

   # nmcli device wifi connect Office <wifi_password>

   Note that, if the network requires static IP addresses, NetworkManager fails to activate the connection at this point. You can configure the IP addresses in later steps.

4. If the network requires static IP addresses:

   1. Configure the IPv4 address settings, for example:

      # nmcli connection modify Office ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv4.gateway 192.0.2.254 ipv4.dns 192.0.2.200 ipv4.dns-search example.com

   2. Configure the IPv6 address settings, for example:

      # nmcli connection modify Office ipv6.method manual ipv6.addresses 2001:db8:1::1/64 ipv6.gateway 2001:db8:1::fffe ipv6.dns 2001:db8:1::ffbb ipv6.dns-search example.com

5. Re-activate the connection:

   # nmcli connection up Office

Verification

1. Display the active connections:

   # nmcli connection show --active
   NAME    ID                                    TYPE  DEVICE
   Office  2501eb7e-7b16-4dc6-97ef-7cc460139a58  wifi  wlp0s20f3

   If the output lists the wifi connection you have created, the connection is active.

2. Ping a hostname or IP address:

   # *ping -c 3 example.com

Procedure

1. Open the system menu on the right side of the top bar.
2. Expand the Wi-Fi Not Connected entry.

3. Click Select Network:

   
4. Select the wifi network you want to connect to.
5. Click Connect.
6. If this is the first time you connect to this network, enter the password for the network, and click Connect.

Verification

1. Open the system menu on the right side of the top bar, and verify that the wifi network is connected:

   

   If the network appears in the list, it is connected.

2. Ping a hostname or IP address:

   # ping -c 3 example.com

Procedure

1. Press the Super key, type Wi-Fi, and press Enter.
2. Click on the name of the wifi network you want to connect to.
3. Enter the password for the network, and click Connect.

4. If the network requires additional settings, such as static IP addresses or a security type other than WPA2 Personal:

   1. Click the gear icon next to the network’s name.

   2. Optional: Configure the network profile on the Details tab to not automatically connect.

      If you deactivate this feature, you must always manually connect to the network, for example, by using GNOME settings or the GNOME system menu.

   3. Configure IPv4 settings on the IPv4 tab, and IPv6 settings on the IPv6 tab.

   4. On the Security tab, select the authentication of the network, such as WPA3 Personal, and enter the password.

      Depending on the selected security, the application shows additional fields. Fill them accordingly. For details, ask the administrator of the wifi network.

   5. Click Apply.

Verification

1. Open the system menu on the right side of the top bar, and verify that the wifi network is connected:

   

   If the network appears in the list, it is connected.

2. Ping a hostname or IP address:

   # ping -c 3 example.com

Procedure

1. If you do not know the network device name you want to use in the connection, display the available devices:

   # nmcli device status
   DEVICE     TYPE      STATE                   CONNECTION
   wlp2s0     wifi      unavailable             --
   ...

2. Start nmtui:

   # nmtui

3. Select Edit a connection, and press Enter.
4. Press the Add button.
5. Select Wi-Fi from the list of network types, and press Enter.

6. Optional: Enter a name for the NetworkManager profile to be created.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

7. Enter the network device name into the Device field.
8. Enter the name of the Wi-Fi network, the Service Set Identifier (SSID), into the SSID field.
9. Leave the Mode field set to its default, Client.

10. Select the Security field, press Enter, and set the authentication type of the network from the list.

    Depending on the authentication type you have selected, nmtui displays different fields.

11. Fill the authentication type-related fields.

12. If the Wi-Fi network requires static IP addresses:

    1. Press the Automatic button next to the protocol, and select Manual from the displayed list.
    2. Press the Show button next to the protocol you want to configure to display additional fields, and fill them.

13. Press the OK button to create and automatically activate the new connection.

    
14. Press the Back button to return to the main menu.
15. Select Quit, and press Enter to close the nmtui application.

Verification

1. Display the active connections:

   # nmcli connection show --active
   NAME    ID                                    TYPE  DEVICE
   Office  2501eb7e-7b16-4dc6-97ef-7cc460139a58  wifi  wlp0s20f3

   If the output lists the wifi connection you have created, the connection is active.

2. Ping a hostname or IP address:

   # ping -c 3 example.com

Procedure

1. Open a terminal and enter:

   # nm-connection-editor

2. Click the + button to add a new connection.
3. Select the Wi-Fi connection type, and click Create.
4. Optional: Set a name for the connection profile.

5. Optional: Configure the network profile on the General tab to not automatically connect.

   If you deactivate this feature, you must always manually connect to the network, for example, by using GNOME settings or the GNOME system menu.

6. On the Wi-Fi tab, enter the service set identifier (SSID) in the SSID field.

7. On the Wi-Fi Security tab, select the authentication type for the network, such as WPA3 Personal, and enter the password.

   Depending on the selected security, the application shows additional fields. Fill them accordingly. For details, ask the administrator of the wifi network.

8. Configure IPv4 settings on the IPv4 tab, and IPv6 settings on the IPv6 tab.
9. Click Save.
10. Close the Network Connections window.

Verification

1. Open the system menu on the right side of the top bar, and verify that the wifi network is connected:

   

   If the network appears in the list, it is connected.

2. Ping a hostname or IP address:

   # ping -c 3 example.com

Procedure

1. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      pwd: <password>

   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

2. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure a wifi connection with 802.1X authentication
     hosts: managed-node-01.example.com
     tasks:
       - name: Copy client key for 802.1X authentication
         ansible.builtin.copy:
           src: "/srv/data/client.key"
           dest: "/etc/pki/tls/private/client.key"
           mode: 0400
   
       - name: Copy client certificate for 802.1X authentication
         ansible.builtin.copy:
           src: "/srv/data/client.crt"
           dest: "/etc/pki/tls/certs/client.crt"
   
       - name: Copy CA certificate for 802.1X authentication
         ansible.builtin.copy:
           src: "/srv/data/ca.crt"
           dest: "/etc/pki/ca-trust/source/anchors/ca.crt"
   
       - name: Wifi connection profile with dynamic IP address settings and 802.1X
         ansible.builtin.import_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             - name: Wifi connection profile with dynamic IP address settings and 802.1X
               interface_name: wlp1s0
               state: up
               type: wireless
               autoconnect: yes
               ip:
                 dhcp4: true
                 auto6: true
               wireless:
                 ssid: "Example-wifi"
                 key_mgmt: "wpa-eap"
               ieee802_1x:
                 identity: <user_name>
                 eap: tls
                 private_key: "/etc/pki/tls/client.key"
                 private_key_password: "{{ pwd }}"
                 private_key_password_flags: none
                 client_cert: "/etc/pki/tls/client.pem"
                 ca_cert: "/etc/pki/tls/cacert.pem"
                 domain_suffix_match: "example.com"

   The settings specified in the example playbook include the following:

   ieee802_1x

   This variable contains the 802.1X-related settings.

   eap: tls

   Configures the profile to use the certificate-based TLS authentication method for the Extensible Authentication Protocol (EAP).

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

3. Validate the playbook syntax:

   $ ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

4. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

Procedure

1. Set the wifi security mode to wpa-eap, the Extensible Authentication Protocol (EAP) to peap, the inner authentication protocol to mschapv2, and the user name:

   # nmcli connection modify wlp1s0 wireless-security.key-mgmt wpa-eap 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity user_name

   Note that you must set the wireless-security.key-mgmt, 802-1x.eap, 802-1x.phase2-auth, and 802-1x.identity parameters in a single command.

2. Optional: Store the password in the configuration:

   # nmcli connection modify wlp1s0 802-1x.password password

   Important

   By default, NetworkManager stores the password in plain text in the /etc/sysconfig/network-scripts/keys-connection_name file, which is readable only by the root user. However, plain text passwords in a configuration file can be a security risk.

   To increase the security, set the 802-1x.password-flags parameter to 0x1. With this setting, on servers with the GNOME desktop environment or the nm-applet running, NetworkManager retrieves the password from these services. In other cases, NetworkManager prompts for the password.

3. If the client needs to verify the certificate of the authenticator, set the 802-1x.ca-cert parameter in the connection profile to the path of the CA certificate:

   # nmcli connection modify wlp1s0 802-1x.ca-cert /etc/pki/ca-trust/source/anchors/ca.crt

   Note

   For security reasons, clients should validate the certiciate of the authenticator.

4. Activate the connection profile:

   # nmcli connection up wlp1s0

Procedure

1. Optional: Display the current regulatory domain settings:

   # iw reg get
   global
   country US: DFS-FCC
   ...

2. Create the /etc/sysconfig/regdomain file with the following content:

   COUNTRY=<country_code>

   Set the COUNTRY variable to an ISO 3166-1 alpha2 country code, such as DE for Germany or US for the United States of America.

3. Set the regulatory domain:

   # setregdomain