<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>802-1x: NetworkManager Reference Manual</title>
<meta name="generator" content="DocBook XSL Stylesheets Vsnapshot">
<link rel="home" href="index.html" title="NetworkManager Reference Manual">
<link rel="up" href="ch01.html" title="Configuration Settings">
<link rel="prev" href="settings-6lowpan.html" title="6lowpan">
<link rel="next" href="settings-adsl.html" title="adsl">
<meta name="generator" content="GTK-Doc V1.33.1 (XML mode)">
<link rel="stylesheet" href="style.css" type="text/css">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<table class="navigation" id="top" width="100%" summary="Navigation header" cellpadding="2" cellspacing="5"><tr valign="middle">
<td width="100%" align="left" class="shortcuts">
<a href="#" class="shortcut">Top</a><span id="nav_properties"> <span class="dim">|</span>
<a href="#settings-802-1x.properties" class="shortcut">
Properties
</a></span>
</td>
<td><a accesskey="h" href="index.html"><img src="home.png" width="16" height="16" border="0" alt="Home"></a></td>
<td><a accesskey="u" href="ch01.html"><img src="up.png" width="16" height="16" border="0" alt="Up"></a></td>
<td><a accesskey="p" href="settings-6lowpan.html"><img src="left.png" width="16" height="16" border="0" alt="Prev"></a></td>
<td><a accesskey="n" href="settings-adsl.html"><img src="right.png" width="16" height="16" border="0" alt="Next"></a></td>
</tr></table>
<div class="refentry">
<a name="settings-802-1x"></a><div class="titlepage"></div>
<div class="refnamediv"><table width="100%"><tr>
<td valign="top">
<h2>802-1x</h2>
<p>802-1x — IEEE 802.1x Authentication Settings</p>
</td>
<td class="gallery_image" valign="top" align="right"></td>
</tr></table></div>
<div class="refsect1">
<a name="id-1.3.3.4.2"></a><h2>
Properties
</h2>
<div class="table">
<a name="id-1.3.3.4.2.2.1"></a><p class="title"><b>Table 47. </b></p>
<div class="table-contents"><table class="table" border="1">
<colgroup>
<col>
<col>
<col>
<col>
</colgroup>
<thead><tr>
<th>Key Name</th>
<th>Value Type</th>
<th>Default Value</th>
<th>Value Description</th>
</tr></thead>
<tbody>
<tr>
<td><pre class="screen">altsubject-matches</pre></td>
<td><pre class="screen">array of string</pre></td>
<td><pre class="screen"></pre></td>
<td>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.</td>
</tr>
<tr>
<td><pre class="screen">anonymous-identity</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Anonymous identity string for EAP authentication methods. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS.</td>
</tr>
<tr>
<td><pre class="screen">auth-timeout</pre></td>
<td><pre class="screen">int32</pre></td>
<td><pre class="screen">0</pre></td>
<td>A timeout for the authentication. Zero means the global default; if the global default is not set, the authentication timeout is 25 seconds.</td>
</tr>
<tr>
<td><pre class="screen">ca-cert</pre></td>
<td><pre class="screen">byte array</pre></td>
<td><pre class="screen"></pre></td>
<td>Contains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.</td>
</tr>
<tr>
<td><pre class="screen">ca-cert-password</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>The password used to access the CA certificate stored in "ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</td>
</tr>
<tr>
<td><pre class="screen">ca-cert-password-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "ca-cert-password" property.</td>
</tr>
<tr>
<td><pre class="screen">ca-path</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.</td>
</tr>
<tr>
<td><pre class="screen">client-cert</pre></td>
<td><pre class="screen">byte array</pre></td>
<td><pre class="screen"></pre></td>
<td>Contains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.</td>
</tr>
<tr>
<td><pre class="screen">client-cert-password</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>The password used to access the client certificate stored in "client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</td>
</tr>
<tr>
<td><pre class="screen">client-cert-password-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "client-cert-password" property.</td>
</tr>
<tr>
<td><pre class="screen">domain-match</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a ";" delimited list.</td>
</tr>
<tr>
<td><pre class="screen">domain-suffix-match</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited list.</td>
</tr>
<tr>
<td><pre class="screen">eap</pre></td>
<td><pre class="screen">array of string</pre></td>
<td><pre class="screen"></pre></td>
<td>The allowed EAP method to be used when authenticating to the network with 802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast". Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations.</td>
</tr>
<tr>
<td><pre class="screen">identity</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Identity string for EAP authentication methods. Often the user's user or login name.</td>
</tr>
<tr>
<td><pre class="screen">optional</pre></td>
<td><pre class="screen">boolean</pre></td>
<td><pre class="screen">FALSE</pre></td>
<td>Whether the 802.1X authentication is optional. If TRUE, the activation will continue even after a timeout or an authentication failure. Setting the property to TRUE is currently allowed only for Ethernet connections. If set to FALSE, the activation can continue only after a successful authentication.</td>
</tr>
<tr>
<td><pre class="screen">pac-file</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>UTF-8 encoded file path containing PAC for EAP-FAST.</td>
</tr>
<tr>
<td><pre class="screen">password</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>UTF-8 encoded password used for EAP authentication methods. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</td>
</tr>
<tr>
<td><pre class="screen">password-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "password" property.</td>
</tr>
<tr>
<td><pre class="screen">password-raw</pre></td>
<td><pre class="screen">byte array</pre></td>
<td><pre class="screen"></pre></td>
<td>Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF-8 to be used. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</td>
</tr>
<tr>
<td><pre class="screen">password-raw-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "password-raw" property.</td>
</tr>
<tr>
<td><pre class="screen">phase1-auth-flags</pre></td>
<td><pre class="screen">uint32</pre></td>
<td><pre class="screen">0</pre></td>
<td>Specifies authentication flags to use in "phase 1" outer authentication using NMSetting8021xAuthFlags options. The individual TLS versions can be explicitly disabled. If a certain TLS disable flag is not set, it is up to the supplicant to allow or forbid it. The TLS options map to tls_disable_tlsv1_x settings. See the wpa_supplicant documentation for more details.</td>
</tr>
<tr>
<td><pre class="screen">phase1-fast-provisioning</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Enables or disables in-line provisioning of EAP-FAST credentials when FAST is specified as the EAP method in the "eap" property. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning). See the wpa_supplicant documentation for more details.</td>
</tr>
<tr>
<td><pre class="screen">phase1-peaplabel</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Forces use of the new PEAP label during key derivation. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1. Set to "1" to force use of the new PEAP label. See the wpa_supplicant documentation for more details.</td>
</tr>
<tr>
<td><pre class="screen">phase1-peapver</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Forces which PEAP version is used when PEAP is set as the EAP method in the "eap" property. When unset, the version reported by the server will be used. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version. To do so, this property may be set to "0" or "1" to force that specific PEAP version.</td>
</tr>
<tr>
<td><pre class="screen">phase2-altsubject-matches</pre></td>
<td><pre class="screen">array of string</pre></td>
<td><pre class="screen"></pre></td>
<td>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed.</td>
</tr>
<tr>
<td><pre class="screen">phase2-auth</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Specifies the allowed "phase 2" inner non-EAP authentication method when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized non-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</td>
</tr>
<tr>
<td><pre class="screen">phase2-autheap</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Specifies the allowed "phase 2" inner EAP-based authentication method when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized EAP-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</td>
</tr>
<tr>
<td><pre class="screen">phase2-ca-cert</pre></td>
<td><pre class="screen">byte array</pre></td>
<td><pre class="screen"></pre></td>
<td>Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.</td>
</tr>
<tr>
<td><pre class="screen">phase2-ca-cert-password</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>The password used to access the "phase2" CA certificate stored in "phase2-ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</td>
</tr>
<tr>
<td><pre class="screen">phase2-ca-cert-password-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "phase2-ca-cert-password" property.</td>
</tr>
<tr>
<td><pre class="screen">phase2-ca-path</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.</td>
</tr>
<tr>
<td><pre class="screen">phase2-client-cert</pre></td>
<td><pre class="screen">byte array</pre></td>
<td><pre class="screen"></pre></td>
<td>Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</td>
</tr>
<tr>
<td><pre class="screen">phase2-client-cert-password</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>The password used to access the "phase2" client certificate stored in "phase2-client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</td>
</tr>
<tr>
<td><pre class="screen">phase2-client-cert-password-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "phase2-client-cert-password" property.</td>
</tr>
<tr>
<td><pre class="screen">phase2-domain-match</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a ";" delimited list.</td>
</tr>
<tr>
<td><pre class="screen">phase2-domain-suffix-match</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited list.</td>
</tr>
<tr>
<td><pre class="screen">phase2-private-key</pre></td>
<td><pre class="screen">byte array</pre></td>
<td><pre class="screen"></pre></td>
<td>Contains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.</td>
</tr>
<tr>
<td><pre class="screen">phase2-private-key-password</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>The password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key.</td>
</tr>
<tr>
<td><pre class="screen">phase2-private-key-password-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "phase2-private-key-password" property.</td>
</tr>
<tr>
<td><pre class="screen">phase2-subject-match</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication. When unset, no verification of the authentication server certificate's subject is performed. This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:phase2-domain-suffix-match.</td>
</tr>
<tr>
<td><pre class="screen">pin</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>PIN used for EAP authentication methods.</td>
</tr>
<tr>
<td><pre class="screen">pin-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "pin" property.</td>
</tr>
<tr>
<td><pre class="screen">private-key</pre></td>
<td><pre class="screen">byte array</pre></td>
<td><pre class="screen"></pre></td>
<td>Contains the private key when the "eap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.</td>
</tr>
<tr>
<td><pre class="screen">private-key-password</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>The password used to decrypt the private key specified in the "private-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key.</td>
</tr>
<tr>
<td><pre class="screen">private-key-password-flags</pre></td>
<td><pre class="screen">NMSettingSecretFlags (uint32)</pre></td>
<td><pre class="screen"></pre></td>
<td>Flags indicating how to handle the "private-key-password" property.</td>
</tr>
<tr>
<td><pre class="screen">subject-match</pre></td>
<td><pre class="screen">string</pre></td>
<td><pre class="screen"></pre></td>
<td>Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed. This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:domain-suffix-match.</td>
</tr>
<tr>
<td><pre class="screen">system-ca-certs</pre></td>
<td><pre class="screen">boolean</pre></td>
<td><pre class="screen">FALSE</pre></td>
<td>When TRUE, overrides the "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch. The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca-cert" and "phase2-ca-cert" properties. If the path provided with --system-ca-path is rather a file name (bundle of trusted CA certificates), it overrides "ca-cert" and "phase2-ca-cert" properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant).</td>
</tr>
</tbody>
</table></div>
</div>
<p><br class="table-break"></p>
</div>
</div>
<div class="footer">
<hr>Generated by GTK-Doc V1.33.1</div>
</body>
</html>