netctl

From ArchWiki
Revision as of 19:51, 5 August 2013 by Lahwaacz (Talk | contribs) (Bonding: cleanup)

Jump to: navigation, search

Template:Article summary start Template:Article summary text Template:Article summary heading Template:Article summary text Template:Article summary heading Template:Article summary wiki Template:Article summary end

Netctl is a CLI-based tool used to configure and manage network connections via profiles. It is a native Arch Linux project that replaces the old netcfg utility.

Installation

The netctl package is available in the official repositories. Installing netctl will replace netcfgAUR.

netctl and netcfgAUR are conflicting packages. You will be potentially connectionless after installing netctl if your profiles are misconfigured.

Note: It may be a good idea to use systemctl --type=service to ensure that no other service is running that may want to configure the network. Multiple networking services will conflict.

Required reading

It is advisable to read the following man pages before using netctl:

Configuration

netctl uses profiles to manage network connections, profile files are stored in /etc/netctl/. Example configuration files are provided for the user to assist them in configuring their network connection. These example profiles are located in /etc/netctl/examples/. The common configurations include:

  • ethernet-dhcp
  • ethernet-static
  • wireless-wpa
  • wireless-wpa-static

For wireless settings, you can use wifi-menu -o to generate the profile file in /etc/netctl/.

To use an example profile, simply copy one of them from /etc/netctl/examples/ to /etc/netctl/ and configure it to your needs:

# cp /etc/netctl/examples/wireless-wpa /etc/netctl/profile

Once you have created your profile, make an attempt to establish a connection using the newly created profile by running:

# netctl start profile
Note: profile is the file name, not including the full path. Providing the full path will make netctl return with an error code.

If issuing the above command results in a failure, then use journalctl -xn and netctl status profile in order to obtain a more in depth explanation of the failure. Make the needed corrections to the failed configuration and retest.

Automatic operation

If you use only one profile (per interface) or want to switch profiles manually, the basic method will do. Most common examples are servers, workstations, routers etc.

If you need to switch multiple profiles frequently, use Automatic switching of profiles. Most common examples are laptops.

Basic method

With this method, you can statically start only one profile per interface. First manually check that the profile can be started successfully, then it can be enabled using

# netctl enable profile

This will create and enable a systemd service that will start when the computer boots.

Note: The connection is only established if the profile can be started succesfully at boot time (or when the service starts). That specifically means, in case of wired connection the cable must be plugged-in, in case of wireless connection the network must be in range.
Tip: To enable static IP profile on wired interface no matter if the cable is connected or not, use SkipNoCarrier=yes in your profile.

Automatic switching of profiles

netctl provides two special systemd services for automatic switching of profiles: netctl-auto@interface.service for wireless interfaces, and netctl-ifplugd@interface.service for wired interfaces. Using netctl-auto@interface.service, netctl profiles change as you move from range of one network into range of other network. Using netctl-ifplugd@interface.service, netctl profiles change as you plug the cable in and out.

Note: netcfg used net-auto-wireless.service and net-auto-wired.service for this purpose.

First install required packages:

  • Package wpa_actiond is required to use netctl-auto@interface.service.
  • Package ifplugd is required to use netctl-ifplugd@interface.service.

Now configure all profiles that netctl-auto@interface.service or netctl-ifplugd@interface.service can start. If you want some profile not to be started automatically by these services, you have to explicitly add ExcludeAuto=yes to that profile. You can use Priority= to set priority of some profile when multiple profiles are available. See netctl.profile(5) for details.

Warning: Automatic selection of a WPA-enabled profile by netctl-auto is not possible with option Security=wpa-config, please use Security=wpa-configsection instead.

Once your profiles are set and verified to be working, simply enable these services using systemctl:

# systemctl enable netctl-auto@interface.service 
# systemctl enable netctl-ifplugd@interface.service  
Warning: If any of the profiles contain errors, such as an empty Key= variable, the unit will fail to load at boot.
Warning: This method conflicts with the basic method. If you have previously enabled a profile through netctl, run
# netctl disable profile
to prevent the profile from starting twice at boot.

Migrating from netcfg

netctl uses /etc/netctl to store its profiles, not /etc/network.d (netcfg's profile storage location).

In order to migrate from netcfg, at least the following is needed:

  • Disable the netcfg service: systemctl disable netcfg.service.
  • Uninstall netcfg and install netctl.
  • Move network profile files to the new directory.
  • Rename variables therein according to netctl.profile(5) (Most variable names have only UpperCamelCase i.e CONNECTION becomes Connection).
  • For static IP configuration make sure the Address variables have a netmask after the IP (e.g. Address=('192.168.1.23/24' '192.168.1.87/24') in the example profile).
  • If you setup a wireless profile according in the wireless-wpa-configsection example, note that this overrides wpa_supplicant options defined above the brackets. For a connection to a hidden wireless network, add scan_ssid=1 to the options in the wireless-wpa-configsection; Hidden=yes does not work there.
  • Unquote interface variables and other variables that don't strictly need quoting (this is mainly a style thing).
  • Run netctl enable profile for every profile in the old NETWORKS array. last doesn't work this way, see netctl.special(7).
  • Use netctl list and/or netctl start profile instead of netcfg-menu. wifi-menu remains available.
  • Unlike netcfg, by default netctl fails to bring up a NIC when it is not connected to another powered up NIC. To solve this problem, add SkipNoCarrier=yes at the end of your /etc/netctl/profile.

Passphrase obfuscation (256-bit PSK)

Note: Although "encrypted", the key that you put in the profile configuration is enough to connect to a WPA-PSK network. Therefore this process is only useful for hiding the human-readable version of the passphrase. This will not prevent anyone with read access to this file from connecting to the network. You should ask yourself if there is any use in this at all, since using the same passphrase for anything else is a very poor security measure.

Users not wishing to have the passphrase to their wireless network stored in plain text have the option of storing the corresponding 256-bit pre-shared key (PSK) instead, which is calculated from the passphrase and the SSID using standard algorithms.

  • Method 1: Use wifi-menu -o to generate a config file in /etc/netctl
  • Method 2: Manual settings as follows. If the passphrase fails, try removing the \" in Key= (see note below)

For both methods it is suggested to chmod 600 /etc/netctl/<config_file> to prevent user access to the password.

Calculate your 256-bit PSK using wpa_passphrase:

$ wpa_passphrase archlinux freenode
network={
  ssid="archlinux"
  #psk="freenode"
  psk=64cf3ced850ecef39197bb7b7b301fc39437a6aa6c6a599d0534b16af578e04a
}
Note: This information will be used in your profile, so do not close the terminal.

In a second terminal window, copy the example file wireless-wpa from /etc/netctl/examples to /etc/netctl:

# cp /etc/netctl/examples/wireless-wpa /etc/netctl/wireless-wpa

You will then need to edit /etc/netctl/wireless-wpa using your favorite text editor and add the pre-shared key, that was generated earlier using wpa_passphrase, to the Key variable of this profile.

Once completed your network profile wireless-wpa containing a 256-bit PSK should resemble:

/etc/netctl/wireless-wpa
Description='A simple WPA encrypted wireless connection using 256-bit PSK'
Interface=wlp2s2
Connection=wireless
Security=wpa
IP=dhcp
ESSID=archlinux
Key=\"64cf3ced850ecef39197bb7b7b301fc39437a6aa6c6a599d0534b16af578e04a
Note: Make sure to use the special non-quoted rules for Key= that are explained at the end of netctl.profile(5).

Support

Official announcement thread: https://bbs.archlinux.org/viewtopic.php?id=157670

Tips and tricks

Replace 'netcfg current'

As of April 2013 there is no netctl alternative to netcfg current. If you relied on it for something, like a status bar for a tiling window manager, you can now use:

# netctl list | awk '/*/ {print $2}'

or, when netctl-auto was used to connect:

# wpa_cli -i interface status | sed -n 's/^id_str=//p'

Eduroam

Some universities use a system called "Eduroam" to manage their wireless networks. For this system, a WPA config-section profile with the following format is often useful:

/etc/netctl/wlan0-eduroam
Description='Eduroam-profile for <user>'
Interface=wlan0
Connection=wireless
Security=wpa-configsection
IP=dhcp
WPAConfigSection=(
 'ssid="eduroam"'
 'proto=RSN'
 'key_mgmt=WPA-EAP'
 'pairwise=CCMP'
 'auth_alg=OPEN'
 'eap=PEAP'
 'identity="<user>"'
 'password="<password>"'
)

Bonding

Copy /etc/netctl/examples/bonding to /etc/netctl/bonding and edit it, for example:

/etc/netctl/bonding
Description='Bond Interface'
Interface='bond0'
Connection=bond
BindsToInterfaces=('eth0' 'eth1')
IP=dhcp
IP6=stateless

Now you can disable your old configuration and set bonding to be started automatically. Switch to the new profile, for example:

# netctl switch-to bonding
Note: To change the bonding mode (default is round robin) to, e.g, active backup:

Create /etc/modprobe.d/bonding.conf:

/etc/modprobe.d/bonding.conf
options bonding mode=active-backup
options bonding miimon=100
For more information about the different bonding policies (and other driver settings) see the Linux Ethernet Bonding Driver HOWTO and The Linux Foundation: bonding.

To check the status and bonding mode:

$ cat /proc/net/bonding/bond0

Wired -> Wireless Failover

Using bonding to fallback to wireless when the wired ethernet goes down, this also detects the presence of either network connection and starts dhcpcd when either or both are connected.

You'll need additional packages from the official repositories: ifplugd, ifenslave and wpa_supplicant.

First configure the bonding driver to use active-backup:

/etc/modprobe.d/bonding.conf
options bonding mode=active-backup
options bonding miimon=100
options bonding primary=eth0
options bonding max_bonds=0

The max-bonds line avoids the Interface bond0 already exists error.

Next, configure a netctl profile to enslave the two hardware interfaces:

/etc/netctl/failover
Description='A wired connection with failover to wireless'
Interface='bond0'
Connection=bond
BindsToInterfaces=('eth0' 'wlan0')
IP='no'
SkipNoCarrier='no'

Enable the profile on startup.

# netctl enable failover

Configure wpa_supplicant to associate with known networks. This can be done with a netctl profile (remember to use IP='no') and a wpa_supplicant service running constantly, or on-demand with wpa_cli. Ways to do this are covered on the wpa_supplicant page.

Create an ifplugd action for automatic DHCP assignment on the bonded interface:

/etc/ifplugd/bond_dhcp.action
#!/bin/sh

case "$2" in
  up)
    systemctl start "dhcpcd@$1.service" && exit 0
    ;;
  down)
    systemctl stop "dhcpcd@$1.service" && exit 0
    ;;
  *)
    echo "Wrong arguments" > /dev/stderr
    ;;
esac
exit 1

and make it executable

# chmod +x /etc/ifplugd/bond_dhcp.action

Then create the systemd service which starts ifplugd for bond0:

/etc/systemd/system/net-auto-bonded@.service
[Unit]
Description=Provides automatic dhcp resolution for bonded failover connection
Requires=netctl@failover.service
After=netctl@failover.service

[Service]
ExecStart=/usr/bin/ifplugd -i %i -r /etc/ifplugd/bond_dhcp.action -fIns

[Install]
WantedBy=multi-user.target

Enable the net-auto-bonded service and reboot:

# systemctl enable net-auto-bonded@bond0.service
# reboot

If you have a wired and wireless connection to the same network, you can probably now disconnect and reconnect the wired connection without losing connectivity. In most cases, even streaming music won't skip!