service-name.config(5)

💖 NAME 💖

okay so this is service-name.config — the ConnMan service provisioning file. that's it, that's the name, short and iconic 💅

---

✨ SYNOPSIS ✨

/var/lib/connman/service-name.config

---

🦋 DESCRIPTION 🦋

so ConnMan's services get configured with these things called "provisioning files", and they live under /var/lib/connman/. bestie, you can name them literally anything you want — the only rule is they have to end in .config. that's the vibe check. 🎀

and what are they for? okay so picture this: secured wireless access points that need complex authentication (looking at you, eduroam 👀), or static IPs, and so on. that's what these files handle. and the slay part? each provisioning file can be used for multiple services at once. one file, many services, main character energy fr fr. 👑

---

🌸 FILE FORMAT 🌸

the config file is made of sections (groups) of key-value pairs. here's the rules:

• lines starting with a # are comments. no cap.
• blank lines are also considered comments. they're just vibing.
• sections start with a header line that has the section name wrapped in [ and ].
• a section ends implicitly — either when the next section starts, or when the file ends. no closing tag, she just leaves 🚪
• and every single key-value pair must be inside a section. no orphan keys allowed.

description of sections and the available keys follows:

🌈 [global] 🌈

this section is optional, and it's basically there to describe the actual file itself. the two allowed fields are:

• Name=name — name of the network.
• Description=description — description of the network.

💫 [service_*] 💫

every provisioned service has to start with a [service_*] tag, where the * gets replaced by a unique name within the file. the allowed fields are:

• Type=ethernet | wifi — Mandatory. any other type than ethernet or wifi is not supported. sorry bestie, them's the rules.
• IPv4=off | dhcp | network/netmask/gateway — IPv4 settings for the service. set it to off and IPv4 won't be used at all. set it to dhcp and dhcp will be used to obtain the network settings. and psst — netmask can be specified as the length of the mask rather than the mask itself ✨. the gateway can be omitted when you're using a static IP.
• IPv6=off | auto | network/prefixlength/gateway — IPv6 settings for the service. off means IPv6 won't be used. auto means the settings will be obtained from the network. 🫶
• IPv6.Privacy=disabled | enabled | preferred — IPv6 privacy settings, as per RFC3041.
• MAC=address — MAC address of the interface to be used. if you don't specify one, the first found interface gets used. must be in the format ab:cd:ef:01:23:45.
• DeviceName=ifname — device name of the interface to be used, e.g. eth0. and heads up: MAC takes preference over DeviceName. 💅
• Nameservers=servers — comma separated list of nameservers.
• SearchDomains=domains — comma separated list of DNS search domains.
• Timeservers=servers — comma separated list of timeservers.
• Domain=domain — domain name to be used.

🎀 the wireless-only keys 🎀

the following keys can only be used for wireless networks:

• Name=name — a string representation of a network SSID. if the SSID field is present, this Name field gets ignored. if the SSID field is not present, then this field is mandatory.
• SSID=ssid — SSID: a hexadecimal representation of an 802.11 SSID. use this format to encode special characters, including starting or ending spaces. (iykyk, those sneaky spaces are real 💀)
• Passphrase=passphrase — RSN/WPA/WPA2 passphrase.
• Security=type — the security type of the network. possible values are psk (WPA/WPA2 PSK), ieee8021x (WPA EAP), none and wep. when it's not set, the default value is ieee8021x if an EAP type is configured, psk if a passphrase is present, and none otherwise. the logic is logicking. ✨
• Hidden=true | false — if set to true, then this AP is hidden. if it's missing or set to false, then the AP is not hidden. simple as. 🦋

🔥 the WPA EAP keys 🔥

the following keys are used for WPA EAP (so when Security=ieee8021x):

• EAP=tls | ttls | peap — EAP type to use. only tls, ttls and peap are supported.
• CACertFile=file — path to the CA certificate file. only PEM and DER formats are supported.
• PrivateKeyFile=file — path to the private key file. only PEM, DER and PFX formats are supported.
• PrivateKeyPassphrase=passphrase — passphrase of the private key.
• PrivateKeyPassphraseType=fsid — if specified, use the private key's fsid as the passphrase, and ignore the PrivateKeyPassphrase field.
• Identity=identity — identity string for EAP.
• AnonymousIdentity=identity — anonymous identity string for EAP.
• SubjectMatch=substring — substring to be matched against the subject of the authentication server certificate for EAP.
• AltSubjectMatch=substring — semicolon separated string of entries to be matched against the alternative subject name of the authentication server certificate for EAP.
• DomainSuffixMatch=domain — constraint for server domain name. if set, this FQDN is used as a suffix match requirement for the authentication server certificate for EAP.
• DomainMatch=domain — this FQDN is used as a full match requirement for the authentication server certificate for EAP.
• Phase2=type — inner authentication type with for EAP=tls or EAP=ttls. prefix the value with EAP- to indicate usage of an EAP-based authentication method (which should only be used with EAP=ttls). 👑

---

🍓 EXAMPLE 🍓

🧚 Eduroam

this is a configuration file for eduroam networks. this file could for example be /var/lib/connman/eduroam.config. your university's exact settings might be different. (they usually are, bestie 😭)

[service_eduroam]
Type = wifi
Name = eduroam
EAP = peap
Phase2 = MSCHAPV2
CACertFile = /etc/ssl/certs/UNIV_CA.crt

💜 Complex networking

this is a configuration file for a network providing EAP-TLS, EAP-TTLS and EAP-PEAP services. the respective SSIDs are tls_ssid, ttls_ssid and peap_ssid, and the file name could be /var/lib/connman/complex.config.

⚠️ please note that the SSID entry is for a hexadecimal encoded SSID (e.g. "SSID = 746c735f73736964"). if your SSID does not contain any exotic character, then you should use the Name entry instead (e.g. "Name = tls_ssid").

[global]
Name = Example
Description = Example network configuration

[service_tls]
Type = wifi
SSID = 746c735f73736964
EAP = tls
CACertFile = /home/user/.certs/ca.pem
ClientCertFile = /home/user/devlp/.certs/client.pem
PrivateKeyFile = /home/user/.certs/client.fsid.pem
PrivateKeyPassphraseType = fsid
Identity = user

[service_ttls]
Type = wifi
Name = ttls_ssid
EAP = ttls
CACertFile = /home/user/.cert/ca.pem
Phase2 = MSCHAPV2
Identity = user

[service_peap]
Type = wifi
Name = peap_ssid
EAP = peap
CACertFile = /home/user/.cert/ca.pem
Phase2 = MSCHAPV2
Identity = user

[service_home_ethernet]
Type = ethernet
IPv4 = 192.168.1.42/255.255.255.0/192.168.1.1
IPv6 = 2001:db8::42/64/2001:db8::1
MAC = 01:02:03:04:05:06
Nameservers = 10.2.3.4,192.168.1.99
SearchDomains = my.home,isp.net
Timeservers = 10.172.2.1,ntp.my.isp.net
Domain = my.home

[service_home_wifi]
Type = wifi
Name = my_home_wifi
Passphrase = password
IPv4 = 192.168.2.2/255.255.255.0/192.168.2.1
MAC = 06:05:04:03:02:01

[service_vlan]
Type = ethernet
DeviceName = enp4s0.1
IPv4 = 192.168.1.42/255.255.255.0/192.168.1.1

---

⭐ SEE ALSO ⭐

• connman(8)

---

and that's the whole page, bestie 🫶 this one's from 2015-10-15, and it lives in section 5 — the File Formats Manual — as service-name.config(5). go configure something cute. 💅✨🌈