[deployment-guide/comm-rel: 63/74] Minor formatting enhancements.
by dsilas
commit 20cb89a37941a6c51a61282186fb1c6d22a3a922
Author: Jaromir Hradilek <jhradile(a)redhat.com>
Date: Tue Jun 29 11:29:25 2010 +0200
Minor formatting enhancements.
en-US/Controlling_Access_to_Services.xml | 31 ++++++++++++++++++++++-------
1 files changed, 23 insertions(+), 8 deletions(-)
---
diff --git a/en-US/Controlling_Access_to_Services.xml b/en-US/Controlling_Access_to_Services.xml
index 927d943..363a599 100644
--- a/en-US/Controlling_Access_to_Services.xml
+++ b/en-US/Controlling_Access_to_Services.xml
@@ -442,7 +442,9 @@ Password: </screen>
<para>
To display a list of system services (i.e., both the services from the <filename class="directory">/etc/rc.d/init.d/</filename> directory, and the services controlled by <application>xinetd</application>), either type <command>chkconfig --list</command>, or use <command>chkconfig</command> with no additional arguments. You should be presented with an output similar to this:
</para>
- <screen>~]# <command>chkconfig --list</command>
+ <example id="ex-services-chkconfig-listing-all">
+ <title>Listing the services</title>
+ <screen>~]# <command>chkconfig --list</command>
NetworkManager 0:off 1:off 2:on 3:on 4:on 5:on 6:off
abrtd 0:off 1:off 2:off 3:on 4:off 5:on 6:off
acpid 0:off 1:off 2:on 3:on 4:on 5:on 6:off
@@ -462,19 +464,26 @@ xinetd based services:
discard-dgram: off
<emphasis>... several lines omitted ...</emphasis>
time-stream: off</screen>
+ </example>
<para>
As you can see, each line consists of the name of the service followed by its status (<emphasis>on</emphasis> or <emphasis>off</emphasis>) for each of the seven numbered runlevels. For example, in the listing above, <application>NetworkManager</application> is enabled for runlevel 2, 3, 4, and 5, while <application>abrtd</application> runs in runlevel 3 and 5. The <application>xinetd</application> based services are listed at the end, being either <emphasis>on</emphasis>, or <emphasis>off</emphasis>.
</para>
<para>
To display the current settings for selected service only, use <command>chkconfig --list</command> followed by the name of the service:
</para>
- <screen>~]# <command>chkconfig --list sshd</command>
+ <example id="ex-services-chkconfig-listing-single">
+ <title>Listing a single service</title>
+ <screen>~]# <command>chkconfig --list sshd</command>
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off</screen>
- <para>
- You can also use <command>chkconfig --list <replaceable><service></replaceable></command> to display the status of a service that is managed by <application>xinetd</application>. In that case, the output will simply contain the information whether the service is enabled or disabled:
- </para>
- <screen>~]# <command>chkconfig --list rsync</command>
+ </example>
+ <para>
+ You can also use <command>chkconfig --list <replaceable><service></replaceable></command> to display the status of a service that is managed by <application>xinetd</application>. In that case, the output will simply contain the information whether the service is enabled or disabled:
+ </para>
+ <example id="ex-services-chkconfig-listing-xinetd">
+ <title>Listing a service that is managed by <application>xinetd</application></title>
+ <screen>~]# <command>chkconfig --list rsync</command>
rsync off</screen>
+ </example>
</section>
<section id="s3-services-chkconfig-enabling">
<title>Enabling the Service</title>
@@ -577,12 +586,17 @@ Starting httpd: [ OK ]</screen>
<para>
To check the current status of the service, type <command>service <replaceable><service_name></replaceable> status</command>. For example:
</para>
- <screen>~]# <command>service httpd status</command>
+ <example id="ex-services-running-checking-single">
+ <title>Checking the status of <application>httpd</application></title>
+ <screen>~]# <command>service httpd status</command>
httpd (pid 7474) is running...</screen>
+ </example>
<para>
You can also display the status of all available services at once using the <option>--status-all</option> option:
</para>
- <screen>~]# <command>service --status-all</command>
+ <example id="ex-services-running-checking-all">
+ <title>Checking the status of all services</title>
+ <screen>~]# <command>service --status-all</command>
abrt (pid 1492) is running...
acpid (pid 1305) is running...
atd (pid 1540) is running...
@@ -592,6 +606,7 @@ Avahi daemon is running
cpuspeed is stopped
<emphasis>... several lines omitted ...</emphasis>
wpa_supplicant (pid 1227) is running...</screen>
+ </example>
</section>
</section>
</section>
13 years, 11 months
[deployment-guide/comm-rel: 62/74] NetConf: comment out non-public template text, remarks
by dsilas
commit 10ea14703a9fa831320f510b21fb12c8856faa3b
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Mon Jun 28 20:55:26 2010 +0200
NetConf: comment out non-public template text, remarks
en-US/Network_Configuration.xml | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
---
diff --git a/en-US/Network_Configuration.xml b/en-US/Network_Configuration.xml
index ff3b9df..74172dd 100644
--- a/en-US/Network_Configuration.xml
+++ b/en-US/Network_Configuration.xml
@@ -517,7 +517,7 @@ NetworkManager (pid 1527) is running...
<section
id="sec-Establishing_a_Mobile_Broadband_Connection">
<title>Establishing a Mobile Broadband Connection</title>
- <remark>What is a <replaceable><type></replaceable> connection</remark>
+ <!--<remark>What is a <replaceable><type></replaceable> connection</remark>
<remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark>
<para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
@@ -548,11 +548,11 @@ NetworkManager (pid 1527) is running...
<para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
<para>At this point, you have created a new <replaceable><type></replaceable> connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
- <para>Then, to configure:</para>
+ <para>Then, to configure:</para>-->
<itemizedlist>
- <listitem>
+ <!--<listitem>
<para>;</para>
- </listitem>
+ </listitem>-->
<listitem>
<para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
linkend="sec-Configuring_IPv4_Settings"/>; or,
13 years, 11 months
[deployment-guide/comm-rel: 61/74] Merge branch 'martin'
by dsilas
commit 16c2b5aa67c8a426498ca11e8d45ac8c71a7f09a
Merge: 5484887... 0fa5efb...
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Mon Jun 28 20:52:56 2010 +0200
Merge branch 'martin'
en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
13 years, 11 months
[deployment-guide/comm-rel: 60/74] Merge branch 'jarek'
by dsilas
commit 548488751ecc0a89405ba5b1fda82e9a50220a7c
Merge: 4cb5e8a... bb8452e...
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Mon Jun 28 20:50:42 2010 +0200
Merge branch 'jarek'
en-US/OpenSSH.xml | 1002 ++++++++++++++++++++++++++++++-----------------------
1 files changed, 577 insertions(+), 425 deletions(-)
---
13 years, 11 months
[deployment-guide/comm-rel: 59/74] NetConf: complete wireless tab descriptions, +doc
by dsilas
commit 4cb5e8aadbcf2ce8a7259eff0ae0332a93524ab1
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Mon Jun 28 20:50:09 2010 +0200
NetConf: complete wireless tab descriptions, +doc
en-US/Network_Configuration.xml | 1807 ++++++++++++++++++++-------------------
1 files changed, 925 insertions(+), 882 deletions(-)
---
diff --git a/en-US/Network_Configuration.xml b/en-US/Network_Configuration.xml
index ca8656a..ff3b9df 100644
--- a/en-US/Network_Configuration.xml
+++ b/en-US/Network_Configuration.xml
@@ -271,7 +271,7 @@ NetworkManager (pid 1527) is running...
</term>
<listitem>
<para>Network hardware such as a Network Interface Card (NIC) has a unique MAC address (Media Access Control; also known as a <firstterm>hardware address</firstterm>) that identifies it to the system. Running the <command>ip addr</command> command will show the MAC address associated with each interface. For example, in the following <command>ip addr</command> output, the MAC address for the eth0 interface (which is <computeroutput> 52:54:00:26:9e:f1</computeroutput>) immediately follows the <computeroutput>link/ether</computeroutput> keyword:</para>
- <screen>~]# <command>ip addr</command>
+ <screen>~]# <command>ip addr</command>
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
@@ -282,191 +282,188 @@ NetworkManager (pid 1527) is running...
inet 192.168.122.251/24 brd 192.168.122.255 scope global eth0
inet6 fe80::5054:ff:fe26:9ef1/64 scope link
valid_lft forever preferred_lft forever</screen>
- <para>A single system can have one or more NICs installed on it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific NIC with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>MTU</guilabel>
- </term>
+ <para>A single system can have one or more NICs installed on it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific NIC with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>MTU</guilabel>
+ </term>
+ <listitem>
+ <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.</para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ <bridgehead
+ id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-Wired">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
+ <para>Once you have finished editing your new wired connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
+ linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
+ <para>At this point, you have created a new wired connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
+ <para>Then, to configure:</para>
+ <itemizedlist>
<listitem>
- <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.</para>
- </listitem>
- </varlistentry>
- </variablelist>
- <bridgehead
- id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-Wired">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
- <para>Once you have finished editing your new wired connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
- linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
- <para>At this point, you have created a new wired connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
- <para>Then, to configure:</para>
- <itemizedlist>
- <listitem>
- <para>port-based Network Access Control (PNAC), click the <guilabel>802.1x Security</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_802.1x_Security"/>;
+ <para>port-based Network Access Control (PNAC), click the <guilabel>802.1x Security</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_802.1x_Security"/>;
</para>
- </listitem>
- <listitem>
- <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv4_Settings"/>; or,
+ </listitem>
+ <listitem>
+ <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv4_Settings"/>; or,
</para>
- </listitem>
- <listitem>
- <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv6_Settings"/>.
+ </listitem>
+ <listitem>
+ <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv6_Settings"/>.
</para>
- </listitem>
- </itemizedlist>
- </section>
- <section
- id="sec-Establishing_a_Wireless_Connection">
- <title>Establishing a Wireless Connection</title>
- <para>
- <application>NetworkManager</application> makes configuring a wireless (also known as wi-fi or 802.1<replaceable>a/b/g/n</replaceable>) connection quick and simple. To establish a wireless connection, you need:</para>
- <itemizedlist>
- <listitem>
- <para>a computer capable of wi-fi connectivity (such as a laptop with an integrated 802.1<replaceable>x</replaceable> card or chip);</para>
- </listitem>
- <listitem>
- <para>a wireless access point to connect to (such as a wireless router); and,</para>
- </listitem>
- <listitem>
- <para>if the access point is secured, an authentication secret such as a key, passphrase, or digital certificate.</para>
- </listitem>
- </itemizedlist>
- <para>To configure a mobile broadband (such as 3G) connection instead of a wireless one, refer to <xref
- linkend="sec-Establishing_a_Mobile_Broadband_Connection"/>.</para>
- <!--<para>There are two ways to create a connection for a wireless access point. The first (and easier) way is to simply try to connect to an available wireless access point (see <xref
- linkend="bh-Quickly_Connecting_to_an_Existing_Access_Point"/>), and the second way is to create a new, blank connection and configure its settings (see <xref
- linkend="bh-Creating_a_New_Wireless_Connection"/>).</para>-->
- <bridgehead
- id="bh-Quickly_Connecting_to_an_Available_Access_Point">Quickly Connecting to an Available Access Point</bridgehead>
- <para>The easiest way to connect to an available access point is to left-click on the <application>NetworkManager</application> applet, locate the SSID of the access point in the list of <guilabel>Available</guilabel> networks, and click on it. If the access point is secured, a dialog prompts you for authentication.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-Wireless_authentication_required">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-Wireless_authentication_required.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Authenticating with a wireless access point</para>
- </caption>
- </mediaobject>
- <para>
- <application>NetworkManager</application> tries to auto-detect the type of security used by the access point. If there are multiple possibilities, <application>NetworkManager</application> guesses the security type and presents it in the <guilabel>Wireless security</guilabel> dropdown. To see if there are multiple choices, click the <guilabel>Wireless security</guilabel> dropdown menu and select the type of security the access point is using. If you are unsure, try connecting to each type in turn. Finally, enter the key or passphrase in the <guilabel>Password</guilabel> field. Certain password types, such as a 40-bit WEP or 128-bit WPA key, are invalid unless they are of a requisite length. The <guilabel>Connect</guilabel> button will remain inactive until you enter a key of the length required for the selected security type. To learn more about wireless security, refer to <xref
- linkend="sec-Configuring_Wireless_Security"/>.</para>
- <para>If <application>NetworkManager</application> connects to the access point succesfully, its applet icon will change into a graphical indicator of the wireless connection's signal strength.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM_applet-signal_strength_75">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM_applet-signal_strength_75.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Applet icon indicating a wireless connection signal strength of 75%</para>
- </caption>
- </mediaobject>
- <para>You can also edit the settings for one of these auto-created access point connections just as if you had <guilabel>Add</guilabel>ded it yourself. The <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window lists all of the connections you have ever tried to connect to: <application>NetworkManager</application> names each of them <computeroutput>Auto <replaceable><SSID></replaceable>
- </computeroutput>, where SSID is the <firstterm>Service Set identifier</firstterm> of the access point.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-Wireless_Auto_Connections_List">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-Wireless_Auto_Connections_List.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Previous access points that have been connected to</para>
- </caption>
- </mediaobject>
- <bridgehead
- id="bh-Connecting_to_a_Hidden_Wireless_Network">Connecting to a Hidden Wireless Network</bridgehead>
- <para>All access points have a <firstterm>Service Set identifier</firstterm> (SSID) to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID, authentication method, and secrets.</para>
- <para>To connect to a hidden wireless network, left-click <application>NetworkManager</application>'s applet icon and select <guilabel>Connect to Hidden Wireless Network...</guilabel> to cause a dialog to appear. If you have connected to the hidden network before, use the <guilabel>Connection</guilabel> dropdown to select it, and click <guibutton>Connect</guibutton>. If you have not, leave the <guilabel>Connection</guilabel> dropdown as <guimenuitem>New...</guimenuitem>, enter the SSID of the hidden network, select its <guilabel>Wireless security</guilabel> method, enter the correct authentication secrets, and click <guibutton>Connect</guibutton>.</para>
- <para>For more information on wireless security settings, refer to <xref
- linkend="sec-Configuring_Wireless_Security"/>.</para>
- <bridgehead
- id="bh-Editing_a_Connection_or_Creating_a_Completely_New_One">Editing a Connection, or Creating a Completely New One</bridgehead>
- <para>You can edit an existing connection that you have tried or succeeded in connecting to in the past by opening the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel>, selecting the connection by name (words which follow <computeroutput>Auto</computeroutput> refer to the SSID of an access point), and clicking <guilabel>Edit</guilabel>.</para>
- <para>You can create a new connection by opening the <guilabel>Network Connections</guilabel> window, selecting the <guilabel>Wireless</guilabel> tab, and clicking the <guilabel>Add</guilabel> button.</para>
- <para>For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
- linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-Editing_Wireless_Connection_1">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-Editing_Wireless_Connection_1.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Editing the newly-created Wireless connection 1</para>
- </caption>
- </mediaobject>
- <bridgehead
- id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wireless">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
- <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
- <itemizedlist>
- <listitem>
- <para>
- <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box. By default, wireless connections are named the same as the <firstterm>SSID</firstterm> of the wireless access point. You can rename the wireless connection without affecting its ability to connect, but it is recommended to retain the SSID name.</para>
- </listitem>
- <listitem>
- <para>
- <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
- linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
- </listitem>
- <listitem>
- <para>
- <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
- linkend="sec-User_and_System_Connections"/> for details.</para>
- </listitem>
- </itemizedlist>
- <bridgehead
- id="bh-Configuring_the_Wireless_Tab">Configuring the Wireless Tab</bridgehead>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>SSID</guilabel>
- </term>
+ </listitem>
+ </itemizedlist>
+ </section>
+ <section
+ id="sec-Establishing_a_Wireless_Connection">
+ <title>Establishing a Wireless Connection</title>
+ <para>
+ <application>NetworkManager</application> makes configuring a wireless (also known as wi-fi or 802.1<replaceable>a/b/g/n</replaceable>) connection quick and simple. To establish a wireless connection, you need:</para>
+ <itemizedlist>
<listitem>
- <para>All access points have a <firstterm>Service Set identifier</firstterm> to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID (and authentication secrets).</para>
- <para>For information on connecting to a hidden wireless network, refer to <xref
- linkend="bh-Connecting_to_a_Hidden_Wireless_Network"/>.</para>
+ <para>a computer capable of wi-fi connectivity (such as a laptop with an integrated 802.1<replaceable>x</replaceable> card or chip);</para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Mode</guilabel>
- </term>
+ <listitem>
+ <para>a wireless access point to connect to (such as a wireless router); and,</para>
+ </listitem>
+ <listitem>
+ <para>if the access point is secured, an authentication secret such as a key, passphrase, or digital certificate.</para>
+ </listitem>
+ </itemizedlist>
+ <para>To configure a mobile broadband (such as 3G) connection instead of a wireless one, refer to <xref
+ linkend="sec-Establishing_a_Mobile_Broadband_Connection"/>.</para>
+ <bridgehead
+ id="bh-Quickly_Connecting_to_an_Available_Access_Point">Quickly Connecting to an Available Access Point</bridgehead>
+ <para>The easiest way to connect to an available access point is to left-click on the <application>NetworkManager</application> applet, locate the SSID of the access point in the list of <guilabel>Available</guilabel> networks, and click on it. If the access point is secured, a dialog prompts you for authentication.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-Wireless_authentication_required">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-Wireless_authentication_required.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Authenticating with a wireless access point</para>
+ </caption>
+ </mediaobject>
+ <para>
+ <application>NetworkManager</application> tries to auto-detect the type of security used by the access point. If there are multiple possibilities, <application>NetworkManager</application> guesses the security type and presents it in the <guilabel>Wireless security</guilabel> dropdown. To see if there are multiple choices, click the <guilabel>Wireless security</guilabel> dropdown menu and select the type of security the access point is using. If you are unsure, try connecting to each type in turn. Finally, enter the key or passphrase in the <guilabel>Password</guilabel> field. Certain password types, such as a 40-bit WEP or 128-bit WPA key, are invalid unless they are of a requisite length. The <guilabel>Connect</guilabel> button will remain inactive until you enter a key of the length required for the selected security type. To learn more about wireless security, refer to <xref
+ linkend="sec-Configuring_Wireless_Security"/>.</para>
+ <para>If <application>NetworkManager</application> connects to the access point succesfully, its applet icon will change into a graphical indicator of the wireless connection's signal strength.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM_applet-signal_strength_75">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM_applet-signal_strength_75.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Applet icon indicating a wireless connection signal strength of 75%</para>
+ </caption>
+ </mediaobject>
+ <para>You can also edit the settings for one of these auto-created access point connections just as if you had <guilabel>Add</guilabel>ded it yourself. The <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window lists all of the connections you have ever tried to connect to: <application>NetworkManager</application> names each of them <computeroutput>Auto <replaceable><SSID></replaceable>
+ </computeroutput>, where SSID is the <firstterm>Service Set identifier</firstterm> of the access point.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-Wireless_Auto_Connections_List">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-Wireless_Auto_Connections_List.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Previous access points that have been connected to</para>
+ </caption>
+ </mediaobject>
+ <bridgehead
+ id="bh-Connecting_to_a_Hidden_Wireless_Network">Connecting to a Hidden Wireless Network</bridgehead>
+ <para>All access points have a <firstterm>Service Set identifier</firstterm> (SSID) to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID, authentication method, and secrets.</para>
+ <para>To connect to a hidden wireless network, left-click <application>NetworkManager</application>'s applet icon and select <guilabel>Connect to Hidden Wireless Network...</guilabel> to cause a dialog to appear. If you have connected to the hidden network before, use the <guilabel>Connection</guilabel> dropdown to select it, and click <guibutton>Connect</guibutton>. If you have not, leave the <guilabel>Connection</guilabel> dropdown as <guimenuitem>New...</guimenuitem>, enter the SSID of the hidden network, select its <guilabel>Wireless security</guilabel> method, enter the correct authentication secrets, and click <guibutton>Connect</guibutton>.</para>
+ <para>For more information on wireless security settings, refer to <xref
+ linkend="sec-Configuring_Wireless_Security"/>.</para>
+ <bridgehead
+ id="bh-Editing_a_Connection_or_Creating_a_Completely_New_One">Editing a Connection, or Creating a Completely New One</bridgehead>
+ <para>You can edit an existing connection that you have tried or succeeded in connecting to in the past by opening the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel>, selecting the connection by name (words which follow <computeroutput>Auto</computeroutput> refer to the SSID of an access point), and clicking <guilabel>Edit</guilabel>.</para>
+ <para>You can create a new connection by opening the <guilabel>Network Connections</guilabel> window, selecting the <guilabel>Wireless</guilabel> tab, and clicking the <guilabel>Add</guilabel> button.</para>
+ <para>For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
+ linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-Editing_Wireless_Connection_1">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-Editing_Wireless_Connection_1.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Editing the newly-created Wireless connection 1</para>
+ </caption>
+ </mediaobject>
+ <bridgehead
+ id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wireless">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
+ <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
+ <itemizedlist>
<listitem>
<para>
- <guimenuitem>Infrastructure</guimenuitem> — Set <guilabel>Mode</guilabel> to <guimenuitem>Infrastructure</guimenuitem> if you are connecting to a wireless access point such as a router or a switch.</para>
- <para>
- <guimenuitem>Ad-hoc</guimenuitem> — Set <guilabel>Mode</guilabel> to <guimenuitem>Ad-hoc</guimenuitem> if you are creating a peer-to-peer network for two or more mobile devices to communicate directly with each other. If you use <guimenuitem>Ad-hoc</guimenuitem> mode, you must ensure that the same <guilabel>SSID</guilabel> is set for all participating wireless devices, and that they are all communicating over the same channel.</para>
+ <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box. By default, wireless connections are named the same as the <firstterm>SSID</firstterm> of the wireless access point. You can rename the wireless connection without affecting its ability to connect, but it is recommended to retain the SSID name.</para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>BSSID</guilabel>
- </term>
<listitem>
- <para>The Basic Service Set Identifier (BSSID) is the MAC address of the wireless access point you are connecting to when in <guilabel>Infrastructure</guilabel> mode. This field is blank by default, and you are able to connect to a wireless access point by <guilabel>SSID</guilabel> without having to specify its <guilabel>BSSID</guilabel>. </para>
- <para>For ad-hoc networks, the BSSID is generated randomly. However, <application>NetworkManager</application> does not have the capability to generate the BSSID for an ad-hoc network.</para>
+ <para>
+ <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
+ linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>MAC address</guilabel>
- </term>
<listitem>
- <para>Like an ethernet Network Interface Card (NIC), a wireless adapter has a unique MAC address (Media Access Control; also known as a <firstterm>hardware address</firstterm>) that identifies it to the system. Running the <command>ip addr</command> command will show the MAC address associated with each interface. For example, in the following <command>ip addr</command> output, the MAC address for the <computeroutput>wlan0</computeroutput> interface (which is <computeroutput>00:1c:bf:02:f8:70</computeroutput>) immediately follows the <computeroutput>link/ether</computeroutput> keyword:</para>
- <screen>~]# <command>ip addr</command>
+ <para>
+ <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
+ linkend="sec-User_and_System_Connections"/> for details.</para>
+ </listitem>
+ </itemizedlist>
+ <bridgehead
+ id="bh-Configuring_the_Wireless_Tab">Configuring the Wireless Tab</bridgehead>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>SSID</guilabel>
+ </term>
+ <listitem>
+ <para>All access points have a <firstterm>Service Set identifier</firstterm> to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID (and authentication secrets).</para>
+ <para>For information on connecting to a hidden wireless network, refer to <xref
+ linkend="bh-Connecting_to_a_Hidden_Wireless_Network"/>.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Mode</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Infrastructure</guimenuitem> — Set <guilabel>Mode</guilabel> to <guimenuitem>Infrastructure</guimenuitem> if you are connecting to a wireless access point such as a router or a switch.</para>
+ <para>
+ <guimenuitem>Ad-hoc</guimenuitem> — Set <guilabel>Mode</guilabel> to <guimenuitem>Ad-hoc</guimenuitem> if you are creating a peer-to-peer network for two or more mobile devices to communicate directly with each other. If you use <guimenuitem>Ad-hoc</guimenuitem> mode, you must ensure that the same <guilabel>SSID</guilabel> is set for all participating wireless devices, and that they are all communicating over the same channel.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>BSSID</guilabel>
+ </term>
+ <listitem>
+ <para>The Basic Service Set Identifier (BSSID) is the MAC address of the wireless access point you are connecting to when in <guilabel>Infrastructure</guilabel> mode. This field is blank by default, and you are able to connect to a wireless access point by <guilabel>SSID</guilabel> without having to specify its <guilabel>BSSID</guilabel>. </para>
+ <para>For ad-hoc networks, the BSSID is generated randomly. However, <application>NetworkManager</application> does not have the capability to generate the BSSID for an ad-hoc network.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>MAC address</guilabel>
+ </term>
+ <listitem>
+ <para>Like an ethernet Network Interface Card (NIC), a wireless adapter has a unique MAC address (Media Access Control; also known as a <firstterm>hardware address</firstterm>) that identifies it to the system. Running the <command>ip addr</command> command will show the MAC address associated with each interface. For example, in the following <command>ip addr</command> output, the MAC address for the <computeroutput>wlan0</computeroutput> interface (which is <computeroutput>00:1c:bf:02:f8:70</computeroutput>) immediately follows the <computeroutput>link/ether</computeroutput> keyword:</para>
+ <screen>~]# <command>ip addr</command>
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
@@ -482,743 +479,789 @@ NetworkManager (pid 1527) is running...
inet 10.200.130.67/24 brd 10.200.130.255 scope global wlan0
inet6 fe80::21c:bfff:fe02:f870/64 scope link
valid_lft forever preferred_lft forever</screen>
- <para>A single system could have one or more wireless network adapters connected to it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific wireless adapter with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>MTU</guilabel>
- </term>
- <listitem>
- <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. <!--This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.--> If set to a non-zero number, only packets of the specified size or smaller will be transmitted. Larger packets are broken up into multiple Ethernet frames. It is recommended to leave this setting on <guimenuitem>automatic</guimenuitem>.</para>
- </listitem>
- </varlistentry>
- </variablelist>
- <bridgehead
- id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-wireless">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
- <para>Once you have finished editing the wireless connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can successfully connect to your the modified connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
- linkend="sec-Connecting_to_a_Network"/> for details on selecting and connecting to a network.</para>
- <para>You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
- <para>Then, to configure:</para>
- <itemizedlist>
- <listitem>
- <para>security authentication for the wireless connection, click the <guilabel>Wireless Security</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_Wireless_Security"/>;</para>
- </listitem>
- <listitem>
- <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv4_Settings"/>; or,
- </para>
- </listitem>
- <listitem>
- <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv6_Settings"/>.
- </para>
- </listitem>
- </itemizedlist>
-</section>
-<section
- id="sec-Establishing_a_Mobile_Broadband_Connection">
- <title>Establishing a Mobile Broadband Connection</title>
- <remark>What is a <replaceable><type></replaceable> connection</remark>
- <remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark>
- <para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
- linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
- <remark>image editing a <replaceable><type></replaceable> connection; caption: Editing the newly-created <replaceable><type></replaceable> connection 1</remark>
- <bridgehead
- id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-tab_name">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
- <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
- <itemizedlist>
- <listitem>
- <para>
- <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>tab</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box.</para>
- </listitem>
- <listitem>
- <para>
- <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
- linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
- </listitem>
- <listitem>
- <para>
- <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
- linkend="sec-User_and_System_Connections"/> for details.</para>
- </listitem>
- </itemizedlist>
- <bridgehead>Configuring the <replaceable><tab></replaceable> Tab</bridgehead>
- <remark>describe tab-specific settings here</remark>
- <bridgehead
- id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-tab_name">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
- <para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
- linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
- <para>At this point, you have created a new <replaceable><type></replaceable> connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
- <para>Then, to configure:</para>
- <itemizedlist>
- <listitem>
- <para>;</para>
- </listitem>
- <listitem>
- <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv4_Settings"/>; or,
- </para>
- </listitem>
- <listitem>
- <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv6_Settings"/>.
- </para>
- </listitem>
- </itemizedlist>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Number</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>APN</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Network ID</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Type</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>PIN</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
-</section>
-<section
- id="sec-Establishing_a_VPN_Connection">
- <title>Establishing a VPN Connection</title>
- <para></para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Gateway</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Group name</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>User password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Group password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>User name</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Domain</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Encryption Method</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Secure (default)</guimenuitem> — </para>
- <para>
- <guimenuitem>Weak (use with caution)</guimenuitem> — </para>
- <para>
- <guimenuitem>None (completely insecure)</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>NAT traversal</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Cisco UDP (default)</guimenuitem> — </para>
- <para>
- <guimenuitem>NAT-T</guimenuitem> — </para>
- <para>
- <guimenuitem>Disabled</guimenuitem> — </para>
- <para>
- <guilabel>Disable Dead Peer Detection</guilabel> — </para>
- </listitem>
- </varlistentry>
- </variablelist>
-</section>
-<section
- id="sec-Establishing_a_DSL_Connection">
- <title>Establishing a DSL Connection</title>
- <para></para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Service</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
-</section>
-<section
- id="sec-Establishing_Routes">
- <title>Establishing Routes</title>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-System_eth0-Routes">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-System_eth0-Routes.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Configuring static network routes</para>
- </caption>
- </mediaobject>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Addresses</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Address</guimenuitem> — </para>
- <para>
- <guimenuitem>Prefix</guimenuitem> — </para>
- <para>
- <guimenuitem>Gateway</guimenuitem> — </para>
- <para>
- <guimenuitem>Metric</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Ignore automatically obtained routes</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Use this connection only for resources on its network</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
-</section>
-</section>
-<section
-id="sec-Configuring_Connection_Settings">
-<title>Configuring Connection Settings</title>
-<section
- id="sec-Configuring_802.1x_Security">
- <title>Configuring 802.1x Security</title>
- <para>802.1x security is the name of the IEEE standard for port-based Network Access Control (PNAC). Simply put, 802.1x security is a way of defining a <firstterm>logical network</firstterm> out of a physical one. All clients who want to join the logical network must authenticate with the server (a router, for example) using the correct 802.1x authentication method.</para>
- <para>802.1x security is most often associated with securing wireless networks (WLANs), but can also be used to prevent intruders with physical access to the network (LAN) from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but but for various reasons this practice is both impractical and insecure, and thus is no longer recommended. Instead, 802.1x security is used to ensure a logically-secure network through port-based authentication.</para>
- <para>802.1x provides a framework for WLAN and LAN access control and serves as an envelope for carrying one of the Extensible Authentication Protocol (EAP) types. An EAP type is a protocol that defines how WLAN security is achieved on the network.</para>
- <para>You can configure 802.1x security for a wired or wireless connection type by opening the <guilabel>Network Connections</guilabel> window (refer to <xref
- linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>) and following the applicable procedure:</para>
- <procedure
- id="procedure-For_a_wired_connection...">
- <title>For a wired connection...</title>
- <step>
- <para>Select the <guilabel>Wired</guilabel> tab.</para>
- </step>
- <step>
- <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
- </step>
- <step>
- <para>Then select the <guilabel>802.1x Security</guilabel> tab and check the <guilabel>Use 802.1x security for this connection</guilabel> checkbox to enable settings configuration.</para>
- </step>
- <step>
- <para>Proceed to </para>
- </step>
- </procedure>
- <procedure
- id="procedure-For_a_wireless_connection...">
- <title>For a wireless connection...</title>
- <step>
- <para>Select the <guilabel>Wireless</guilabel> tab.</para>
- </step>
- <step>
- <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
- </step>
- <step>
- <para>Then click the <guilabel>Security</guilabel> dropdown and choose one of the following security methods: <guimenuitem>LEAP</guimenuitem>, <guimenuitem>Dynamic WEP (802.1x)</guimenuitem>, or <guimenuitem>WPA & WPA2 Enterprise</guimenuitem>.</para>
- </step>
- <step>
- <para>Refer to for descriptions of which EAP types correspond to your selection in the <guilabel>Security</guilabel> dropdown.</para>
- </step>
- </procedure>
-<!-- <variablelist>
+ <para>A single system could have one or more wireless network adapters connected to it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific wireless adapter with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para>
+ </listitem>
+ </varlistentry>
<varlistentry>
<term>
- <guilabel>Authentication</guilabel>
+ <guilabel>MTU</guilabel>
</term>
<listitem>
- <para>
- <guimenuitem>TLS</guimenuitem> — (Transport Layer Security) </para>
- <para>
- <guimenuitem>Tunneled TLS</guimenuitem> — </para>
- <para>
- <guimenuitem>Protected EAP (PEAP)</guimenuitem> — </para>
+ <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. <!--This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.--> If set to a non-zero number, only packets of the specified size or smaller will be transmitted. Larger packets are broken up into multiple Ethernet frames. It is recommended to leave this setting on <guimenuitem>automatic</guimenuitem>.</para>
</listitem>
</varlistentry>
- </variablelist>-->
- <section
- id="sec-Configuring_TLS_Transport_Level_Security_Settings">
- <title>Configuring TLS (Transport Level Security) Settings</title>
- <para>With Transport Level Security, the client and server mutually authenticate using the TLS protocol. The server demonstrates that it holds a digital certificate, the client proves its own identity using its client-side certificate, and key information is exchanged. Once authentication is complete, the TLS tunnel is no longer used. Instead, the client and server use the exchanged keys to encrypt data using AES, TKIP or WEP.</para>
- <para>The fact that certificates must be distributed to all clients who want to authenticate means that the the EAP-TLS authentication method is very strong, but also more complicated to set up. Using TLS security requires the overhead of a public key infrastructure (PKI) to manage certificates. The benefit to TLS security is that a compromised password does not allow access to the (W)LAN: an intruder must also have access to the authenticating client's private key.</para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Identity</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>User certificate</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>CA certificate</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Private key</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Private key password</guilabel>
- </term>
+ </variablelist>
+ <bridgehead
+ id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-wireless">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
+ <para>Once you have finished editing the wireless connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can successfully connect to your the modified connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
+ linkend="sec-Connecting_to_a_Network"/> for details on selecting and connecting to a network.</para>
+ <para>You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
+ <para>Then, to configure:</para>
+ <itemizedlist>
<listitem>
- <para></para>
+ <para>security authentication for the wireless connection, click the <guilabel>Wireless Security</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_Wireless_Security"/>;</para>
</listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Configuring_Tunneled_TLS_Settings">
- <title>Configuring Tunneled TLS Settings</title>
- <para></para>
- <remark>Which version of TTLS does NM use? v0 or v1?</remark>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Anonymous identity</guilabel>
- </term>
<listitem>
- <para></para>
+ <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv4_Settings"/>; or,
+ </para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>CA certificate</guilabel>
- </term>
<listitem>
- <para></para>
+ <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv6_Settings"/>.
+ </para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Inner authentication</guilabel>
- </term>
+ </itemizedlist>
+ </section>
+ <section
+ id="sec-Establishing_a_Mobile_Broadband_Connection">
+ <title>Establishing a Mobile Broadband Connection</title>
+ <remark>What is a <replaceable><type></replaceable> connection</remark>
+ <remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark>
+ <para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
+ linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
+ <remark>image editing a <replaceable><type></replaceable> connection; caption: Editing the newly-created <replaceable><type></replaceable> connection 1</remark>
+ <bridgehead
+ id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-mobile_broadband">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
+ <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
+ <itemizedlist>
<listitem>
<para>
- <guimenuitem>PAP</guimenuitem> — </para>
- <para>
- <guimenuitem>MSCHAP</guimenuitem> — </para>
- <para>
- <guimenuitem>MSCHAPv2</guimenuitem> — </para>
- <para>
- <guimenuitem>CHAP</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
- <listitem>
- <para></para>
+ <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>tab</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box.</para>
</listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Configuring_Protected_EAP_PEAP_Settings">
- <title>Configuring Protected EAP (PEAP) Settings</title>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Anonymous Identity</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>CA certificate</guilabel>
- </term>
<listitem>
- <para></para>
+ <para>
+ <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
+ linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>PEAP version</guilabel>
- </term>
<listitem>
- <para></para>
+ <para>
+ <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
+ linkend="sec-User_and_System_Connections"/> for details.</para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Inner authentication</guilabel>
- </term>
+ </itemizedlist>
+ <bridgehead>Configuring the <replaceable><tab></replaceable> Tab</bridgehead>
+ <remark>describe tab-specific settings here</remark>
+ <bridgehead
+ id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-mobile_broadband">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
+ <para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
+ linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
+ <para>At this point, you have created a new <replaceable><type></replaceable> connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
+ <para>Then, to configure:</para>
+ <itemizedlist>
<listitem>
- <para>
- <guimenuitem>MSCHAPv2</guimenuitem> — </para>
- <para>
- <guimenuitem>MD5</guimenuitem> — </para>
- <para>
- <guimenuitem>GTC</guimenuitem> — </para>
+ <para>;</para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
<listitem>
- <para></para>
+ <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv4_Settings"/>; or,
+ </para>
</listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
<listitem>
- <para></para>
+ <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv6_Settings"/>.
+ </para>
</listitem>
- </varlistentry>
- </variablelist>
+ </itemizedlist>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Number</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>APN</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Network ID</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Type</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>PIN</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Establishing_a_VPN_Connection">
+ <title>Establishing a VPN Connection</title>
+ <!--<remark>What is a <replaceable><type></replaceable> connection</remark>
+ <remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark>
+ <para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
+ linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
+ <remark>image editing a <replaceable><type></replaceable> connection; caption: Editing the newly-created <replaceable><type></replaceable> connection 1</remark>
+ <bridgehead
+ id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-vpn">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
+ <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>tab</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
+ linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
+ linkend="sec-User_and_System_Connections"/> for details.</para>
+ </listitem>
+ </itemizedlist>
+ <bridgehead>Configuring the <replaceable><tab></replaceable> Tab</bridgehead>
+ <remark>describe tab-specific settings here</remark>
+ <bridgehead
+ id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-vpn">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
+ <para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
+ linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
+ <para>At this point, you have created a new <replaceable><type></replaceable> connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
+ <para>Then, to configure:</para>
+ <itemizedlist>
+ <listitem>
+ <para>;</para>
+ </listitem>
+ <listitem>
+ <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv4_Settings"/>; or,
+ </para>
+ </listitem>
+ <listitem>
+ <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv6_Settings"/>.
+ </para>
+ </listitem>
+ </itemizedlist>-->
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Gateway</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Group name</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>User password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Group password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>User name</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Domain</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Encryption Method</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Secure (default)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Weak (use with caution)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>None (completely insecure)</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>NAT traversal</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Cisco UDP (default)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>NAT-T</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Disabled</guimenuitem> — </para>
+ <para>
+ <guilabel>Disable Dead Peer Detection</guilabel> — </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Establishing_a_DSL_Connection">
+ <title>Establishing a DSL Connection</title>
+ <para></para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Service</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Establishing_Routes">
+ <title>Establishing Routes</title>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-System_eth0-Routes">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-System_eth0-Routes.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Configuring static network routes</para>
+ </caption>
+ </mediaobject>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Addresses</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Address</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Prefix</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Gateway</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Metric</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Ignore automatically obtained routes</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Use this connection only for resources on its network</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
</section>
-</section>
-<section
- id="sec-Configuring_Wireless_Security">
- <title>Configuring Wireless Security</title>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Security</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>None</guimenuitem> — </para>
- <para>
- <guimenuitem>WEP 40/128-bit Key</guimenuitem> — </para>
- <para>
- <guimenuitem>WEP 128-bit Passphrase</guimenuitem> — </para>
- <para>
- <guimenuitem>LEAP</guimenuitem> — </para>
- <para>
- <guimenuitem>Dynamic WEP (802.1x)</guimenuitem> — </para>
- <para>
- <guimenuitem>WPA & WPA2 Personal</guimenuitem> — </para>
- <para>
- <guimenuitem>WPA & WPA2 Enterprise</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>Password</term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
-</section>
-<section
- id="sec-Configuring_PPP_Point-to-Point_Settings">
- <title>Configuring PPP (Point-to-Point) Settings</title>
- <para></para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Configure Methods</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Use point-to-point encryption (MPPE)</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Allow BSD data compression</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Allow Deflate data compression</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Use TCP header compression</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Send PPP echo packets</guilabel>
- </term>
- <listitem>
+ <section
+ id="sec-Configuring_Connection_Settings">
+ <title>Configuring Connection Settings</title>
+ <section
+ id="sec-Configuring_802.1x_Security">
+ <title>Configuring 802.1x Security</title>
+ <para>802.1x security is the name of the IEEE standard for port-based Network Access Control (PNAC). Simply put, 802.1x security is a way of defining a <firstterm>logical network</firstterm> out of a physical one. All clients who want to join the logical network must authenticate with the server (a router, for example) using the correct 802.1x authentication method.</para>
+ <para>802.1x security is most often associated with securing wireless networks (WLANs), but can also be used to prevent intruders with physical access to the network (LAN) from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but but for various reasons this practice is both impractical and insecure, and thus is no longer recommended. Instead, 802.1x security is used to ensure a logically-secure network through port-based authentication.</para>
+ <para>802.1x provides a framework for WLAN and LAN access control and serves as an envelope for carrying one of the Extensible Authentication Protocol (EAP) types. An EAP type is a protocol that defines how WLAN security is achieved on the network.</para>
+ <para>You can configure 802.1x security for a wired or wireless connection type by opening the <guilabel>Network Connections</guilabel> window (refer to <xref
+ linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>) and following the applicable procedure:</para>
+ <procedure
+ id="procedure-For_a_wired_connection...">
+ <title>For a wired connection...</title>
+ <step>
+ <para>Select the <guilabel>Wired</guilabel> tab.</para>
+ </step>
+ <step>
+ <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
+ </step>
+ <step>
+ <para>Then select the <guilabel>802.1x Security</guilabel> tab and check the <guilabel>Use 802.1x security for this connection</guilabel> checkbox to enable settings configuration.</para>
+ </step>
+ <step>
+ <para>Proceed to </para>
+ </step>
+ </procedure>
+ <procedure
+ id="procedure-For_a_wireless_connection...">
+ <title>For a wireless connection...</title>
+ <step>
+ <para>Select the <guilabel>Wireless</guilabel> tab.</para>
+ </step>
+ <step>
+ <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
+ </step>
+ <step>
+ <para>Then click the <guilabel>Security</guilabel> dropdown and choose one of the following security methods: <guimenuitem>LEAP</guimenuitem>, <guimenuitem>Dynamic WEP (802.1x)</guimenuitem>, or <guimenuitem>WPA & WPA2 Enterprise</guimenuitem>.</para>
+ </step>
+ <step>
+ <para>Refer to for descriptions of which EAP types correspond to your selection in the <guilabel>Security</guilabel> dropdown.</para>
+ </step>
+ </procedure>
+<!-- <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Authentication</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>TLS</guimenuitem> — (Transport Layer Security) </para>
+ <para>
+ <guimenuitem>Tunneled TLS</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Protected EAP (PEAP)</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>-->
+ <section
+ id="sec-Configuring_TLS_Transport_Level_Security_Settings">
+ <title>Configuring TLS (Transport Level Security) Settings</title>
+ <para>With Transport Level Security, the client and server mutually authenticate using the TLS protocol. The server demonstrates that it holds a digital certificate, the client proves its own identity using its client-side certificate, and key information is exchanged. Once authentication is complete, the TLS tunnel is no longer used. Instead, the client and server use the exchanged keys to encrypt data using AES, TKIP or WEP.</para>
+ <para>The fact that certificates must be distributed to all clients who want to authenticate means that the the EAP-TLS authentication method is very strong, but also more complicated to set up. Using TLS security requires the overhead of a public key infrastructure (PKI) to manage certificates. The benefit to TLS security is that a compromised password does not allow access to the (W)LAN: an intruder must also have access to the authenticating client's private key.</para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Identity</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>User certificate</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>CA certificate</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Private key</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Private key password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Configuring_Tunneled_TLS_Settings">
+ <title>Configuring Tunneled TLS Settings</title>
<para></para>
- </listitem>
- </varlistentry>
- </variablelist>
-</section>
-<section
- id="sec-Configuring_IPv4_Settings">
- <title>Configuring IPv4 Settings</title>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-IPv4_Settings">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-IPv4_Settings.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Editing the IPv4 Settings Tab</para>
- </caption>
- </mediaobject>
- <para>The <guilabel>IPv4 Settings</guilabel> tab allows you to configure the method by which you connect to the Internet and enter IP address, route, and DNS information as required. The <guilabel>IPv4 Settings</guilabel> tab is available when you create and modify one of the following connection types: wired, wireless, mobile broadband, VPN or DSL. If you need to configure IPv6 addresses, refer to ???. If you need to configure static routes, which can be done by clicking on the <guibutton>Routes</guibutton> button, refer to ???.</para>
- <para>If you are using DHCP to obtain a dynamic IP address from a DHCP server, you can simply set <guilabel>Method</guilabel> to <guimenuitem>Automatic (DHCP)</guimenuitem>.</para>
- <bridgehead
- id="bh-Setting_the_Method">Setting the Method</bridgehead>
- <variablelist
- id="varlist-Available_IPv4_Methods_by_Connection_Type">
- <title>Available IPv4 Methods by Connection Type</title>
- <para>When you click the <guilabel>Method</guilabel> dropdown menu, depending on the type of connection you are configuring, you are able to select one of the following IPv4 connection methods. All of the methods are listed here according to which connection type or types they are associated with.</para>
- <varlistentry>
- <term>
- <guilabel>Method</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Automatic (DHCP)</guimenuitem> — Choose this option if the network you are connecting to uses a DHCP server to assign IP addresses. You do not need to fill in the <guilabel>DHCP client ID</guilabel> field.</para>
- <para>
- <guimenuitem>Automatic (DHCP) addresses only</guimenuitem> —</para>
- <para>
- <guimenuitem>Link-Local Only</guimenuitem> —</para>
- <para>
- <guimenuitem>Shared to other computers</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>Wired, Wireless and DSL Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Manual</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>Mobile Broadband Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Automatic (PPP)</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic (PPP) addresses only</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>VPN Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Automatic (VPN)</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic (VPN) addresses only</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>DSL Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Automatic (PPPoE)</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic (PPPoE) addresses only</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- </variablelist>
-</section>
-<section
- id="sec-Configuring_IPv6_Settings">
- <title>Configuring IPv6 Settings</title>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Method</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Ignore</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic, addresses only</guimenuitem> — </para>
- <para>
- <guimenuitem>Manual</guimenuitem> — </para>
- <para>
- <guimenuitem>Link-Local Only</guimenuitem> — </para>
- <para>
- <guimenuitem>Shared to other computers</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Addresses</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>DNS servers</guimenuitem> — </para>
- <para>
- <guimenuitem>Search domains</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- </variablelist>
+ <remark>Which version of TTLS does NM use? v0 or v1?</remark>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Anonymous identity</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>CA certificate</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Inner authentication</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>PAP</guimenuitem> — </para>
+ <para>
+ <guimenuitem>MSCHAP</guimenuitem> — </para>
+ <para>
+ <guimenuitem>MSCHAPv2</guimenuitem> — </para>
+ <para>
+ <guimenuitem>CHAP</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Configuring_Protected_EAP_PEAP_Settings">
+ <title>Configuring Protected EAP (PEAP) Settings</title>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Anonymous Identity</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>CA certificate</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>PEAP version</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Inner authentication</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>MSCHAPv2</guimenuitem> — </para>
+ <para>
+ <guimenuitem>MD5</guimenuitem> — </para>
+ <para>
+ <guimenuitem>GTC</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ </section>
+ <section
+ id="sec-Configuring_Wireless_Security">
+ <title>Configuring Wireless Security</title>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Security</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>None</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WEP 40/128-bit Key</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WEP 128-bit Passphrase</guimenuitem> — </para>
+ <para>
+ <guimenuitem>LEAP</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Dynamic WEP (802.1x)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WPA & WPA2 Personal</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WPA & WPA2 Enterprise</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Password</term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Configuring_PPP_Point-to-Point_Settings">
+ <title>Configuring PPP (Point-to-Point) Settings</title>
+ <para></para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Configure Methods</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Use point-to-point encryption (MPPE)</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Allow BSD data compression</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Allow Deflate data compression</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Use TCP header compression</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Send PPP echo packets</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Configuring_IPv4_Settings">
+ <title>Configuring IPv4 Settings</title>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-IPv4_Settings">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-IPv4_Settings.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Editing the IPv4 Settings Tab</para>
+ </caption>
+ </mediaobject>
+ <para>The <guilabel>IPv4 Settings</guilabel> tab allows you to configure the method by which you connect to the Internet and enter IP address, route, and DNS information as required. The <guilabel>IPv4 Settings</guilabel> tab is available when you create and modify one of the following connection types: wired, wireless, mobile broadband, VPN or DSL. If you need to configure IPv6 addresses, refer to ???. If you need to configure static routes, which can be done by clicking on the <guibutton>Routes</guibutton> button, refer to ???.</para>
+ <para>If you are using DHCP to obtain a dynamic IP address from a DHCP server, you can simply set <guilabel>Method</guilabel> to <guimenuitem>Automatic (DHCP)</guimenuitem>.</para>
+ <bridgehead
+ id="bh-Setting_the_Method">Setting the Method</bridgehead>
+ <variablelist
+ id="varlist-Available_IPv4_Methods_by_Connection_Type">
+ <title>Available IPv4 Methods by Connection Type</title>
+ <para>When you click the <guilabel>Method</guilabel> dropdown menu, depending on the type of connection you are configuring, you are able to select one of the following IPv4 connection methods. All of the methods are listed here according to which connection type or types they are associated with.</para>
+ <varlistentry>
+ <term>
+ <guilabel>Method</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (DHCP)</guimenuitem> — Choose this option if the network you are connecting to uses a DHCP server to assign IP addresses. You do not need to fill in the <guilabel>DHCP client ID</guilabel> field.</para>
+ <para>
+ <guimenuitem>Automatic (DHCP) addresses only</guimenuitem> —</para>
+ <para>
+ <guimenuitem>Link-Local Only</guimenuitem> —</para>
+ <para>
+ <guimenuitem>Shared to other computers</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Wired, Wireless and DSL Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Manual</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Mobile Broadband Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (PPP)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic (PPP) addresses only</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>VPN Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (VPN)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic (VPN) addresses only</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>DSL Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (PPPoE)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic (PPPoE) addresses only</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Configuring_IPv6_Settings">
+ <title>Configuring IPv6 Settings</title>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Method</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Ignore</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic, addresses only</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Manual</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Link-Local Only</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Shared to other computers</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Addresses</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>DNS servers</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Search domains</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
<!--<para>For information on configuring static routes for the network connection, go to <xref
linkend="sec-Configuring_Routes"/>.</para>-->
-</section>
-</section>
-<section
-id="sec-NetworkManager_Architecture">
-<title>NetworkManager Architecture</title>
-<para>See <ulink
- url="http://live.gnome.org/NetworkManagerConfiguration"/>
-</para>
-</section>
+ </section>
+ </section>
+ <section
+ id="sec-NetworkManager_Architecture">
+ <title>NetworkManager Architecture</title>
+ <para>See <ulink
+ url="http://live.gnome.org/NetworkManagerConfiguration"/>
+ </para>
+ </section>
</chapter>
<!--<section
id="sec-Configuring_IPv4_Settings">
13 years, 11 months
[deployment-guide/comm-rel: 58/74] Updated the Additional Resources section.
by dsilas
commit bb8452e67698f6110c02b5023eb0295b0ee52ba9
Author: Jaromir Hradilek <jhradile(a)redhat.com>
Date: Mon Jun 28 17:52:42 2010 +0200
Updated the Additional Resources section.
en-US/OpenSSH.xml | 92 +++++++++++++++++++++++++++++++++++++++--------------
1 files changed, 68 insertions(+), 24 deletions(-)
---
diff --git a/en-US/OpenSSH.xml b/en-US/OpenSSH.xml
index e9a489e..8169dfc 100644
--- a/en-US/OpenSSH.xml
+++ b/en-US/OpenSSH.xml
@@ -933,33 +933,77 @@ Are you sure you want to continue connecting (yes/no)?</screen>
</para>
<section id="s2-openssh-installed-docs">
<title>Installed Documentation</title>
- <itemizedlist>
- <listitem>
- <para>
- The <command>ssh</command>, <command>scp</command>, <command>sftp</command>, <command>sshd</command>, and <command>ssh-keygen</command> man pages — These man pages include information on how to use these commands as well as all the parameters that can be used with them.
- </para>
- </listitem>
- </itemizedlist>
+ <variablelist>
+ <varlistentry>
+ <term><command>man ssh</command></term>
+ <listitem>
+ <para>
+ The manual page for <application>ssh</application>, a remote login program, containing the full documentation on its usage.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><command>man scp</command></term>
+ <listitem>
+ <para>
+ The manual page for <application>scp</application>, a remote file copy program, containing the full documentation on its usage.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><command>man sftp</command></term>
+ <listitem>
+ <para>
+ The manual page for <application>sftp</application>, a secure file transfer program, containing the full documentation on its usage.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><command>man ssh-keygen</command></term>
+ <listitem>
+ <para>
+ The manual page for <application>ssh-keygen</application>, an authentication key management program, containing the full documentation on its usage.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><command>man 8 sshd</command></term>
+ <listitem>
+ <para>
+ The manual page for <application>sshd</application>, an OpenSSH SSH daemon, containing the full documentation on its usage.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
</section>
<section id="s2-openssh-useful-websites">
<title>Useful Websites</title>
- <itemizedlist>
- <listitem>
- <para>
- <ulink url="http://www.openssh.com/">http://www.openssh.com/</ulink> — The OpenSSH FAQ page, bug reports, mailing lists, project goals, and a more technical explanation of the security features.
- </para>
- </listitem>
- <listitem>
- <para>
- <ulink url="http://www.openssl.org/">http://www.openssl.org/</ulink> — The OpenSSL FAQ page, mailing lists, and a description of the project goal.
- </para>
- </listitem>
- <listitem>
- <para>
- <ulink url="http://www.freessh.org/">http://www.freesshd.com/</ulink> — SSH client software for other platforms.
- </para>
- </listitem>
- </itemizedlist>
+ <variablelist>
+ <varlistentry>
+ <term><ulink url="http://www.openssh.com/" /></term>
+ <listitem>
+ <para>
+ The OpenSSH home page containing further documentation, frequently asked questions, links to the mailing lists, bug reports, and other useful resources.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><ulink url="http://www.openssl.org/" /></term>
+ <listitem>
+ <para>
+ The OpenSSL home page containing further documentation, frequently asked questions, links to the mailing lists, and other useful resources.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><ulink url="http://www.freesshd.com/" /></term>
+ <listitem>
+ <para>
+ Another implementation of an SSH server.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
</section>
</section>
</chapter>
13 years, 11 months
[deployment-guide/comm-rel: 57/74] Changed the DocBook formatting.
by dsilas
commit 02f9fbe8918f2ee5c0cb108676d6af0758580c11
Author: Jaromir Hradilek <jhradile(a)redhat.com>
Date: Mon Jun 28 16:49:24 2010 +0200
Changed the DocBook formatting.
This is basically to make it easier for me to navigate through the
document, and to ensure a consistent output.
en-US/OpenSSH.xml | 928 ++++++++++++++++++++++++++++++-----------------------
1 files changed, 518 insertions(+), 410 deletions(-)
---
diff --git a/en-US/OpenSSH.xml b/en-US/OpenSSH.xml
index 71312ac..e9a489e 100644
--- a/en-US/OpenSSH.xml
+++ b/en-US/OpenSSH.xml
@@ -1,85 +1,100 @@
<?xml version='1.0'?>
<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
]>
-<chapter
- id="ch-OpenSSH">
+<chapter id="ch-OpenSSH">
<title>OpenSSH</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
</indexterm>
<para>
- <trademark
- class="trade">SSH</trademark> (or <emphasis>S</emphasis>ecure <emphasis>SH</emphasis>ell) is a protocol which facilitates secure communications between two systems using a client/server architecture and allows users to log into server host systems remotely. Unlike other remote communication protocols, such as FTP or Telnet, SSH encrypts the login session, rendering the connection difficult for intruders to collect unencrypted passwords.</para>
- <para>SSH is designed to replace older, less secure terminal applications used to log into remote hosts, such as <command>telnet</command> or <command>rsh</command>. A related program called <command>scp</command> replaces older programs designed to copy files between hosts, such as <command>rcp</command>. Because these older applications do not encrypt passwords transmitted between the client and the server, avoid them whenever possible. Using secure methods to log into remote systems decreases the risks for both the client system and the remote host.</para>
- <section
- id="s1-ssh-intro">
+ <trademark class="trade">SSH</trademark> (or <emphasis>S</emphasis>ecure <emphasis>SH</emphasis>ell) is a protocol which facilitates secure communications between two systems using a client/server architecture and allows users to log into server host systems remotely. Unlike other remote communication protocols, such as FTP or Telnet, SSH encrypts the login session, rendering the connection difficult for intruders to collect unencrypted passwords.
+ </para>
+ <para>
+ SSH is designed to replace older, less secure terminal applications used to log into remote hosts, such as <command>telnet</command> or <command>rsh</command>. A related program called <command>scp</command> replaces older programs designed to copy files between hosts, such as <command>rcp</command>. Because these older applications do not encrypt passwords transmitted between the client and the server, avoid them whenever possible. Using secure methods to log into remote systems decreases the risks for both the client system and the remote host.
+ </para>
+ <section id="s1-ssh-intro">
<title>Features of SSH</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>features of</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<seealso>SSH</seealso>
</indexterm>
- <para>The SSH protocol provides the following safeguards:</para>
+ <para>
+ The SSH protocol provides the following safeguards:
+ </para>
<itemizedlist>
<listitem>
- <para>After an initial connection, the client can verify that it is connecting to the same server it had connected to previously.</para>
+ <para>
+ After an initial connection, the client can verify that it is connecting to the same server it had connected to previously.
+ </para>
</listitem>
<listitem>
- <para>The client transmits its authentication information to the server using strong, 128-bit encryption.</para>
+ <para>
+ The client transmits its authentication information to the server using strong, 128-bit encryption.
+ </para>
</listitem>
<listitem>
- <para>All data sent and received during a session is transferred using 128-bit encryption, making intercepted transmissions extremely difficult to decrypt and read.</para>
+ <para>
+ All data sent and received during a session is transferred using 128-bit encryption, making intercepted transmissions extremely difficult to decrypt and read.
+ </para>
</listitem>
<listitem>
- <para>The client can forward X11<footnote>
- <para>X11 refers to the X11R7 windowing display system, traditionally referred to as the X Window System or X. &MAJOROS; includes X11R7, an open source X Window System.</para>
- </footnote> applications from the server. This technique, called <firstterm>X11 forwarding</firstterm>, provides a secure means to use graphical applications over a network.</para>
+ <para>
+ The client can forward X11<footnote><para>X11 refers to the X11R7 windowing display system, traditionally referred to as the X Window System or X. &MAJOROS; includes X11R7, an open source X Window System.</para></footnote> applications from the server. This technique, called <firstterm>X11 forwarding</firstterm>, provides a secure means to use graphical applications over a network.
+ </para>
</listitem>
</itemizedlist>
- <para>Because the SSH protocol encrypts everything it sends and receives, it can be used to secure otherwise insecure protocols. Using a technique called <firstterm>port forwarding</firstterm>, an SSH server can become a conduit to securing otherwise insecure protocols, like POP, and increasing overall system and data security.</para>
- <para>The OpenSSH server and client can also be configured to create a tunnel similar to a virtual private network for traffic between server and client machines.</para>
- <para
- lang="en-US,as-IN,bn-IN,gu-IN,hi-IN,kn-IN,ml-IN,mr-IN,or-IN,pa-IN,si-LK,ta-IN,te-IN,pt-BR">
- Finally, OpenSSH servers and clients can be configured to authenticate using the GSSAPI implementation of the Kerberos network authentication protocol. For more information on configuring Kerberos authentication services, refer to <!-- TBD6: <xref
- linkend="ch-kerberos"/> -->.</para>
- <para>&MAJOROS; includes the general OpenSSH package (<filename>openssh</filename>) as well as the OpenSSH server (<filename>openssh-server</filename>) and client (<filename>openssh-clients</filename>) packages. Note, the OpenSSH packages require the OpenSSL package (<filename>openssl</filename>) which installs several important cryptographic libraries, enabling OpenSSH to provide encrypted communications.</para>
- <section
- id="s2-ssh-intro-why">
+ <para>
+ Because the SSH protocol encrypts everything it sends and receives, it can be used to secure otherwise insecure protocols. Using a technique called <firstterm>port forwarding</firstterm>, an SSH server can become a conduit to securing otherwise insecure protocols, like POP, and increasing overall system and data security.
+ </para>
+ <para>
+ The OpenSSH server and client can also be configured to create a tunnel similar to a virtual private network for traffic between server and client machines.
+ </para>
+ <para lang="en-US,as-IN,bn-IN,gu-IN,hi-IN,kn-IN,ml-IN,mr-IN,or-IN,pa-IN,si-LK,ta-IN,te-IN,pt-BR">
+ Finally, OpenSSH servers and clients can be configured to authenticate using the GSSAPI implementation of the Kerberos network authentication protocol. For more information on configuring Kerberos authentication services, refer to <!-- TBD6: <xref linkend="ch-kerberos" /> -->.
+ </para>
+ <para>
+ &MAJOROS; includes the general OpenSSH package (<filename>openssh</filename>) as well as the OpenSSH server (<filename>openssh-server</filename>) and client (<filename>openssh-clients</filename>) packages. Note, the OpenSSH packages require the OpenSSL package (<filename>openssl</filename>) which installs several important cryptographic libraries, enabling OpenSSH to provide encrypted communications.
+ </para>
+ <section id="s2-ssh-intro-why">
<title>Why Use SSH?</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>security risks</secondary>
</indexterm>
- <para>Nefarious computer users have a variety of tools at their disposal enabling them to disrupt, intercept, and re-route network traffic in an effort to gain access to a system. In general terms, these threats can be categorized as follows:</para>
+ <para>
+ Nefarious computer users have a variety of tools at their disposal enabling them to disrupt, intercept, and re-route network traffic in an effort to gain access to a system. In general terms, these threats can be categorized as follows:
+ </para>
<itemizedlist>
<listitem>
<para>
- <emphasis>Interception of communication between two systems</emphasis> — In this scenario, the attacker can be somewhere on the network between the communicating parties, copying any information passed between them. The attacker may intercept and keep the information, or alter the information and send it on to the intended recipient.</para>
- <para>This attack can be mounted through the use of a packet sniffer — a common network utility.</para>
+ <emphasis>Interception of communication between two systems</emphasis> — In this scenario, the attacker can be somewhere on the network between the communicating parties, copying any information passed between them. The attacker may intercept and keep the information, or alter the information and send it on to the intended recipient.
+ </para>
+ <para>
+ This attack can be mounted through the use of a packet sniffer — a common network utility.
+ </para>
</listitem>
<listitem>
<para>
- <emphasis>Impersonation of a particular host</emphasis> — Using this strategy, an attacker's system is configured to pose as the intended recipient of a transmission. If this strategy works, the user's system remains unaware that it is communicating with the wrong host.</para>
- <para>This attack can be mounted through techniques known as DNS poisoning<footnote>
- <para>DNS poisoning occurs when an intruder cracks a DNS server, pointing client systems to a maliciously duplicated host.</para>
- </footnote> or IP spoofing<footnote>
- <para>IP spoofing occurs when an intruder sends network packets which falsely appear to be from a trusted host on the network.</para>
- </footnote>.</para>
+ <emphasis>Impersonation of a particular host</emphasis> — Using this strategy, an attacker's system is configured to pose as the intended recipient of a transmission. If this strategy works, the user's system remains unaware that it is communicating with the wrong host.
+ </para>
+ <para>
+ This attack can be mounted through techniques known as DNS poisoning<footnote><para>DNS poisoning occurs when an intruder cracks a DNS server, pointing client systems to a maliciously duplicated host.</para></footnote> or IP spoofing<footnote><para>IP spoofing occurs when an intruder sends network packets which falsely appear to be from a trusted host on the network.</para></footnote>.
+ </para>
</listitem>
</itemizedlist>
- <para>Both techniques intercept potentially sensitive information and, if the interception is made for hostile reasons, the results can be disastrous.</para>
- <para>If SSH is used for remote shell login and file copying, these security threats can be greatly diminished. This is because the SSH client and server use digital signatures to verify their identity. Additionally, all communication between the client and server systems is encrypted. Attempts to spoof the identity of either side of a communication does not work, since each packet is encrypted using a key known only by the local and remote systems.</para>
+ <para>
+ Both techniques intercept potentially sensitive information and, if the interception is made for hostile reasons, the results can be disastrous.
+ </para>
+ <para>
+ If SSH is used for remote shell login and file copying, these security threats can be greatly diminished. This is because the SSH client and server use digital signatures to verify their identity. Additionally, all communication between the client and server systems is encrypted. Attempts to spoof the identity of either side of a communication does not work, since each packet is encrypted using a key known only by the local and remote systems.
+ </para>
</section>
</section>
- <section
- id="s1-ssh-version">
+ <section id="s1-ssh-version">
<title>SSH Protocol Versions</title>
<indexterm
significance="normal">
@@ -101,100 +116,134 @@
<section
id="s1-ssh-conn">
<title>Event Sequence of an SSH Connection</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>connection sequence</secondary>
</indexterm>
- <para>The following series of events help protect the integrity of SSH communication between two hosts.</para>
+ <para>
+ The following series of events help protect the integrity of SSH communication between two hosts.
+ </para>
<orderedlist>
<listitem>
- <para>A cryptographic handshake is made so that the client can verify that it is communicating with the correct server.</para>
+ <para>
+ A cryptographic handshake is made so that the client can verify that it is communicating with the correct server.
+ </para>
</listitem>
<listitem>
- <para>The transport layer of the connection between the client and remote host is encrypted using a symmetric cipher.</para>
+ <para>
+ The transport layer of the connection between the client and remote host is encrypted using a symmetric cipher.
+ </para>
</listitem>
<listitem>
- <para>The client authenticates itself to the server.</para>
+ <para>
+ The client authenticates itself to the server.
+ </para>
</listitem>
<listitem>
- <para>The remote client interacts with the remote host over the encrypted connection.</para>
+ <para>
+ The remote client interacts with the remote host over the encrypted connection.
+ </para>
</listitem>
</orderedlist>
- <section
- id="s2-ssh-protocol-conn-transport">
+ <section id="s2-ssh-protocol-conn-transport">
<title>Transport Layer</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>layers of</secondary>
<tertiary>transport layer</tertiary>
</indexterm>
- <para>The primary role of the transport layer is to facilitate safe and secure communication between the two hosts at the time of authentication and during subsequent communication. The transport layer accomplishes this by handling the encryption and decryption of data, and by providing integrity protection of data packets as they are sent and received. The transport layer also provides compression, speeding the transfer of information.</para>
- <para>Once an SSH client contacts a server, key information is exchanged so that the two systems can correctly construct the transport layer. The following steps occur during this exchange:</para>
+ <para>
+ The primary role of the transport layer is to facilitate safe and secure communication between the two hosts at the time of authentication and during subsequent communication. The transport layer accomplishes this by handling the encryption and decryption of data, and by providing integrity protection of data packets as they are sent and received. The transport layer also provides compression, speeding the transfer of information.
+ </para>
+ <para>
+ Once an SSH client contacts a server, key information is exchanged so that the two systems can correctly construct the transport layer. The following steps occur during this exchange:
+ </para>
<itemizedlist>
<listitem>
- <para>Keys are exchanged</para>
+ <para>
+ Keys are exchanged
+ </para>
</listitem>
<listitem>
- <para>The public key encryption algorithm is determined</para>
+ <para>
+ The public key encryption algorithm is determined
+ </para>
</listitem>
<listitem>
- <para>The symmetric encryption algorithm is determined</para>
+ <para>
+ The symmetric encryption algorithm is determined
+ </para>
</listitem>
<listitem>
- <para>The message authentication algorithm is determined</para>
+ <para>
+ The message authentication algorithm is determined
+ </para>
</listitem>
<listitem>
- <para>The hash algorithm is determined</para>
+ <para>
+ The hash algorithm is determined
+ </para>
</listitem>
</itemizedlist>
- <para>During the key exchange, the server identifies itself to the client with a unique <firstterm>host key</firstterm>. If the client has never communicated with this particular server before, the server's host key is unknown to the client and it does not connect. OpenSSH gets around this problem by accepting the server's host key. This is done after the user is notified and has both accepted and verified the new host key. In subsequent connections, the server's host key is checked against the saved version on the client, providing confidence that the client is indeed communicating with the intended server. If, in the future, the host key no longer matches, the user must remove the client's saved version before a connection can occur.</para>
+ <para>
+ During the key exchange, the server identifies itself to the client with a unique <firstterm>host key</firstterm>. If the client has never communicated with this particular server before, the server's host key is unknown to the client and it does not connect. OpenSSH gets around this problem by accepting the server's host key. This is done after the user is notified and has both accepted and verified the new host key. In subsequent connections, the server's host key is checked against the saved version on the client, providing confidence that the client is indeed communicating with the intended server. If, in the future, the host key no longer matches, the user must remove the client's saved version before a connection can occur.
+ </para>
<warning>
<title>Caution</title>
- <para>It is possible for an attacker to masquerade as an SSH server during the initial contact since the local system does not know the difference between the intended server and a false one set up by an attacker. To help prevent this, verify the integrity of a new SSH server by contacting the server administrator before connecting for the first time or in the event of a host key mismatch.</para>
+ <para>
+ It is possible for an attacker to masquerade as an SSH server during the initial contact since the local system does not know the difference between the intended server and a false one set up by an attacker. To help prevent this, verify the integrity of a new SSH server by contacting the server administrator before connecting for the first time or in the event of a host key mismatch.
+ </para>
</warning>
- <para>SSH is designed to work with almost any kind of public key algorithm or encoding format. After an initial key exchange creates a hash value used for exchanges and a shared secret value, the two systems immediately begin calculating new keys and algorithms to protect authentication and future data sent over the connection.</para>
- <para>After a certain amount of data has been transmitted using a given key and algorithm (the exact amount depends on the SSH implementation), another key exchange occurs, generating another set of hash values and a new shared secret value. Even if an attacker is able to determine the hash and shared secret value, this information is only useful for a limited period of time.</para>
+ <para>
+ SSH is designed to work with almost any kind of public key algorithm or encoding format. After an initial key exchange creates a hash value used for exchanges and a shared secret value, the two systems immediately begin calculating new keys and algorithms to protect authentication and future data sent over the connection.
+ </para>
+ <para>
+ After a certain amount of data has been transmitted using a given key and algorithm (the exact amount depends on the SSH implementation), another key exchange occurs, generating another set of hash values and a new shared secret value. Even if an attacker is able to determine the hash and shared secret value, this information is only useful for a limited period of time.
+ </para>
</section>
- <section
- id="s2-ssh-protocol-authentication">
+ <section id="s2-ssh-protocol-authentication">
<title>Authentication</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>authentication</secondary>
</indexterm>
- <para>Once the transport layer has constructed a secure tunnel to pass information between the two systems, the server tells the client the different authentication methods supported, such as using a private key-encoded signature or typing a password. The client then tries to authenticate itself to the server using one of these supported methods.</para>
- <para>SSH servers and clients can be configured to allow different types of authentication, which gives each side the optimal amount of control. The server can decide which encryption methods it supports based on its security model, and the client can choose the order of authentication methods to attempt from the available options.</para>
+ <para>
+ Once the transport layer has constructed a secure tunnel to pass information between the two systems, the server tells the client the different authentication methods supported, such as using a private key-encoded signature or typing a password. The client then tries to authenticate itself to the server using one of these supported methods.
+ </para>
+ <para>
+ SSH servers and clients can be configured to allow different types of authentication, which gives each side the optimal amount of control. The server can decide which encryption methods it supports based on its security model, and the client can choose the order of authentication methods to attempt from the available options.
+ </para>
</section>
- <section
- id="s2-ssh-protocol-connection">
+ <section id="s2-ssh-protocol-connection">
<title>Channels</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>layers of</secondary>
<tertiary>channels</tertiary>
</indexterm>
- <para>After a successful authentication over the SSH transport layer, multiple channels are opened via a technique called <firstterm>multiplexing</firstterm>
- <footnote>
- <para>A multiplexed connection consists of several signals being sent over a shared, common medium. With SSH, different channels are sent over a common secure connection.</para>
- </footnote>. Each of these channels handles communication for different terminal sessions and for forwarded X11 sessions.</para>
- <para>Both clients and servers can create a new channel. Each channel is then assigned a different number on each end of the connection. When the client attempts to open a new channel, the clients sends the channel number along with the request. This information is stored by the server and is used to direct communication to that channel. This is done so that different types of sessions do not affect one another and so that when a given session ends, its channel can be closed without disrupting the primary SSH connection.</para>
- <para>Channels also support <firstterm>flow-control</firstterm>, which allows them to send and receive data in an orderly fashion. In this way, data is not sent over the channel until the client receives a message that the channel is open.</para>
- <para>The client and server negotiate the characteristics of each channel automatically, depending on the type of service the client requests and the way the user is connected to the network. This allows great flexibility in handling different types of remote connections without having to change the basic infrastructure of the protocol.</para>
+ <para>
+ After a successful authentication over the SSH transport layer, multiple channels are opened via a technique called <firstterm>multiplexing</firstterm><footnote><para>A multiplexed connection consists of several signals being sent over a shared, common medium. With SSH, different channels are sent over a common secure connection.</para></footnote>. Each of these channels handles communication for different terminal sessions and for forwarded X11 sessions.
+ </para>
+ <para>
+ Both clients and servers can create a new channel. Each channel is then assigned a different number on each end of the connection. When the client attempts to open a new channel, the clients sends the channel number along with the request. This information is stored by the server and is used to direct communication to that channel. This is done so that different types of sessions do not affect one another and so that when a given session ends, its channel can be closed without disrupting the primary SSH connection.
+ </para>
+ <para>
+ Channels also support <firstterm>flow-control</firstterm>, which allows them to send and receive data in an orderly fashion. In this way, data is not sent over the channel until the client receives a message that the channel is open.
+ </para>
+ <para>
+ The client and server negotiate the characteristics of each channel automatically, depending on the type of service the client requests and the way the user is connected to the network. This allows great flexibility in handling different types of remote connections without having to change the basic infrastructure of the protocol.
+ </para>
</section>
</section>
- <section
- id="s1-openssh-server-config">
+ <section id="s1-openssh-server-config">
<title>Configuring an OpenSSH Server</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>server</secondary>
</indexterm>
- <para>To run an OpenSSH server, you must first make sure that you have the proper RPM packages installed. The <filename>openssh-server</filename> package is required and is dependent on the <filename>openssh</filename> package.</para>
+ <para>
+ To run an OpenSSH server, you must first make sure that you have the proper RPM packages installed. The <filename>openssh-server</filename> package is required and is dependent on the <filename>openssh</filename> package.
+ </para>
<indexterm
significance="normal">
<primary>OpenSSH</primary>
@@ -210,35 +259,37 @@
<secondary>server</secondary>
<tertiary>starting and stopping</tertiary>
</indexterm>
- <para
- lang="en-US,as-IN,bn-IN,gu-IN,hi-IN,kn-IN,ml-IN,mr-IN,or-IN,pa-IN,si-LK,ta-IN,te-IN">
- To start the OpenSSH service, use the command <command>/sbin/service sshd start</command>. To stop the OpenSSH server, use the command <command>/sbin/service sshd stop</command>. If you want the daemon to start automatically at boot time, refer to <xref
- linkend="ch-Controlling_Access_to_Services"/> for information on how to manage services.</para>
- <para>If you reinstall, the reinstalled system creates a new set of identification keys. Any clients who had connected to the system with any of the OpenSSH tools before the reinstall will see the following message:</para>
- <screen>
-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+ <para lang="en-US,as-IN,bn-IN,gu-IN,hi-IN,kn-IN,ml-IN,mr-IN,or-IN,pa-IN,si-LK,ta-IN,te-IN">
+ To start the OpenSSH service, use the command <command>/sbin/service sshd start</command>. To stop the OpenSSH server, use the command <command>/sbin/service sshd stop</command>. If you want the daemon to start automatically at boot time, refer to <xref linkend="ch-Controlling_Access_to_Services" /> for information on how to manage services.
+ </para>
+ <para>
+ If you reinstall, the reinstalled system creates a new set of identification keys. Any clients who had connected to the system with any of the OpenSSH tools before the reinstall will see the following message:
+ </para>
+ <screen>@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
-It is also possible that the RSA host key has just been changed.
-</screen>
- <para>If you want to keep the host keys generated for the system, backup the <filename>/etc/ssh/ssh_host*key*</filename> files and restore them after the reinstall. This process retains the system's identity, and when clients try to connect to the system after the reinstall, they will not receive the warning message.</para>
- <section
- id="s2-ssh-requiring">
+It is also possible that the RSA host key has just been changed.</screen>
+ <para>
+ If you want to keep the host keys generated for the system, backup the <filename>/etc/ssh/ssh_host*key*</filename> files and restore them after the reinstall. This process retains the system's identity, and when clients try to connect to the system after the reinstall, they will not receive the warning message.
+ </para>
+ <section id="s2-ssh-requiring">
<title>Requiring SSH for Remote Connections</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>insecure protocols and</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>requiring for remote login</secondary>
</indexterm>
- <para>For SSH to be truly effective, using insecure connection protocols, such as Telnet and FTP, should be prohibited. Otherwise, a user's password may be protected using SSH for one session, only to be captured later while logging in using Telnet.</para>
- <para>Some services to disable include:</para>
+ <para>
+ For SSH to be truly effective, using insecure connection protocols, such as Telnet and FTP, should be prohibited. Otherwise, a user's password may be protected using SSH for one session, only to be captured later while logging in using Telnet.
+ </para>
+ <para>
+ Some services to disable include:
+ </para>
<itemizedlist>
<listitem>
<para>
@@ -262,594 +313,651 @@ It is also possible that the RSA host key has just been changed.
</listitem>
</itemizedlist>
<para>To disable insecure connection methods to the system, use the command line program <command>chkconfig</command>, the ncurses-based program <application>/usr/sbin/ntsysv</application>, or the <application>Services Configuration Tool</application> (<command>system-config-services</command>) graphical application. All of these tools require root level access.</para>
- <para
- lang="en-US,as-IN,bn-IN,gu-IN,hi-IN,kn-IN,ml-IN,mr-IN,or-IN,pa-IN,si-LK,ta-IN,te-IN">
- For more information on runlevels and configuring services with <command>chkconfig</command>, <application>/usr/sbin/ntsysv</application>, and the <application>Services Configuration Tool</application>, refer to <xref
- linkend="ch-Controlling_Access_to_Services"/>.</para>
+ <para lang="en-US,as-IN,bn-IN,gu-IN,hi-IN,kn-IN,ml-IN,mr-IN,or-IN,pa-IN,si-LK,ta-IN,te-IN">
+ For more information on runlevels and configuring services with <command>chkconfig</command>, <application>/usr/sbin/ntsysv</application>, and the <application>Services Configuration Tool</application>, refer to <xref linkend="ch-Controlling_Access_to_Services" />.
+ </para>
</section>
</section>
- <section
- id="s1-ssh-configfiles">
+ <section id="s1-ssh-configfiles">
<title>OpenSSH Configuration Files</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>configuration files</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>configuration files for</secondary>
</indexterm>
- <para>OpenSSH has two different sets of configuration files: one for client programs (<command>ssh</command>, <command>scp</command>, and <command>sftp</command>) and one for the server daemon (<command>sshd</command>).</para>
- <para>System-wide SSH configuration information is stored in the <filename>/etc/ssh/</filename> directory:</para>
+ <para>
+ OpenSSH has two different sets of configuration files: one for client programs (<command>ssh</command>, <command>scp</command>, and <command>sftp</command>) and one for the server daemon (<command>sshd</command>).
+ </para>
+ <para>
+ System-wide SSH configuration information is stored in the <filename>/etc/ssh/</filename> directory:
+ </para>
<itemizedlist>
<listitem>
<para>
- <filename>moduli</filename> — Contains Diffie-Hellman groups used for the Diffie-Hellman key exchange which is critical for constructing a secure transport layer. When keys are exchanged at the beginning of an SSH session, a shared, secret value is created which cannot be determined by either party alone. This value is then used to provide host authentication.</para>
+ <filename>moduli</filename> — Contains Diffie-Hellman groups used for the Diffie-Hellman key exchange which is critical for constructing a secure transport layer. When keys are exchanged at the beginning of an SSH session, a shared, secret value is created which cannot be determined by either party alone. This value is then used to provide host authentication.
+ </para>
</listitem>
<listitem>
<para>
- <filename>ssh_config</filename> — The system-wide default SSH client configuration file. It is overridden if one is also present in the user's home directory (<filename>~/.ssh/config</filename>).</para>
+ <filename>ssh_config</filename> — The system-wide default SSH client configuration file. It is overridden if one is also present in the user's home directory (<filename>~/.ssh/config</filename>).
+ </para>
</listitem>
<listitem>
<para>
- <filename>sshd_config</filename> — The configuration file for the <command>sshd</command> daemon.</para>
+ <filename>sshd_config</filename> — The configuration file for the <command>sshd</command> daemon.
+ </para>
</listitem>
<listitem>
<para>
- <filename>ssh_host_dsa_key</filename> — The DSA private key used by the <command>sshd</command> daemon.</para>
+ <filename>ssh_host_dsa_key</filename> — The DSA private key used by the <command>sshd</command> daemon.
+ </para>
</listitem>
<listitem>
<para>
- <filename>ssh_host_dsa_key.pub</filename> — The DSA public key used by the <command>sshd</command> daemon.</para>
+ <filename>ssh_host_dsa_key.pub</filename> — The DSA public key used by the <command>sshd</command> daemon.
+ </para>
</listitem>
<listitem>
<para>
- <filename>ssh_host_key</filename> — The RSA private key used by the <command>sshd</command> daemon for version 1 of the SSH protocol.</para>
+ <filename>ssh_host_key</filename> — The RSA private key used by the <command>sshd</command> daemon for version 1 of the SSH protocol.
+ </para>
</listitem>
<listitem>
<para>
- <filename>ssh_host_key.pub</filename> — The RSA public key used by the <command>sshd</command> daemon for version 1 of the SSH protocol.</para>
+ <filename>ssh_host_key.pub</filename> — The RSA public key used by the <command>sshd</command> daemon for version 1 of the SSH protocol.
+ </para>
</listitem>
<listitem>
<para>
- <filename>ssh_host_rsa_key</filename> — The RSA private key used by the <command>sshd</command> daemon for version 2 of the SSH protocol.</para>
+ <filename>ssh_host_rsa_key</filename> — The RSA private key used by the <command>sshd</command> daemon for version 2 of the SSH protocol.
+ </para>
</listitem>
<listitem>
<para>
- <filename>ssh_host_rsa_key.pub</filename> — The RSA public key used by the <command>sshd</command> for version 2 of the SSH protocol.</para>
+ <filename>ssh_host_rsa_key.pub</filename> — The RSA public key used by the <command>sshd</command> for version 2 of the SSH protocol.
+ </para>
</listitem>
</itemizedlist>
- <para>User-specific SSH configuration information is stored in the user's home directory within the <filename>~/.ssh/</filename> directory:</para>
+ <para>
+ User-specific SSH configuration information is stored in the user's home directory within the <filename>~/.ssh/</filename> directory:
+ </para>
<itemizedlist>
<listitem>
<para>
- <filename>authorized_keys</filename> — This file holds a list of authorized public keys for servers. When the client connects to a server, the server authenticates the client by checking its signed public key stored within this file.</para>
+ <filename>authorized_keys</filename> — This file holds a list of authorized public keys for servers. When the client connects to a server, the server authenticates the client by checking its signed public key stored within this file.
+ </para>
</listitem>
<listitem>
<para>
- <filename>id_dsa</filename> — Contains the DSA private key of the user.</para>
+ <filename>id_dsa</filename> — Contains the DSA private key of the user.
+ </para>
</listitem>
<listitem>
<para>
- <filename>id_dsa.pub</filename> — The DSA public key of the user.</para>
+ <filename>id_dsa.pub</filename> — The DSA public key of the user.
+ </para>
</listitem>
<listitem>
<para>
- <filename>id_rsa</filename> — The RSA private key used by <command>ssh</command> for version 2 of the SSH protocol.</para>
+ <filename>id_rsa</filename> — The RSA private key used by <command>ssh</command> for version 2 of the SSH protocol.
+ </para>
</listitem>
<listitem>
<para>
- <filename>id_rsa.pub</filename> — The RSA public key used by <command>ssh</command> for version 2 of the SSH protocol</para>
+ <filename>id_rsa.pub</filename> — The RSA public key used by <command>ssh</command> for version 2 of the SSH protocol
+ </para>
</listitem>
<listitem>
<para>
- <filename>identity</filename> — The RSA private key used by <command>ssh</command> for version 1 of the SSH protocol.</para>
+ <filename>identity</filename> — The RSA private key used by <command>ssh</command> for version 1 of the SSH protocol.
+ </para>
</listitem>
<listitem>
<para>
- <filename>identity.pub</filename> — The RSA public key used by <command>ssh</command> for version 1 of the SSH protocol.</para>
+ <filename>identity.pub</filename> — The RSA public key used by <command>ssh</command> for version 1 of the SSH protocol.
+ </para>
</listitem>
<listitem>
<para>
- <filename>known_hosts</filename> — This file contains DSA host keys of SSH servers accessed by the user. This file is very important for ensuring that the SSH client is connecting the correct SSH server.</para>
+ <filename>known_hosts</filename> — This file contains DSA host keys of SSH servers accessed by the user. This file is very important for ensuring that the SSH client is connecting the correct SSH server.
+ </para>
<important>
<title>Important</title>
- <para>If an SSH server's host key has changed, the client notifies the user that the connection cannot proceed until the server's host key is deleted from the <filename>known_hosts</filename> file using a text editor. Before doing this, however, contact the system administrator of the SSH server to verify the server is not compromised.</para>
+ <para>
+ If an SSH server's host key has changed, the client notifies the user that the connection cannot proceed until the server's host key is deleted from the <filename>known_hosts</filename> file using a text editor. Before doing this, however, contact the system administrator of the SSH server to verify the server is not compromised.
+ </para>
</important>
</listitem>
</itemizedlist>
- <para>Refer to the <command>ssh_config</command> and <command>sshd_config</command> man pages for information concerning the various directives available in the SSH configuration files.</para>
+ <para>
+ Refer to the <command>ssh_config</command> and <command>sshd_config</command> man pages for information concerning the various directives available in the SSH configuration files.
+ </para>
</section>
- <section
- id="s1-openssh-client-config">
+ <section id="s1-openssh-client-config">
<title>Configuring an OpenSSH Client</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>client</secondary>
</indexterm>
- <para>To connect to an OpenSSH server from a client machine, you must have the <filename>openssh-clients</filename> and <filename>openssh</filename> packages installed on the client machine.</para>
- <section
- id="s2-openssh-using-ssh">
+ <para>
+ To connect to an OpenSSH server from a client machine, you must have the <filename>openssh-clients</filename> and <filename>openssh</filename> packages installed on the client machine.
+ </para>
+ <section id="s2-openssh-using-ssh">
<title>Using the <command>ssh</command> Command</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>
<command>ssh</command>
</primary>
<see>OpenSSH</see>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>client</secondary>
<tertiary>
<command>ssh</command>
</tertiary>
</indexterm>
- <para>The <command>ssh</command> command is a secure replacement for the <command>rlogin</command>, <command>rsh</command>, and <command>telnet</command> commands. It allows you to log in to a remote machine as well as execute commands on a remote machine.</para>
- <para>Logging in to a remote machine with <command>ssh</command> is similar to using <command>telnet</command>. To log in to a remote machine named penguin.example.net, type the following command at a shell prompt:</para>
- <screen>
-ssh penguin.example.net
-</screen>
- <para>The first time you <command>ssh</command> to a remote machine, you will see a message similar to the following:</para>
- <screen>
-The authenticity of host 'penguin.example.net' can't be established.
+ <para>
+ The <command>ssh</command> command is a secure replacement for the <command>rlogin</command>, <command>rsh</command>, and <command>telnet</command> commands. It allows you to log in to a remote machine as well as execute commands on a remote machine.
+ </para>
+ <para>
+ Logging in to a remote machine with <command>ssh</command> is similar to using <command>telnet</command>. To log in to a remote machine named penguin.example.net, type the following command at a shell prompt:
+ </para>
+ <screen>ssh penguin.example.net</screen>
+ <para>
+ The first time you <command>ssh</command> to a remote machine, you will see a message similar to the following:
+ </para>
+ <screen>The authenticity of host 'penguin.example.net' can't be established.
DSA key fingerprint is 94:68:3a:3a:bc:f3:9a:9b:01:5d:b3:07:38:e2:11:0c.
-Are you sure you want to continue connecting (yes/no)?
-</screen>
- <para>Type <userinput>yes</userinput> to continue. This will add the server to your list of known hosts (<filename>~/.ssh/known_hosts</filename>) as seen in the following message:</para>
- <screen>
-Warning: Permanently added 'penguin.example.net' (RSA) to the list of known hosts.
-</screen>
- <para>Next, you will see a prompt asking for your password for the remote machine. After entering your password, you will be at a shell prompt for the remote machine. If you do not specify a username the username that you are logged in as on the local client machine is passed to the remote machine. If you want to specify a different username, use the following command:</para>
- <screen>
-ssh <replaceable>username</replaceable>@penguin.example.net
-</screen>
- <para>You can also use the syntax <command>ssh -l <replaceable>username</replaceable> penguin.example.net</command>.</para>
- <para>The <command>ssh</command> command can be used to execute a command on the remote machine without logging in to a shell prompt. The syntax is <command> ssh <replaceable>hostname</replaceable>
- <replaceable>command</replaceable>
- </command>. For example, if you want to execute the command <command>ls /usr/share/doc</command> on the remote machine penguin.example.net, type the following command at a shell prompt:</para>
- <screen>
-ssh penguin.example.net ls /usr/share/doc
-</screen>
- <para>After you enter the correct password, the contents of the remote directory <filename>/usr/share/doc</filename> will be displayed, and you will return to your local shell prompt.</para>
+Are you sure you want to continue connecting (yes/no)?</screen>
+ <para>
+ Type <userinput>yes</userinput> to continue. This will add the server to your list of known hosts (<filename>~/.ssh/known_hosts</filename>) as seen in the following message:
+ </para>
+ <screen>Warning: Permanently added 'penguin.example.net' (RSA) to the list of known hosts.</screen>
+ <para>
+ Next, you will see a prompt asking for your password for the remote machine. After entering your password, you will be at a shell prompt for the remote machine. If you do not specify a username the username that you are logged in as on the local client machine is passed to the remote machine. If you want to specify a different username, use the following command:
+ </para>
+ <screen>ssh <replaceable>username</replaceable>@penguin.example.net</screen>
+ <para>
+ You can also use the syntax <command>ssh -l <replaceable>username</replaceable> penguin.example.net</command>.
+ </para>
+ <para>
+ The <command>ssh</command> command can be used to execute a command on the remote machine without logging in to a shell prompt. The syntax is <command> ssh <replaceable>hostname</replaceable> <replaceable>command</replaceable></command>. For example, if you want to execute the command <command>ls /usr/share/doc</command> on the remote machine penguin.example.net, type the following command at a shell prompt:
+ </para>
+ <screen>ssh penguin.example.net ls /usr/share/doc</screen>
+ <para>
+ After you enter the correct password, the contents of the remote directory <filename>/usr/share/doc</filename> will be displayed, and you will return to your local shell prompt.
+ </para>
</section>
- <section
- id="s2-openssh-using-scp">
+ <section id="s2-openssh-using-scp">
<title>Using the <command>scp</command> Command</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>
<command>scp</command>
</primary>
<see>OpenSSH</see>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>client</secondary>
<tertiary>
<command>scp</command>
</tertiary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>
<command>rcp</command>
</primary>
</indexterm>
- <para>The <command>scp</command> command can be used to transfer files between machines over a secure, encrypted connection. It is similar to <command>rcp</command>.</para>
- <para>The general syntax to transfer a local file to a remote system is as follows:</para>
- <screen>
-scp <replaceable><localfile></replaceable>
- <replaceable>username@tohostname:<remotefile></replaceable>
- </screen>
- <para>The <replaceable><localfile></replaceable> specifies the source including path to the file, such as <filename>/var/log/maillog</filename>. The <replaceable><remotefile></replaceable> specifies the destination, which can be a new filename such as <filename>/tmp/hostname-maillog</filename>. For the remote system, if you do not have a preceding <command>/</command>, the path will be relative to the home directory of <replaceable>username</replaceable>, typically <filename>/home/username/</filename>.</para>
- <para>To transfer the local file <filename>shadowman</filename> to the home directory of your account on penguin.example.net, type the following at a shell prompt (replace <replaceable>username</replaceable> with your username):</para>
- <screen>
-scp shadowman <replaceable>username</replaceable>@penguin.example.net:shadowman
-</screen>
- <para>This will transfer the local file <filename>shadowman</filename> to <filename>/home/<replaceable>username</replaceable>/shadowman</filename> on penguin.example.net. Alternately, you can leave off the final <computeroutput>shadowman</computeroutput> in the <command>scp</command> command.</para>
- <para>The general syntax to transfer a remote file to the local system is as follows:</para>
- <screen>
-scp <replaceable>username@tohostname:<remotefile></replaceable>
- <replaceable><newlocalfile></replaceable>
- </screen>
- <para>The <replaceable><remotefile></replaceable> specifies the source including path, and <replaceable><newlocalfile></replaceable> specifies the destination including path.</para>
- <para>Multiple files can be specified as the source files. For example, to transfer the contents of the directory <filename>downloads/</filename> to an existing directory called <filename>uploads/</filename> on the remote machine penguin.example.net, type the following at a shell prompt:</para>
- <screen>
-scp downloads/* <replaceable>username</replaceable>@penguin.example.net:uploads/
-</screen>
+ <para>
+ The <command>scp</command> command can be used to transfer files between machines over a secure, encrypted connection. It is similar to <command>rcp</command>.
+ </para>
+ <para>
+ The general syntax to transfer a local file to a remote system is as follows:
+ </para>
+ <screen>scp <replaceable><localfile></replaceable> <replaceable>username@tohostname:<remotefile></replaceable></screen>
+ <para>
+ The <replaceable><localfile></replaceable> specifies the source including path to the file, such as <filename>/var/log/maillog</filename>. The <replaceable><remotefile></replaceable> specifies the destination, which can be a new filename such as <filename>/tmp/hostname-maillog</filename>. For the remote system, if you do not have a preceding <command>/</command>, the path will be relative to the home directory of <replaceable>username</replaceable>, typically <filename>/home/username/</filename>.
+ </para>
+ <para>
+ To transfer the local file <filename>shadowman</filename> to the home directory of your account on penguin.example.net, type the following at a shell prompt (replace <replaceable>username</replaceable> with your username):
+ </para>
+ <screen>scp shadowman <replaceable>username</replaceable>@penguin.example.net:shadowman</screen>
+ <para>
+ This will transfer the local file <filename>shadowman</filename> to <filename>/home/<replaceable>username</replaceable>/shadowman</filename> on penguin.example.net. Alternately, you can leave off the final <computeroutput>shadowman</computeroutput> in the <command>scp</command> command.
+ </para>
+ <para>
+ The general syntax to transfer a remote file to the local system is as follows:
+ </para>
+ <screen>scp <replaceable>username@tohostname:<remotefile></replaceable> <replaceable><newlocalfile></replaceable></screen>
+ <para>
+ The <replaceable><remotefile></replaceable> specifies the source including path, and <replaceable><newlocalfile></replaceable> specifies the destination including path.
+ </para>
+ <para>
+ Multiple files can be specified as the source files. For example, to transfer the contents of the directory <filename>downloads/</filename> to an existing directory called <filename>uploads/</filename> on the remote machine penguin.example.net, type the following at a shell prompt:
+ </para>
+ <screen>scp downloads/* <replaceable>username</replaceable>@penguin.example.net:uploads/</screen>
</section>
- <section
- id="s2-openssh-using-sftp">
+ <section id="s2-openssh-using-sftp">
<title>Using the <command>sftp</command> Command</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>
<command>sftp</command>
</primary>
<see>OpenSSH</see>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>client</secondary>
<tertiary>
<command>sftp</command>
</tertiary>
</indexterm>
- <para>The <command>sftp</command> utility can be used to open a secure, interactive FTP session. It is similar to <command>ftp</command> except that it uses a secure, encrypted connection. The general syntax is <command>sftp<replaceable> username(a)hostname.com</replaceable>
- </command>. Once authenticated, you can use a set of commands similar to those used by FTP. Refer to the <command>sftp</command> man page for a list of these commands. To read the man page, execute the command <command>man sftp</command> at a shell prompt. The <command>sftp</command> utility is only available in OpenSSH version 2.5.0p1 and higher.</para>
+ <para>
+ The <command>sftp</command> utility can be used to open a secure, interactive FTP session. It is similar to <command>ftp</command> except that it uses a secure, encrypted connection. The general syntax is <command>sftp<replaceable> username(a)hostname.com</replaceable></command>. Once authenticated, you can use a set of commands similar to those used by FTP. Refer to the <command>sftp</command> man page for a list of these commands. To read the man page, execute the command <command>man sftp</command> at a shell prompt. The <command>sftp</command> utility is only available in OpenSSH version 2.5.0p1 and higher.
+ </para>
</section>
</section>
- <section
- id="s1-ssh-beyondshell">
+ <section id="s1-ssh-beyondshell">
<title>More Than a Secure Shell</title>
- <para>A secure command line interface is just the beginning of the many ways SSH can be used. Given the proper amount of bandwidth, X11 sessions can be directed over an SSH channel. Or, by using TCP/IP forwarding, previously insecure port connections between systems can be mapped to specific SSH channels.</para>
- <section
- id="s2-ssh-beyondshell-x11">
+ <para>
+ A secure command line interface is just the beginning of the many ways SSH can be used. Given the proper amount of bandwidth, X11 sessions can be directed over an SSH channel. Or, by using TCP/IP forwarding, previously insecure port connections between systems can be mapped to specific SSH channels.
+ </para>
+ <section id="s2-ssh-beyondshell-x11">
<title>X11 Forwarding</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>X11 forwarding</secondary>
</indexterm>
- <para>Opening an X11 session over an SSH connection is as easy as connecting to the SSH server using the <option>-Y</option> option and running an X program on a local machine.</para>
- <screen>
-ssh -Y <user>(a)example.com
-</screen>
- <para>When an X program is run from the secure shell prompt, the SSH client and server create a new secure channel, and the X program data is sent over that channel to the client machine transparently.</para>
- <para>X11 forwarding can be very useful. For example, X11 forwarding can be used to create a secure, interactive session of the <application>Printer Configuration Tool</application>. To do this, connect to the server using <application>ssh</application> and type:</para>
- <screen>
-system-config-printer &
-</screen>
- <para>After supplying the root password for the server, the <application>Printer Configuration Tool</application> appears and allows the remote user to safely configure printing on the remote system.</para>
+ <para>
+ Opening an X11 session over an SSH connection is as easy as connecting to the SSH server using the <option>-Y</option> option and running an X program on a local machine.
+ </para>
+ <screen>ssh -Y <user>(a)example.com</screen>
+ <para>
+ When an X program is run from the secure shell prompt, the SSH client and server create a new secure channel, and the X program data is sent over that channel to the client machine transparently.
+ </para>
+ <para>
+ X11 forwarding can be very useful. For example, X11 forwarding can be used to create a secure, interactive session of the <application>Printer Configuration Tool</application>. To do this, connect to the server using <application>ssh</application> and type:
+ </para>
+ <screen>system-config-printer &</screen>
+ <para>
+ After supplying the root password for the server, the <application>Printer Configuration Tool</application> appears and allows the remote user to safely configure printing on the remote system.
+ </para>
</section>
- <section
- id="s2-ssh-beyondshell-tcpip">
+ <section id="s2-ssh-beyondshell-tcpip">
<title>Port Forwarding</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>SSH protocol</primary>
<secondary>port forwarding</secondary>
</indexterm>
- <para>SSH can secure otherwise insecure TCP/IP protocols via port forwarding. When using this technique, the SSH server becomes an encrypted conduit to the SSH client.</para>
- <para>Port forwarding works by mapping a local port on the client to a remote port on the server. SSH can map any port from the server to any port on the client; port numbers do not need to match for this technique to work.</para>
- <para>To create a TCP/IP port forwarding channel which listens for connections on the localhost, use the following command:</para>
- <screen>
-ssh -L <replaceable>local-port</replaceable>:<replaceable>remote-hostname</replaceable>:<replaceable>remote-port</replaceable>
- <replaceable>username</replaceable>@<replaceable>hostname</replaceable>
- </screen>
+ <para>
+ SSH can secure otherwise insecure TCP/IP protocols via port forwarding. When using this technique, the SSH server becomes an encrypted conduit to the SSH client.
+ </para>
+ <para>
+ Port forwarding works by mapping a local port on the client to a remote port on the server. SSH can map any port from the server to any port on the client; port numbers do not need to match for this technique to work.
+ </para>
+ <para>
+ To create a TCP/IP port forwarding channel which listens for connections on the localhost, use the following command:
+ </para>
+ <screen>ssh -L <replaceable>local-port</replaceable>:<replaceable>remote-hostname</replaceable>:<replaceable>remote-port</replaceable> <replaceable>username</replaceable>@<replaceable>hostname</replaceable></screen>
<note>
<title>Note</title>
- <para>Setting up port forwarding to listen on ports below 1024 requires root level access.</para>
+ <para>
+ Setting up port forwarding to listen on ports below 1024 requires root level access.
+ </para>
</note>
- <para>To check email on a server called <command>mail.example.com</command> using POP3 through an encrypted connection, use the following command:</para>
- <screen>
-ssh -L 1100:mail.example.com:110 mail.example.com
-</screen>
- <para>Once the port forwarding channel is in place between the client machine and the mail server, direct a POP3 mail client to use port 1100 on the localhost to check for new mail. Any requests sent to port 1100 on the client system are directed securely to the <command>mail.example.com</command> server.</para>
- <para>If <command>mail.example.com</command> is not running an SSH server, but another machine on the same network is, SSH can still be used to secure part of the connection. However, a slightly different command is necessary:</para>
- <screen>
-ssh -L 1100:mail.example.com:110 other.example.com
-</screen>
- <para>In this example, POP3 requests from port 1100 on the client machine are forwarded through the SSH connection on port 22 to the SSH server, <command>other.example.com</command>. Then, <command>other.example.com</command> connects to port 110 on <command>mail.example.com</command> to check for new mail. Note, when using this technique only the connection between the client system and <command>other.example.com</command> SSH server is secure.</para>
- <para>Port forwarding can also be used to get information securely through network firewalls. If the firewall is configured to allow SSH traffic via its standard port (22) but blocks access to other ports, a connection between two hosts using the blocked ports is still possible by redirecting their communication over an established SSH connection.</para>
+ <para>
+ To check email on a server called <command>mail.example.com</command> using POP3 through an encrypted connection, use the following command:
+ </para>
+ <screen>ssh -L 1100:mail.example.com:110 mail.example.com</screen>
+ <para>
+ Once the port forwarding channel is in place between the client machine and the mail server, direct a POP3 mail client to use port 1100 on the localhost to check for new mail. Any requests sent to port 1100 on the client system are directed securely to the <command>mail.example.com</command> server.
+ </para>
+ <para>
+ If <command>mail.example.com</command> is not running an SSH server, but another machine on the same network is, SSH can still be used to secure part of the connection. However, a slightly different command is necessary:
+ </para>
+ <screen>ssh -L 1100:mail.example.com:110 other.example.com</screen>
+ <para>
+ In this example, POP3 requests from port 1100 on the client machine are forwarded through the SSH connection on port 22 to the SSH server, <command>other.example.com</command>. Then, <command>other.example.com</command> connects to port 110 on <command>mail.example.com</command> to check for new mail. Note, when using this technique only the connection between the client system and <command>other.example.com</command> SSH server is secure.
+ </para>
+ <para>
+ Port forwarding can also be used to get information securely through network firewalls. If the firewall is configured to allow SSH traffic via its standard port (22) but blocks access to other ports, a connection between two hosts using the blocked ports is still possible by redirecting their communication over an established SSH connection.
+ </para>
<note>
<title>Note</title>
- <para>Using port forwarding to forward connections in this manner allows any user on the client system to connect to that service. If the client system becomes compromised, the attacker also has access to forwarded services.</para>
- <para>System administrators concerned about port forwarding can disable this functionality on the server by specifying a <command>No</command> parameter for the <command>AllowTcpForwarding</command> line in <filename>/etc/ssh/sshd_config</filename> and restarting the <command>sshd</command> service.</para>
+ <para>
+ Using port forwarding to forward connections in this manner allows any user on the client system to connect to that service. If the client system becomes compromised, the attacker also has access to forwarded services.
+ </para>
+ <para>
+ System administrators concerned about port forwarding can disable this functionality on the server by specifying a <command>No</command> parameter for the <command>AllowTcpForwarding</command> line in <filename>/etc/ssh/sshd_config</filename> and restarting the <command>sshd</command> service.
+ </para>
</note>
</section>
- <section
- id="s2-openssh-generate-keypairs">
+ <section id="s2-openssh-generate-keypairs">
<title>Generating Key Pairs</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>generating key pairs</secondary>
</indexterm>
- <para>If you do not want to enter your password every time you use <command>ssh</command>, <command>scp</command>, or <command>sftp</command> to connect to a remote machine, you can generate an authorization key pair.</para>
- <para>Keys must be generated for each user. To generate keys for a user, use the following steps as the user who wants to connect to remote machines. If you complete the steps as root, only root will be able to use the keys.</para>
- <para>Starting with OpenSSH version 3.0, <filename>~/.ssh/authorized_keys2</filename>, <filename>~/.ssh/known_hosts2</filename>, and <filename>/etc/ssh_known_hosts2</filename> are obsolete. SSH Protocol 1 and 2 share the <filename>~/.ssh/authorized_keys</filename>, <filename>~/.ssh/known_hosts</filename>, and <filename>/etc/ssh/ssh_known_hosts</filename> files.</para>
- <para>&MAJOROSVER; uses SSH Protocol 2 and RSA keys by default.</para>
+ <para>
+ If you do not want to enter your password every time you use <command>ssh</command>, <command>scp</command>, or <command>sftp</command> to connect to a remote machine, you can generate an authorization key pair.
+ </para>
+ <para>
+ Keys must be generated for each user. To generate keys for a user, use the following steps as the user who wants to connect to remote machines. If you complete the steps as root, only root will be able to use the keys.
+ </para>
+ <para>
+ Starting with OpenSSH version 3.0, <filename>~/.ssh/authorized_keys2</filename>, <filename>~/.ssh/known_hosts2</filename>, and <filename>/etc/ssh_known_hosts2</filename> are obsolete. SSH Protocol 1 and 2 share the <filename>~/.ssh/authorized_keys</filename>, <filename>~/.ssh/known_hosts</filename>, and <filename>/etc/ssh/ssh_known_hosts</filename> files.
+ </para>
+ <para>
+ &MAJOROSVER; uses SSH Protocol 2 and RSA keys by default.
+ </para>
<note>
<title>Tip</title>
- <para>If you reinstall and want to save your generated key pair, backup the <filename>.ssh</filename> directory in your home directory. After reinstalling, copy this directory back to your home directory. This process can be done for all users on your system, including root.</para>
+ <para>
+ If you reinstall and want to save your generated key pair, backup the <filename>.ssh</filename> directory in your home directory. After reinstalling, copy this directory back to your home directory. This process can be done for all users on your system, including root.
+ </para>
</note>
- <section
- id="s3-openssh-rsa-keys-v2">
+ <section id="s3-openssh-rsa-keys-v2">
<title>Generating an RSA Key Pair for Version 2</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>RSA keys</primary>
<secondary>generating</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>RSA keys</secondary>
<tertiary>generating</tertiary>
</indexterm>
- <para>Use the following steps to generate an RSA key pair for version 2 of the SSH protocol. This is the default starting with OpenSSH 2.9.</para>
- <indexterm
- significance="normal">
+ <para>
+ Use the following steps to generate an RSA key pair for version 2 of the SSH protocol. This is the default starting with OpenSSH 2.9.
+ </para>
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>ssh-keygen</secondary>
<tertiary>RSA</tertiary>
</indexterm>
- <orderedlist
- continuation="restarts"
- inheritnum="ignore">
+ <orderedlist continuation="restarts" inheritnum="ignore">
<listitem>
- <para>To generate an RSA key pair to work with version 2 of the protocol, type the following command at a shell prompt:</para>
- <screen>
-ssh-keygen -t rsa
-</screen>
- <para>Accept the default file location of <filename>~/.ssh/id_rsa</filename>. Enter a passphrase different from your account password and confirm it by entering it again.</para>
- <para>The public key is written to <filename>~/.ssh/id_rsa.pub</filename>. The private key is written to <filename>~/.ssh/id_rsa</filename>. Never distribute your private key to anyone.</para>
+ <para>
+ To generate an RSA key pair to work with version 2 of the protocol, type the following command at a shell prompt:
+ </para>
+ <screen>ssh-keygen -t rsa</screen>
+ <para>
+ Accept the default file location of <filename>~/.ssh/id_rsa</filename>. Enter a passphrase different from your account password and confirm it by entering it again.
+ </para>
+ <para>
+ The public key is written to <filename>~/.ssh/id_rsa.pub</filename>. The private key is written to <filename>~/.ssh/id_rsa</filename>. Never distribute your private key to anyone.
+ </para>
</listitem>
<listitem>
- <para>Change the permissions of the <filename>.ssh</filename> directory using the following command:</para>
- <screen>
-chmod 755 ~/.ssh
-</screen>
+ <para>
+ Change the permissions of the <filename>.ssh</filename> directory using the following command:
+ </para>
+ <screen>chmod 755 ~/.ssh</screen>
</listitem>
<listitem>
- <para>Copy the contents of <filename>~/.ssh/id_rsa.pub</filename> into the file <filename>~/.ssh/authorized_keys</filename> on the machine to which you want to connect. If the file <filename>~/.ssh/authorized_keys</filename> exist, append the contents of the file <filename>~/.ssh/id_rsa.pub</filename> to the file <filename>~/.ssh/authorized_keys</filename> on the other machine.</para>
+ <para>
+ Copy the contents of <filename>~/.ssh/id_rsa.pub</filename> into the file <filename>~/.ssh/authorized_keys</filename> on the machine to which you want to connect. If the file <filename>~/.ssh/authorized_keys</filename> exist, append the contents of the file <filename>~/.ssh/id_rsa.pub</filename> to the file <filename>~/.ssh/authorized_keys</filename> on the other machine.
+ </para>
</listitem>
<listitem>
- <para>Change the permissions of the <filename>authorized_keys</filename> file using the following command:</para>
- <screen>
-chmod 644 ~/.ssh/authorized_keys
-</screen>
+ <para>
+ Change the permissions of the <filename>authorized_keys</filename> file using the following command:
+ </para>
+ <screen>chmod 644 ~/.ssh/authorized_keys</screen>
</listitem>
<listitem>
- <para>If you are running GNOME or are running in a graphical desktop with GTK2+ libraries installed, skip to <xref
- linkend="s3-openssh-ssh-agent-with-gnome"/>. If you are not running the X Window System, skip to <xref
- linkend="s3-openssh-config-ssh-agent"/>.</para>
+ <para>
+ If you are running GNOME or are running in a graphical desktop with GTK2+ libraries installed, skip to <xref linkend="s3-openssh-ssh-agent-with-gnome" />. If you are not running the X Window System, skip to <xref linkend="s3-openssh-config-ssh-agent" />.
+ </para>
</listitem>
</orderedlist>
</section>
- <section
- id="s3-openssh-dsa-key">
+ <section id="s3-openssh-dsa-key">
<title>Generating a DSA Key Pair for Version 2</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>DSA keys</primary>
<secondary>generating</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>DSA keys</secondary>
<tertiary>generating</tertiary>
</indexterm>
- <para>Use the following steps to generate a DSA key pair for version 2 of the SSH Protocol.</para>
- <indexterm
- significance="normal">
+ <para>
+ Use the following steps to generate a DSA key pair for version 2 of the SSH Protocol.
+ </para>
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>ssh-keygen</secondary>
<tertiary>DSA</tertiary>
</indexterm>
- <orderedlist
- continuation="restarts"
- inheritnum="ignore">
+ <orderedlist continuation="restarts" inheritnum="ignore">
<listitem>
- <para>To generate a DSA key pair to work with version 2 of the protocol, type the following command at a shell prompt:</para>
- <screen>
-ssh-keygen -t dsa
-</screen>
- <para>Accept the default file location of <filename>~/.ssh/id_dsa</filename>. Enter a passphrase different from your account password and confirm it by entering it again.</para>
+ <para>
+ To generate a DSA key pair to work with version 2 of the protocol, type the following command at a shell prompt:
+ </para>
+ <screen>ssh-keygen -t dsa</screen>
+ <para>
+ Accept the default file location of <filename>~/.ssh/id_dsa</filename>. Enter a passphrase different from your account password and confirm it by entering it again.
+ </para>
<note>
<title>Tip</title>
- <para>A passphrase is a string of words and characters used to authenticate a user. Passphrases differ from passwords in that you can use spaces or tabs in the passphrase. Passphrases are generally longer than passwords because they are usually phrases instead of a single word.</para>
+ <para>
+ A passphrase is a string of words and characters used to authenticate a user. Passphrases differ from passwords in that you can use spaces or tabs in the passphrase. Passphrases are generally longer than passwords because they are usually phrases instead of a single word.
+ </para>
</note>
- <para>The public key is written to <filename>~/.ssh/id_dsa.pub</filename>. The private key is written to <filename>~/.ssh/id_dsa</filename>. It is important never to give anyone the private key.</para>
+ <para>
+ The public key is written to <filename>~/.ssh/id_dsa.pub</filename>. The private key is written to <filename>~/.ssh/id_dsa</filename>. It is important never to give anyone the private key.
+ </para>
</listitem>
<listitem>
- <para>Change the permissions of the <filename>.ssh</filename> directory with the following command:</para>
- <screen>
-chmod 755 ~/.ssh
-</screen>
+ <para>
+ Change the permissions of the <filename>.ssh</filename> directory with the following command:
+ </para>
+ <screen>chmod 755 ~/.ssh</screen>
</listitem>
<listitem>
- <para>Copy the contents of <filename>~/.ssh/id_dsa.pub</filename> into the file <filename>~/.ssh/authorized_keys</filename> on the machine to which you want to connect. If the file <filename>~/.ssh/authorized_keys</filename> exist, append the contents of the file <filename>~/.ssh/id_dsa.pub</filename> to the file <filename>~/.ssh/authorized_keys</filename> on the other machine.</para>
+ <para>
+ Copy the contents of <filename>~/.ssh/id_dsa.pub</filename> into the file <filename>~/.ssh/authorized_keys</filename> on the machine to which you want to connect. If the file <filename>~/.ssh/authorized_keys</filename> exist, append the contents of the file <filename>~/.ssh/id_dsa.pub</filename> to the file <filename>~/.ssh/authorized_keys</filename> on the other machine.
+ </para>
</listitem>
<listitem>
- <para>Change the permissions of the <filename>authorized_keys</filename> file using the following command:</para>
- <screen>
-chmod 644 ~/.ssh/authorized_keys
-</screen>
+ <para>
+ Change the permissions of the <filename>authorized_keys</filename> file using the following command:
+ </para>
+ <screen>chmod 644 ~/.ssh/authorized_keys</screen>
</listitem>
<listitem>
- <para>If you are running GNOME or a graphical desktop environment with the GTK2+ libraries installed, skip to <xref
- linkend="s3-openssh-ssh-agent-with-gnome"/>. If you are not running the X Window System, skip to <xref
- linkend="s3-openssh-config-ssh-agent"/>.</para>
+ <para>
+ If you are running GNOME or a graphical desktop environment with the GTK2+ libraries installed, skip to <xref linkend="s3-openssh-ssh-agent-with-gnome" />. If you are not running the X Window System, skip to <xref linkend="s3-openssh-config-ssh-agent" />.
+ </para>
</listitem>
</orderedlist>
</section>
- <section
- id="s3-openssh-rsa-keys-v1">
+ <section id="s3-openssh-rsa-keys-v1">
<title>Generating an RSA Key Pair for Version 1.3 and 1.5</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>RSA Version 1 keys</primary>
<secondary>generating</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>RSA Version 1 keys</secondary>
<tertiary>generating</tertiary>
</indexterm>
- <para>Use the following steps to generate an RSA key pair, which is used by version 1 of the SSH Protocol. If you are only connecting between systems that use DSA, you do not need an RSA version 1.3 or RSA version 1.5 key pair.</para>
- <indexterm
- significance="normal">
+ <para>
+ Use the following steps to generate an RSA key pair, which is used by version 1 of the SSH Protocol. If you are only connecting between systems that use DSA, you do not need an RSA version 1.3 or RSA version 1.5 key pair.
+ </para>
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>ssh-keygen</secondary>
<tertiary>RSA Version 1</tertiary>
</indexterm>
- <orderedlist
- continuation="restarts"
- inheritnum="ignore">
+ <orderedlist continuation="restarts" inheritnum="ignore">
<listitem>
- <para>To generate an RSA (for version 1.3 and 1.5 protocol) key pair, type the following command at a shell prompt:</para>
- <screen>
-ssh-keygen -t rsa1
-</screen>
- <para>Accept the default file location (<filename>~/.ssh/identity</filename>). Enter a passphrase different from your account password. Confirm the passphrase by entering it again.</para>
- <para>The public key is written to <filename>~/.ssh/identity.pub</filename>. The private key is written to <filename>~/.ssh/identity</filename>. Do not give anyone the private key.</para>
+ <para>
+ To generate an RSA (for version 1.3 and 1.5 protocol) key pair, type the following command at a shell prompt:
+ </para>
+ <screen>ssh-keygen -t rsa1</screen>
+ <para>
+ Accept the default file location (<filename>~/.ssh/identity</filename>). Enter a passphrase different from your account password. Confirm the passphrase by entering it again.
+ </para>
+ <para>
+ The public key is written to <filename>~/.ssh/identity.pub</filename>. The private key is written to <filename>~/.ssh/identity</filename>. Do not give anyone the private key.
+ </para>
</listitem>
<listitem>
- <para>Change the permissions of your <filename>.ssh</filename> directory and your key with the commands <command>chmod 755 ~/.ssh</command> and <command>chmod 644 ~/.ssh/identity.pub</command>.</para>
+ <para>
+ Change the permissions of your <filename>.ssh</filename> directory and your key with the commands <command>chmod 755 ~/.ssh</command> and <command>chmod 644 ~/.ssh/identity.pub</command>.
+ </para>
</listitem>
<listitem>
- <para>Copy the contents of <filename>~/.ssh/identity.pub</filename> into the file <filename>~/.ssh/authorized_keys</filename> on the machine to which you wish to connect. If the file <filename>~/.ssh/authorized_keys</filename> does not exist, you can copy the file <filename>~/.ssh/identity.pub</filename> to the file <filename>~/.ssh/authorized_keys</filename> on the remote machine.</para>
+ <para>
+ Copy the contents of <filename>~/.ssh/identity.pub</filename> into the file <filename>~/.ssh/authorized_keys</filename> on the machine to which you wish to connect. If the file <filename>~/.ssh/authorized_keys</filename> does not exist, you can copy the file <filename>~/.ssh/identity.pub</filename> to the file <filename>~/.ssh/authorized_keys</filename> on the remote machine.
+ </para>
</listitem>
<listitem>
- <para>If you are running GNOME, skip to <xref
- linkend="s3-openssh-ssh-agent-with-gnome"/>. If you are not running GNOME, skip to <xref
- linkend="s3-openssh-config-ssh-agent"/>.</para>
+ <para>
+ If you are running GNOME, skip to <xref linkend="s3-openssh-ssh-agent-with-gnome" />. If you are not running GNOME, skip to <xref linkend="s3-openssh-config-ssh-agent" />.
+ </para>
</listitem>
</orderedlist>
</section>
- <section
- id="s3-openssh-ssh-agent-with-gnome">
+ <section id="s3-openssh-ssh-agent-with-gnome">
<title>Configuring <command>ssh-agent</command> with a GUI</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>
<command>ssh-agent</command>
</secondary>
<tertiary>with GNOME</tertiary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>
<command>ssh-agent</command>
</primary>
<secondary>with GNOME</secondary>
</indexterm>
- <para>The <command>ssh-agent</command> utility can be used to save your passphrase so that you do not have to enter it each time you initiate an <command>ssh</command> or <command>scp</command> connection. If you are using GNOME, the <command>gnome-ssh-askpass</command> package contains the application used to prompt you for your passphrase when you log in to GNOME and save it until you log out of GNOME. You will not have to enter your password or passphrase for any <command>ssh</command> or <command>scp</command> connection made during that GNOME session. If you are not using GNOME, refer to <xref
- linkend="s3-openssh-config-ssh-agent"/>.</para>
- <para>To save your passphrase during your GNOME session, follow the following steps:</para>
- <orderedlist
- continuation="restarts"
- inheritnum="ignore">
+ <para>
+ The <command>ssh-agent</command> utility can be used to save your passphrase so that you do not have to enter it each time you initiate an <command>ssh</command> or <command>scp</command> connection. If you are using GNOME, the <command>gnome-ssh-askpass</command> package contains the application used to prompt you for your passphrase when you log in to GNOME and save it until you log out of GNOME. You will not have to enter your password or passphrase for any <command>ssh</command> or <command>scp</command> connection made during that GNOME session. If you are not using GNOME, refer to <xref linkend="s3-openssh-config-ssh-agent" />.
+ </para>
+ <para>
+ To save your passphrase during your GNOME session, follow the following steps:
+ </para>
+ <orderedlist continuation="restarts" inheritnum="ignore">
<listitem>
- <para>You will need to have the package <filename>gnome-ssh-askpass</filename> installed; you can use the command <command>rpm -q openssh-askpass</command> to determine if it is installed or not. If it is not installed, install it from your &MAJOROS; CD-ROM set, from a Red Hat FTP mirror site, or using Red Hat Network.</para>
+ <para>
+ You will need to have the package <filename>gnome-ssh-askpass</filename> installed; you can use the command <command>rpm -q openssh-askpass</command> to determine if it is installed or not. If it is not installed, install it from your &MAJOROS; CD-ROM set, from a Red Hat FTP mirror site, or using Red Hat Network.
+ </para>
</listitem>
<listitem>
- <para>Select <guimenu>Main Menu Button</guimenu> (on the Panel) > <guimenuitem>Preferences</guimenuitem> > <guimenuitem>More Preferences</guimenuitem> > <guilabel>Sessions</guilabel>, and click on the <guilabel>Startup Programs</guilabel> tab. Click <guibutton>Add</guibutton> and enter <userinput>/usr/bin/ssh-add</userinput> in the <guilabel>Startup Command</guilabel> text area. Set it a priority to a number higher than any existing commands to ensure that it is executed last. A good priority number for <command>ssh-add</command> is 70 or higher. The higher the priority number, the lower the priority. If you have other programs listed, this one should have the lowest priority. Click <guibutton>Close</guibutton> to exit the program.</para>
+ <para>
+ Select <guimenu>Main Menu Button</guimenu> (on the Panel) > <guimenuitem>Preferences</guimenuitem> > <guimenuitem>More Preferences</guimenuitem> > <guilabel>Sessions</guilabel>, and click on the <guilabel>Startup Programs</guilabel> tab. Click <guibutton>Add</guibutton> and enter <userinput>/usr/bin/ssh-add</userinput> in the <guilabel>Startup Command</guilabel> text area. Set it a priority to a number higher than any existing commands to ensure that it is executed last. A good priority number for <command>ssh-add</command> is 70 or higher. The higher the priority number, the lower the priority. If you have other programs listed, this one should have the lowest priority. Click <guibutton>Close</guibutton> to exit the program.
+ </para>
</listitem>
<listitem>
- <para>Log out and then log back into GNOME; in other words, restart X. After GNOME is started, a dialog box will appear prompting you for your passphrase(s). Enter the passphrase requested. If you have both DSA and RSA key pairs configured, you will be prompted for both. From this point on, you should not be prompted for a password by <command>ssh</command>, <command>scp</command>, or <command>sftp</command>.</para>
+ <para>
+ Log out and then log back into GNOME; in other words, restart X. After GNOME is started, a dialog box will appear prompting you for your passphrase(s). Enter the passphrase requested. If you have both DSA and RSA key pairs configured, you will be prompted for both. From this point on, you should not be prompted for a password by <command>ssh</command>, <command>scp</command>, or <command>sftp</command>.
+ </para>
</listitem>
</orderedlist>
</section>
- <section
- id="s3-openssh-config-ssh-agent">
- <title>Configuring <command>ssh-agent</command>
- </title>
- <indexterm
- significance="normal">
+ <section id="s3-openssh-config-ssh-agent">
+ <title>Configuring <command>ssh-agent</command></title>
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>
<command>ssh-agent</command>
</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>
<command>ssh-agent</command>
</primary>
</indexterm>
- <para>The <command>ssh-agent</command> can be used to store your passphrase so that you do not have to enter it each time you make a <command>ssh</command> or <command>scp</command> connection. If you are not running the X Window System, follow these steps from a shell prompt. If you are running GNOME but you do not want to configure it to prompt you for your passphrase when you log in (refer to <xref
- linkend="s3-openssh-ssh-agent-with-gnome"/>), this procedure will work in a terminal window, such as an XTerm. If you are running X but not GNOME, this procedure will work in a terminal window. However, your passphrase will only be remembered for that terminal window; it is not a global setting.</para>
- <indexterm
- significance="normal">
+ <para>
+ The <command>ssh-agent</command> can be used to store your passphrase so that you do not have to enter it each time you make a <command>ssh</command> or <command>scp</command> connection. If you are not running the X Window System, follow these steps from a shell prompt. If you are running GNOME but you do not want to configure it to prompt you for your passphrase when you log in (refer to <xref linkend="s3-openssh-ssh-agent-with-gnome" />), this procedure will work in a terminal window, such as an XTerm. If you are running X but not GNOME, this procedure will work in a terminal window. However, your passphrase will only be remembered for that terminal window; it is not a global setting.
+ </para>
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>
<command>ssh-add</command>
</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>
<command>ssh-add</command>
</primary>
</indexterm>
- <orderedlist
- continuation="restarts"
- inheritnum="ignore">
- <listitem
- id="nox">
- <para>At a shell prompt, type the following command:</para>
- <screen>
-exec /usr/bin/ssh-agent $SHELL
-</screen>
+ <orderedlist continuation="restarts" inheritnum="ignore">
+ <listitem id="nox">
+ <para>
+ At a shell prompt, type the following command:
+ </para>
+ <screen>exec /usr/bin/ssh-agent $SHELL</screen>
</listitem>
<listitem>
- <para>Then type the command:</para>
- <screen>
-ssh-add
-</screen>
- <para>and enter your passphrase(s). If you have more than one key pair configured, you will be prompted for each one.</para>
+ <para>
+ Then type the command:
+ </para>
+ <screen>ssh-add</screen>
+ <para>
+ and enter your passphrase(s). If you have more than one key pair configured, you will be prompted for each one.
+ </para>
</listitem>
<listitem>
- <para>When you log out, your passphrase(s) will be forgotten. You must execute these two commands each time you log in to a virtual console or open a terminal window.</para>
+ <para>
+ When you log out, your passphrase(s) will be forgotten. You must execute these two commands each time you log in to a virtual console or open a terminal window.
+ </para>
</listitem>
</orderedlist>
</section>
</section>
</section>
- <section
- id="s1-openssh-additional-resources">
+ <section id="s1-openssh-additional-resources">
<title>Additional Resources</title>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSH</primary>
<secondary>additional resources</secondary>
</indexterm>
- <indexterm
- significance="normal">
+ <indexterm>
<primary>OpenSSL</primary>
<secondary>additional resources</secondary>
</indexterm>
- <para>The OpenSSH and OpenSSL projects are in constant development, and the most up-to-date information for them is available from their websites. The man pages for OpenSSH and OpenSSL tools are also good sources of detailed information.</para>
- <section
- id="s2-openssh-installed-docs">
+ <para>
+ The OpenSSH and OpenSSL projects are in constant development, and the most up-to-date information for them is available from their websites. The man pages for OpenSSH and OpenSSL tools are also good sources of detailed information.
+ </para>
+ <section id="s2-openssh-installed-docs">
<title>Installed Documentation</title>
<itemizedlist>
<listitem>
- <para>The <command>ssh</command>, <command>scp</command>, <command>sftp</command>, <command>sshd</command>, and <command>ssh-keygen</command> man pages — These man pages include information on how to use these commands as well as all the parameters that can be used with them.</para>
+ <para>
+ The <command>ssh</command>, <command>scp</command>, <command>sftp</command>, <command>sshd</command>, and <command>ssh-keygen</command> man pages — These man pages include information on how to use these commands as well as all the parameters that can be used with them.
+ </para>
</listitem>
</itemizedlist>
</section>
- <section
- id="s2-openssh-useful-websites">
+ <section id="s2-openssh-useful-websites">
<title>Useful Websites</title>
<itemizedlist>
<listitem>
<para>
- <ulink
- url="http://www.openssh.com/">http://www.openssh.com/</ulink> — The OpenSSH FAQ page, bug reports, mailing lists, project goals, and a more technical explanation of the security features.</para>
+ <ulink url="http://www.openssh.com/">http://www.openssh.com/</ulink> — The OpenSSH FAQ page, bug reports, mailing lists, project goals, and a more technical explanation of the security features.
+ </para>
</listitem>
<listitem>
<para>
- <ulink
- url="http://www.openssl.org/">http://www.openssl.org/</ulink> — The OpenSSL FAQ page, mailing lists, and a description of the project goal.</para>
+ <ulink url="http://www.openssl.org/">http://www.openssl.org/</ulink> — The OpenSSL FAQ page, mailing lists, and a description of the project goal.
+ </para>
</listitem>
<listitem>
<para>
- <ulink
- url="http://www.freessh.org/">http://www.freesshd.com/</ulink> — SSH client software for other platforms.</para>
+ <ulink url="http://www.freessh.org/">http://www.freesshd.com/</ulink> — SSH client software for other platforms.
+ </para>
</listitem>
</itemizedlist>
</section>
13 years, 11 months
[deployment-guide/comm-rel: 56/74] Merge branch 'martin'
by dsilas
commit d2c4fd177a4634d617bae730b04a58f8ae532665
Merge: 8d73995... d9c82b5...
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Mon Jun 28 15:39:07 2010 +0200
Merge branch 'martin'
en-US/Authentication_Configuration.xml | 92 ++++++++++-
en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml | 166 +++++++++-----------
2 files changed, 160 insertions(+), 98 deletions(-)
---
13 years, 11 months
[deployment-guide/comm-rel: 55/74] modified DHCP chapter
by dsilas
commit 0fa5efbe783799a80d8d094ef18c353edd8ac3d0
Author: Martin Prpic <mprpic(a)redhat.com>
Date: Mon Jun 28 15:38:57 2010 +0200
modified DHCP chapter
en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml b/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml
index 976ced2..334562c 100644
--- a/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml
+++ b/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml
@@ -607,7 +607,7 @@ subnet6 2001:db8:0:1::/64 {
<primary>DHCP</primary>
<secondary>additional resources</secondary>
</indexterm>
- <para>For additional configuration options, refer to <citetitle>The DHCP Handbook; Ralph Droms and Ted Lemon; 2003</citetitle> or the following resources.</para>
+ <para>For additional information, refer to <citetitle>The DHCP Handbook; Ralph Droms and Ted Lemon; 2003</citetitle> or the following resources.</para>
<section
id="s2-dhcp-installed-docs">
<title>Installed Documentation</title>
13 years, 11 months
[deployment-guide/comm-rel: 54/74] NetConf: complete wireless tab descriptions, +doc
by dsilas
commit 8d7399506cc770343eed1c9811c1069bf7ac6235
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Mon Jun 28 15:38:21 2010 +0200
NetConf: complete wireless tab descriptions, +doc
en-US/Network_Configuration.xml | 1778 ++++++++++++++++++++-------------------
1 files changed, 897 insertions(+), 881 deletions(-)
---
diff --git a/en-US/Network_Configuration.xml b/en-US/Network_Configuration.xml
index 44be9bf..ca8656a 100644
--- a/en-US/Network_Configuration.xml
+++ b/en-US/Network_Configuration.xml
@@ -35,7 +35,7 @@ IPv4 Settings
<para>Previous versions of &MAJOROS; shipped with the <application>Network Administration Tool</application>, which was commonly known as <command>system-config-network</command> after its command line invocation. In &MAJOROSVER;, <application>NetworkManager</application> replaces the former <application>Network Administration Tool</application> while providing enhanced functionality, such as user-specific and mobile broadband configuration. It is also possible to configure the network in &MAJOROSVER; by editing interface configuration files; refer to <xref
linkend="ch-Network_Interfaces"/> for more information.</para>
<para>
- <application>NetworkManager</application> should be installed by default on &MAJOROS;. To ensure that it is, you can run the following command as the root user:</para>
+ <application>NetworkManager</application> may be installed by default on &MAJOROS;. To ensure that it is, first run the following command as the root user:</para>
<screen>~]# <command>yum install NetworkManager</command>
</screen>
<section
@@ -169,7 +169,7 @@ NetworkManager (pid 1527) is running...
<title>User and System Connections</title>
<para>
<application>NetworkManager</application> connections are always either <emphasis>user connections</emphasis> or <emphasis>system connections</emphasis>. Depending on the system-specific policy that the administrator has configured, users may need root privileges to create and modify system connections. <application>NetworkManager</application>'s default policy enables users to create and modify user connections, but requires them to have root privileges to add, modify or delete system connections.</para>
- <para>User connections are so-called because they are specific to the user who creates them. In contrast to system connections, whose configurations are stored under the <filename>/etc/sysconfig/networking/</filename> directory (mainly in <filename>ifcfg-<replaceable><network_type></replaceable>
+ <para>User connections are so-called because they are specific to the user who creates them. In contrast to system connections, whose configurations are stored under the <filename>/etc/sysconfig/network-scripts/</filename> directory (mainly in <filename>ifcfg-<replaceable><network_type></replaceable>
</filename> interface configuration files), user connection settings are stored in the GConf configuration database and the GNOME keyring, and are only available during login sessions for the user who created them. Thus, logging out of the desktop session causes user-specific connections to become unavailable.</para>
<note
id="note-Tip-Increase_security_by_making_VPN_connections_user-specific">
@@ -178,7 +178,7 @@ NetworkManager (pid 1527) is running...
</note>
<para>System connections, on the other hand, become available at boot time and can be used by other users on the system without first logging in to a desktop session.</para>
<para>
- <application>NetworkManager</application> can quickly and conveniently convert user to system connections and vice versa. Converting a user connection to a system connection causes <application>NetworkManager</application> to create the relevant interface configuration files under the <filename>/etc/sysconfig/networking/</filename> directory, and to delete the GConf settings from the user's session. Conversely, converting a system to a user-specific connection causes <application>NetworkManager</application> to remove the system-wide configuration files and create the corresponding GConf/GNOME keyring settings.</para>
+ <application>NetworkManager</application> can quickly and conveniently convert user to system connections and vice versa. Converting a user connection to a system connection causes <application>NetworkManager</application> to create the relevant interface configuration files under the <filename>/etc/sysconfig/network-scripts/</filename> directory, and to delete the GConf settings from the user's session. Conversely, converting a system to a user-specific connection causes <application>NetworkManager</application> to remove the system-wide configuration files and create the corresponding GConf/GNOME keyring settings.</para>
<mediaobject
id="mediaobj-Network_Configuration-NM-Available_to_all_users">
<imageobject>
@@ -270,9 +270,8 @@ NetworkManager (pid 1527) is running...
<guilabel>MAC Address</guilabel>
</term>
<listitem>
- <para>Network hardware such as a Network Interface Card (NIC) has a unique MAC (Media Access Control) address that identifies it to the system. Running the <command>ip addr
- </command> command will show the MAC address associated with each interface. For example, in the following <command>ip addr</command> output, the MAC address for the eth0 interface (which is <computeroutput> 52:54:00:26:9e:f1</computeroutput>) immediately follows the <computeroutput>link/ether</computeroutput> keyword:</para>
- <screen>~]# <command>ip addr</command>
+ <para>Network hardware such as a Network Interface Card (NIC) has a unique MAC address (Media Access Control; also known as a <firstterm>hardware address</firstterm>) that identifies it to the system. Running the <command>ip addr</command> command will show the MAC address associated with each interface. For example, in the following <command>ip addr</command> output, the MAC address for the eth0 interface (which is <computeroutput> 52:54:00:26:9e:f1</computeroutput>) immediately follows the <computeroutput>link/ether</computeroutput> keyword:</para>
+ <screen>~]# <command>ip addr</command>
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
@@ -283,926 +282,943 @@ NetworkManager (pid 1527) is running...
inet 192.168.122.251/24 brd 192.168.122.255 scope global eth0
inet6 fe80::5054:ff:fe26:9ef1/64 scope link
valid_lft forever preferred_lft forever</screen>
- <para>A single system can have one or more NICs installed on it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific NIC with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>MTU</guilabel>
- </term>
- <listitem>
- <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.</para>
- </listitem>
- </varlistentry>
- </variablelist>
- <bridgehead
- id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-Wired">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
- <para>Once you have finished editing your new wired connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
- linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
- <para>At this point, you have created a new wired connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
- <para>Then, to configure:</para>
- <itemizedlist>
- <listitem>
- <para>port-based Network Access Control (PNAC), click the <guilabel>802.1x Security</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_802.1x_Security"/>;
- </para>
+ <para>A single system can have one or more NICs installed on it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific NIC with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>MTU</guilabel>
+ </term>
<listitem>
- <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv4_Settings"/>; or,
- </para>
+ <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.</para>
</listitem>
- <listitem>
- <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv6_Settings"/>.
+ </varlistentry>
+ </variablelist>
+ <bridgehead
+ id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-Wired">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
+ <para>Once you have finished editing your new wired connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
+ linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
+ <para>At this point, you have created a new wired connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
+ <para>Then, to configure:</para>
+ <itemizedlist>
+ <listitem>
+ <para>port-based Network Access Control (PNAC), click the <guilabel>802.1x Security</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_802.1x_Security"/>;
</para>
- </listitem>
- </itemizedlist>
- </section>
- <section
- id="sec-Establishing_a_Wireless_Connection">
- <title>Establishing a Wireless Connection</title>
- <para>
- <application>NetworkManager</application> makes configuring a wireless (also known as wi-fi or 802.1<replaceable>a/b/g/n</replaceable>) connection quick and simple. To establish a wireless connection, you need:</para>
- <itemizedlist>
- <listitem>
- <para>a computer capable of wi-fi connectivity (such as a laptop with an integrated 802.1<replaceable>x</replaceable> card or chip);</para>
- </listitem>
- <listitem>
- <para>a wireless access point to connect to (such as a wireless router); and,</para>
- </listitem>
- <listitem>
- <para>if the access point is secured, an authentication secret such as a key, passphrase, or digital certificate.</para>
- </listitem>
- </itemizedlist>
- <para>To configure a mobile broadband (such as 3G) connection instead of a wireless one, refer to <xref
- linkend="sec-Establishing_a_Mobile_Broadband_Connection"/>.</para>
+ </listitem>
+ <listitem>
+ <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv4_Settings"/>; or,
+ </para>
+ </listitem>
+ <listitem>
+ <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv6_Settings"/>.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
+ <section
+ id="sec-Establishing_a_Wireless_Connection">
+ <title>Establishing a Wireless Connection</title>
+ <para>
+ <application>NetworkManager</application> makes configuring a wireless (also known as wi-fi or 802.1<replaceable>a/b/g/n</replaceable>) connection quick and simple. To establish a wireless connection, you need:</para>
+ <itemizedlist>
+ <listitem>
+ <para>a computer capable of wi-fi connectivity (such as a laptop with an integrated 802.1<replaceable>x</replaceable> card or chip);</para>
+ </listitem>
+ <listitem>
+ <para>a wireless access point to connect to (such as a wireless router); and,</para>
+ </listitem>
+ <listitem>
+ <para>if the access point is secured, an authentication secret such as a key, passphrase, or digital certificate.</para>
+ </listitem>
+ </itemizedlist>
+ <para>To configure a mobile broadband (such as 3G) connection instead of a wireless one, refer to <xref
+ linkend="sec-Establishing_a_Mobile_Broadband_Connection"/>.</para>
<!--<para>There are two ways to create a connection for a wireless access point. The first (and easier) way is to simply try to connect to an available wireless access point (see <xref
linkend="bh-Quickly_Connecting_to_an_Existing_Access_Point"/>), and the second way is to create a new, blank connection and configure its settings (see <xref
linkend="bh-Creating_a_New_Wireless_Connection"/>).</para>-->
- <bridgehead
- id="bh-Quickly_Connecting_to_an_Available_Access_Point">Quickly Connecting to an Available Access Point</bridgehead>
- <para>The easiest way to connect to an available access point is to left-click on the <application>NetworkManager</application> applet, locate the SSID of the access point in the list of <guilabel>Available</guilabel> networks, and click on it. If the access point is secured, a dialog prompts you for authentication.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-Wireless_authentication_required">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-Wireless_authentication_required.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Authenticating with a wireless access point</para>
- </caption>
- </mediaobject>
- <para>
- <application>NetworkManager</application> tries to auto-detect the type of security used by the access point. If there are multiple possibilities, <application>NetworkManager</application> guesses the security type and presents it in the <guilabel>Wireless security</guilabel> dropdown. To see if there are multiple choices, click the <guilabel>Wireless security</guilabel> dropdown menu and select the type of security the access point is using. If you are unsure, try connecting to each type in turn. Finally, enter the key or passphrase in the <guilabel>Password</guilabel> field. Certain password types, such as a 40-bit WEP or 128-bit WPA key, are invalid unless they are of a requisite length. The <guilabel>Connect</guilabel> button will remain inactive until you enter a key of the length required for the selected security type. To learn more about wireless security, refer to <xref
- linkend="sec-Configuring_Wireless_Security"/>.</para>
- <para>If <application>NetworkManager</application> connects to the access point succesfully, its applet icon will change into a graphical indicator of the wireless connection's signal strength.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM_applet-signal_strength_75">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM_applet-signal_strength_75.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Applet icon indicating a wireless connection signal strength of 75%</para>
- </caption>
- </mediaobject>
- <para>You can also edit the settings for one of these auto-created access point connections just as if you had <guilabel>Add</guilabel>ded it yourself. The <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window lists all of the connections you have ever tried to connect to: <application>NetworkManager</application> names each of them <computeroutput>Auto <replaceable><SSID></replaceable>
- </computeroutput>, where SSID is the <firstterm>Service Set identifier</firstterm> of the access point.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-Wireless_Auto_Connections_List">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-Wireless_Auto_Connections_List.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Previous access points that have been connected to</para>
- </caption>
- </mediaobject>
- <bridgehead
- id="bh-Connecting_to_a_Hidden_Wireless_Network">Connecting to a Hidden Wireless Network</bridgehead>
- <para>All access points have a <firstterm>Service Set identifier</firstterm> (SSID) to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID, authentication method, and secrets.</para>
- <para>To connect to a hidden wireless network, left-click <application>NetworkManager</application>'s applet icon and select <guilabel>Connect to Hidden Wireless Network...</guilabel> to cause a dialog to appear. If you have connected to the hidden network before, use the <guilabel>Connection</guilabel> dropdown to select it, and click <guibutton>Connect</guibutton>. If you have not, leave the <guilabel>Connection</guilabel> dropdown as <guimenuitem>New...</guimenuitem>, enter the SSID of the hidden network, select its <guilabel>Wireless security</guilabel> method, enter the correct authentication secrets, and click <guibutton>Connect</guibutton>.</para>
- <para>For more information on wireless security settings, refer to <xref
- linkend="sec-Configuring_Wireless_Security"/>.</para>
- <bridgehead
- id="bh-Editing_a_Connection_or_Creating_a_Completely_New_One">Editing a Connection, or Creating a Completely New One</bridgehead>
- <para>You can edit an existing connection that you have tried or succeeded in connecting to in the past by opening the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel>, selecting the connection by name (words which follow <computeroutput>Auto</computeroutput> refer to the SSID of an access point), and clicking <guilabel>Edit</guilabel>.</para>
- <para>You can create a new connection by opening the <guilabel>Network Connections</guilabel> window, selecting the <guilabel>Wireless</guilabel> tab, and clicking the <guilabel>Add</guilabel> button.</para>
- <para>For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
- linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-Editing_Wireless_Connection_1">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-Editing_Wireless_Connection_1.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Editing the newly-created Wireless connection 1</para>
- </caption>
- </mediaobject>
- <bridgehead
- id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wireless">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
- <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
- <itemizedlist>
+ <bridgehead
+ id="bh-Quickly_Connecting_to_an_Available_Access_Point">Quickly Connecting to an Available Access Point</bridgehead>
+ <para>The easiest way to connect to an available access point is to left-click on the <application>NetworkManager</application> applet, locate the SSID of the access point in the list of <guilabel>Available</guilabel> networks, and click on it. If the access point is secured, a dialog prompts you for authentication.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-Wireless_authentication_required">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-Wireless_authentication_required.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Authenticating with a wireless access point</para>
+ </caption>
+ </mediaobject>
+ <para>
+ <application>NetworkManager</application> tries to auto-detect the type of security used by the access point. If there are multiple possibilities, <application>NetworkManager</application> guesses the security type and presents it in the <guilabel>Wireless security</guilabel> dropdown. To see if there are multiple choices, click the <guilabel>Wireless security</guilabel> dropdown menu and select the type of security the access point is using. If you are unsure, try connecting to each type in turn. Finally, enter the key or passphrase in the <guilabel>Password</guilabel> field. Certain password types, such as a 40-bit WEP or 128-bit WPA key, are invalid unless they are of a requisite length. The <guilabel>Connect</guilabel> button will remain inactive until you enter a key of the length required for the selected security type. To learn more about wireless security, refer to <xref
+ linkend="sec-Configuring_Wireless_Security"/>.</para>
+ <para>If <application>NetworkManager</application> connects to the access point succesfully, its applet icon will change into a graphical indicator of the wireless connection's signal strength.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM_applet-signal_strength_75">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM_applet-signal_strength_75.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Applet icon indicating a wireless connection signal strength of 75%</para>
+ </caption>
+ </mediaobject>
+ <para>You can also edit the settings for one of these auto-created access point connections just as if you had <guilabel>Add</guilabel>ded it yourself. The <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window lists all of the connections you have ever tried to connect to: <application>NetworkManager</application> names each of them <computeroutput>Auto <replaceable><SSID></replaceable>
+ </computeroutput>, where SSID is the <firstterm>Service Set identifier</firstterm> of the access point.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-Wireless_Auto_Connections_List">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-Wireless_Auto_Connections_List.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Previous access points that have been connected to</para>
+ </caption>
+ </mediaobject>
+ <bridgehead
+ id="bh-Connecting_to_a_Hidden_Wireless_Network">Connecting to a Hidden Wireless Network</bridgehead>
+ <para>All access points have a <firstterm>Service Set identifier</firstterm> (SSID) to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID, authentication method, and secrets.</para>
+ <para>To connect to a hidden wireless network, left-click <application>NetworkManager</application>'s applet icon and select <guilabel>Connect to Hidden Wireless Network...</guilabel> to cause a dialog to appear. If you have connected to the hidden network before, use the <guilabel>Connection</guilabel> dropdown to select it, and click <guibutton>Connect</guibutton>. If you have not, leave the <guilabel>Connection</guilabel> dropdown as <guimenuitem>New...</guimenuitem>, enter the SSID of the hidden network, select its <guilabel>Wireless security</guilabel> method, enter the correct authentication secrets, and click <guibutton>Connect</guibutton>.</para>
+ <para>For more information on wireless security settings, refer to <xref
+ linkend="sec-Configuring_Wireless_Security"/>.</para>
+ <bridgehead
+ id="bh-Editing_a_Connection_or_Creating_a_Completely_New_One">Editing a Connection, or Creating a Completely New One</bridgehead>
+ <para>You can edit an existing connection that you have tried or succeeded in connecting to in the past by opening the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel>, selecting the connection by name (words which follow <computeroutput>Auto</computeroutput> refer to the SSID of an access point), and clicking <guilabel>Edit</guilabel>.</para>
+ <para>You can create a new connection by opening the <guilabel>Network Connections</guilabel> window, selecting the <guilabel>Wireless</guilabel> tab, and clicking the <guilabel>Add</guilabel> button.</para>
+ <para>For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
+ linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-Editing_Wireless_Connection_1">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-Editing_Wireless_Connection_1.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Editing the newly-created Wireless connection 1</para>
+ </caption>
+ </mediaobject>
+ <bridgehead
+ id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wireless">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
+ <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box. By default, wireless connections are named the same as the <firstterm>SSID</firstterm> of the wireless access point. You can rename the wireless connection without affecting its ability to connect, but it is recommended to retain the SSID name.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
+ linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
+ linkend="sec-User_and_System_Connections"/> for details.</para>
+ </listitem>
+ </itemizedlist>
+ <bridgehead
+ id="bh-Configuring_the_Wireless_Tab">Configuring the Wireless Tab</bridgehead>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>SSID</guilabel>
+ </term>
<listitem>
- <para>
- <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box. By default, wireless connections are named the same as the <firstterm>SSID</firstterm> of the wireless access point. You can rename the wireless connection without affecting its ability to connect, but it is recommended to retain the SSID name.</para>
+ <para>All access points have a <firstterm>Service Set identifier</firstterm> to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID (and authentication secrets).</para>
+ <para>For information on connecting to a hidden wireless network, refer to <xref
+ linkend="bh-Connecting_to_a_Hidden_Wireless_Network"/>.</para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Mode</guilabel>
+ </term>
<listitem>
<para>
- <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
- linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
+ <guimenuitem>Infrastructure</guimenuitem> — Set <guilabel>Mode</guilabel> to <guimenuitem>Infrastructure</guimenuitem> if you are connecting to a wireless access point such as a router or a switch.</para>
+ <para>
+ <guimenuitem>Ad-hoc</guimenuitem> — Set <guilabel>Mode</guilabel> to <guimenuitem>Ad-hoc</guimenuitem> if you are creating a peer-to-peer network for two or more mobile devices to communicate directly with each other. If you use <guimenuitem>Ad-hoc</guimenuitem> mode, you must ensure that the same <guilabel>SSID</guilabel> is set for all participating wireless devices, and that they are all communicating over the same channel.</para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>BSSID</guilabel>
+ </term>
<listitem>
- <para>
- <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
- linkend="sec-User_and_System_Connections"/> for details.</para>
+ <para>The Basic Service Set Identifier (BSSID) is the MAC address of the wireless access point you are connecting to when in <guilabel>Infrastructure</guilabel> mode. This field is blank by default, and you are able to connect to a wireless access point by <guilabel>SSID</guilabel> without having to specify its <guilabel>BSSID</guilabel>. </para>
+ <para>For ad-hoc networks, the BSSID is generated randomly. However, <application>NetworkManager</application> does not have the capability to generate the BSSID for an ad-hoc network.</para>
</listitem>
- </itemizedlist>
- <bridgehead
- id="bh-Configuring_the_Wireless_Tab">Configuring the Wireless Tab</bridgehead>
- <remark>describe tab-specific settings here</remark>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>SSID</guilabel>
- </term>
- <listitem>
- <para>All access points have a <firstterm>Service Set identifier</firstterm> to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID (and authentication secrets).</para>
- <para>For information on connecting to a hidden wireless network, refer to <xref
- linkend="bh-Connecting_to_a_Hidden_Wireless_Network"/>.</para>
- </listitem>
- </varlistentry>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>MAC address</guilabel>
+ </term>
+ <listitem>
+ <para>Like an ethernet Network Interface Card (NIC), a wireless adapter has a unique MAC address (Media Access Control; also known as a <firstterm>hardware address</firstterm>) that identifies it to the system. Running the <command>ip addr</command> command will show the MAC address associated with each interface. For example, in the following <command>ip addr</command> output, the MAC address for the <computeroutput>wlan0</computeroutput> interface (which is <computeroutput>00:1c:bf:02:f8:70</computeroutput>) immediately follows the <computeroutput>link/ether</computeroutput> keyword:</para>
+ <screen>~]# <command>ip addr</command>
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
+ link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+ inet 127.0.0.1/8 scope host lo
+ inet6 ::1/128 scope host
+ valid_lft forever preferred_lft forever
+2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
+ link/ether 52:54:00:26:9e:f1 brd ff:ff:ff:ff:ff:ff
+ inet 192.168.122.251/24 brd 192.168.122.255 scope global eth0
+ inet6 fe80::5054:ff:fe26:9ef1/64 scope link
+ valid_lft forever preferred_lft forever
+3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
+ link/ether <emphasis>00:1c:bf:02:f8:70</emphasis> brd ff:ff:ff:ff:ff:ff
+ inet 10.200.130.67/24 brd 10.200.130.255 scope global wlan0
+ inet6 fe80::21c:bfff:fe02:f870/64 scope link
+ valid_lft forever preferred_lft forever</screen>
+ <para>A single system could have one or more wireless network adapters connected to it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific wireless adapter with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>MTU</guilabel>
+ </term>
+ <listitem>
+ <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. <!--This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.--> If set to a non-zero number, only packets of the specified size or smaller will be transmitted. Larger packets are broken up into multiple Ethernet frames. It is recommended to leave this setting on <guimenuitem>automatic</guimenuitem>.</para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ <bridgehead
+ id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-wireless">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
+ <para>Once you have finished editing the wireless connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can successfully connect to your the modified connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
+ linkend="sec-Connecting_to_a_Network"/> for details on selecting and connecting to a network.</para>
+ <para>You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
+ <para>Then, to configure:</para>
+ <itemizedlist>
+ <listitem>
+ <para>security authentication for the wireless connection, click the <guilabel>Wireless Security</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_Wireless_Security"/>;</para>
+ </listitem>
+ <listitem>
+ <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv4_Settings"/>; or,
+ </para>
+ </listitem>
+ <listitem>
+ <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv6_Settings"/>.
+ </para>
+ </listitem>
+ </itemizedlist>
+</section>
+<section
+ id="sec-Establishing_a_Mobile_Broadband_Connection">
+ <title>Establishing a Mobile Broadband Connection</title>
+ <remark>What is a <replaceable><type></replaceable> connection</remark>
+ <remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark>
+ <para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
+ linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
+ <remark>image editing a <replaceable><type></replaceable> connection; caption: Editing the newly-created <replaceable><type></replaceable> connection 1</remark>
+ <bridgehead
+ id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-tab_name">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
+ <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>tab</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
+ linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
+ linkend="sec-User_and_System_Connections"/> for details.</para>
+ </listitem>
+ </itemizedlist>
+ <bridgehead>Configuring the <replaceable><tab></replaceable> Tab</bridgehead>
+ <remark>describe tab-specific settings here</remark>
+ <bridgehead
+ id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-tab_name">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
+ <para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
+ linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
+ <para>At this point, you have created a new <replaceable><type></replaceable> connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
+ <para>Then, to configure:</para>
+ <itemizedlist>
+ <listitem>
+ <para>;</para>
+ </listitem>
+ <listitem>
+ <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv4_Settings"/>; or,
+ </para>
+ </listitem>
+ <listitem>
+ <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
+ linkend="sec-Configuring_IPv6_Settings"/>.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Number</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>APN</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Network ID</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Type</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>PIN</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
+<section
+ id="sec-Establishing_a_VPN_Connection">
+ <title>Establishing a VPN Connection</title>
+ <para></para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Gateway</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Group name</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>User password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Group password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>User name</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Domain</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Encryption Method</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Secure (default)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Weak (use with caution)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>None (completely insecure)</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>NAT traversal</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Cisco UDP (default)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>NAT-T</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Disabled</guimenuitem> — </para>
+ <para>
+ <guilabel>Disable Dead Peer Detection</guilabel> — </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
+<section
+ id="sec-Establishing_a_DSL_Connection">
+ <title>Establishing a DSL Connection</title>
+ <para></para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Service</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
+<section
+ id="sec-Establishing_Routes">
+ <title>Establishing Routes</title>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-System_eth0-Routes">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-System_eth0-Routes.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Configuring static network routes</para>
+ </caption>
+ </mediaobject>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Addresses</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Address</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Prefix</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Gateway</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Metric</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Ignore automatically obtained routes</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Use this connection only for resources on its network</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
+</section>
+<section
+id="sec-Configuring_Connection_Settings">
+<title>Configuring Connection Settings</title>
+<section
+ id="sec-Configuring_802.1x_Security">
+ <title>Configuring 802.1x Security</title>
+ <para>802.1x security is the name of the IEEE standard for port-based Network Access Control (PNAC). Simply put, 802.1x security is a way of defining a <firstterm>logical network</firstterm> out of a physical one. All clients who want to join the logical network must authenticate with the server (a router, for example) using the correct 802.1x authentication method.</para>
+ <para>802.1x security is most often associated with securing wireless networks (WLANs), but can also be used to prevent intruders with physical access to the network (LAN) from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but but for various reasons this practice is both impractical and insecure, and thus is no longer recommended. Instead, 802.1x security is used to ensure a logically-secure network through port-based authentication.</para>
+ <para>802.1x provides a framework for WLAN and LAN access control and serves as an envelope for carrying one of the Extensible Authentication Protocol (EAP) types. An EAP type is a protocol that defines how WLAN security is achieved on the network.</para>
+ <para>You can configure 802.1x security for a wired or wireless connection type by opening the <guilabel>Network Connections</guilabel> window (refer to <xref
+ linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>) and following the applicable procedure:</para>
+ <procedure
+ id="procedure-For_a_wired_connection...">
+ <title>For a wired connection...</title>
+ <step>
+ <para>Select the <guilabel>Wired</guilabel> tab.</para>
+ </step>
+ <step>
+ <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
+ </step>
+ <step>
+ <para>Then select the <guilabel>802.1x Security</guilabel> tab and check the <guilabel>Use 802.1x security for this connection</guilabel> checkbox to enable settings configuration.</para>
+ </step>
+ <step>
+ <para>Proceed to </para>
+ </step>
+ </procedure>
+ <procedure
+ id="procedure-For_a_wireless_connection...">
+ <title>For a wireless connection...</title>
+ <step>
+ <para>Select the <guilabel>Wireless</guilabel> tab.</para>
+ </step>
+ <step>
+ <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
+ </step>
+ <step>
+ <para>Then click the <guilabel>Security</guilabel> dropdown and choose one of the following security methods: <guimenuitem>LEAP</guimenuitem>, <guimenuitem>Dynamic WEP (802.1x)</guimenuitem>, or <guimenuitem>WPA & WPA2 Enterprise</guimenuitem>.</para>
+ </step>
+ <step>
+ <para>Refer to for descriptions of which EAP types correspond to your selection in the <guilabel>Security</guilabel> dropdown.</para>
+ </step>
+ </procedure>
+<!-- <variablelist>
<varlistentry>
<term>
- <guilabel>Mode</guilabel>
+ <guilabel>Authentication</guilabel>
</term>
<listitem>
<para>
- <guimenuitem>Infrastructure</guimenuitem> — </para>
+ <guimenuitem>TLS</guimenuitem> — (Transport Layer Security) </para>
<para>
- <guimenuitem>Ad-hoc</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>BSSID</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>MAC address</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>MTU</guilabel>
- </term>
- <listitem>
- <para></para>
+ <guimenuitem>Tunneled TLS</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Protected EAP (PEAP)</guimenuitem> — </para>
</listitem>
</varlistentry>
- </variablelist>
- <bridgehead
- id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-wireless">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
- <para>Once you have finished editing the wireless connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can successfully connect to your the modified connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
- linkend="sec-Connecting_to_a_Network"/> for details on selecting and connecting to a network.</para>
- <para>You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
- <para>Then, to configure:</para>
- <itemizedlist>
+ </variablelist>-->
+ <section
+ id="sec-Configuring_TLS_Transport_Level_Security_Settings">
+ <title>Configuring TLS (Transport Level Security) Settings</title>
+ <para>With Transport Level Security, the client and server mutually authenticate using the TLS protocol. The server demonstrates that it holds a digital certificate, the client proves its own identity using its client-side certificate, and key information is exchanged. Once authentication is complete, the TLS tunnel is no longer used. Instead, the client and server use the exchanged keys to encrypt data using AES, TKIP or WEP.</para>
+ <para>The fact that certificates must be distributed to all clients who want to authenticate means that the the EAP-TLS authentication method is very strong, but also more complicated to set up. Using TLS security requires the overhead of a public key infrastructure (PKI) to manage certificates. The benefit to TLS security is that a compromised password does not allow access to the (W)LAN: an intruder must also have access to the authenticating client's private key.</para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Identity</guilabel>
+ </term>
<listitem>
- <para>security authentication for the wireless connection, click the <guilabel>Wireless Security</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_Wireless_Security"/>;</para>
+ <para></para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>User certificate</guilabel>
+ </term>
<listitem>
- <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv4_Settings"/>; or,
- </para>
+ <para></para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>CA certificate</guilabel>
+ </term>
<listitem>
- <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv6_Settings"/>.
- </para>
+ <para></para>
</listitem>
- </itemizedlist>
- </section>
- <section
- id="sec-Establishing_a_Mobile_Broadband_Connection">
- <title>Establishing a Mobile Broadband Connection</title>
- <remark>What is a <replaceable><type></replaceable> connection</remark>
- <remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark>
- <para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref
- linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para>
- <remark>image editing a <replaceable><type></replaceable> connection; caption: Editing the newly-created <replaceable><type></replaceable> connection 1</remark>
- <bridgehead
- id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-tab_name">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead>
- <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para>
- <itemizedlist>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Private key</guilabel>
+ </term>
<listitem>
- <para>
- <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>tab</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box.</para>
+ <para></para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Private key password</guilabel>
+ </term>
<listitem>
- <para>
- <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref
- linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para>
+ <para></para>
</listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section
+ id="sec-Configuring_Tunneled_TLS_Settings">
+ <title>Configuring Tunneled TLS Settings</title>
+ <para></para>
+ <remark>Which version of TTLS does NM use? v0 or v1?</remark>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Anonymous identity</guilabel>
+ </term>
<listitem>
- <para>
- <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref
- linkend="sec-User_and_System_Connections"/> for details.</para>
+ <para></para>
</listitem>
- </itemizedlist>
- <bridgehead>Configuring the <replaceable><tab></replaceable> Tab</bridgehead>
- <remark>describe tab-specific settings here</remark>
- <bridgehead
- id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-tab_name">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead>
- <para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref
- linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para>
- <para>At this point, you have created a new <replaceable><type></replaceable> connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para>
- <para>Then, to configure:</para>
- <itemizedlist>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>CA certificate</guilabel>
+ </term>
<listitem>
- <para>;</para>
+ <para></para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Inner authentication</guilabel>
+ </term>
<listitem>
- <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv4_Settings"/>; or,
- </para>
+ <para>
+ <guimenuitem>PAP</guimenuitem> — </para>
+ <para>
+ <guimenuitem>MSCHAP</guimenuitem> — </para>
+ <para>
+ <guimenuitem>MSCHAPv2</guimenuitem> — </para>
+ <para>
+ <guimenuitem>CHAP</guimenuitem> — </para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
<listitem>
- <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref
- linkend="sec-Configuring_IPv6_Settings"/>.
- </para>
+ <para></para>
</listitem>
- </itemizedlist>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Number</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>APN</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Network ID</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Type</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>PIN</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Establishing_a_VPN_Connection">
- <title>Establishing a VPN Connection</title>
- <para></para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Gateway</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Group name</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>User password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Group password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>User name</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Domain</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Encryption Method</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Secure (default)</guimenuitem> — </para>
- <para>
- <guimenuitem>Weak (use with caution)</guimenuitem> — </para>
- <para>
- <guimenuitem>None (completely insecure)</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>NAT traversal</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Cisco UDP (default)</guimenuitem> — </para>
- <para>
- <guimenuitem>NAT-T</guimenuitem> — </para>
- <para>
- <guimenuitem>Disabled</guimenuitem> — </para>
- <para>
- <guilabel>Disable Dead Peer Detection</guilabel> — </para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Establishing_a_DSL_Connection">
- <title>Establishing a DSL Connection</title>
- <para></para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Service</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Establishing_Routes">
- <title>Establishing Routes</title>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-System_eth0-Routes">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-System_eth0-Routes.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Configuring static network routes</para>
- </caption>
- </mediaobject>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Addresses</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Address</guimenuitem> — </para>
- <para>
- <guimenuitem>Prefix</guimenuitem> — </para>
- <para>
- <guimenuitem>Gateway</guimenuitem> — </para>
- <para>
- <guimenuitem>Metric</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Ignore automatically obtained routes</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Use this connection only for resources on its network</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
</section>
<section
- id="sec-Configuring_Connection_Settings">
- <title>Configuring Connection Settings</title>
- <section
- id="sec-Configuring_802.1x_Security">
- <title>Configuring 802.1x Security</title>
- <para>802.1x security is the name of the IEEE standard for port-based Network Access Control (PNAC). Simply put, 802.1x security is a way of defining a <firstterm>logical network</firstterm> out of a physical one. All clients who want to join the logical network must authenticate with the server (a router, for example) using the correct 802.1x authentication method.</para>
- <para>802.1x security is most often associated with securing wireless networks (WLANs), but can also be used to prevent intruders with physical access to the network (LAN) from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but but for various reasons this practice is both impractical and insecure, and thus is no longer recommended. Instead, 802.1x security is used to ensure a logically-secure network through port-based authentication.</para>
- <para>802.1x provides a framework for WLAN and LAN access control and serves as an envelope for carrying one of the Extensible Authentication Protocol (EAP) types. An EAP type is a protocol that defines how WLAN security is achieved on the network.</para>
- <para>You can configure 802.1x security for a wired or wireless connection type by opening the <guilabel>Network Connections</guilabel> window (refer to <xref
- linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>) and following the applicable procedure:</para>
- <procedure
- id="procedure-For_a_wired_connection...">
- <title>For a wired connection...</title>
- <step>
- <para>Select the <guilabel>Wired</guilabel> tab.</para>
- </step>
- <step>
- <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
- </step>
- <step>
- <para>Then select the <guilabel>802.1x Security</guilabel> tab and check the <guilabel>Use 802.1x security for this connection</guilabel> checkbox to enable settings configuration.</para>
- </step>
- <step>
- <para>Proceed to </para>
- </step>
- </procedure>
- <procedure
- id="procedure-For_a_wireless_connection...">
- <title>For a wireless connection...</title>
- <step>
- <para>Select the <guilabel>Wireless</guilabel> tab.</para>
- </step>
- <step>
- <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para>
- </step>
- <step>
- <para>Then click the <guilabel>Security</guilabel> dropdown and choose one of the following security methods: <guimenuitem>LEAP</guimenuitem>, <guimenuitem>Dynamic WEP (802.1x)</guimenuitem>, or <guimenuitem>WPA & WPA2 Enterprise</guimenuitem>.</para>
- </step>
- <step>
- <para>Refer to for descriptions of which EAP types correspond to your selection in the <guilabel>Security</guilabel> dropdown.</para>
- </step>
- </procedure>
-<!-- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Authentication</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>TLS</guimenuitem> — (Transport Layer Security) </para>
- <para>
- <guimenuitem>Tunneled TLS</guimenuitem> — </para>
- <para>
- <guimenuitem>Protected EAP (PEAP)</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- </variablelist>-->
- <section
- id="sec-Configuring_TLS_Transport_Level_Security_Settings">
- <title>Configuring TLS (Transport Level Security) Settings</title>
- <para>With Transport Level Security, the client and server mutually authenticate using the TLS protocol. The server demonstrates that it holds a digital certificate, the client proves its own identity using its client-side certificate, and key information is exchanged. Once authentication is complete, the TLS tunnel is no longer used. Instead, the client and server use the exchanged keys to encrypt data using AES, TKIP or WEP.</para>
- <para>The fact that certificates must be distributed to all clients who want to authenticate means that the the EAP-TLS authentication method is very strong, but also more complicated to set up. Using TLS security requires the overhead of a public key infrastructure (PKI) to manage certificates. The benefit to TLS security is that a compromised password does not allow access to the (W)LAN: an intruder must also have access to the authenticating client's private key.</para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Identity</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>User certificate</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>CA certificate</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Private key</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Private key password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Configuring_Tunneled_TLS_Settings">
- <title>Configuring Tunneled TLS Settings</title>
+ id="sec-Configuring_Protected_EAP_PEAP_Settings">
+ <title>Configuring Protected EAP (PEAP) Settings</title>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Anonymous Identity</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>CA certificate</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>PEAP version</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Inner authentication</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>MSCHAPv2</guimenuitem> — </para>
+ <para>
+ <guimenuitem>MD5</guimenuitem> — </para>
+ <para>
+ <guimenuitem>GTC</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Username</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Password</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+</section>
+<section
+ id="sec-Configuring_Wireless_Security">
+ <title>Configuring Wireless Security</title>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Security</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>None</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WEP 40/128-bit Key</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WEP 128-bit Passphrase</guimenuitem> — </para>
+ <para>
+ <guimenuitem>LEAP</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Dynamic WEP (802.1x)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WPA & WPA2 Personal</guimenuitem> — </para>
+ <para>
+ <guimenuitem>WPA & WPA2 Enterprise</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Password</term>
+ <listitem>
<para></para>
- <remark>Which version of TTLS does NM use? v0 or v1?</remark>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Anonymous identity</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>CA certificate</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Inner authentication</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>PAP</guimenuitem> — </para>
- <para>
- <guimenuitem>MSCHAP</guimenuitem> — </para>
- <para>
- <guimenuitem>MSCHAPv2</guimenuitem> — </para>
- <para>
- <guimenuitem>CHAP</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Configuring_Protected_EAP_PEAP_Settings">
- <title>Configuring Protected EAP (PEAP) Settings</title>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Anonymous Identity</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>CA certificate</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>PEAP version</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Inner authentication</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>MSCHAPv2</guimenuitem> — </para>
- <para>
- <guimenuitem>MD5</guimenuitem> — </para>
- <para>
- <guimenuitem>GTC</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Username</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Password</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- </section>
- <section
- id="sec-Configuring_Wireless_Security">
- <title>Configuring Wireless Security</title>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Security</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>None</guimenuitem> — </para>
- <para>
- <guimenuitem>WEP 40/128-bit Key</guimenuitem> — </para>
- <para>
- <guimenuitem>WEP 128-bit Passphrase</guimenuitem> — </para>
- <para>
- <guimenuitem>LEAP</guimenuitem> — </para>
- <para>
- <guimenuitem>Dynamic WEP (802.1x)</guimenuitem> — </para>
- <para>
- <guimenuitem>WPA & WPA2 Personal</guimenuitem> — </para>
- <para>
- <guimenuitem>WPA & WPA2 Enterprise</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>Password</term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Configuring_PPP_Point-to-Point_Settings">
- <title>Configuring PPP (Point-to-Point) Settings</title>
- <para></para>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Configure Methods</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Use point-to-point encryption (MPPE)</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Allow BSD data compression</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Allow Deflate data compression</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Use TCP header compression</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Send PPP echo packets</guilabel>
- </term>
- <listitem>
- <para></para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Configuring_IPv4_Settings">
- <title>Configuring IPv4 Settings</title>
- <mediaobject
- id="mediaobj-Network_Configuration-NM-IPv4_Settings">
- <imageobject>
- <imagedata
- align="center"
- fileref="images/Network_Configuration-NM-IPv4_Settings.png"
- format="PNG" />
- </imageobject>
- <caption>
- <para>Editing the IPv4 Settings Tab</para>
- </caption>
- </mediaobject>
- <para>The <guilabel>IPv4 Settings</guilabel> tab allows you to configure the method by which you connect to the Internet and enter IP address, route, and DNS information as required. The <guilabel>IPv4 Settings</guilabel> tab is available when you create and modify one of the following connection types: wired, wireless, mobile broadband, VPN or DSL. If you need to configure IPv6 addresses, refer to ???. If you need to configure static routes, which can be done by clicking on the <guibutton>Routes</guibutton> button, refer to ???.</para>
- <para>If you are using DHCP to obtain a dynamic IP address from a DHCP server, you can simply set <guilabel>Method</guilabel> to <guimenuitem>Automatic (DHCP)</guimenuitem>.</para>
- <bridgehead
- id="bh-Setting_the_Method">Setting the Method</bridgehead>
- <variablelist
- id="varlist-Available_IPv4_Methods_by_Connection_Type">
- <title>Available IPv4 Methods by Connection Type</title>
- <para>When you click the <guilabel>Method</guilabel> dropdown menu, depending on the type of connection you are configuring, you are able to select one of the following IPv4 connection methods. All of the methods are listed here according to which connection type or types they are associated with.</para>
- <varlistentry>
- <term>
- <guilabel>Method</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Automatic (DHCP)</guimenuitem> — Choose this option if the network you are connecting to uses a DHCP server to assign IP addresses. You do not need to fill in the <guilabel>DHCP client ID</guilabel> field.</para>
- <para>
- <guimenuitem>Automatic (DHCP) addresses only</guimenuitem> —</para>
- <para>
- <guimenuitem>Link-Local Only</guimenuitem> —</para>
- <para>
- <guimenuitem>Shared to other computers</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>Wired, Wireless and DSL Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Manual</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>Mobile Broadband Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Automatic (PPP)</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic (PPP) addresses only</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>VPN Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Automatic (VPN)</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic (VPN) addresses only</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>DSL Connection Methods</term>
- <listitem>
- <para>
- <guimenuitem>Automatic (PPPoE)</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic (PPPoE) addresses only</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section
- id="sec-Configuring_IPv6_Settings">
- <title>Configuring IPv6 Settings</title>
- <variablelist>
- <varlistentry>
- <term>
- <guilabel>Method</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>Ignore</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic</guimenuitem> — </para>
- <para>
- <guimenuitem>Automatic, addresses only</guimenuitem> — </para>
- <para>
- <guimenuitem>Manual</guimenuitem> — </para>
- <para>
- <guimenuitem>Link-Local Only</guimenuitem> — </para>
- <para>
- <guimenuitem>Shared to other computers</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <guilabel>Addresses</guilabel>
- </term>
- <listitem>
- <para>
- <guimenuitem>DNS servers</guimenuitem> — </para>
- <para>
- <guimenuitem>Search domains</guimenuitem> — </para>
- </listitem>
- </varlistentry>
- </variablelist>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
+<section
+ id="sec-Configuring_PPP_Point-to-Point_Settings">
+ <title>Configuring PPP (Point-to-Point) Settings</title>
+ <para></para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Configure Methods</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Use point-to-point encryption (MPPE)</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Allow BSD data compression</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Allow Deflate data compression</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Use TCP header compression</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Send PPP echo packets</guilabel>
+ </term>
+ <listitem>
+ <para></para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
+<section
+ id="sec-Configuring_IPv4_Settings">
+ <title>Configuring IPv4 Settings</title>
+ <mediaobject
+ id="mediaobj-Network_Configuration-NM-IPv4_Settings">
+ <imageobject>
+ <imagedata
+ align="center"
+ fileref="images/Network_Configuration-NM-IPv4_Settings.png"
+ format="PNG" />
+ </imageobject>
+ <caption>
+ <para>Editing the IPv4 Settings Tab</para>
+ </caption>
+ </mediaobject>
+ <para>The <guilabel>IPv4 Settings</guilabel> tab allows you to configure the method by which you connect to the Internet and enter IP address, route, and DNS information as required. The <guilabel>IPv4 Settings</guilabel> tab is available when you create and modify one of the following connection types: wired, wireless, mobile broadband, VPN or DSL. If you need to configure IPv6 addresses, refer to ???. If you need to configure static routes, which can be done by clicking on the <guibutton>Routes</guibutton> button, refer to ???.</para>
+ <para>If you are using DHCP to obtain a dynamic IP address from a DHCP server, you can simply set <guilabel>Method</guilabel> to <guimenuitem>Automatic (DHCP)</guimenuitem>.</para>
+ <bridgehead
+ id="bh-Setting_the_Method">Setting the Method</bridgehead>
+ <variablelist
+ id="varlist-Available_IPv4_Methods_by_Connection_Type">
+ <title>Available IPv4 Methods by Connection Type</title>
+ <para>When you click the <guilabel>Method</guilabel> dropdown menu, depending on the type of connection you are configuring, you are able to select one of the following IPv4 connection methods. All of the methods are listed here according to which connection type or types they are associated with.</para>
+ <varlistentry>
+ <term>
+ <guilabel>Method</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (DHCP)</guimenuitem> — Choose this option if the network you are connecting to uses a DHCP server to assign IP addresses. You do not need to fill in the <guilabel>DHCP client ID</guilabel> field.</para>
+ <para>
+ <guimenuitem>Automatic (DHCP) addresses only</guimenuitem> —</para>
+ <para>
+ <guimenuitem>Link-Local Only</guimenuitem> —</para>
+ <para>
+ <guimenuitem>Shared to other computers</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Wired, Wireless and DSL Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Manual</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Mobile Broadband Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (PPP)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic (PPP) addresses only</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>VPN Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (VPN)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic (VPN) addresses only</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>DSL Connection Methods</term>
+ <listitem>
+ <para>
+ <guimenuitem>Automatic (PPPoE)</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic (PPPoE) addresses only</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
+<section
+ id="sec-Configuring_IPv6_Settings">
+ <title>Configuring IPv6 Settings</title>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <guilabel>Method</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>Ignore</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Automatic, addresses only</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Manual</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Link-Local Only</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Shared to other computers</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
+ <guilabel>Addresses</guilabel>
+ </term>
+ <listitem>
+ <para>
+ <guimenuitem>DNS servers</guimenuitem> — </para>
+ <para>
+ <guimenuitem>Search domains</guimenuitem> — </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
<!--<para>For information on configuring static routes for the network connection, go to <xref
linkend="sec-Configuring_Routes"/>.</para>-->
- </section>
- </section>
- <section
- id="sec-NetworkManager_Architecture">
- <title>NetworkManager Architecture</title>
- <para>See <ulink
- url="http://live.gnome.org/NetworkManagerConfiguration"/>
- </para>
- </section>
+</section>
+</section>
+<section
+id="sec-NetworkManager_Architecture">
+<title>NetworkManager Architecture</title>
+<para>See <ulink
+ url="http://live.gnome.org/NetworkManagerConfiguration"/>
+</para>
+</section>
</chapter>
<!--<section
id="sec-Configuring_IPv4_Settings">
13 years, 11 months