No network on first try

[Martin Wagner]

I've got a Fedora 27 desktop that has a slight network problem. 

I'm using VPN and I used nm-connection-editor to configure it so that
the VPN activates when eno1 activates. That worked fine in Fedora 26.
But after upgrade to Fedora 27 the network doesn't start properly at
startup, instead after I log in to gnome desktop I use the tools in top
right corner to Turn On Wired Connection and that brings up both eno1
and VPN just fine. 

Any suggestion how to make it work at startup?

[toddandmargo]

Perhaps "ONBOOT" is disabled?

Would you send us /etc/sysconfig/network-scripts/ifcfg-eno1 ?


---- On Wed, 14 Mar 2018 13:49:37 -0700 Martin Wagner  wrote ---- 
> I've got a Fedora 27 desktop that has a slight network problem. 
>  
> I'm using VPN and I used nm-connection-editor to configure it so that 
> the VPN activates when eno1 activates. That worked fine in Fedora 26. 
> But after upgrade to Fedora 27 the network doesn't start properly at 
> startup, instead after I log in to gnome desktop I use the tools in top 
> right corner to Turn On Wired Connection and that brings up both eno1 
> and VPN just fine. 
>  
> Any suggestion how to make it work at startup?
> _______________________________________________
> users mailing list -- users(a)lists.fedoraproject.org
> To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>
>

[Martin Wagner]

On Wed, 2018-03-14 at 18:00 -0700, toddandmargo wrote:
>  Perhaps "ONBOOT" is disabled?
>  
>  Would you send us /etc/sysconfig/network-scripts/ifcfg-eno1 ? 
This is what it looks like. 

TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME="Profile 2"
UUID=
ONBOOT=yes
IPADDR=192.168.1.103
PREFIX=24
GATEWAY=192.168.1.1
DNS1=127.0.0.1
SECONDARY_UUIDS=

Removed UUIDs

> 
> 
> ---- On Wed, 14 Mar 2018 13:49:37 -0700 Martin Wagner  wrote ---- 
> > I've got a Fedora 27 desktop that has a slight network problem. 
> > 
> > I'm using VPN and I used nm-connection-editor to configure it so
> > that 
> > the VPN activates when eno1 activates. That worked fine in Fedora
> > 26. 
> > But after upgrade to Fedora 27 the network doesn't start properly
> > at 
> > startup, instead after I log in to gnome desktop I use the tools in
> > top 
> > right corner to Turn On Wired Connection and that brings up both
> > eno1 
> > and VPN just fine. 
> > 
> > Any suggestion how to make it work at startup?
> > _______________________________________________
> > users mailing list -- users(a)lists.fedoraproject.org
> > To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> > 
> > 
> 
> _______________________________________________
> users mailing list -- users(a)lists.fedoraproject.org
> To unsubscribe send an email to users-leave(a)lists.fedoraproject.org

[Todd Chester]

On 03/14/2018 11:29 PM, Martin Wagner wrote:
>  TYPE=Ethernet
>  PROXY_METHOD=none
>  BROWSER_ONLY=no
>  BOOTPROTO=none
>  DEFROUTE=yes
>  IPV4_FAILURE_FATAL=no
>  IPV6INIT=no
>  IPV6_AUTOCONF=yes
>  IPV6_DEFROUTE=yes
>  IPV6_FAILURE_FATAL=no
>  IPV6_ADDR_GEN_MODE=stable-privacy
>  NAME="Profile 2"
>  UUID=
>  ONBOOT=yes
>  IPADDR=192.168.1.103
>  PREFIX=24
>  GATEWAY=192.168.1.1
>  DNS1=127.0.0.1
>  SECONDARY_UUIDS= 

Nothing seems wrong here.  You are using Fixed IP.
And ONBOOT is enabled

The only thing I am find a bit odd is your DNS1.
This is okay if you are running your own DNS (bind).
If not, try changing it to 8.8.8.8 (Google's DNS).

Also what is your /etc/resolv.conf ?

Mine looks like:

    # Generated by NetworkManager
    search netgear.com
    nameserver 192.168.250.1

The above is my el-cheap-o router.


Also try adding to your ifcfg-eno1
    USERCTL=yes

and see if that helps.

You can up and down eno1 from the command line with
     ifdown eno1
     ifup eno1

USERCTL has to be enabled for a user to do the above,
otherwise, you are stuck doing it as root

[Ed Greshko]

On 03/15/18 04:49, Martin Wagner wrote:
>  I've got a Fedora 27 desktop that has a slight network problem. 
>
>  I'm using VPN and I used nm-connection-editor to configure it so that
>  the VPN activates when eno1 activates. That worked fine in Fedora 26.
>  But after upgrade to Fedora 27 the network doesn't start properly at
>  startup, instead after I log in to gnome desktop I use the tools in top
>  right corner to Turn On Wired Connection and that brings up both eno1
>  and VPN just fine. 
>
>  Any suggestion how to make it work at startup? 

You've said you have things set to activate a VPN connection for the ethernet
interface, yes?

What type of VPN are you using?  I don't have my VPN activated automatically.  But
when it comes to OpenVPN there are 2 choices for saving the password.  Either for one
user and encrypted or for all users and un-encrypted.  I would think that for the VPN
to be activated without your having logged-in it would have to have been saved
un-encrypted for all users. 

I just tested it on a VPN and unless I have the PW saved for all the interface will
not come up on boot.

-- 
Conjecture is just a conclusion based on incomplete information. It isn't a fact.

[Martin Wagner]

On Thu, 2018-03-15 at 16:21 +0800, Ed Greshko wrote:
>  You've said you have things set to activate a VPN connection for
> the
>  ethernet
>  interface, yes?
>  
>  What type of VPN are you using?  I don't have my VPN activated
>  automatically.  But
>  when it comes to OpenVPN there are 2 choices for saving the
>  password.  Either for one
>  user and encrypted or for all users and un-encrypted.  I would think
>  that for the VPN
>  to be activated without your having logged-in it would have to have
>  been saved
>  un-encrypted for all users. 
>  
>  I just tested it on a VPN and unless I have the PW saved for all the
>  interface will
>  not come up on boot. 
I think you're on to something. When I inspected the log files I found
the following that's logged during startup.

vpn-connection[]: Failed to request VPN secrets #3: No agents were
available for this request.

But I do have the 'Make available to other users' enabled in the
settings for this VPN profile. The certificate for the VPN provider is
in a folder under /home/mainuser. If that location would make any
difference?

This is a OpenVPN service by Mullvad that I'm using.

[Ed Greshko]

On 03/17/18 00:36, Martin Wagner wrote:
>  On Thu, 2018-03-15 at 16:21 +0800, Ed Greshko wrote:
> > You've said you have things set to activate a VPN connection for the
> > ethernet
> > interface, yes?
> >
> > What type of VPN are you using?  I don't have my VPN activated
> > automatically.  But
> > when it comes to OpenVPN there are 2 choices for saving the
> > password.  Either for one
> > user and encrypted or for all users and un-encrypted.  I would think
> > that for the VPN
> > to be activated without your having logged-in it would have to have
> > been saved
> > un-encrypted for all users. 
> >
> > I just tested it on a VPN and unless I have the PW saved for all the
> > interface will
> > not come up on boot.
>  I think you're on to something. When I inspected the log files I found
>  the following that's logged during startup.
>
>  vpn-connection[]: Failed to request VPN secrets #3: No agents were
>  available for this request.
>
>  But I do have the 'Make available to other users' enabled in the
>  settings for this VPN profile. The certificate for the VPN provider is
>  in a folder under /home/mainuser. If that location would make any
>  difference? 
Yes, it would.

The problem you now have is that you've placed the certs in a non-standard location. 
This means they will have the wrong selinux context.

The easiest thing to do is delete the VPN profiles and say "yes" when it prompts
to
place the certs in the standard location of

~/.local/share/networkmanagement/certificates/<Connection Name>

They will then have selinux context like this...

[egreshko@meimei US-West]$ pwd
/home/egreshko/.local/share/networkmanagement/certificates/US-West
[egreshko@meimei US-West]$ ls -Z
unconfined_u:object_r:home_cert_t:s0 ca.crt
unconfined_u:object_r:home_cert_t:s0 cert.crt
unconfined_u:object_r:home_cert_t:s0 private.key
unconfined_u:object_r:home_cert_t:s0 tls_auth.key


-- 
Conjecture is just a conclusion based on incomplete information. It isn't a fact.

[Martin Wagner]

On Sat, 2018-03-17 at 04:33 +0800, Ed Greshko wrote:
>  On 03/17/18 00:36, Martin Wagner wrote:
>  > On Thu, 2018-03-15 at 16:21 +0800, Ed Greshko wrote:
>  > > You've said you have things set to activate a VPN connection for
>  > > the
>  > > ethernet
>  > > interface, yes?
>  > > 
>  > > What type of VPN are you using?  I don't have my VPN activated
>  > > automatically.  But
>  > > when it comes to OpenVPN there are 2 choices for saving the
>  > > password.  Either for one
>  > > user and encrypted or for all users and un-encrypted.  I would
>  > > think
>  > > that for the VPN
>  > > to be activated without your having logged-in it would have to
>  > > have
>  > > been saved
>  > > un-encrypted for all users. 
>  > > 
>  > > I just tested it on a VPN and unless I have the PW saved for all
>  > > the
>  > > interface will
>  > > not come up on boot.
>  > 
>  > I think you're on to something. When I inspected the log files I
>  > found
>  > the following that's logged during startup.
>  > 
>  > vpn-connection[]: Failed to request VPN secrets #3: No agents were
>  > available for this request.
>  > 
>  > But I do have the 'Make available to other users' enabled in the
>  > settings for this VPN profile. The certificate for the VPN provider
>  > is
>  > in a folder under /home/mainuser. If that location would make any
>  > difference?
>  
>  Yes, it would.
>  
>  The problem you now have is that you've placed the certs in a non-
>  standard location. 
>  This means they will have the wrong selinux context.
>  
>  The easiest thing to do is delete the VPN profiles and say "yes" when
>  it prompts to
>  place the certs in the standard location of
>  
>  ~/.local/share/networkmanagement/certificates/<Connection Name>
>  
>  They will then have selinux context like this...
>  
>  [egreshko@meimei US-West]$ pwd
>  /home/egreshko/.local/share/networkmanagement/certificates/US-West
>  [egreshko@meimei US-West]$ ls -Z
>  unconfined_u:object_r:home_cert_t:s0 ca.crt
>  unconfined_u:object_r:home_cert_t:s0 cert.crt
>  unconfined_u:object_r:home_cert_t:s0 private.key
>  unconfined_u:object_r:home_cert_t:s0 tls_auth.key 
Thanks for the help. I finally got it working. I think that the actual
problem was that I had missed that there's an icon to the right in the
password field. I got the VPN working at startup after changing its
value to 'Store the password for all users'

[Ed Greshko]

On 03/17/18 05:49, Martin Wagner wrote:
>  On Sat, 2018-03-17 at 04:33 +0800, Ed Greshko wrote:
> > On 03/17/18 00:36, Martin Wagner wrote:
> >> On Thu, 2018-03-15 at 16:21 +0800, Ed Greshko wrote:
> >>> You've said you have things set to activate a VPN connection for
> >>> the
> >>> ethernet
> >>> interface, yes?
> >>>
> >>> What type of VPN are you using?  I don't have my VPN activated
> >>> automatically.  But
> >>> when it comes to OpenVPN there are 2 choices for saving the
> >>> password.  Either for one
> >>> user and encrypted or for all users and un-encrypted.  I would
> >>> think
> >>> that for the VPN
> >>> to be activated without your having logged-in it would have to
> >>> have
> >>> been saved
> >>> un-encrypted for all users. 
> >>>
> >>> I just tested it on a VPN and unless I have the PW saved for all
> >>> the
> >>> interface will
> >>> not come up on boot.
> >> I think you're on to something. When I inspected the log files I
> >> found
> >> the following that's logged during startup.
> >>
> >> vpn-connection[]: Failed to request VPN secrets #3: No agents were
> >> available for this request.
> >>
> >> But I do have the 'Make available to other users' enabled in the
> >> settings for this VPN profile. The certificate for the VPN provider
> >> is
> >> in a folder under /home/mainuser. If that location would make any
> >> difference?
> > Yes, it would.
> >
> > The problem you now have is that you've placed the certs in a non-
> > standard location. 
> > This means they will have the wrong selinux context.
> >
> > The easiest thing to do is delete the VPN profiles and say "yes" when
> > it prompts to
> > place the certs in the standard location of
> >
> > ~/.local/share/networkmanagement/certificates/<Connection Name>
> >
> > They will then have selinux context like this...
> >
> > [egreshko@meimei US-West]$ pwd
> > /home/egreshko/.local/share/networkmanagement/certificates/US-West
> > [egreshko@meimei US-West]$ ls -Z
> > unconfined_u:object_r:home_cert_t:s0 ca.crt
> > unconfined_u:object_r:home_cert_t:s0 cert.crt
> > unconfined_u:object_r:home_cert_t:s0 private.key
> > unconfined_u:object_r:home_cert_t:s0 tls_auth.key
>  Thanks for the help. I finally got it working. I think that the actual
>  problem was that I had missed that there's an icon to the right in the
>  password field. I got the VPN working at startup after changing its
>  value to 'Store the password for all users' 
Yes, that was the setting I was referring to in my original response.  Sorry for not
being more clear.

Good to hear it is all working now.


-- 
Conjecture is just a conclusion based on incomplete information. It isn't a fact.