Unable to Connect Raspberry Pi 4 to WPA3 WiFi and Persist WPA2 Password on LibreELEC 12.0

    Hi everyone,

    I'm running the latest LibreELEC 12.0 on a Raspberry Pi 4 and, as the title suggests, I'm having issues connecting to my WiFi with WPA3 configured. I've enabled debug logging on the iwd service, and the only message I received was "Can't use SAE, trying WPA2." Since SAE_OFFLOAD is not a supported feature, I assume I won't be able to get WPA3 working either.

    So, I tried logging Kodi into my IoT WiFi network, which still runs on WPA2. However, the password is quite long, and I tried persisting it via SSH.

    First, I attempted to save the password using a profile file in /var/lib/iwd, but it did not persist. Then, I tried using the connmanctl agent on command, but I still get prompted for the WiFi password after every reboot. I'm out of ideas on how to make the password persist.

    Could anyone please advise me on how to save my WiFi password permanently?

    Best regards,

    Affe

    LE does not use/store profiles for iwd, only for ConnMan in /storage/.cache/connman/ .. but the correct way to store those is to use the connmanctl agent. The only time I've seen issues with passwords not being retained over boot is with WiFi devices that have no persistent MAC; so the kernel auto-generates and assigns a new one on each boot and since ConnMan stores profiles against the MAC, on reboot the MAC changes and there's no store profile and you're forced to configure it afresh. I do also see isses from users trying to use overly-long passwords too, but that's usually a more simple rejection.

    Are you using the onboard WiFi of the RPi4 or some cheap USB dongle?. Check the MAC before/after rebooting.

    Quote from chewitt

    LE does not use/store profiles for iwd, only for ConnMan in /storage/.cache/connman/ .. but the correct way to store those is to use the connmanctl agent. The only time I've seen issues with passwords not being retained over boot is with WiFi devices that have no persistent MAC; so the kernel auto-generates and assigns a new one on each boot and since ConnMan stores profiles against the MAC, on reboot the MAC changes and there's no store profile and you're forced to configure it afresh. I do also see isses from users trying to use overly-long passwords too, but that's usually a more simple rejection.

    Are you using the onboard WiFi of the RPi4 or some cheap USB dongle?. Check the MAC before/after rebooting.

    just the onboard wifi, does that one auto generate its mac adress?

    i've managed to use connman shortly after i made this post to get it working, but it has been somewhat unstable, sometimes disconnecting, sometimes asking for the password. yesterday it stopped working for good


    connmanctl output without invervention

    Quote

    connmanctl> services
    *AR Wired ethernet_dca632225c66_cable
    *A blah blah

    neither ssh, the webserver, or any outgoing connection is working via wifi, even if i manually enable it and it tells me AR on the wifi one.


    honestly i'm at my wits end, everything worked fine in the previous libreelec versions

    Hi,

    I've done a full reset to 12.0.1 and tried again using connmanctl, while wired it worked, after restarting it failed to connect to the wifi and asked me for the password.

    It feels totally hopeless getting wifi working in a secure manner. :(

    br.

    Affe

    The non-trivial suggestion is to self-build an image that uses wpa_supplicant instead of iwd to see if that's the issue. The switch to iwd has overall been successful, but over time there's been a few users whose setups are tripping over edge cases and/or borderline reception and iwd doesn't seem to perform as well in those situations as older wpa_supplicant. We aren't going to be moving back to wpa but we've intentionally left support in the build system for a while to support people doing some a/b testing.

    after tinkering a bit and creating a startup script that auto connects the wifi i've made the following discovery

    setup: IP#1 for LAN and IP#2 for wifi

    startup + having the LAN cable that i used for the initial setup => wifi works, can connect to IP#1 and IP#2

    startup + having the LAN cable disconnected => wifi doesnt work, no connection to IP#2, but the frontend tells me that its connected and the script logs also say that the connection succeeded

    #!/bin/sh


    # Wi-Fi service identifier
    WIFI_SERVICE=""

    # Maximum number of retries
    MAX_RETRIES=5

    # Initial delay before retrying (in seconds)
    DELAY=10

    # Function to connect to Wi-Fi with retries
    connect_to_wifi() {
    local retries=0
    local success=0
    sleep 10

    while [ $retries -lt $MAX_RETRIES ]; do
    echo "Attempting to connect to Wi-Fi (try #$((retries + 1)))..." >> /storage/.config/autostart.log 2>&1

    # Try to connect to the Wi-Fi service in the background
    nohup connmanctl connect "$WIFI_SERVICE" &

    # Check if the connection was successful
    if [ $? -eq 0 ]; then
    echo "Successfully connected to Wi-Fi." >> /storage/.config/autostart.log 2>&1
    success=1
    break
    else
    echo "Failed to connect. Retrying in $DELAY seconds..." >> /storage/.config/autostart.log 2>&1
    sleep $DELAY
    retries=$((retries + 1))

    # Exponential backoff: double the delay with each retry
    DELAY=$((DELAY * 2))
    fi
    done

    if [ $success -eq 0 ]; then
    echo "Failed to connect to Wi-Fi after $MAX_RETRIES attempts." >> /storage/.config/autostart.log 2>&1
    fi
    }

    # Execute the function to connect to Wi-Fi in the background
    connect_to_wifi &


    this is my script and this the log output

    cat /storage/.config/autostart.log
    Attempting to connect to Wi-Fi (try #1)...
    Successfully connected to Wi-Fi.
    Attempting to connect to Wi-Fi (try #1)...
    Successfully connected to Wi-Fi.
    Attempting to connect to Wi-Fi (try #1)...
    Successfully connected to Wi-Fi.
    Attempting to connect to Wi-Fi (try #1)...
    Successfully connected to Wi-Fi.

    It's because you're testing for 'success' on the return code of 'nohup' rather than 'connmanctl'. Plus, you should be testing if there is a valid 'ipv4' address acquired like this.


    This will try to obtain the IP address every 3 seconds for a max of five times.

    Shell session
    timeout=$(($(date +%s) + 15))
until [ -n "$(ip -4 route get 8.8.8.8 2>/dev/null | awk {'print $7'} | tr -d '\n')" ] || [ $(date +%s) -gt $timeout ]; do sleep 3; done
ip=$(ip -4 route get 8.8.8.8 | awk {'print $7'} | tr -d '\n' 2>/dev/null)
[[ ${#ip} -gt 0 ]] && echo "Connected!"