python icon indicating copy to clipboard operation
python copied to clipboard

Setting `security.is_managed true` over the air results in NO_CHANNEL for PKI admin

Open ndoo opened this issue 3 months ago • 2 comments

Using > meshtastic --dest !abcd1234 --set security.is_managed true to enable managed mode over the air results in NO_CHANNEL errors and losing PKI admin access.

Using local serial does not cause this.

I think this is due to not being able to read out the existing security configs over the air, causing a blank security section to get written back to the node (other than security.is_managed), resulting in the admin keys getting wiped out.

ndoo avatar Sep 19 '25 15:09 ndoo

Very annoyingly, it also means that disabling managed mode over the air also causes the security keys to get wiped halfway through the transaction, causing it to fail.

> meshtastic --dest !abcd1234 --set security.is_managed false --host [redacted]
Connected to radio
Requesting current config from remote node (this can take a while).

Set security.is_managed to false
Writing modified preferences to device
Writing security configuration to device
Waiting for an acknowledgment from remote node (this could take a while)
Aborting due to: Timed out waiting for an acknowledgment

For now it seems like using CLI to set/unset managed mode with PKI admin is not possible.

ndoo avatar Sep 19 '25 15:09 ndoo

If you're able to get (and redact) a debug logs from the CLI that would be helpful here. There isn't any reason I know of that it wouldn't be possible to fetch the security config over the air -- certainly I've used it with --get over remote admin to check which keys are set to admin and similar things

ianmcorvidae avatar Oct 10 '25 22:10 ianmcorvidae