How can I keep a wireless card's radio powered off by default?

"Modern" solution using Network Manager: simply uncheck the Wireless Enabled option at the Network Manager applet (KDE: Network Management). The command nmcli nm wifi off is equivalent. Continue reading if you sporadically enable Wi-Fi, but would like to revert it to disabled on reboot.

The wireless state is remembered in the file /var/lib/NetworkManager/NetworkManager.state. To disable Wi-Fi at boot, ensure that the key WirelessEnabled stays at false. You could do that by editing the init script of Network Manager, or by using the /etc/rc.local trick below. The command you need is:

sed s/^WirelessEnabled=true/WirelessEnabled=false/ -i /var/lib/NetworkManager/NetworkManager.state
rfkill block wifi

Put this before exit 0 (as described below). The rfkill block wifi command is still needed due to a race with startup of Network Manager (NM). Once NM has started, changes to the state file have no effect.

---

(old answer that involves editing file /etc/rc.local with an explanation of the rfkill command)

A bit hacky, but it should work. A wireless card can be disabled using the rfkill command. All devices used by rfkill can be shown using rfkill list. Sample output:

0: phy0: Wireless LAN
        Soft blocked: no
        Hard blocked: no

Hard blocked is dependend on a hardware setting, e.g. a wireless switch on a notebook. Soft blocked can be controlled by the OS (Ubuntu).

How does it work? It does not have a manpage, running rfkill provides a help text in this case:

Usage:  rfkill [options] command
Options:
        --version       show version (0.4)
Commands:
        help
        event
        list [IDENTIFIER]
        block IDENTIFIER
        unblock IDENTIFIER
where IDENTIFIER is the index no. of an rfkill switch or one of:
        <idx> all wifi wlan bluetooth uwb ultrawideband wimax wwan gps fm

Ah, now we get somewhere. You need to run rfkill block wifi as root to disable the wireless device. (wlan is an alias of wifi, see the source code of rfkill).

Now, if you want to disable the wireless functions at boottime, add the command to /etc/rc.local by running sudo nano /etc/rc.local. Use the arrow keys / page up/down keys to navigate to the line before exit 0 and add rfkill block wifi, so that the file end like this:

# By default, this script does nothing

rfkill block wifi
exit 0

When finished, press Ctrl + X, then press Y to save it and press Enter to accept the filename.

If you decide to activate the device later, run: sudo rfkill unblock wifi. Do not forget to remove the line from /etc/rc.local if you decide to use the wireless card.

There are at least two Upstart jobs that affect the default wireless state:

• /etc/init/rfkill-restore.conf restores the soft block state for all radios to what they were at last shutdown, as recorded in /var/lib/rfkill/saved-state.
• /etc/init/network-manager.conf starts Network Manager which in turn restores its idea of wireless state from /var/lib/NetworkManager/NetworkManager.state.

If you look at those two job configurations you will find that they have no temporal relationship, which seems like a design flaw to me. I'm guessing this race condition is rarely a problem because /etc/init/rfkill-restore.conf is much simpler and has fewer start conditions.

All the solutions to enforcing a wireless-off default that I've seen try to use /etc/rc.local, including the "modern" solution that @Lekensteyn and @rubo77 came up with. Unfortunately, that solution does not work for me on either of two laptops I have tried. This is not particularly surprising because /etc/rc.local also has no temporal relationship that I can find to either of /etc/init/rfkill-restore.conf and /etc/init/network-manager.conf. Throwing in a lengthy sleep in /etc/rc.local prior to issuing an rfkill block wifi is an ugly workaround for this race condition mess, but it works if the delay is long enough.

A better solution would be for us to impose our desired states in /var/lib/rfkill/saved-state and /var/lib/NetworkManager/NetworkManager.state before those two Upstart jobs are even permitted to run. We can achieve this by creating our own Upstart job. In actual fact, we'll need two job configuration files to achieve the timing we need.

Our first job configuration does the actual file modifications we need. It will run as early as possible and will only run once. Create /etc/init/radio-silence.conf with this content:

# radio-silence - Ensure radio silence on startup
#
# Override default startup behaviour of radios to ensure they are all
# disabled until the user deliberately enables them. This job requires
# radio-silence-wait to delay start of any services that may depend on
# resources manipulated by this job.

description "Disable all radios by default"

start on local-filesystems

pre-start script
  sed -i -re "s/^(.+[[:space:]]+)[01][[:space:]]*\$/\11/" /var/lib/rfkill/saved-state
  sed -i -re "s/^(WirelessEnabled=).*\$/\1false/" /var/lib/NetworkManager/NetworkManager.state
end script

As I prefer total radio silence when my laptop starts, I soft block all radios, not just wireless, but you can modify the first sed in the above to limit this job's impact to whichever wireless devices you wish to soft block.

Our second job configuration is responsible for ensuring that neither of the rfkill-restore and network-manager jobs will start before radio-silence has completed the file modifications. Create /etc/init/radio-silence-wait.conf as follows:

# radio-silence-wait - Helper task for radio-silence
#
# Delays the start of all jobs that may depend on resources manipulated
# by radio-silence job. Avoids the need to modify job configuration of
# those other jobs.

description "Assist radio-silence by delaying jobs it affects"

start on (starting rfkill-restore or starting network-manager)
stop on (started radio-silence or stopped radio-silence)

instance $JOB
normal exit 0 2
task

script
  status radio-silence | grep -q "start/running" && exit 0
  start radio-silence || true
  sleep infinity
end script

With this solution I am no longer seeing race condition problems, although I have not addressed the theoretical race between rfkill-restore and network-manager.

For more detail on how these jobs work together to achieve our temporal goal, refer to my question and answer, "How do I create a single-execution Upstart job guaranteed to complete before two other jobs begin?"