2006-03-07 05:26:33 +00:00
|
|
|
.\" This manpage has been automatically generated by docbook2man
|
|
|
|
.\" from a DocBook document. This tool can be found at:
|
|
|
|
.\" <http://shell.ipoline.com/~elmert/comp/docbook2X/>
|
|
|
|
.\" Please send any bug reports, improvements, comments, patches,
|
|
|
|
.\" etc. to Steve Cheng <steve@ggi-project.org>.
|
Import wpa_supplicant / hostapd 0.7.3.
Changes:
2010-09-07 - v0.7.3
* fixed fallback from failed PMKSA caching into full EAP authentication
[Bug 355]
* fixed issue with early D-Bus signals during initialization
* fixed X.509 name handling in internal TLS
* fixed WPS ER to use corrent Enrollee MAC Address in Credential
* fixed scanning routines ot improve AP selection for WPS
* added WPS workaround for open networks
* fixed WPS Diffie-Hellman derivation to use correct public key length
* fixed wpa_supplicant AP mode operations to ignore Supplicant and
scan result events
* improved SME operations with nl80211
* fixed WPS ER event_id handling in some cases
* fixed some issues with bgscan simple to avoid unnecessary scans
* fixed issue with l2_packet_ndis overlapped writes corrupting stack
[Bug 328]
* updated WinPcap to the latest stable version 4.1.2 in Windows
installer
2010-04-18 - v0.7.2
* nl80211: fixed number of issues with roaming
* avoid unnecessary roaming if multiple APs with similar signal
strength are present in scan results
* add TLS client events and server probing to ease design of
automatic detection of EAP parameters
* add option for server certificate matching (SHA256 hash of the
certificate) instead of trusted CA certificate configuration
* bsd: Cleaned up driver wrapper and added various low-level
configuration options
* wpa_gui-qt4: do not show too frequent WPS AP available events as
tray messages
* TNC: fixed issues with fragmentation
* EAP-TNC: add Flags field into fragment acknowledgement (needed to
interoperate with other implementations; may potentially breaks
compatibility with older wpa_supplicant/hostapd versions)
* wpa_cli: added option for using a separate process to receive event
messages to reduce latency in showing these
(CFLAGS += -DCONFIG_WPA_CLI_FORK=y in .config to enable this)
* maximum BSS table size can now be configured (bss_max_count)
* BSSes to be included in the BSS table can be filtered based on
configured SSIDs to save memory (filter_ssids)
* fix number of issues with IEEE 802.11r/FT; this version is not
backwards compatible with old versions
* nl80211: add support for IEEE 802.11r/FT protocol (both over-the-air
and over-the-DS)
* add freq_list network configuration parameter to allow the AP
selection to filter out entries based on the operating channel
* add signal strength change events for bgscan; this allows more
dynamic changes to background scanning interval based on changes in
the signal strength with the current AP; this improves roaming within
ESS quite a bit, e.g., with bgscan="simple:30:-45:300" in the network
configuration block to request background scans less frequently when
signal strength remains good and to automatically trigger background
scans whenever signal strength drops noticeably
(this is currently only available with nl80211)
* add BSSID and reason code (if available) to disconnect event messages
* wpa_gui-qt4: more complete support for translating the GUI with
linguist and add German translation
* fix DH padding with internal crypto code (mainly, for WPS)
* do not trigger initial scan automatically anymore if there are no
enabled networks
2010-01-16 - v0.7.1
* cleaned up driver wrapper API (struct wpa_driver_ops); the new API
is not fully backwards compatible, so out-of-tree driver wrappers
will need modifications
* cleaned up various module interfaces
* merge hostapd and wpa_supplicant developers' documentation into a
single document
* nl80211: use explicit deauthentication to clear cfg80211 state to
avoid issues when roaming between APs
* dbus: major design changes in the new D-Bus API
(fi.w1.wpa_supplicant1)
* nl80211: added support for IBSS networks
* added internal debugging mechanism with backtrace support and memory
allocation/freeing validation, etc. tests (CONFIG_WPA_TRACE=y)
* added WPS ER unsubscription command to more cleanly unregister from
receiving UPnP events when ER is terminated
* cleaned up AP mode operations to avoid need for virtual driver_ops
wrapper
* added BSS table to maintain more complete scan result information
over multiple scans (that may include only partial results)
* wpa_gui-qt4: update Peers dialog information more dynamically while
the dialog is kept open
* fixed PKCS#12 use with OpenSSL 1.0.0
* driver_wext: Added cfg80211-specific optimization to avoid some
unnecessary scans and to speed up association
2009-11-21 - v0.7.0
* increased wpa_cli ping interval to 5 seconds and made this
configurable with a new command line options (-G<seconds>)
* fixed scan buffer processing with WEXT to handle up to 65535
byte result buffer (previously, limited to 32768 bytes)
* allow multiple driver wrappers to be specified on command line
(e.g., -Dnl80211,wext); the first one that is able to initialize the
interface will be used
* added support for multiple SSIDs per scan request to optimize
scan_ssid=1 operations in ap_scan=1 mode (i.e., search for hidden
SSIDs); this requires driver support and can currently be used only
with nl80211
* added support for WPS USBA out-of-band mechanism with USB Flash
Drives (UFD) (CONFIG_WPS_UFD=y)
* driver_ndis: add PAE group address to the multicast address list to
fix wired IEEE 802.1X authentication
* fixed IEEE 802.11r key derivation function to match with the standard
(note: this breaks interoperability with previous version) [Bug 303]
* added better support for drivers that allow separate authentication
and association commands (e.g., mac80211-based Linux drivers with
nl80211; SME in wpa_supplicant); this allows over-the-air FT protocol
to be used (IEEE 802.11r)
* fixed SHA-256 based key derivation function to match with the
standard when using CCMP (for IEEE 802.11r and IEEE 802.11w)
(note: this breaks interoperability with previous version) [Bug 307]
* use shared driver wrapper files with hostapd
* added AP mode functionality (CONFIG_AP=y) with mode=2 in the network
block; this can be used for open and WPA2-Personal networks
(optionally, with WPS); this links in parts of hostapd functionality
into wpa_supplicant
* wpa_gui-qt4: added new Peers dialog to show information about peers
(other devices, including APs and stations, etc. in the neighborhood)
* added support for WPS External Registrar functionality (configure APs
and enroll new devices); can be used with wpa_gui-qt4 Peers dialog
and wpa_cli commands wps_er_start, wps_er_stop, wps_er_pin,
wps_er_pbc, wps_er_learn
(this can also be used with a new 'none' driver wrapper if no
wireless device or IEEE 802.1X on wired is needed)
* driver_nl80211: multiple updates to provide support for new Linux
nl80211/mac80211 functionality
* updated management frame protection to use IEEE Std 802.11w-2009
* fixed number of small WPS issues and added workarounds to
interoperate with common deployed broken implementations
* added support for NFC out-of-band mechanism with WPS
* driver_ndis: fixed wired IEEE 802.1X authentication with PAE group
address frames
* added preliminary support for IEEE 802.11r RIC processing
* added support for specifying subset of enabled frequencies to scan
(scan_freq option in the network configuration block); this can speed
up scanning process considerably if it is known that only a small
subset of channels is actually used in the network (this is currently
supported only with -Dnl80211)
* added a workaround for race condition between receiving the
association event and the following EAPOL-Key
* added background scan and roaming infrastructure to allow
network-specific optimizations to be used to improve roaming within
an ESS (same SSID)
* added new DBus interface (fi.w1.wpa_supplicant1)
2010-10-29 08:01:21 +00:00
|
|
|
.TH "WPA_SUPPLICANT.CONF" "5" "07 September 2010" "" ""
|
2006-03-07 05:26:33 +00:00
|
|
|
|
|
|
|
.SH NAME
|
|
|
|
wpa_supplicant.conf \- configuration file for wpa_supplicant
|
|
|
|
.SH "OVERVIEW"
|
|
|
|
.PP
|
|
|
|
\fBwpa_supplicant\fR is configured using a text
|
|
|
|
file that lists all accepted networks and security policies,
|
|
|
|
including pre-shared keys. See the example configuration file,
|
|
|
|
probably in \fB/usr/share/doc/wpa_supplicant/\fR, for
|
|
|
|
detailed information about the configuration format and supported
|
|
|
|
fields.
|
|
|
|
.PP
|
|
|
|
All file paths in this configuration file should use full
|
|
|
|
(absolute, not relative to working directory) path in order to allow
|
|
|
|
working directory to be changed. This can happen if wpa_supplicant is
|
|
|
|
run in the background.
|
|
|
|
.PP
|
|
|
|
Changes to configuration file can be reloaded be sending
|
|
|
|
SIGHUP signal to \fBwpa_supplicant\fR ('killall -HUP
|
|
|
|
wpa_supplicant'). Similarly, reloading can be triggered with
|
2009-01-15 04:25:21 +00:00
|
|
|
the \fBwpa_cli reconfigure\fR command.
|
2006-03-07 05:26:33 +00:00
|
|
|
.PP
|
|
|
|
Configuration file can include one or more network blocks,
|
|
|
|
e.g., one for each used SSID. wpa_supplicant will automatically
|
2007-07-11 15:48:36 +00:00
|
|
|
select the best network based on the order of network blocks in
|
2006-03-07 05:26:33 +00:00
|
|
|
the configuration file, network security level (WPA/WPA2 is
|
2007-07-11 15:48:36 +00:00
|
|
|
preferred), and signal strength.
|
2006-03-07 05:26:33 +00:00
|
|
|
.SH "QUICK EXAMPLES"
|
|
|
|
.TP 3
|
|
|
|
1.
|
|
|
|
WPA-Personal (PSK) as home network and WPA-Enterprise with
|
|
|
|
EAP-TLS as work network.
|
|
|
|
.sp
|
|
|
|
.RS
|
|
|
|
|
|
|
|
.nf
|
|
|
|
# allow frontend (e.g., wpa_cli) to be used by all users in 'wheel' group
|
2009-03-01 22:10:07 +00:00
|
|
|
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
|
2006-03-07 05:26:33 +00:00
|
|
|
#
|
|
|
|
# home network; allow all valid ciphers
|
|
|
|
network={
|
|
|
|
ssid="home"
|
|
|
|
scan_ssid=1
|
|
|
|
key_mgmt=WPA-PSK
|
|
|
|
psk="very secret passphrase"
|
|
|
|
}
|
|
|
|
#
|
|
|
|
# work network; use EAP-TLS with WPA; allow only CCMP and TKIP ciphers
|
|
|
|
network={
|
|
|
|
ssid="work"
|
|
|
|
scan_ssid=1
|
|
|
|
key_mgmt=WPA-EAP
|
|
|
|
pairwise=CCMP TKIP
|
|
|
|
group=CCMP TKIP
|
|
|
|
eap=TLS
|
|
|
|
identity="user@example.com"
|
|
|
|
ca_cert="/etc/cert/ca.pem"
|
|
|
|
client_cert="/etc/cert/user.pem"
|
|
|
|
private_key="/etc/cert/user.prv"
|
|
|
|
private_key_passwd="password"
|
|
|
|
}
|
|
|
|
.fi
|
|
|
|
.RE
|
|
|
|
.TP 3
|
|
|
|
2.
|
|
|
|
WPA-RADIUS/EAP-PEAP/MSCHAPv2 with RADIUS servers that
|
|
|
|
use old peaplabel (e.g., Funk Odyssey and SBR, Meetinghouse
|
|
|
|
Aegis, Interlink RAD-Series)
|
|
|
|
.sp
|
|
|
|
.RS
|
|
|
|
|
|
|
|
.nf
|
2009-03-01 22:10:07 +00:00
|
|
|
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
|
2006-03-07 05:26:33 +00:00
|
|
|
network={
|
|
|
|
ssid="example"
|
|
|
|
scan_ssid=1
|
|
|
|
key_mgmt=WPA-EAP
|
|
|
|
eap=PEAP
|
|
|
|
identity="user@example.com"
|
|
|
|
password="foobar"
|
|
|
|
ca_cert="/etc/cert/ca.pem"
|
|
|
|
phase1="peaplabel=0"
|
|
|
|
phase2="auth=MSCHAPV2"
|
|
|
|
}
|
|
|
|
.fi
|
|
|
|
.RE
|
|
|
|
.TP 3
|
|
|
|
3.
|
|
|
|
EAP-TTLS/EAP-MD5-Challenge configuration with anonymous
|
|
|
|
identity for the unencrypted use. Real identity is sent only
|
|
|
|
within an encrypted TLS tunnel.
|
|
|
|
.sp
|
|
|
|
.RS
|
|
|
|
|
|
|
|
.nf
|
2009-03-01 22:10:07 +00:00
|
|
|
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
|
2006-03-07 05:26:33 +00:00
|
|
|
network={
|
|
|
|
ssid="example"
|
|
|
|
scan_ssid=1
|
|
|
|
key_mgmt=WPA-EAP
|
|
|
|
eap=TTLS
|
|
|
|
identity="user@example.com"
|
|
|
|
anonymous_identity="anonymous@example.com"
|
|
|
|
password="foobar"
|
|
|
|
ca_cert="/etc/cert/ca.pem"
|
|
|
|
phase2="auth=MD5"
|
|
|
|
}
|
|
|
|
.fi
|
|
|
|
.RE
|
|
|
|
.TP 3
|
|
|
|
4.
|
|
|
|
IEEE 802.1X (i.e., no WPA) with dynamic WEP keys
|
|
|
|
(require both unicast and broadcast); use EAP-TLS for
|
|
|
|
authentication
|
|
|
|
.sp
|
|
|
|
.RS
|
|
|
|
|
|
|
|
.nf
|
2009-03-01 22:10:07 +00:00
|
|
|
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
|
2006-03-07 05:26:33 +00:00
|
|
|
network={
|
|
|
|
ssid="1x-test"
|
|
|
|
scan_ssid=1
|
|
|
|
key_mgmt=IEEE8021X
|
|
|
|
eap=TLS
|
|
|
|
identity="user@example.com"
|
|
|
|
ca_cert="/etc/cert/ca.pem"
|
|
|
|
client_cert="/etc/cert/user.pem"
|
|
|
|
private_key="/etc/cert/user.prv"
|
|
|
|
private_key_passwd="password"
|
|
|
|
eapol_flags=3
|
|
|
|
}
|
|
|
|
.fi
|
|
|
|
.RE
|
|
|
|
.TP 3
|
|
|
|
5.
|
|
|
|
Catch all example that allows more or less all
|
|
|
|
configuration modes. The configuration options are used based
|
|
|
|
on what security policy is used in the selected SSID. This is
|
|
|
|
mostly for testing and is not recommended for normal
|
|
|
|
use.
|
|
|
|
.sp
|
|
|
|
.RS
|
|
|
|
|
|
|
|
.nf
|
2009-03-01 22:10:07 +00:00
|
|
|
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
|
2006-03-07 05:26:33 +00:00
|
|
|
network={
|
|
|
|
ssid="example"
|
|
|
|
scan_ssid=1
|
|
|
|
key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
|
|
|
|
pairwise=CCMP TKIP
|
|
|
|
group=CCMP TKIP WEP104 WEP40
|
|
|
|
psk="very secret passphrase"
|
|
|
|
eap=TTLS PEAP TLS
|
|
|
|
identity="user@example.com"
|
|
|
|
password="foobar"
|
|
|
|
ca_cert="/etc/cert/ca.pem"
|
|
|
|
client_cert="/etc/cert/user.pem"
|
|
|
|
private_key="/etc/cert/user.prv"
|
|
|
|
private_key_passwd="password"
|
|
|
|
phase1="peaplabel=0"
|
|
|
|
ca_cert2="/etc/cert/ca2.pem"
|
|
|
|
client_cert2="/etc/cer/user.pem"
|
|
|
|
private_key2="/etc/cer/user.prv"
|
|
|
|
private_key2_passwd="password"
|
|
|
|
}
|
|
|
|
.fi
|
|
|
|
.RE
|
|
|
|
.TP 3
|
|
|
|
6.
|
|
|
|
Authentication for wired Ethernet. This can be used with
|
2009-03-01 22:10:07 +00:00
|
|
|
\fBwired\fR or \fBroboswitch\fR interface
|
|
|
|
(-Dwired or -Droboswitch on command line).
|
2006-03-07 05:26:33 +00:00
|
|
|
.sp
|
|
|
|
.RS
|
|
|
|
|
|
|
|
.nf
|
2009-03-01 22:10:07 +00:00
|
|
|
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
|
2006-03-07 05:26:33 +00:00
|
|
|
ap_scan=0
|
|
|
|
network={
|
|
|
|
key_mgmt=IEEE8021X
|
|
|
|
eap=MD5
|
|
|
|
identity="user"
|
|
|
|
password="password"
|
|
|
|
eapol_flags=0
|
|
|
|
}
|
|
|
|
.fi
|
|
|
|
.RE
|
|
|
|
.SH "CERTIFICATES"
|
|
|
|
.PP
|
|
|
|
Some EAP authentication methods require use of
|
|
|
|
certificates. EAP-TLS uses both server side and client
|
|
|
|
certificates whereas EAP-PEAP and EAP-TTLS only require the server
|
|
|
|
side certificate. When client certificate is used, a matching
|
|
|
|
private key file has to also be included in configuration. If the
|
|
|
|
private key uses a passphrase, this has to be configured in
|
|
|
|
wpa_supplicant.conf ("private_key_passwd").
|
|
|
|
.PP
|
|
|
|
wpa_supplicant supports X.509 certificates in PEM and DER
|
|
|
|
formats. User certificate and private key can be included in the
|
|
|
|
same file.
|
|
|
|
.PP
|
|
|
|
If the user certificate and private key is received in
|
|
|
|
PKCS#12/PFX format, they need to be converted to suitable PEM/DER
|
|
|
|
format for wpa_supplicant. This can be done, e.g., with following
|
|
|
|
commands:
|
|
|
|
.sp
|
|
|
|
.RS
|
|
|
|
|
|
|
|
.nf
|
|
|
|
# convert client certificate and private key to PEM format
|
|
|
|
openssl pkcs12 -in example.pfx -out user.pem -clcerts
|
|
|
|
# convert CA certificate (if included in PFX file) to PEM format
|
|
|
|
openssl pkcs12 -in example.pfx -out ca.pem -cacerts -nokeys
|
|
|
|
.fi
|
|
|
|
.RE
|
|
|
|
.SH "SEE ALSO"
|
|
|
|
.PP
|
|
|
|
\fBwpa_supplicant\fR(8)
|
|
|
|
\fBopenssl\fR(1)
|