279 lines
11 KiB
Plaintext
279 lines
11 KiB
Plaintext
##### hostapd configuration file ##############################################
|
|
# Empty lines and lines starting with # are ignored
|
|
|
|
# AP netdevice name (without 'ap' prefix, i.e., wlan0 uses wlan0ap for
|
|
# management frames)
|
|
interface=ath0
|
|
|
|
# In case of madwifi driver, an additional configuration parameter, bridge,
|
|
# must be used to notify hostapd if the interface is included in a bridge. This
|
|
# parameter is not used with Host AP driver.
|
|
bridge=br0
|
|
|
|
# Driver interface type (hostap/wired/madwifi; default: hostap)
|
|
driver=madwifi
|
|
|
|
# hostapd event logger configuration
|
|
#
|
|
# Two output method: syslog and stdout (only usable if not forking to
|
|
# background).
|
|
#
|
|
# Module bitfield (ORed bitfield of modules that will be logged; -1 = all
|
|
# modules):
|
|
# bit 0 (1) = IEEE 802.11
|
|
# bit 1 (2) = IEEE 802.1X
|
|
# bit 2 (4) = RADIUS
|
|
# bit 3 (8) = WPA
|
|
# bit 4 (16) = driver interface
|
|
# bit 5 (32) = IAPP
|
|
#
|
|
# Levels (minimum value for logged events):
|
|
# 0 = verbose debugging
|
|
# 1 = debugging
|
|
# 2 = informational messages
|
|
# 3 = notification
|
|
# 4 = warning
|
|
#
|
|
logger_syslog=-1
|
|
logger_syslog_level=2
|
|
logger_stdout=-1
|
|
logger_stdout_level=2
|
|
|
|
# Debugging: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive
|
|
debug=0
|
|
|
|
# Dump file for state information (on SIGUSR1)
|
|
dump_file=/tmp/hostapd.dump
|
|
|
|
|
|
##### IEEE 802.11 related configuration #######################################
|
|
|
|
# SSID to be used in IEEE 802.11 management frames
|
|
ssid=wpa-test
|
|
|
|
##### IEEE 802.1X-REV related configuration ###################################
|
|
|
|
# Require IEEE 802.1X authorization
|
|
#ieee8021x=1
|
|
|
|
# Optional displayable message sent with EAP Request-Identity. The first \0
|
|
# in this string will be converted to ASCII-0 (nul). This can be used to
|
|
# separate network info (comma separated list of attribute=value pairs); see,
|
|
# e.g., draft-adrangi-eap-network-discovery-07.txt.
|
|
#eap_message=hello
|
|
#eap_message=hello\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com
|
|
|
|
# WEP rekeying (disabled if key lengths are not set or are set to 0)
|
|
# Key lengths for default/broadcast and individual/unicast keys:
|
|
# 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
|
|
# 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
|
|
#wep_key_len_broadcast=5
|
|
#wep_key_len_unicast=5
|
|
# Rekeying period in seconds. 0 = do not rekey (i.e., set keys only once)
|
|
#wep_rekey_period=300
|
|
|
|
# EAPOL-Key index workaround (set bit7) for WinXP Supplicant (needed only if
|
|
# only broadcast keys are used)
|
|
eapol_key_index_workaround=0
|
|
|
|
# EAP reauthentication period in seconds (default: 3600 seconds; 0 = disable
|
|
# reauthentication).
|
|
#eap_reauth_period=3600
|
|
|
|
|
|
##### Integrated EAP server ###################################################
|
|
|
|
# Optionally, hostapd can be configured to use an integrated EAP server
|
|
# to process EAP authentication locally without need for an external RADIUS
|
|
# server. This functionality can be used both as a local authentication server
|
|
# for IEEE 802.1X/EAPOL and as a RADIUS server for other devices.
|
|
|
|
# Use integrated EAP server instead of external RADIUS authentication
|
|
# server. This is also needed if hostapd is configured to act as a RADIUS
|
|
# authentication server.
|
|
eap_server=0
|
|
|
|
# Path for EAP server user database
|
|
#eap_user_file=/etc/hostapd.eap_user
|
|
|
|
# CA certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
|
|
#ca_cert=/etc/hostapd.ca.pem
|
|
|
|
# Server certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
|
|
#server_cert=/etc/hostapd.server.pem
|
|
|
|
# Private key matching with the server certificate for EAP-TLS/PEAP/TTLS
|
|
# This may point to the same file as server_cert if both certificate and key
|
|
# are included in a single file. PKCS#12 (PFX) file (.p12/.pfx) can also be
|
|
# used by commenting out server_cert and specifying the PFX file as the
|
|
# private_key.
|
|
#private_key=/etc/hostapd.server.prv
|
|
|
|
# Passphrase for private key
|
|
#private_key_passwd=secret passphrase
|
|
|
|
# Enable CRL verification.
|
|
# Note: hostapd does not yet support CRL downloading based on CDP. Thus, a
|
|
# valid CRL signed by the CA is required to be included in the ca_cert file.
|
|
# This can be done by using PEM format for CA certificate and CRL and
|
|
# concatenating these into one file. Whenever CRL changes, hostapd needs to be
|
|
# restarted to take the new CRL into use.
|
|
# 0 = do not verify CRLs (default)
|
|
# 1 = check the CRL of the user certificate
|
|
# 2 = check all CRLs in the certificate path
|
|
#check_crl=1
|
|
|
|
# Configuration data for EAP-SIM database/authentication gateway interface.
|
|
# This is a text string in implementation specific format. The example
|
|
# implementation in eap_sim_db.c uses this as the file name for the GSM
|
|
# authentication triplets.
|
|
#eap_sim_db=/etc/hostapd.sim_db
|
|
|
|
|
|
##### IEEE 802.11f - Inter-Access Point Protocol (IAPP) #######################
|
|
|
|
# Interface to be used for IAPP broadcast packets
|
|
#iapp_interface=eth0
|
|
|
|
|
|
##### RADIUS client configuration #############################################
|
|
# for IEEE 802.1X with external Authentication Server, IEEE 802.11
|
|
# authentication with external ACL for MAC addresses, and accounting
|
|
|
|
# The own IP address of the access point (used as NAS-IP-Address)
|
|
own_ip_addr=127.0.0.1
|
|
|
|
# Optional NAS-Identifier string for RADIUS messages. When used, this should be
|
|
# a unique to the NAS within the scope of the RADIUS server. For example, a
|
|
# fully qualified domain name can be used here.
|
|
#nas_identifier=ap.example.com
|
|
|
|
# RADIUS authentication server
|
|
#auth_server_addr=127.0.0.1
|
|
#auth_server_port=1812
|
|
#auth_server_shared_secret=secret
|
|
|
|
# RADIUS accounting server
|
|
#acct_server_addr=127.0.0.1
|
|
#acct_server_port=1813
|
|
#acct_server_shared_secret=secret
|
|
|
|
# Secondary RADIUS servers; to be used if primary one does not reply to
|
|
# RADIUS packets. These are optional and there can be more than one secondary
|
|
# server listed.
|
|
#auth_server_addr=127.0.0.2
|
|
#auth_server_port=1812
|
|
#auth_server_shared_secret=secret2
|
|
#
|
|
#acct_server_addr=127.0.0.2
|
|
#acct_server_port=1813
|
|
#acct_server_shared_secret=secret2
|
|
|
|
# Retry interval for trying to return to the primary RADIUS server (in
|
|
# seconds). RADIUS client code will automatically try to use the next server
|
|
# when the current server is not replying to requests. If this interval is set,
|
|
# primary server will be retried after configured amount of time even if the
|
|
# currently used secondary server is still working.
|
|
#radius_retry_primary_interval=600
|
|
|
|
|
|
# Interim accounting update interval
|
|
# If this is set (larger than 0) and acct_server is configured, hostapd will
|
|
# send interim accounting updates every N seconds. Note: if set, this overrides
|
|
# possible Acct-Interim-Interval attribute in Access-Accept message. Thus, this
|
|
# value should not be configured in hostapd.conf, if RADIUS server is used to
|
|
# control the interim interval.
|
|
# This value should not be less 600 (10 minutes) and must not be less than
|
|
# 60 (1 minute).
|
|
#radius_acct_interim_interval=600
|
|
|
|
|
|
##### RADIUS authentication server configuration ##############################
|
|
|
|
# hostapd can be used as a RADIUS authentication server for other hosts. This
|
|
# requires that the integrated EAP authenticator is also enabled and both
|
|
# authentication services are sharing the same configuration.
|
|
|
|
# File name of the RADIUS clients configuration for the RADIUS server. If this
|
|
# commented out, RADIUS server is disabled.
|
|
#radius_server_clients=/etc/hostapd.radius_clients
|
|
|
|
# The UDP port number for the RADIUS authentication server
|
|
#radius_server_auth_port=1812
|
|
|
|
# Use IPv6 with RADIUS server (IPv4 will also be supported using IPv6 API)
|
|
#radius_server_ipv6=1
|
|
|
|
|
|
##### WPA/IEEE 802.11i configuration ##########################################
|
|
|
|
# Enable WPA. Setting this variable configures the AP to require WPA (either
|
|
# WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either
|
|
# wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK.
|
|
# For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
|
|
# RADIUS authentication server must be configured, and WPA-EAP must be included
|
|
# in wpa_key_mgmt.
|
|
# This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0)
|
|
# and/or WPA2 (full IEEE 802.11i/RSN):
|
|
# bit0 = WPA
|
|
# bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
|
|
#wpa=1
|
|
|
|
# WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
|
|
# secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
|
|
# (8..63 characters) that will be converted to PSK. This conversion uses SSID
|
|
# so the PSK changes when ASCII passphrase is used and the SSID is changed.
|
|
# wpa_psk (dot11RSNAConfigPSKValue)
|
|
# wpa_passphrase (dot11RSNAConfigPSKPassPhrase)
|
|
#wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
|
|
#wpa_passphrase=secret passphrase
|
|
|
|
# Optionally, WPA PSKs can be read from a separate text file (containing list
|
|
# of (PSK,MAC address) pairs. This allows more than one PSK to be configured.
|
|
# Use absolute path name to make sure that the files can be read on SIGHUP
|
|
# configuration reloads.
|
|
#wpa_psk_file=/etc/hostapd.wpa_psk
|
|
|
|
# Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
|
|
# entries are separated with a space.
|
|
# (dot11RSNAConfigAuthenticationSuitesTable)
|
|
#wpa_key_mgmt=WPA-PSK WPA-EAP
|
|
|
|
# Set of accepted cipher suites (encryption algorithms) for pairwise keys
|
|
# (unicast packets). This is a space separated list of algorithms:
|
|
# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
|
|
# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
|
|
# Group cipher suite (encryption algorithm for broadcast and multicast frames)
|
|
# is automatically selected based on this configuration. If only CCMP is
|
|
# allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
|
|
# TKIP will be used as the group cipher.
|
|
# (dot11RSNAConfigPairwiseCiphersTable)
|
|
#wpa_pairwise=TKIP CCMP
|
|
|
|
# Time interval for rekeying GTK (broadcast/multicast encryption keys) in
|
|
# seconds. (dot11RSNAConfigGroupRekeyTime)
|
|
#wpa_group_rekey=600
|
|
|
|
# Rekey GTK when any STA that possesses the current GTK is leaving the BSS.
|
|
# (dot11RSNAConfigGroupRekeyStrict)
|
|
#wpa_strict_rekey=1
|
|
|
|
# Time interval for rekeying GMK (master key used internally to generate GTKs
|
|
# (in seconds).
|
|
#wpa_gmk_rekey=86400
|
|
|
|
# Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
|
|
# roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
|
|
# authentication and key handshake before actually associating with a new AP.
|
|
# (dot11RSNAPreauthenticationEnabled)
|
|
#rsn_preauth=1
|
|
#
|
|
# Space separated list of interfaces from which pre-authentication frames are
|
|
# accepted (e.g., 'eth0' or 'eth0 wlan0wds0'. This list should include all
|
|
# interface that are used for connections to other APs. This could include
|
|
# wired interfaces and WDS links. The normal wireless data interface towards
|
|
# associated stations (e.g., wlan0) should not be added, since
|
|
# pre-authentication is only used with APs other than the currently associated
|
|
# one.
|
|
#rsn_preauth_interfaces=eth0
|