| WPA_SUPPLICANT.CONF(5) | MidnightBSD File Formats Manual | WPA_SUPPLICANT.CONF(5) |
wpa_supplicant.conf —
configuration file for
wpa_supplicant(8)
The wpa_supplicant(8) utility is an implementation of the WPA Supplicant component, i.e., the part that runs in the client stations. It implements WPA key negotiation with a WPA Authenticator and EAP authentication with Authentication Server using configuration information stored in a text file.
The configuration file consists of optional global parameter
settings and one or more network blocks, e.g. one for each used SSID. The
wpa_supplicant(8)
utility will automatically select the best network based on the order of the
network blocks in the configuration file, network security level (WPA/WPA2
is preferred), and signal strength. Comments are indicated with the
‘#’ character; all text to the end of
the line will be ignored.
Default parameters used by wpa_supplicant(8) may be overridden by specifying
parameter=valuein the configuration file (note no spaces are allowed). Values with embedded spaces must be enclosed in quote marks.
The following parameters are recognized:
Each potential network/access point should have a “network block” that describes how to identify it and how to set up security. When multiple network blocks are listed in a configuration file, the highest priority one is selected for use or, if multiple networks with the same priority are identified, the first one listed in the configuration file is used.
A network block description is of the form:
network={
parameter=value
...
}
(note the leading "network={"
may have no spaces). The block specification contains one or more parameters
from the following list:
NONE
(plaintext and static WEP), or key_mgmt set to
WPA-NONE (fixed group key TKIP/CCMP). In addition,
ap_scan has to be set to 2 for IBSS.
WPA-NONE requires proto set
to WPA, key_mgmt set to WPA-NONE,
pairwise set to NONE, group
set to either CCMP or TKIP (but not both), and psk
must also be set.WPA
(IEEE 802.11i/D3.0) and RSN (IEEE 802.11i).
WPA2 is another name for
RSN. If not set this defaults to
"WPA RSN".WPA-PSK (WPA pre-shared key),
WPA-EAP (WPA using EAP authentication),
IEEE8021X (IEEE 802.1x using EAP authentication
and, optionally, dynamically generated WEP keys),
NONE (plaintext or static WEP keys). If not set
this defaults to "WPA-PSK WPA-EAP".OPEN (Open System authentication, required for
WPA/WPA2), SHARED (Shared Key authentication),
LEAP (LEAP/Network EAP). If not set automatic
selection is used (Open System with LEAP enabled if LEAP is allowed as one
of the EAP methods).CCMP (AES in Counter mode with CBC-MAC, RFC 3610,
IEEE 802.11i/D7.0), TKIP (Temporal Key Integrity
Protocol, IEEE 802.11i/D7.0), NONE (deprecated).
If not set this defaults to "CCMP
TKIP".CCMP (AES in Counter mode with CBC-MAC, RFC 3610,
IEEE 802.11i/D7.0), TKIP (Temporal Key Integrity
Protocol, IEEE 802.11i/D7.0), WEP104 (WEP with
104-bit key), WEP40 (WEP with 40-bit key). If not
set this defaults to "CCMP TKIP WEP104
WEP40".MD5 (EAP-MD5, cannot be used with WPA, used only
as a Phase 2 method with EAP-PEAP or EAP-TTLS),
MSCHAPV2 (EAP-MSCHAPV2, cannot be used with WPA;
used only as a Phase 2 method with EAP-PEAP or EAP-TTLS),
OTP (EAP-OTP, cannot be used with WPA; used only
as a Phase 2 metod with EAP-PEAP or EAP-TTLS), GTC
(EAP-GTC, cannot be used with WPA; used only as a Phase 2 metod with
EAP-PEAP or EAP-TTLS), TLS (EAP-TLS, client and
server certificate), PEAP (EAP-PEAP, with tunneled
EAP authentication), TTLS (EAP-TTLS, with tunneled
EAP or PAP/CHAP/MSCHAP/MSCHAPV2 authentication). If not set this defaults
to all available methods compiled in to
wpa_supplicant(8).
Note that by default
wpa_supplicant(8)
is compiled with EAP support; see
make.conf(5) for the
NO_WPA_SUPPLICANT_EAPOL configuration variable that
can be used to disable EAP support./C=US/ST=CA/L=San
Francisco/CN=Test AS/emailAddress=as@example.compeapver=0" or
"peapver=1 peaplabel=1").
peapverpeaplabel=1client EAP encryption”,
and
wpa_supplicant(8)
is now using that as the default value. Some servers, e.g., Radiator,
may require peaplabel=1 configuration to
interoperate with PEAPv1; see eap_testing.txt
for more details.peap_outer_success=0include_tls_length=1sim_min_num_chal=3fast_provisioning=1auth=MSCHAPV2" for EAP-PEAP or
"autheap=MSCHAPV2 autheap=MD5" for
EAP-TTLS).Some EAP authentication methods require use of certificates.
EAP-TLS uses both server- and client-side certificates, whereas EAP-PEAP and
EAP-TTLS only require a server-side certificate. When a client certificate
is used, a matching private key file must also be included in configuration.
If the private key uses a passphrase, this has to be configured in the
wpa_supplicant.conf file as
private_key_passwd.
The wpa_supplicant(8) utility supports X.509 certificates in PEM and DER formats. User certificate and private key can be included in the same file.
If the user certificate and private key is received in PKCS#12/PFX format, they need to be converted to a suitable PEM/DER format for use by wpa_supplicant(8). This can be done using the openssl(1) program, e.g. with the following commands:
# convert client certificate and private key to PEM format openssl pkcs12 -in example.pfx -out user.pem -clcerts # convert CA certificate (if included in PFX file) to PEM format openssl pkcs12 -in example.pfx -out ca.pem -cacerts -nokeys
WPA-Personal (PSK) as a home network and WPA-Enterprise with EAP-TLS as a work network:
# allow frontend (e.g., wpa_cli) to be used by all users in 'wheel' group
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
#
# home network; allow all valid ciphers
network={
ssid="home"
scan_ssid=1
key_mgmt=WPA-PSK
psk="very secret passphrase"
}
#
# work network; use EAP-TLS with WPA; allow only CCMP and TKIP ciphers
network={
ssid="work"
scan_ssid=1
key_mgmt=WPA-EAP
pairwise=CCMP TKIP
group=CCMP TKIP
eap=TLS
identity="user@example.com"
ca_cert="/etc/cert/ca.pem"
client_cert="/etc/cert/user.pem"
private_key="/etc/cert/user.prv"
private_key_passwd="password"
}
WPA-RADIUS/EAP-PEAP/MSCHAPv2 with RADIUS servers that use old peaplabel (e.g., Funk Odyssey and SBR, Meetinghouse Aegis, Interlink RAD-Series):
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
network={
ssid="example"
scan_ssid=1
key_mgmt=WPA-EAP
eap=PEAP
identity="user@example.com"
password="foobar"
ca_cert="/etc/cert/ca.pem"
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
}
EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the unencrypted use. Real identity is sent only within an encrypted TLS tunnel.
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
network={
ssid="example"
scan_ssid=1
key_mgmt=WPA-EAP
eap=TTLS
identity="user@example.com"
anonymous_identity="anonymous@example.com"
password="foobar"
ca_cert="/etc/cert/ca.pem"
phase2="auth=MD5"
}
Traditional WEP configuration with 104 bit key specified in hexadecimal. Note the WEP key is not quoted.
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
network={
ssid="example"
scan_ssid=1
key_mgmt=NONE
wep_tx_keyidx=0
# hex keys denoted without quotes
wep_key0=42FEEDDEAFBABEDEAFBEEFAA55
# ASCII keys denoted with quotes.
wep_key1="FreeBSDr0cks!"
}
Minimal eduroam configuration.
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
network={
ssid="eduroam"
scan_ssid=1
key_mgmt=WPA-EAP
eap=TTLS
identity="user@example.org"
password="foobar"
phase2="auth=MSCHAPV2"
}
The wpa_supplicant.conf manual page and
wpa_supplicant(8)
functionality first appeared in FreeBSD 6.0.
This manual page is derived from the
README and
wpa_supplicant.conf files in the
wpa_supplicant distribution provided by
Jouni Malinen
<j@w1.fi>.
| March 26, 2018 | midnightbsd-3.1 |