1##### Example wpa_supplicant configuration file ###############################
2#
3# ***** Please check wpa_supplicant.conf(5) for details on these options *****
4#
5# This file describes configuration file format and lists all available option.
6# Please also take a look at simpler configuration examples in 'examples'
7# subdirectory.
8#
9# Empty lines and lines starting with # are ignored
10
11# NOTE! This file may contain password information and should probably be made
12# readable only by root user on multiuser systems.
13
14# Note: All file paths in this configuration file should use full (absolute,
15# not relative to working directory) path in order to allow working directory
16# to be changed. This can happen if wpa_supplicant is run in the background.
17
18# Whether to allow wpa_supplicant to update (overwrite) configuration
19#
20# This option can be used to allow wpa_supplicant to overwrite configuration
21# file whenever configuration is changed (e.g., new network block is added with
22# wpa_cli or wpa_gui, or a password is changed). This is required for
23# wpa_cli/wpa_gui to be able to store the configuration changes permanently.
24# Please note that overwriting configuration file will remove the comments from
25# it.
26#update_config=1
27
28# global configuration (shared by all network blocks)
29#
30# Parameters for the control interface. If this is specified, wpa_supplicant
31# will open a control interface that is available for external programs to
32# manage wpa_supplicant. The meaning of this string depends on which control
33# interface mechanism is used. For all cases, the existance of this parameter
34# in configuration is used to determine whether the control interface is
35# enabled.
36#
37# For UNIX domain sockets (default on Linux and BSD): This is a directory that
38# will be created for UNIX domain sockets for listening to requests from
39# external programs (CLI/GUI, etc.) for status information and configuration.
40# The socket file will be named based on the interface name, so multiple
41# wpa_supplicant processes can be run at the same time if more than one
42# interface is used.
43# /var/run/wpa_supplicant is the recommended directory for sockets and by
44# default, wpa_cli will use it when trying to connect with wpa_supplicant.
45#
46# Access control for the control interface can be configured by setting the
47# directory to allow only members of a group to use sockets. This way, it is
48# possible to run wpa_supplicant as root (since it needs to change network
49# configuration and open raw sockets) and still allow GUI/CLI components to be
50# run as non-root users. However, since the control interface can be used to
51# change the network configuration, this access needs to be protected in many
52# cases. By default, wpa_supplicant is configured to use gid 0 (root). If you
53# want to allow non-root users to use the control interface, add a new group
54# and change this value to match with that group. Add users that should have
55# control interface access to this group. If this variable is commented out or
56# not included in the configuration file, group will not be changed from the
57# value it got by default when the directory or socket was created.
58#
59# When configuring both the directory and group, use following format:
60# DIR=/var/run/wpa_supplicant GROUP=wheel
61# DIR=/var/run/wpa_supplicant GROUP=0
62# (group can be either group name or gid)
63#
64ctrl_interface=/var/run/wpa_supplicant
65
66# IEEE 802.1X/EAPOL version
67# wpa_supplicant is implemented based on IEEE Std 802.1X-2004 which defines
68# EAPOL version 2. However, there are many APs that do not handle the new
69# version number correctly (they seem to drop the frames completely). In order
70# to make wpa_supplicant interoperate with these APs, the version number is set
71# to 1 by default. This configuration value can be used to set it to the new
72# version (2).
73eapol_version=1
74
75# AP scanning/selection
76# By default, wpa_supplicant requests driver to perform AP scanning and then
77# uses the scan results to select a suitable AP. Another alternative is to
78# allow the driver to take care of AP scanning and selection and use
79# wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association
80# information from the driver.
| 1##### Example wpa_supplicant configuration file ###############################
2#
3# ***** Please check wpa_supplicant.conf(5) for details on these options *****
4#
5# This file describes configuration file format and lists all available option.
6# Please also take a look at simpler configuration examples in 'examples'
7# subdirectory.
8#
9# Empty lines and lines starting with # are ignored
10
11# NOTE! This file may contain password information and should probably be made
12# readable only by root user on multiuser systems.
13
14# Note: All file paths in this configuration file should use full (absolute,
15# not relative to working directory) path in order to allow working directory
16# to be changed. This can happen if wpa_supplicant is run in the background.
17
18# Whether to allow wpa_supplicant to update (overwrite) configuration
19#
20# This option can be used to allow wpa_supplicant to overwrite configuration
21# file whenever configuration is changed (e.g., new network block is added with
22# wpa_cli or wpa_gui, or a password is changed). This is required for
23# wpa_cli/wpa_gui to be able to store the configuration changes permanently.
24# Please note that overwriting configuration file will remove the comments from
25# it.
26#update_config=1
27
28# global configuration (shared by all network blocks)
29#
30# Parameters for the control interface. If this is specified, wpa_supplicant
31# will open a control interface that is available for external programs to
32# manage wpa_supplicant. The meaning of this string depends on which control
33# interface mechanism is used. For all cases, the existance of this parameter
34# in configuration is used to determine whether the control interface is
35# enabled.
36#
37# For UNIX domain sockets (default on Linux and BSD): This is a directory that
38# will be created for UNIX domain sockets for listening to requests from
39# external programs (CLI/GUI, etc.) for status information and configuration.
40# The socket file will be named based on the interface name, so multiple
41# wpa_supplicant processes can be run at the same time if more than one
42# interface is used.
43# /var/run/wpa_supplicant is the recommended directory for sockets and by
44# default, wpa_cli will use it when trying to connect with wpa_supplicant.
45#
46# Access control for the control interface can be configured by setting the
47# directory to allow only members of a group to use sockets. This way, it is
48# possible to run wpa_supplicant as root (since it needs to change network
49# configuration and open raw sockets) and still allow GUI/CLI components to be
50# run as non-root users. However, since the control interface can be used to
51# change the network configuration, this access needs to be protected in many
52# cases. By default, wpa_supplicant is configured to use gid 0 (root). If you
53# want to allow non-root users to use the control interface, add a new group
54# and change this value to match with that group. Add users that should have
55# control interface access to this group. If this variable is commented out or
56# not included in the configuration file, group will not be changed from the
57# value it got by default when the directory or socket was created.
58#
59# When configuring both the directory and group, use following format:
60# DIR=/var/run/wpa_supplicant GROUP=wheel
61# DIR=/var/run/wpa_supplicant GROUP=0
62# (group can be either group name or gid)
63#
64ctrl_interface=/var/run/wpa_supplicant
65
66# IEEE 802.1X/EAPOL version
67# wpa_supplicant is implemented based on IEEE Std 802.1X-2004 which defines
68# EAPOL version 2. However, there are many APs that do not handle the new
69# version number correctly (they seem to drop the frames completely). In order
70# to make wpa_supplicant interoperate with these APs, the version number is set
71# to 1 by default. This configuration value can be used to set it to the new
72# version (2).
73eapol_version=1
74
75# AP scanning/selection
76# By default, wpa_supplicant requests driver to perform AP scanning and then
77# uses the scan results to select a suitable AP. Another alternative is to
78# allow the driver to take care of AP scanning and selection and use
79# wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association
80# information from the driver.
|
81# 1: wpa_supplicant initiates scanning and AP selection
| 81# 1: wpa_supplicant initiates scanning and AP selection; if no APs matching to
82# the currently enabled networks are found, a new network (IBSS or AP mode
83# operation) may be initialized (if configured) (default)
|
82# 0: driver takes care of scanning, AP selection, and IEEE 802.11 association
83# parameters (e.g., WPA IE generation); this mode can also be used with
84# non-WPA drivers when using IEEE 802.1X mode; do not try to associate with
85# APs (i.e., external program needs to control association). This mode must
86# also be used when using wired Ethernet drivers.
87# 2: like 0, but associate with APs using security policy and SSID (but not
88# BSSID); this can be used, e.g., with ndiswrapper and NDIS drivers to
89# enable operation with hidden SSIDs and optimized roaming; in this mode,
90# the network blocks in the configuration file are tried one by one until
91# the driver reports successful association; each network block should have
92# explicit security policy (i.e., only one option in the lists) for
93# key_mgmt, pairwise, group, proto variables
94#
95# For use in FreeBSD with the wlan module ap_scan must be set to 1.
| 84# 0: driver takes care of scanning, AP selection, and IEEE 802.11 association
85# parameters (e.g., WPA IE generation); this mode can also be used with
86# non-WPA drivers when using IEEE 802.1X mode; do not try to associate with
87# APs (i.e., external program needs to control association). This mode must
88# also be used when using wired Ethernet drivers.
89# 2: like 0, but associate with APs using security policy and SSID (but not
90# BSSID); this can be used, e.g., with ndiswrapper and NDIS drivers to
91# enable operation with hidden SSIDs and optimized roaming; in this mode,
92# the network blocks in the configuration file are tried one by one until
93# the driver reports successful association; each network block should have
94# explicit security policy (i.e., only one option in the lists) for
95# key_mgmt, pairwise, group, proto variables
96#
97# For use in FreeBSD with the wlan module ap_scan must be set to 1.
|
| 98# When using IBSS or AP mode, ap_scan=2 mode can force the new network to be
99# created immediately regardless of scan results. ap_scan=1 mode will first try
100# to scan for existing networks and only if no matches with the enabled
101# networks are found, a new IBSS or AP mode network is created.
|
96ap_scan=1
97
98# EAP fast re-authentication
99# By default, fast re-authentication is enabled for all EAP methods that
100# support it. This variable can be used to disable fast re-authentication.
101# Normally, there is no need to disable this.
102fast_reauth=1
103
104# OpenSSL Engine support
105# These options can be used to load OpenSSL engines.
106# The two engines that are supported currently are shown below:
107# They are both from the opensc project (http://www.opensc.org/)
108# By default no engines are loaded.
109# make the opensc engine available
110#opensc_engine_path=/usr/lib/opensc/engine_opensc.so
111# make the pkcs11 engine available
112#pkcs11_engine_path=/usr/lib/opensc/engine_pkcs11.so
113# configure the path to the pkcs11 module required by the pkcs11 engine
114#pkcs11_module_path=/usr/lib/pkcs11/opensc-pkcs11.so
115
116# Dynamic EAP methods
117# If EAP methods were built dynamically as shared object files, they need to be
118# loaded here before being used in the network blocks. By default, EAP methods
119# are included statically in the build, so these lines are not needed
120#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_tls.so
121#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_md5.so
122
123# Driver interface parameters
124# This field can be used to configure arbitrary driver interace parameters. The
125# format is specific to the selected driver interface. This field is not used
126# in most cases.
127#driver_param="field=value"
128
129# Country code
130# The ISO/IEC alpha2 country code for the country in which this device is
131# currently operating.
132#country=US
133
134# Maximum lifetime for PMKSA in seconds; default 43200
135#dot11RSNAConfigPMKLifetime=43200
136# Threshold for reauthentication (percentage of PMK lifetime); default 70
137#dot11RSNAConfigPMKReauthThreshold=70
138# Timeout for security association negotiation in seconds; default 60
139#dot11RSNAConfigSATimeout=60
140
141# Wi-Fi Protected Setup (WPS) parameters
142
143# Universally Unique IDentifier (UUID; see RFC 4122) of the device
144# If not configured, UUID will be generated based on the local MAC address.
145#uuid=12345678-9abc-def0-1234-56789abcdef0
146
147# Device Name
148# User-friendly description of device; up to 32 octets encoded in UTF-8
149#device_name=Wireless Client
150
151# Manufacturer
152# The manufacturer of the device (up to 64 ASCII characters)
153#manufacturer=Company
154
155# Model Name
156# Model of the device (up to 32 ASCII characters)
157#model_name=cmodel
158
159# Model Number
160# Additional device description (up to 32 ASCII characters)
161#model_number=123
162
163# Serial Number
164# Serial number of the device (up to 32 characters)
165#serial_number=12345
166
167# Primary Device Type
168# Used format: <categ>-<OUI>-<subcateg>
169# categ = Category as an integer value
170# OUI = OUI and type octet as a 4-octet hex-encoded value; 0050F204 for
171# default WPS OUI
172# subcateg = OUI-specific Sub Category as an integer value
173# Examples:
174# 1-0050F204-1 (Computer / PC)
175# 1-0050F204-2 (Computer / Server)
176# 5-0050F204-1 (Storage / NAS)
177# 6-0050F204-1 (Network Infrastructure / AP)
178#device_type=1-0050F204-1
179
180# OS Version
181# 4-octet operating system version number (hex string)
182#os_version=01020300
183
| 102ap_scan=1
103
104# EAP fast re-authentication
105# By default, fast re-authentication is enabled for all EAP methods that
106# support it. This variable can be used to disable fast re-authentication.
107# Normally, there is no need to disable this.
108fast_reauth=1
109
110# OpenSSL Engine support
111# These options can be used to load OpenSSL engines.
112# The two engines that are supported currently are shown below:
113# They are both from the opensc project (http://www.opensc.org/)
114# By default no engines are loaded.
115# make the opensc engine available
116#opensc_engine_path=/usr/lib/opensc/engine_opensc.so
117# make the pkcs11 engine available
118#pkcs11_engine_path=/usr/lib/opensc/engine_pkcs11.so
119# configure the path to the pkcs11 module required by the pkcs11 engine
120#pkcs11_module_path=/usr/lib/pkcs11/opensc-pkcs11.so
121
122# Dynamic EAP methods
123# If EAP methods were built dynamically as shared object files, they need to be
124# loaded here before being used in the network blocks. By default, EAP methods
125# are included statically in the build, so these lines are not needed
126#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_tls.so
127#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_md5.so
128
129# Driver interface parameters
130# This field can be used to configure arbitrary driver interace parameters. The
131# format is specific to the selected driver interface. This field is not used
132# in most cases.
133#driver_param="field=value"
134
135# Country code
136# The ISO/IEC alpha2 country code for the country in which this device is
137# currently operating.
138#country=US
139
140# Maximum lifetime for PMKSA in seconds; default 43200
141#dot11RSNAConfigPMKLifetime=43200
142# Threshold for reauthentication (percentage of PMK lifetime); default 70
143#dot11RSNAConfigPMKReauthThreshold=70
144# Timeout for security association negotiation in seconds; default 60
145#dot11RSNAConfigSATimeout=60
146
147# Wi-Fi Protected Setup (WPS) parameters
148
149# Universally Unique IDentifier (UUID; see RFC 4122) of the device
150# If not configured, UUID will be generated based on the local MAC address.
151#uuid=12345678-9abc-def0-1234-56789abcdef0
152
153# Device Name
154# User-friendly description of device; up to 32 octets encoded in UTF-8
155#device_name=Wireless Client
156
157# Manufacturer
158# The manufacturer of the device (up to 64 ASCII characters)
159#manufacturer=Company
160
161# Model Name
162# Model of the device (up to 32 ASCII characters)
163#model_name=cmodel
164
165# Model Number
166# Additional device description (up to 32 ASCII characters)
167#model_number=123
168
169# Serial Number
170# Serial number of the device (up to 32 characters)
171#serial_number=12345
172
173# Primary Device Type
174# Used format: <categ>-<OUI>-<subcateg>
175# categ = Category as an integer value
176# OUI = OUI and type octet as a 4-octet hex-encoded value; 0050F204 for
177# default WPS OUI
178# subcateg = OUI-specific Sub Category as an integer value
179# Examples:
180# 1-0050F204-1 (Computer / PC)
181# 1-0050F204-2 (Computer / Server)
182# 5-0050F204-1 (Storage / NAS)
183# 6-0050F204-1 (Network Infrastructure / AP)
184#device_type=1-0050F204-1
185
186# OS Version
187# 4-octet operating system version number (hex string)
188#os_version=01020300
189
|
| 190# Config Methods
191# List of the supported configuration methods
192# Available methods: usba ethernet label display ext_nfc_token int_nfc_token
193# nfc_interface push_button keypad
194#config_methods=label display push_button keypad
195
|
184# Credential processing
185# 0 = process received credentials internally (default)
186# 1 = do not process received credentials; just pass them over ctrl_iface to
187# external program(s)
188# 2 = process received credentials internally and pass them over ctrl_iface
189# to external program(s)
190#wps_cred_processing=0
191
| 196# Credential processing
197# 0 = process received credentials internally (default)
198# 1 = do not process received credentials; just pass them over ctrl_iface to
199# external program(s)
200# 2 = process received credentials internally and pass them over ctrl_iface
201# to external program(s)
202#wps_cred_processing=0
203
|
| 204# Maximum number of BSS entries to keep in memory
205# Default: 200
206# This can be used to limit memory use on the BSS entries (cached scan
207# results). A larger value may be needed in environments that have huge number
208# of APs when using ap_scan=1 mode.
209#bss_max_count=200
210
211
212# filter_ssids - SSID-based scan result filtering
213# 0 = do not filter scan results (default)
214# 1 = only include configured SSIDs in scan results/BSS table
215#filter_ssids=0
216
217
|
192# network block
193#
194# Each network (usually AP's sharing the same SSID) is configured as a separate
195# block in this configuration file. The network blocks are in preference order
196# (the first match is used).
197#
198# network block fields:
199#
200# disabled:
201# 0 = this network can be used (default)
202# 1 = this network block is disabled (can be enabled through ctrl_iface,
203# e.g., with wpa_cli or wpa_gui)
204#
205# id_str: Network identifier string for external scripts. This value is passed
206# to external action script through wpa_cli as WPA_ID_STR environment
207# variable to make it easier to do network specific configuration.
208#
209# ssid: SSID (mandatory); either as an ASCII string with double quotation or
210# as hex string; network name
211#
212# scan_ssid:
213# 0 = do not scan this SSID with specific Probe Request frames (default)
214# 1 = scan with SSID-specific Probe Request frames (this can be used to
215# find APs that hide (do not broadcast) SSID or use multiple SSIDs;
216# this will add latency to scanning, so enable this only when needed)
217#
218# bssid: BSSID (optional); if set, this network block is used only when
219# associating with the AP using the configured BSSID
220#
221# priority: priority group (integer)
222# By default, all networks will get same priority group (0). If some of the
223# networks are more desirable, this field can be used to change the order in
224# which wpa_supplicant goes through the networks when selecting a BSS. The
225# priority groups will be iterated in decreasing priority (i.e., the larger the
226# priority value, the sooner the network is matched against the scan results).
227# Within each priority group, networks will be selected based on security
228# policy, signal strength, etc.
229# Please note that AP scanning with scan_ssid=1 and ap_scan=2 mode are not
230# using this priority to select the order for scanning. Instead, they try the
231# networks in the order that they are listed in the configuration file.
232#
233# mode: IEEE 802.11 operation mode
234# 0 = infrastructure (Managed) mode, i.e., associate with an AP (default)
235# 1 = IBSS (ad-hoc, peer-to-peer)
| 218# network block
219#
220# Each network (usually AP's sharing the same SSID) is configured as a separate
221# block in this configuration file. The network blocks are in preference order
222# (the first match is used).
223#
224# network block fields:
225#
226# disabled:
227# 0 = this network can be used (default)
228# 1 = this network block is disabled (can be enabled through ctrl_iface,
229# e.g., with wpa_cli or wpa_gui)
230#
231# id_str: Network identifier string for external scripts. This value is passed
232# to external action script through wpa_cli as WPA_ID_STR environment
233# variable to make it easier to do network specific configuration.
234#
235# ssid: SSID (mandatory); either as an ASCII string with double quotation or
236# as hex string; network name
237#
238# scan_ssid:
239# 0 = do not scan this SSID with specific Probe Request frames (default)
240# 1 = scan with SSID-specific Probe Request frames (this can be used to
241# find APs that hide (do not broadcast) SSID or use multiple SSIDs;
242# this will add latency to scanning, so enable this only when needed)
243#
244# bssid: BSSID (optional); if set, this network block is used only when
245# associating with the AP using the configured BSSID
246#
247# priority: priority group (integer)
248# By default, all networks will get same priority group (0). If some of the
249# networks are more desirable, this field can be used to change the order in
250# which wpa_supplicant goes through the networks when selecting a BSS. The
251# priority groups will be iterated in decreasing priority (i.e., the larger the
252# priority value, the sooner the network is matched against the scan results).
253# Within each priority group, networks will be selected based on security
254# policy, signal strength, etc.
255# Please note that AP scanning with scan_ssid=1 and ap_scan=2 mode are not
256# using this priority to select the order for scanning. Instead, they try the
257# networks in the order that they are listed in the configuration file.
258#
259# mode: IEEE 802.11 operation mode
260# 0 = infrastructure (Managed) mode, i.e., associate with an AP (default)
261# 1 = IBSS (ad-hoc, peer-to-peer)
|
| 262# 2 = AP (access point)
|
236# Note: IBSS can only be used with key_mgmt NONE (plaintext and static WEP)
| 263# Note: IBSS can only be used with key_mgmt NONE (plaintext and static WEP)
|
237# and key_mgmt=WPA-NONE (fixed group key TKIP/CCMP). In addition, ap_scan has
238# to be set to 2 for IBSS. WPA-None requires following network block options:
| 264# and key_mgmt=WPA-NONE (fixed group key TKIP/CCMP). WPA-None requires
265# following network block options:
|
239# proto=WPA, key_mgmt=WPA-NONE, pairwise=NONE, group=TKIP (or CCMP, but not
240# both), and psk must also be set.
241#
242# frequency: Channel frequency in megahertz (MHz) for IBSS, e.g.,
243# 2412 = IEEE 802.11b/g channel 1. This value is used to configure the initial
244# channel for IBSS (adhoc) networks. It is ignored in the infrastructure mode.
245# In addition, this value is only used by the station that creates the IBSS. If
246# an IBSS network with the configured SSID is already present, the frequency of
247# the network will be used instead of this configured value.
248#
| 266# proto=WPA, key_mgmt=WPA-NONE, pairwise=NONE, group=TKIP (or CCMP, but not
267# both), and psk must also be set.
268#
269# frequency: Channel frequency in megahertz (MHz) for IBSS, e.g.,
270# 2412 = IEEE 802.11b/g channel 1. This value is used to configure the initial
271# channel for IBSS (adhoc) networks. It is ignored in the infrastructure mode.
272# In addition, this value is only used by the station that creates the IBSS. If
273# an IBSS network with the configured SSID is already present, the frequency of
274# the network will be used instead of this configured value.
275#
|
| 276# scan_freq: List of frequencies to scan
277# Space-separated list of frequencies in MHz to scan when searching for this
278# BSS. If the subset of channels used by the network is known, this option can
279# be used to optimize scanning to not occur on channels that the network does
280# not use. Example: scan_freq=2412 2437 2462
281#
282# freq_list: Array of allowed frequencies
283# Space-separated list of frequencies in MHz to allow for selecting the BSS. If
284# set, scan results that do not match any of the specified frequencies are not
285# considered when selecting a BSS.
286#
|
249# proto: list of accepted protocols
250# WPA = WPA/IEEE 802.11i/D3.0
251# RSN = WPA2/IEEE 802.11i (also WPA2 can be used as an alias for RSN)
252# If not set, this defaults to: WPA RSN
253#
254# key_mgmt: list of accepted authenticated key management protocols
255# WPA-PSK = WPA pre-shared key (this requires 'psk' field)
256# WPA-EAP = WPA using EAP authentication
257# IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
258# generated WEP keys
259# NONE = WPA is not used; plaintext or static WEP could be used
260# WPA-PSK-SHA256 = Like WPA-PSK but using stronger SHA256-based algorithms
261# WPA-EAP-SHA256 = Like WPA-EAP but using stronger SHA256-based algorithms
262# If not set, this defaults to: WPA-PSK WPA-EAP
263#
264# auth_alg: list of allowed IEEE 802.11 authentication algorithms
265# OPEN = Open System authentication (required for WPA/WPA2)
266# SHARED = Shared Key authentication (requires static WEP keys)
267# LEAP = LEAP/Network EAP (only used with LEAP)
268# If not set, automatic selection is used (Open System with LEAP enabled if
269# LEAP is allowed as one of the EAP methods).
270#
271# pairwise: list of accepted pairwise (unicast) ciphers for WPA
272# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
273# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
274# NONE = Use only Group Keys (deprecated, should not be included if APs support
275# pairwise keys)
276# If not set, this defaults to: CCMP TKIP
277#
278# group: list of accepted group (broadcast/multicast) ciphers for WPA
279# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
280# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
281# WEP104 = WEP (Wired Equivalent Privacy) with 104-bit key
282# WEP40 = WEP (Wired Equivalent Privacy) with 40-bit key [IEEE 802.11]
283# If not set, this defaults to: CCMP TKIP WEP104 WEP40
284#
285# psk: WPA preshared key; 256-bit pre-shared key
286# The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e.,
287# 32 bytes or as an ASCII passphrase (in which case, the real PSK will be
288# generated using the passphrase and SSID). ASCII passphrase must be between
289# 8 and 63 characters (inclusive).
290# This field is not needed, if WPA-EAP is used.
291# Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys
292# from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
293# startup and reconfiguration time can be optimized by generating the PSK only
294# only when the passphrase or SSID has actually changed.
295#
296# eapol_flags: IEEE 802.1X/EAPOL options (bit field)
297# Dynamic WEP key required for non-WPA mode
298# bit0 (1): require dynamically generated unicast WEP key
299# bit1 (2): require dynamically generated broadcast WEP key
300# (3 = require both keys; default)
301# Note: When using wired authentication, eapol_flags must be set to 0 for the
302# authentication to be completed successfully.
303#
304# mixed_cell: This option can be used to configure whether so called mixed
305# cells, i.e., networks that use both plaintext and encryption in the same
306# SSID, are allowed when selecting a BSS form scan results.
307# 0 = disabled (default)
308# 1 = enabled
309#
310# proactive_key_caching:
311# Enable/disable opportunistic PMKSA caching for WPA2.
312# 0 = disabled (default)
313# 1 = enabled
314#
315# wep_key0..3: Static WEP key (ASCII in double quotation, e.g. "abcde" or
316# hex without quotation, e.g., 0102030405)
317# wep_tx_keyidx: Default WEP key index (TX) (0..3)
318#
319# peerkey: Whether PeerKey negotiation for direct links (IEEE 802.11e DLS) is
320# allowed. This is only used with RSN/WPA2.
321# 0 = disabled (default)
322# 1 = enabled
323#peerkey=1
324#
325# wpa_ptk_rekey: Maximum lifetime for PTK in seconds. This can be used to
326# enforce rekeying of PTK to mitigate some attacks against TKIP deficiencies.
327#
328# Following fields are only used with internal EAP implementation.
329# eap: space-separated list of accepted EAP methods
330# MD5 = EAP-MD5 (unsecure and does not generate keying material ->
331# cannot be used with WPA; to be used as a Phase 2 method
332# with EAP-PEAP or EAP-TTLS)
333# MSCHAPV2 = EAP-MSCHAPv2 (cannot be used separately with WPA; to be used
334# as a Phase 2 method with EAP-PEAP or EAP-TTLS)
335# OTP = EAP-OTP (cannot be used separately with WPA; to be used
336# as a Phase 2 method with EAP-PEAP or EAP-TTLS)
337# GTC = EAP-GTC (cannot be used separately with WPA; to be used
338# as a Phase 2 method with EAP-PEAP or EAP-TTLS)
339# TLS = EAP-TLS (client and server certificate)
340# PEAP = EAP-PEAP (with tunnelled EAP authentication)
341# TTLS = EAP-TTLS (with tunnelled EAP or PAP/CHAP/MSCHAP/MSCHAPV2
342# authentication)
343# If not set, all compiled in methods are allowed.
344#
345# identity: Identity string for EAP
346# This field is also used to configure user NAI for
347# EAP-PSK/PAX/SAKE/GPSK.
348# anonymous_identity: Anonymous identity string for EAP (to be used as the
349# unencrypted identity with EAP types that support different tunnelled
350# identity, e.g., EAP-TTLS)
351# password: Password string for EAP. This field can include either the
352# plaintext password (using ASCII or hex string) or a NtPasswordHash
353# (16-byte MD4 hash of password) in hash:<32 hex digits> format.
354# NtPasswordHash can only be used when the password is for MSCHAPv2 or
355# MSCHAP (EAP-MSCHAPv2, EAP-TTLS/MSCHAPv2, EAP-TTLS/MSCHAP, LEAP).
356# EAP-PSK (128-bit PSK), EAP-PAX (128-bit PSK), and EAP-SAKE (256-bit
357# PSK) is also configured using this field. For EAP-GPSK, this is a
358# variable length PSK.
359# ca_cert: File path to CA certificate file (PEM/DER). This file can have one
360# or more trusted CA certificates. If ca_cert and ca_path are not
361# included, server certificate will not be verified. This is insecure and
362# a trusted CA certificate should always be configured when using
363# EAP-TLS/TTLS/PEAP. Full path should be used since working directory may
364# change when wpa_supplicant is run in the background.
| 287# proto: list of accepted protocols
288# WPA = WPA/IEEE 802.11i/D3.0
289# RSN = WPA2/IEEE 802.11i (also WPA2 can be used as an alias for RSN)
290# If not set, this defaults to: WPA RSN
291#
292# key_mgmt: list of accepted authenticated key management protocols
293# WPA-PSK = WPA pre-shared key (this requires 'psk' field)
294# WPA-EAP = WPA using EAP authentication
295# IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
296# generated WEP keys
297# NONE = WPA is not used; plaintext or static WEP could be used
298# WPA-PSK-SHA256 = Like WPA-PSK but using stronger SHA256-based algorithms
299# WPA-EAP-SHA256 = Like WPA-EAP but using stronger SHA256-based algorithms
300# If not set, this defaults to: WPA-PSK WPA-EAP
301#
302# auth_alg: list of allowed IEEE 802.11 authentication algorithms
303# OPEN = Open System authentication (required for WPA/WPA2)
304# SHARED = Shared Key authentication (requires static WEP keys)
305# LEAP = LEAP/Network EAP (only used with LEAP)
306# If not set, automatic selection is used (Open System with LEAP enabled if
307# LEAP is allowed as one of the EAP methods).
308#
309# pairwise: list of accepted pairwise (unicast) ciphers for WPA
310# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
311# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
312# NONE = Use only Group Keys (deprecated, should not be included if APs support
313# pairwise keys)
314# If not set, this defaults to: CCMP TKIP
315#
316# group: list of accepted group (broadcast/multicast) ciphers for WPA
317# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
318# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
319# WEP104 = WEP (Wired Equivalent Privacy) with 104-bit key
320# WEP40 = WEP (Wired Equivalent Privacy) with 40-bit key [IEEE 802.11]
321# If not set, this defaults to: CCMP TKIP WEP104 WEP40
322#
323# psk: WPA preshared key; 256-bit pre-shared key
324# The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e.,
325# 32 bytes or as an ASCII passphrase (in which case, the real PSK will be
326# generated using the passphrase and SSID). ASCII passphrase must be between
327# 8 and 63 characters (inclusive).
328# This field is not needed, if WPA-EAP is used.
329# Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys
330# from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
331# startup and reconfiguration time can be optimized by generating the PSK only
332# only when the passphrase or SSID has actually changed.
333#
334# eapol_flags: IEEE 802.1X/EAPOL options (bit field)
335# Dynamic WEP key required for non-WPA mode
336# bit0 (1): require dynamically generated unicast WEP key
337# bit1 (2): require dynamically generated broadcast WEP key
338# (3 = require both keys; default)
339# Note: When using wired authentication, eapol_flags must be set to 0 for the
340# authentication to be completed successfully.
341#
342# mixed_cell: This option can be used to configure whether so called mixed
343# cells, i.e., networks that use both plaintext and encryption in the same
344# SSID, are allowed when selecting a BSS form scan results.
345# 0 = disabled (default)
346# 1 = enabled
347#
348# proactive_key_caching:
349# Enable/disable opportunistic PMKSA caching for WPA2.
350# 0 = disabled (default)
351# 1 = enabled
352#
353# wep_key0..3: Static WEP key (ASCII in double quotation, e.g. "abcde" or
354# hex without quotation, e.g., 0102030405)
355# wep_tx_keyidx: Default WEP key index (TX) (0..3)
356#
357# peerkey: Whether PeerKey negotiation for direct links (IEEE 802.11e DLS) is
358# allowed. This is only used with RSN/WPA2.
359# 0 = disabled (default)
360# 1 = enabled
361#peerkey=1
362#
363# wpa_ptk_rekey: Maximum lifetime for PTK in seconds. This can be used to
364# enforce rekeying of PTK to mitigate some attacks against TKIP deficiencies.
365#
366# Following fields are only used with internal EAP implementation.
367# eap: space-separated list of accepted EAP methods
368# MD5 = EAP-MD5 (unsecure and does not generate keying material ->
369# cannot be used with WPA; to be used as a Phase 2 method
370# with EAP-PEAP or EAP-TTLS)
371# MSCHAPV2 = EAP-MSCHAPv2 (cannot be used separately with WPA; to be used
372# as a Phase 2 method with EAP-PEAP or EAP-TTLS)
373# OTP = EAP-OTP (cannot be used separately with WPA; to be used
374# as a Phase 2 method with EAP-PEAP or EAP-TTLS)
375# GTC = EAP-GTC (cannot be used separately with WPA; to be used
376# as a Phase 2 method with EAP-PEAP or EAP-TTLS)
377# TLS = EAP-TLS (client and server certificate)
378# PEAP = EAP-PEAP (with tunnelled EAP authentication)
379# TTLS = EAP-TTLS (with tunnelled EAP or PAP/CHAP/MSCHAP/MSCHAPV2
380# authentication)
381# If not set, all compiled in methods are allowed.
382#
383# identity: Identity string for EAP
384# This field is also used to configure user NAI for
385# EAP-PSK/PAX/SAKE/GPSK.
386# anonymous_identity: Anonymous identity string for EAP (to be used as the
387# unencrypted identity with EAP types that support different tunnelled
388# identity, e.g., EAP-TTLS)
389# password: Password string for EAP. This field can include either the
390# plaintext password (using ASCII or hex string) or a NtPasswordHash
391# (16-byte MD4 hash of password) in hash:<32 hex digits> format.
392# NtPasswordHash can only be used when the password is for MSCHAPv2 or
393# MSCHAP (EAP-MSCHAPv2, EAP-TTLS/MSCHAPv2, EAP-TTLS/MSCHAP, LEAP).
394# EAP-PSK (128-bit PSK), EAP-PAX (128-bit PSK), and EAP-SAKE (256-bit
395# PSK) is also configured using this field. For EAP-GPSK, this is a
396# variable length PSK.
397# ca_cert: File path to CA certificate file (PEM/DER). This file can have one
398# or more trusted CA certificates. If ca_cert and ca_path are not
399# included, server certificate will not be verified. This is insecure and
400# a trusted CA certificate should always be configured when using
401# EAP-TLS/TTLS/PEAP. Full path should be used since working directory may
402# change when wpa_supplicant is run in the background.
|
| 403#
404# Alternatively, this can be used to only perform matching of the server
405# certificate (SHA-256 hash of the DER encoded X.509 certificate). In
406# this case, the possible CA certificates in the server certificate chain
407# are ignored and only the server certificate is verified. This is
408# configured with the following format:
409# hash:://server/sha256/cert_hash_in_hex
410# For example: "hash://server/sha256/
411# 5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a"
412#
|
365# On Windows, trusted CA certificates can be loaded from the system
366# certificate store by setting this to cert_store://<name>, e.g.,
367# ca_cert="cert_store://CA" or ca_cert="cert_store://ROOT".
368# Note that when running wpa_supplicant as an application, the user
369# certificate store (My user account) is used, whereas computer store
370# (Computer account) is used when running wpasvc as a service.
371# ca_path: Directory path for CA certificate files (PEM). This path may
372# contain multiple CA certificates in OpenSSL format. Common use for this
373# is to point to system trusted CA list which is often installed into
374# directory like /etc/ssl/certs. If configured, these certificates are
375# added to the list of trusted CAs. ca_cert may also be included in that
376# case, but it is not required.
377# client_cert: File path to client certificate file (PEM/DER)
378# Full path should be used since working directory may change when
379# wpa_supplicant is run in the background.
380# Alternatively, a named configuration blob can be used by setting this
381# to blob://<blob name>.
382# private_key: File path to client private key file (PEM/DER/PFX)
383# When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
384# commented out. Both the private key and certificate will be read from
385# the PKCS#12 file in this case. Full path should be used since working
386# directory may change when wpa_supplicant is run in the background.
387# Windows certificate store can be used by leaving client_cert out and
388# configuring private_key in one of the following formats:
389# cert://substring_to_match
390# hash://certificate_thumbprint_in_hex
391# for example: private_key="hash://63093aa9c47f56ae88334c7b65a4"
392# Note that when running wpa_supplicant as an application, the user
393# certificate store (My user account) is used, whereas computer store
394# (Computer account) is used when running wpasvc as a service.
395# Alternatively, a named configuration blob can be used by setting this
396# to blob://<blob name>.
397# private_key_passwd: Password for private key file (if left out, this will be
398# asked through control interface)
399# dh_file: File path to DH/DSA parameters file (in PEM format)
400# This is an optional configuration file for setting parameters for an
401# ephemeral DH key exchange. In most cases, the default RSA
402# authentication does not use this configuration. However, it is possible
403# setup RSA to use ephemeral DH key exchange. In addition, ciphers with
404# DSA keys always use ephemeral DH keys. This can be used to achieve
405# forward secrecy. If the file is in DSA parameters format, it will be
406# automatically converted into DH params.
407# subject_match: Substring to be matched against the subject of the
408# authentication server certificate. If this string is set, the server
409# sertificate is only accepted if it contains this string in the subject.
410# The subject string is in following format:
411# /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com
412# altsubject_match: Semicolon separated string of entries to be matched against
413# the alternative subject name of the authentication server certificate.
414# If this string is set, the server sertificate is only accepted if it
415# contains one of the entries in an alternative subject name extension.
416# altSubjectName string is in following format: TYPE:VALUE
417# Example: EMAIL:server@example.com
418# Example: DNS:server.example.com;DNS:server2.example.com
419# Following types are supported: EMAIL, DNS, URI
420# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
421# (string with field-value pairs, e.g., "peapver=0" or
422# "peapver=1 peaplabel=1")
423# 'peapver' can be used to force which PEAP version (0 or 1) is used.
424# 'peaplabel=1' can be used to force new label, "client PEAP encryption",
425# to be used during key derivation when PEAPv1 or newer. Most existing
426# PEAPv1 implementation seem to be using the old label, "client EAP
427# encryption", and wpa_supplicant is now using that as the default value.
428# Some servers, e.g., Radiator, may require peaplabel=1 configuration to
429# interoperate with PEAPv1; see eap_testing.txt for more details.
430# 'peap_outer_success=0' can be used to terminate PEAP authentication on
431# tunneled EAP-Success. This is required with some RADIUS servers that
432# implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g.,
433# Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode)
434# include_tls_length=1 can be used to force wpa_supplicant to include
435# TLS Message Length field in all TLS messages even if they are not
436# fragmented.
437# sim_min_num_chal=3 can be used to configure EAP-SIM to require three
438# challenges (by default, it accepts 2 or 3)
439# result_ind=1 can be used to enable EAP-SIM and EAP-AKA to use
440# protected result indication.
441# 'crypto_binding' option can be used to control PEAPv0 cryptobinding
442# behavior:
443# * 0 = do not use cryptobinding (default)
444# * 1 = use cryptobinding if server supports it
445# * 2 = require cryptobinding
446# EAP-WSC (WPS) uses following options: pin=<Device Password> or
447# pbc=1.
448# phase2: Phase2 (inner authentication with TLS tunnel) parameters
449# (string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
450# "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS)
451# Following certificate/private key fields are used in inner Phase2
452# authentication when using EAP-TTLS or EAP-PEAP.
453# ca_cert2: File path to CA certificate file. This file can have one or more
454# trusted CA certificates. If ca_cert2 and ca_path2 are not included,
455# server certificate will not be verified. This is insecure and a trusted
456# CA certificate should always be configured.
457# ca_path2: Directory path for CA certificate files (PEM)
458# client_cert2: File path to client certificate file
459# private_key2: File path to client private key file
460# private_key2_passwd: Password for private key file
461# dh_file2: File path to DH/DSA parameters file (in PEM format)
462# subject_match2: Substring to be matched against the subject of the
463# authentication server certificate.
464# altsubject_match2: Substring to be matched against the alternative subject
465# name of the authentication server certificate.
466#
467# fragment_size: Maximum EAP fragment size in bytes (default 1398).
468# This value limits the fragment size for EAP methods that support
469# fragmentation (e.g., EAP-TLS and EAP-PEAP). This value should be set
470# small enough to make the EAP messages fit in MTU of the network
471# interface used for EAPOL. The default value is suitable for most
472# cases.
473#
474# EAP-FAST variables:
475# pac_file: File path for the PAC entries. wpa_supplicant will need to be able
476# to create this file and write updates to it when PAC is being
477# provisioned or refreshed. Full path to the file should be used since
478# working directory may change when wpa_supplicant is run in the
479# background. Alternatively, a named configuration blob can be used by
480# setting this to blob://<blob name>
481# phase1: fast_provisioning option can be used to enable in-line provisioning
482# of EAP-FAST credentials (PAC):
483# 0 = disabled,
484# 1 = allow unauthenticated provisioning,
485# 2 = allow authenticated provisioning,
486# 3 = allow both unauthenticated and authenticated provisioning
487# fast_max_pac_list_len=<num> option can be used to set the maximum
488# number of PAC entries to store in a PAC list (default: 10)
489# fast_pac_format=binary option can be used to select binary format for
490# storing PAC entries in order to save some space (the default
491# text format uses about 2.5 times the size of minimal binary
492# format)
493#
494# wpa_supplicant supports number of "EAP workarounds" to work around
495# interoperability issues with incorrectly behaving authentication servers.
496# These are enabled by default because some of the issues are present in large
497# number of authentication servers. Strict EAP conformance mode can be
498# configured by disabling workarounds with eap_workaround=0.
499
500# Example blocks:
501
502# Simple case: WPA-PSK, PSK as an ASCII passphrase, allow all valid ciphers
503network={
504 ssid="simple"
505 psk="very secret passphrase"
506 priority=5
507}
508
509# Same as previous, but request SSID-specific scanning (for APs that reject
510# broadcast SSID)
511network={
512 ssid="second ssid"
513 scan_ssid=1
514 psk="very secret passphrase"
515 priority=2
516}
517
518# Only WPA-PSK is used. Any valid cipher combination is accepted.
519network={
520 ssid="example"
521 proto=WPA
522 key_mgmt=WPA-PSK
523 pairwise=CCMP TKIP
524 group=CCMP TKIP WEP104 WEP40
525 psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
526 priority=2
527}
528
529# WPA-Personal(PSK) with TKIP and enforcement for frequent PTK rekeying
530network={
531 ssid="example"
532 proto=WPA
533 key_mgmt=WPA-PSK
534 pairwise=TKIP
535 group=TKIP
536 psk="not so secure passphrase"
537 wpa_ptk_rekey=600
538}
539
540# Only WPA-EAP is used. Both CCMP and TKIP is accepted. An AP that used WEP104
541# or WEP40 as the group cipher will not be accepted.
542network={
543 ssid="example"
544 proto=RSN
545 key_mgmt=WPA-EAP
546 pairwise=CCMP TKIP
547 group=CCMP TKIP
548 eap=TLS
549 identity="user@example.com"
550 ca_cert="/etc/cert/ca.pem"
551 client_cert="/etc/cert/user.pem"
552 private_key="/etc/cert/user.prv"
553 private_key_passwd="password"
554 priority=1
555}
556
557# EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new peaplabel
558# (e.g., Radiator)
559network={
560 ssid="example"
561 key_mgmt=WPA-EAP
562 eap=PEAP
563 identity="user@example.com"
564 password="foobar"
565 ca_cert="/etc/cert/ca.pem"
566 phase1="peaplabel=1"
567 phase2="auth=MSCHAPV2"
568 priority=10
569}
570
571# EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the
572# unencrypted use. Real identity is sent only within an encrypted TLS tunnel.
573network={
574 ssid="example"
575 key_mgmt=WPA-EAP
576 eap=TTLS
577 identity="user@example.com"
578 anonymous_identity="anonymous@example.com"
579 password="foobar"
580 ca_cert="/etc/cert/ca.pem"
581 priority=2
582}
583
584# EAP-TTLS/MSCHAPv2 configuration with anonymous identity for the unencrypted
585# use. Real identity is sent only within an encrypted TLS tunnel.
586network={
587 ssid="example"
588 key_mgmt=WPA-EAP
589 eap=TTLS
590 identity="user@example.com"
591 anonymous_identity="anonymous@example.com"
592 password="foobar"
593 ca_cert="/etc/cert/ca.pem"
594 phase2="auth=MSCHAPV2"
595}
596
597# WPA-EAP, EAP-TTLS with different CA certificate used for outer and inner
598# authentication.
599network={
600 ssid="example"
601 key_mgmt=WPA-EAP
602 eap=TTLS
603 # Phase1 / outer authentication
604 anonymous_identity="anonymous@example.com"
605 ca_cert="/etc/cert/ca.pem"
606 # Phase 2 / inner authentication
607 phase2="autheap=TLS"
608 ca_cert2="/etc/cert/ca2.pem"
609 client_cert2="/etc/cer/user.pem"
610 private_key2="/etc/cer/user.prv"
611 private_key2_passwd="password"
612 priority=2
613}
614
615# Both WPA-PSK and WPA-EAP is accepted. Only CCMP is accepted as pairwise and
616# group cipher.
617network={
618 ssid="example"
619 bssid=00:11:22:33:44:55
620 proto=WPA RSN
621 key_mgmt=WPA-PSK WPA-EAP
622 pairwise=CCMP
623 group=CCMP
624 psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
625}
626
627# Special characters in SSID, so use hex string. Default to WPA-PSK, WPA-EAP
628# and all valid ciphers.
629network={
630 ssid=00010203
631 psk=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
632}
633
634
635# EAP-SIM with a GSM SIM or USIM
636network={
637 ssid="eap-sim-test"
638 key_mgmt=WPA-EAP
639 eap=SIM
640 pin="1234"
641 pcsc=""
642}
643
644
645# EAP-PSK
646network={
647 ssid="eap-psk-test"
648 key_mgmt=WPA-EAP
649 eap=PSK
650 anonymous_identity="eap_psk_user"
651 password=06b4be19da289f475aa46a33cb793029
652 identity="eap_psk_user@example.com"
653}
654
655
656# IEEE 802.1X/EAPOL with dynamically generated WEP keys (i.e., no WPA) using
657# EAP-TLS for authentication and key generation; require both unicast and
658# broadcast WEP keys.
659network={
660 ssid="1x-test"
661 key_mgmt=IEEE8021X
662 eap=TLS
663 identity="user@example.com"
664 ca_cert="/etc/cert/ca.pem"
665 client_cert="/etc/cert/user.pem"
666 private_key="/etc/cert/user.prv"
667 private_key_passwd="password"
668 eapol_flags=3
669}
670
671
672# LEAP with dynamic WEP keys
673network={
674 ssid="leap-example"
675 key_mgmt=IEEE8021X
676 eap=LEAP
677 identity="user"
678 password="foobar"
679}
680
681# EAP-IKEv2 using shared secrets for both server and peer authentication
682network={
683 ssid="ikev2-example"
684 key_mgmt=WPA-EAP
685 eap=IKEV2
686 identity="user"
687 password="foobar"
688}
689
690# EAP-FAST with WPA (WPA or WPA2)
691network={
692 ssid="eap-fast-test"
693 key_mgmt=WPA-EAP
694 eap=FAST
695 anonymous_identity="FAST-000102030405"
696 identity="username"
697 password="password"
698 phase1="fast_provisioning=1"
699 pac_file="/etc/wpa_supplicant.eap-fast-pac"
700}
701
702network={
703 ssid="eap-fast-test"
704 key_mgmt=WPA-EAP
705 eap=FAST
706 anonymous_identity="FAST-000102030405"
707 identity="username"
708 password="password"
709 phase1="fast_provisioning=1"
710 pac_file="blob://eap-fast-pac"
711}
712
713# Plaintext connection (no WPA, no IEEE 802.1X)
714network={
715 ssid="plaintext-test"
716 key_mgmt=NONE
717}
718
719
720# Shared WEP key connection (no WPA, no IEEE 802.1X)
721network={
722 ssid="static-wep-test"
723 key_mgmt=NONE
724 wep_key0="abcde"
725 wep_key1=0102030405
726 wep_key2="1234567890123"
727 wep_tx_keyidx=0
728 priority=5
729}
730
731
732# Shared WEP key connection (no WPA, no IEEE 802.1X) using Shared Key
733# IEEE 802.11 authentication
734network={
735 ssid="static-wep-test2"
736 key_mgmt=NONE
737 wep_key0="abcde"
738 wep_key1=0102030405
739 wep_key2="1234567890123"
740 wep_tx_keyidx=0
741 priority=5
742 auth_alg=SHARED
743}
744
745
746# IBSS/ad-hoc network with WPA-None/TKIP.
747network={
748 ssid="test adhoc"
749 mode=1
750 frequency=2412
751 proto=WPA
752 key_mgmt=WPA-NONE
753 pairwise=NONE
754 group=TKIP
755 psk="secret passphrase"
756}
757
758
759# Catch all example that allows more or less all configuration modes
760network={
761 ssid="example"
762 scan_ssid=1
763 key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
764 pairwise=CCMP TKIP
765 group=CCMP TKIP WEP104 WEP40
766 psk="very secret passphrase"
767 eap=TTLS PEAP TLS
768 identity="user@example.com"
769 password="foobar"
770 ca_cert="/etc/cert/ca.pem"
771 client_cert="/etc/cert/user.pem"
772 private_key="/etc/cert/user.prv"
773 private_key_passwd="password"
774 phase1="peaplabel=0"
775}
776
777# Example of EAP-TLS with smartcard (openssl engine)
778network={
779 ssid="example"
780 key_mgmt=WPA-EAP
781 eap=TLS
782 proto=RSN
783 pairwise=CCMP TKIP
784 group=CCMP TKIP
785 identity="user@example.com"
786 ca_cert="/etc/cert/ca.pem"
787 client_cert="/etc/cert/user.pem"
788
789 engine=1
790
791 # The engine configured here must be available. Look at
792 # OpenSSL engine support in the global section.
793 # The key available through the engine must be the private key
794 # matching the client certificate configured above.
795
796 # use the opensc engine
797 #engine_id="opensc"
798 #key_id="45"
799
800 # use the pkcs11 engine
801 engine_id="pkcs11"
802 key_id="id_45"
803
804 # Optional PIN configuration; this can be left out and PIN will be
805 # asked through the control interface
806 pin="1234"
807}
808
809# Example configuration showing how to use an inlined blob as a CA certificate
810# data instead of using external file
811network={
812 ssid="example"
813 key_mgmt=WPA-EAP
814 eap=TTLS
815 identity="user@example.com"
816 anonymous_identity="anonymous@example.com"
817 password="foobar"
818 ca_cert="blob://exampleblob"
819 priority=20
820}
821
822blob-base64-exampleblob={
823SGVsbG8gV29ybGQhCg==
824}
825
826
827# Wildcard match for SSID (plaintext APs only). This example select any
828# open AP regardless of its SSID.
829network={
830 key_mgmt=NONE
831}
| 413# On Windows, trusted CA certificates can be loaded from the system
414# certificate store by setting this to cert_store://<name>, e.g.,
415# ca_cert="cert_store://CA" or ca_cert="cert_store://ROOT".
416# Note that when running wpa_supplicant as an application, the user
417# certificate store (My user account) is used, whereas computer store
418# (Computer account) is used when running wpasvc as a service.
419# ca_path: Directory path for CA certificate files (PEM). This path may
420# contain multiple CA certificates in OpenSSL format. Common use for this
421# is to point to system trusted CA list which is often installed into
422# directory like /etc/ssl/certs. If configured, these certificates are
423# added to the list of trusted CAs. ca_cert may also be included in that
424# case, but it is not required.
425# client_cert: File path to client certificate file (PEM/DER)
426# Full path should be used since working directory may change when
427# wpa_supplicant is run in the background.
428# Alternatively, a named configuration blob can be used by setting this
429# to blob://<blob name>.
430# private_key: File path to client private key file (PEM/DER/PFX)
431# When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
432# commented out. Both the private key and certificate will be read from
433# the PKCS#12 file in this case. Full path should be used since working
434# directory may change when wpa_supplicant is run in the background.
435# Windows certificate store can be used by leaving client_cert out and
436# configuring private_key in one of the following formats:
437# cert://substring_to_match
438# hash://certificate_thumbprint_in_hex
439# for example: private_key="hash://63093aa9c47f56ae88334c7b65a4"
440# Note that when running wpa_supplicant as an application, the user
441# certificate store (My user account) is used, whereas computer store
442# (Computer account) is used when running wpasvc as a service.
443# Alternatively, a named configuration blob can be used by setting this
444# to blob://<blob name>.
445# private_key_passwd: Password for private key file (if left out, this will be
446# asked through control interface)
447# dh_file: File path to DH/DSA parameters file (in PEM format)
448# This is an optional configuration file for setting parameters for an
449# ephemeral DH key exchange. In most cases, the default RSA
450# authentication does not use this configuration. However, it is possible
451# setup RSA to use ephemeral DH key exchange. In addition, ciphers with
452# DSA keys always use ephemeral DH keys. This can be used to achieve
453# forward secrecy. If the file is in DSA parameters format, it will be
454# automatically converted into DH params.
455# subject_match: Substring to be matched against the subject of the
456# authentication server certificate. If this string is set, the server
457# sertificate is only accepted if it contains this string in the subject.
458# The subject string is in following format:
459# /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com
460# altsubject_match: Semicolon separated string of entries to be matched against
461# the alternative subject name of the authentication server certificate.
462# If this string is set, the server sertificate is only accepted if it
463# contains one of the entries in an alternative subject name extension.
464# altSubjectName string is in following format: TYPE:VALUE
465# Example: EMAIL:server@example.com
466# Example: DNS:server.example.com;DNS:server2.example.com
467# Following types are supported: EMAIL, DNS, URI
468# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
469# (string with field-value pairs, e.g., "peapver=0" or
470# "peapver=1 peaplabel=1")
471# 'peapver' can be used to force which PEAP version (0 or 1) is used.
472# 'peaplabel=1' can be used to force new label, "client PEAP encryption",
473# to be used during key derivation when PEAPv1 or newer. Most existing
474# PEAPv1 implementation seem to be using the old label, "client EAP
475# encryption", and wpa_supplicant is now using that as the default value.
476# Some servers, e.g., Radiator, may require peaplabel=1 configuration to
477# interoperate with PEAPv1; see eap_testing.txt for more details.
478# 'peap_outer_success=0' can be used to terminate PEAP authentication on
479# tunneled EAP-Success. This is required with some RADIUS servers that
480# implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g.,
481# Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode)
482# include_tls_length=1 can be used to force wpa_supplicant to include
483# TLS Message Length field in all TLS messages even if they are not
484# fragmented.
485# sim_min_num_chal=3 can be used to configure EAP-SIM to require three
486# challenges (by default, it accepts 2 or 3)
487# result_ind=1 can be used to enable EAP-SIM and EAP-AKA to use
488# protected result indication.
489# 'crypto_binding' option can be used to control PEAPv0 cryptobinding
490# behavior:
491# * 0 = do not use cryptobinding (default)
492# * 1 = use cryptobinding if server supports it
493# * 2 = require cryptobinding
494# EAP-WSC (WPS) uses following options: pin=<Device Password> or
495# pbc=1.
496# phase2: Phase2 (inner authentication with TLS tunnel) parameters
497# (string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
498# "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS)
499# Following certificate/private key fields are used in inner Phase2
500# authentication when using EAP-TTLS or EAP-PEAP.
501# ca_cert2: File path to CA certificate file. This file can have one or more
502# trusted CA certificates. If ca_cert2 and ca_path2 are not included,
503# server certificate will not be verified. This is insecure and a trusted
504# CA certificate should always be configured.
505# ca_path2: Directory path for CA certificate files (PEM)
506# client_cert2: File path to client certificate file
507# private_key2: File path to client private key file
508# private_key2_passwd: Password for private key file
509# dh_file2: File path to DH/DSA parameters file (in PEM format)
510# subject_match2: Substring to be matched against the subject of the
511# authentication server certificate.
512# altsubject_match2: Substring to be matched against the alternative subject
513# name of the authentication server certificate.
514#
515# fragment_size: Maximum EAP fragment size in bytes (default 1398).
516# This value limits the fragment size for EAP methods that support
517# fragmentation (e.g., EAP-TLS and EAP-PEAP). This value should be set
518# small enough to make the EAP messages fit in MTU of the network
519# interface used for EAPOL. The default value is suitable for most
520# cases.
521#
522# EAP-FAST variables:
523# pac_file: File path for the PAC entries. wpa_supplicant will need to be able
524# to create this file and write updates to it when PAC is being
525# provisioned or refreshed. Full path to the file should be used since
526# working directory may change when wpa_supplicant is run in the
527# background. Alternatively, a named configuration blob can be used by
528# setting this to blob://<blob name>
529# phase1: fast_provisioning option can be used to enable in-line provisioning
530# of EAP-FAST credentials (PAC):
531# 0 = disabled,
532# 1 = allow unauthenticated provisioning,
533# 2 = allow authenticated provisioning,
534# 3 = allow both unauthenticated and authenticated provisioning
535# fast_max_pac_list_len=<num> option can be used to set the maximum
536# number of PAC entries to store in a PAC list (default: 10)
537# fast_pac_format=binary option can be used to select binary format for
538# storing PAC entries in order to save some space (the default
539# text format uses about 2.5 times the size of minimal binary
540# format)
541#
542# wpa_supplicant supports number of "EAP workarounds" to work around
543# interoperability issues with incorrectly behaving authentication servers.
544# These are enabled by default because some of the issues are present in large
545# number of authentication servers. Strict EAP conformance mode can be
546# configured by disabling workarounds with eap_workaround=0.
547
548# Example blocks:
549
550# Simple case: WPA-PSK, PSK as an ASCII passphrase, allow all valid ciphers
551network={
552 ssid="simple"
553 psk="very secret passphrase"
554 priority=5
555}
556
557# Same as previous, but request SSID-specific scanning (for APs that reject
558# broadcast SSID)
559network={
560 ssid="second ssid"
561 scan_ssid=1
562 psk="very secret passphrase"
563 priority=2
564}
565
566# Only WPA-PSK is used. Any valid cipher combination is accepted.
567network={
568 ssid="example"
569 proto=WPA
570 key_mgmt=WPA-PSK
571 pairwise=CCMP TKIP
572 group=CCMP TKIP WEP104 WEP40
573 psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
574 priority=2
575}
576
577# WPA-Personal(PSK) with TKIP and enforcement for frequent PTK rekeying
578network={
579 ssid="example"
580 proto=WPA
581 key_mgmt=WPA-PSK
582 pairwise=TKIP
583 group=TKIP
584 psk="not so secure passphrase"
585 wpa_ptk_rekey=600
586}
587
588# Only WPA-EAP is used. Both CCMP and TKIP is accepted. An AP that used WEP104
589# or WEP40 as the group cipher will not be accepted.
590network={
591 ssid="example"
592 proto=RSN
593 key_mgmt=WPA-EAP
594 pairwise=CCMP TKIP
595 group=CCMP TKIP
596 eap=TLS
597 identity="user@example.com"
598 ca_cert="/etc/cert/ca.pem"
599 client_cert="/etc/cert/user.pem"
600 private_key="/etc/cert/user.prv"
601 private_key_passwd="password"
602 priority=1
603}
604
605# EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new peaplabel
606# (e.g., Radiator)
607network={
608 ssid="example"
609 key_mgmt=WPA-EAP
610 eap=PEAP
611 identity="user@example.com"
612 password="foobar"
613 ca_cert="/etc/cert/ca.pem"
614 phase1="peaplabel=1"
615 phase2="auth=MSCHAPV2"
616 priority=10
617}
618
619# EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the
620# unencrypted use. Real identity is sent only within an encrypted TLS tunnel.
621network={
622 ssid="example"
623 key_mgmt=WPA-EAP
624 eap=TTLS
625 identity="user@example.com"
626 anonymous_identity="anonymous@example.com"
627 password="foobar"
628 ca_cert="/etc/cert/ca.pem"
629 priority=2
630}
631
632# EAP-TTLS/MSCHAPv2 configuration with anonymous identity for the unencrypted
633# use. Real identity is sent only within an encrypted TLS tunnel.
634network={
635 ssid="example"
636 key_mgmt=WPA-EAP
637 eap=TTLS
638 identity="user@example.com"
639 anonymous_identity="anonymous@example.com"
640 password="foobar"
641 ca_cert="/etc/cert/ca.pem"
642 phase2="auth=MSCHAPV2"
643}
644
645# WPA-EAP, EAP-TTLS with different CA certificate used for outer and inner
646# authentication.
647network={
648 ssid="example"
649 key_mgmt=WPA-EAP
650 eap=TTLS
651 # Phase1 / outer authentication
652 anonymous_identity="anonymous@example.com"
653 ca_cert="/etc/cert/ca.pem"
654 # Phase 2 / inner authentication
655 phase2="autheap=TLS"
656 ca_cert2="/etc/cert/ca2.pem"
657 client_cert2="/etc/cer/user.pem"
658 private_key2="/etc/cer/user.prv"
659 private_key2_passwd="password"
660 priority=2
661}
662
663# Both WPA-PSK and WPA-EAP is accepted. Only CCMP is accepted as pairwise and
664# group cipher.
665network={
666 ssid="example"
667 bssid=00:11:22:33:44:55
668 proto=WPA RSN
669 key_mgmt=WPA-PSK WPA-EAP
670 pairwise=CCMP
671 group=CCMP
672 psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
673}
674
675# Special characters in SSID, so use hex string. Default to WPA-PSK, WPA-EAP
676# and all valid ciphers.
677network={
678 ssid=00010203
679 psk=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
680}
681
682
683# EAP-SIM with a GSM SIM or USIM
684network={
685 ssid="eap-sim-test"
686 key_mgmt=WPA-EAP
687 eap=SIM
688 pin="1234"
689 pcsc=""
690}
691
692
693# EAP-PSK
694network={
695 ssid="eap-psk-test"
696 key_mgmt=WPA-EAP
697 eap=PSK
698 anonymous_identity="eap_psk_user"
699 password=06b4be19da289f475aa46a33cb793029
700 identity="eap_psk_user@example.com"
701}
702
703
704# IEEE 802.1X/EAPOL with dynamically generated WEP keys (i.e., no WPA) using
705# EAP-TLS for authentication and key generation; require both unicast and
706# broadcast WEP keys.
707network={
708 ssid="1x-test"
709 key_mgmt=IEEE8021X
710 eap=TLS
711 identity="user@example.com"
712 ca_cert="/etc/cert/ca.pem"
713 client_cert="/etc/cert/user.pem"
714 private_key="/etc/cert/user.prv"
715 private_key_passwd="password"
716 eapol_flags=3
717}
718
719
720# LEAP with dynamic WEP keys
721network={
722 ssid="leap-example"
723 key_mgmt=IEEE8021X
724 eap=LEAP
725 identity="user"
726 password="foobar"
727}
728
729# EAP-IKEv2 using shared secrets for both server and peer authentication
730network={
731 ssid="ikev2-example"
732 key_mgmt=WPA-EAP
733 eap=IKEV2
734 identity="user"
735 password="foobar"
736}
737
738# EAP-FAST with WPA (WPA or WPA2)
739network={
740 ssid="eap-fast-test"
741 key_mgmt=WPA-EAP
742 eap=FAST
743 anonymous_identity="FAST-000102030405"
744 identity="username"
745 password="password"
746 phase1="fast_provisioning=1"
747 pac_file="/etc/wpa_supplicant.eap-fast-pac"
748}
749
750network={
751 ssid="eap-fast-test"
752 key_mgmt=WPA-EAP
753 eap=FAST
754 anonymous_identity="FAST-000102030405"
755 identity="username"
756 password="password"
757 phase1="fast_provisioning=1"
758 pac_file="blob://eap-fast-pac"
759}
760
761# Plaintext connection (no WPA, no IEEE 802.1X)
762network={
763 ssid="plaintext-test"
764 key_mgmt=NONE
765}
766
767
768# Shared WEP key connection (no WPA, no IEEE 802.1X)
769network={
770 ssid="static-wep-test"
771 key_mgmt=NONE
772 wep_key0="abcde"
773 wep_key1=0102030405
774 wep_key2="1234567890123"
775 wep_tx_keyidx=0
776 priority=5
777}
778
779
780# Shared WEP key connection (no WPA, no IEEE 802.1X) using Shared Key
781# IEEE 802.11 authentication
782network={
783 ssid="static-wep-test2"
784 key_mgmt=NONE
785 wep_key0="abcde"
786 wep_key1=0102030405
787 wep_key2="1234567890123"
788 wep_tx_keyidx=0
789 priority=5
790 auth_alg=SHARED
791}
792
793
794# IBSS/ad-hoc network with WPA-None/TKIP.
795network={
796 ssid="test adhoc"
797 mode=1
798 frequency=2412
799 proto=WPA
800 key_mgmt=WPA-NONE
801 pairwise=NONE
802 group=TKIP
803 psk="secret passphrase"
804}
805
806
807# Catch all example that allows more or less all configuration modes
808network={
809 ssid="example"
810 scan_ssid=1
811 key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
812 pairwise=CCMP TKIP
813 group=CCMP TKIP WEP104 WEP40
814 psk="very secret passphrase"
815 eap=TTLS PEAP TLS
816 identity="user@example.com"
817 password="foobar"
818 ca_cert="/etc/cert/ca.pem"
819 client_cert="/etc/cert/user.pem"
820 private_key="/etc/cert/user.prv"
821 private_key_passwd="password"
822 phase1="peaplabel=0"
823}
824
825# Example of EAP-TLS with smartcard (openssl engine)
826network={
827 ssid="example"
828 key_mgmt=WPA-EAP
829 eap=TLS
830 proto=RSN
831 pairwise=CCMP TKIP
832 group=CCMP TKIP
833 identity="user@example.com"
834 ca_cert="/etc/cert/ca.pem"
835 client_cert="/etc/cert/user.pem"
836
837 engine=1
838
839 # The engine configured here must be available. Look at
840 # OpenSSL engine support in the global section.
841 # The key available through the engine must be the private key
842 # matching the client certificate configured above.
843
844 # use the opensc engine
845 #engine_id="opensc"
846 #key_id="45"
847
848 # use the pkcs11 engine
849 engine_id="pkcs11"
850 key_id="id_45"
851
852 # Optional PIN configuration; this can be left out and PIN will be
853 # asked through the control interface
854 pin="1234"
855}
856
857# Example configuration showing how to use an inlined blob as a CA certificate
858# data instead of using external file
859network={
860 ssid="example"
861 key_mgmt=WPA-EAP
862 eap=TTLS
863 identity="user@example.com"
864 anonymous_identity="anonymous@example.com"
865 password="foobar"
866 ca_cert="blob://exampleblob"
867 priority=20
868}
869
870blob-base64-exampleblob={
871SGVsbG8gV29ybGQhCg==
872}
873
874
875# Wildcard match for SSID (plaintext APs only). This example select any
876# open AP regardless of its SSID.
877network={
878 key_mgmt=NONE
879}
|