1##### Example wpa_supplicant configuration file ############################### 2# 3# This file describes configuration file format and lists all available option. 4# Please also take a look at simpler configuration examples in 'examples' 5# subdirectory. 6# 7# Empty lines and lines starting with # are ignored 8 9# NOTE! This file may contain password information and should probably be made 10# readable only by root user on multiuser systems. 11 12# Note: All file paths in this configuration file should use full (absolute, 13# not relative to working directory) path in order to allow working directory 14# to be changed. This can happen if wpa_supplicant is run in the background. 15 16# Whether to allow wpa_supplicant to update (overwrite) configuration 17# 18# This option can be used to allow wpa_supplicant to overwrite configuration 19# file whenever configuration is changed (e.g., new network block is added with 20# wpa_cli or wpa_gui, or a password is changed). This is required for 21# wpa_cli/wpa_gui to be able to store the configuration changes permanently. 22# Please note that overwriting configuration file will remove the comments from 23# it. 24#update_config=1 25 26# global configuration (shared by all network blocks) 27# 28# Parameters for the control interface. If this is specified, wpa_supplicant 29# will open a control interface that is available for external programs to 30# manage wpa_supplicant. The meaning of this string depends on which control 31# interface mechanism is used. For all cases, the existance of this parameter 32# in configuration is used to determine whether the control interface is 33# enabled. 34# 35# For UNIX domain sockets (default on Linux and BSD): This is a directory that 36# will be created for UNIX domain sockets for listening to requests from 37# external programs (CLI/GUI, etc.) for status information and configuration. 38# The socket file will be named based on the interface name, so multiple 39# wpa_supplicant processes can be run at the same time if more than one 40# interface is used. 41# /var/run/wpa_supplicant is the recommended directory for sockets and by 42# default, wpa_cli will use it when trying to connect with wpa_supplicant. 43# 44# Access control for the control interface can be configured by setting the 45# directory to allow only members of a group to use sockets. This way, it is 46# possible to run wpa_supplicant as root (since it needs to change network 47# configuration and open raw sockets) and still allow GUI/CLI components to be 48# run as non-root users. However, since the control interface can be used to 49# change the network configuration, this access needs to be protected in many 50# cases. By default, wpa_supplicant is configured to use gid 0 (root). If you 51# want to allow non-root users to use the control interface, add a new group 52# and change this value to match with that group. Add users that should have 53# control interface access to this group. If this variable is commented out or 54# not included in the configuration file, group will not be changed from the 55# value it got by default when the directory or socket was created. 56# 57# When configuring both the directory and group, use following format: 58# DIR=/var/run/wpa_supplicant GROUP=wheel 59# DIR=/var/run/wpa_supplicant GROUP=0 60# (group can be either group name or gid) 61# 62# For UDP connections (default on Windows): The value will be ignored. This 63# variable is just used to select that the control interface is to be created. 64# The value can be set to, e.g., udp (ctrl_interface=udp) 65# 66# For Windows Named Pipe: This value can be used to set the security descriptor 67# for controlling access to the control interface. Security descriptor can be 68# set using Security Descriptor String Format (see http://msdn.microsoft.com/ 69# library/default.asp?url=/library/en-us/secauthz/security/ 70# security_descriptor_string_format.asp). The descriptor string needs to be 71# prefixed with SDDL=. For example, ctrl_interface=SDDL=D: would set an empty 72# DACL (which will reject all connections). See README-Windows.txt for more 73# information about SDDL string format. 74# 75ctrl_interface=/var/run/wpa_supplicant 76 77# IEEE 802.1X/EAPOL version 78# wpa_supplicant is implemented based on IEEE Std 802.1X-2004 which defines 79# EAPOL version 2. However, there are many APs that do not handle the new 80# version number correctly (they seem to drop the frames completely). In order 81# to make wpa_supplicant interoperate with these APs, the version number is set 82# to 1 by default. This configuration value can be used to set it to the new 83# version (2). 84eapol_version=1 85 86# AP scanning/selection 87# By default, wpa_supplicant requests driver to perform AP scanning and then 88# uses the scan results to select a suitable AP. Another alternative is to 89# allow the driver to take care of AP scanning and selection and use 90# wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association 91# information from the driver. 92# 1: wpa_supplicant initiates scanning and AP selection; if no APs matching to 93# the currently enabled networks are found, a new network (IBSS or AP mode 94# operation) may be initialized (if configured) (default) 95# 0: driver takes care of scanning, AP selection, and IEEE 802.11 association 96# parameters (e.g., WPA IE generation); this mode can also be used with 97# non-WPA drivers when using IEEE 802.1X mode; do not try to associate with 98# APs (i.e., external program needs to control association). This mode must 99# also be used when using wired Ethernet drivers. 100# 2: like 0, but associate with APs using security policy and SSID (but not 101# BSSID); this can be used, e.g., with ndiswrapper and NDIS drivers to 102# enable operation with hidden SSIDs and optimized roaming; in this mode, 103# the network blocks in the configuration file are tried one by one until 104# the driver reports successful association; each network block should have 105# explicit security policy (i.e., only one option in the lists) for 106# key_mgmt, pairwise, group, proto variables 107# When using IBSS or AP mode, ap_scan=2 mode can force the new network to be 108# created immediately regardless of scan results. ap_scan=1 mode will first try 109# to scan for existing networks and only if no matches with the enabled 110# networks are found, a new IBSS or AP mode network is created. 111ap_scan=1 112 113# EAP fast re-authentication 114# By default, fast re-authentication is enabled for all EAP methods that 115# support it. This variable can be used to disable fast re-authentication. 116# Normally, there is no need to disable this. 117fast_reauth=1 118 119# OpenSSL Engine support 120# These options can be used to load OpenSSL engines. 121# The two engines that are supported currently are shown below: 122# They are both from the opensc project (http://www.opensc.org/) 123# By default no engines are loaded. 124# make the opensc engine available 125#opensc_engine_path=/usr/lib/opensc/engine_opensc.so 126# make the pkcs11 engine available 127#pkcs11_engine_path=/usr/lib/opensc/engine_pkcs11.so 128# configure the path to the pkcs11 module required by the pkcs11 engine 129#pkcs11_module_path=/usr/lib/pkcs11/opensc-pkcs11.so 130 131# Dynamic EAP methods 132# If EAP methods were built dynamically as shared object files, they need to be 133# loaded here before being used in the network blocks. By default, EAP methods 134# are included statically in the build, so these lines are not needed 135#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_tls.so 136#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_md5.so 137 138# Driver interface parameters 139# This field can be used to configure arbitrary driver interace parameters. The 140# format is specific to the selected driver interface. This field is not used 141# in most cases. 142#driver_param="field=value" 143 144# Country code 145# The ISO/IEC alpha2 country code for the country in which this device is 146# currently operating. 147#country=US 148 149# Maximum lifetime for PMKSA in seconds; default 43200 150#dot11RSNAConfigPMKLifetime=43200 151# Threshold for reauthentication (percentage of PMK lifetime); default 70 152#dot11RSNAConfigPMKReauthThreshold=70 153# Timeout for security association negotiation in seconds; default 60 154#dot11RSNAConfigSATimeout=60 155 156# Wi-Fi Protected Setup (WPS) parameters 157 158# Universally Unique IDentifier (UUID; see RFC 4122) of the device 159# If not configured, UUID will be generated based on the local MAC address. 160#uuid=12345678-9abc-def0-1234-56789abcdef0 161 162# Device Name 163# User-friendly description of device; up to 32 octets encoded in UTF-8 164#device_name=Wireless Client 165 166# Manufacturer 167# The manufacturer of the device (up to 64 ASCII characters) 168#manufacturer=Company 169 170# Model Name 171# Model of the device (up to 32 ASCII characters) 172#model_name=cmodel 173 174# Model Number 175# Additional device description (up to 32 ASCII characters) 176#model_number=123 177 178# Serial Number 179# Serial number of the device (up to 32 characters) 180#serial_number=12345 181 182# Primary Device Type 183# Used format: <categ>-<OUI>-<subcateg> 184# categ = Category as an integer value 185# OUI = OUI and type octet as a 4-octet hex-encoded value; 0050F204 for 186# default WPS OUI 187# subcateg = OUI-specific Sub Category as an integer value 188# Examples: 189# 1-0050F204-1 (Computer / PC) 190# 1-0050F204-2 (Computer / Server) 191# 5-0050F204-1 (Storage / NAS) 192# 6-0050F204-1 (Network Infrastructure / AP) 193#device_type=1-0050F204-1 194 195# OS Version 196# 4-octet operating system version number (hex string) 197#os_version=01020300 198 199# Config Methods 200# List of the supported configuration methods 201# Available methods: usba ethernet label display ext_nfc_token int_nfc_token 202# nfc_interface push_button keypad 203#config_methods=label display push_button keypad 204 205# Credential processing 206# 0 = process received credentials internally (default) 207# 1 = do not process received credentials; just pass them over ctrl_iface to 208# external program(s) 209# 2 = process received credentials internally and pass them over ctrl_iface 210# to external program(s) 211#wps_cred_processing=0 212 213# Maximum number of BSS entries to keep in memory 214# Default: 200 215# This can be used to limit memory use on the BSS entries (cached scan 216# results). A larger value may be needed in environments that have huge number 217# of APs when using ap_scan=1 mode. 218#bss_max_count=200 219 220 221# filter_ssids - SSID-based scan result filtering 222# 0 = do not filter scan results (default) 223# 1 = only include configured SSIDs in scan results/BSS table 224#filter_ssids=0 225 226 227# network block 228# 229# Each network (usually AP's sharing the same SSID) is configured as a separate 230# block in this configuration file. The network blocks are in preference order 231# (the first match is used). 232# 233# network block fields: 234# 235# disabled: 236# 0 = this network can be used (default) 237# 1 = this network block is disabled (can be enabled through ctrl_iface, 238# e.g., with wpa_cli or wpa_gui) 239# 240# id_str: Network identifier string for external scripts. This value is passed 241# to external action script through wpa_cli as WPA_ID_STR environment 242# variable to make it easier to do network specific configuration. 243# 244# ssid: SSID (mandatory); either as an ASCII string with double quotation or 245# as hex string; network name 246# 247# scan_ssid: 248# 0 = do not scan this SSID with specific Probe Request frames (default) 249# 1 = scan with SSID-specific Probe Request frames (this can be used to 250# find APs that do not accept broadcast SSID or use multiple SSIDs; 251# this will add latency to scanning, so enable this only when needed) 252# 253# bssid: BSSID (optional); if set, this network block is used only when 254# associating with the AP using the configured BSSID 255# 256# priority: priority group (integer) 257# By default, all networks will get same priority group (0). If some of the 258# networks are more desirable, this field can be used to change the order in 259# which wpa_supplicant goes through the networks when selecting a BSS. The 260# priority groups will be iterated in decreasing priority (i.e., the larger the 261# priority value, the sooner the network is matched against the scan results). 262# Within each priority group, networks will be selected based on security 263# policy, signal strength, etc. 264# Please note that AP scanning with scan_ssid=1 and ap_scan=2 mode are not 265# using this priority to select the order for scanning. Instead, they try the 266# networks in the order that used in the configuration file. 267# 268# mode: IEEE 802.11 operation mode 269# 0 = infrastructure (Managed) mode, i.e., associate with an AP (default) 270# 1 = IBSS (ad-hoc, peer-to-peer) 271# 2 = AP (access point) 272# Note: IBSS can only be used with key_mgmt NONE (plaintext and static WEP) 273# and key_mgmt=WPA-NONE (fixed group key TKIP/CCMP). WPA-None requires 274# following network block options: 275# proto=WPA, key_mgmt=WPA-NONE, pairwise=NONE, group=TKIP (or CCMP, but not 276# both), and psk must also be set. 277# 278# frequency: Channel frequency in megahertz (MHz) for IBSS, e.g., 279# 2412 = IEEE 802.11b/g channel 1. This value is used to configure the initial 280# channel for IBSS (adhoc) networks. It is ignored in the infrastructure mode. 281# In addition, this value is only used by the station that creates the IBSS. If 282# an IBSS network with the configured SSID is already present, the frequency of 283# the network will be used instead of this configured value. 284# 285# scan_freq: List of frequencies to scan 286# Space-separated list of frequencies in MHz to scan when searching for this 287# BSS. If the subset of channels used by the network is known, this option can 288# be used to optimize scanning to not occur on channels that the network does 289# not use. Example: scan_freq=2412 2437 2462 290# 291# freq_list: Array of allowed frequencies 292# Space-separated list of frequencies in MHz to allow for selecting the BSS. If 293# set, scan results that do not match any of the specified frequencies are not 294# considered when selecting a BSS. 295# 296# proto: list of accepted protocols 297# WPA = WPA/IEEE 802.11i/D3.0 298# RSN = WPA2/IEEE 802.11i (also WPA2 can be used as an alias for RSN) 299# If not set, this defaults to: WPA RSN 300# 301# key_mgmt: list of accepted authenticated key management protocols 302# WPA-PSK = WPA pre-shared key (this requires 'psk' field) 303# WPA-EAP = WPA using EAP authentication 304# IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically 305# generated WEP keys 306# NONE = WPA is not used; plaintext or static WEP could be used 307# WPA-PSK-SHA256 = Like WPA-PSK but using stronger SHA256-based algorithms 308# WPA-EAP-SHA256 = Like WPA-EAP but using stronger SHA256-based algorithms 309# If not set, this defaults to: WPA-PSK WPA-EAP 310# 311# auth_alg: list of allowed IEEE 802.11 authentication algorithms 312# OPEN = Open System authentication (required for WPA/WPA2) 313# SHARED = Shared Key authentication (requires static WEP keys) 314# LEAP = LEAP/Network EAP (only used with LEAP) 315# If not set, automatic selection is used (Open System with LEAP enabled if 316# LEAP is allowed as one of the EAP methods). 317# 318# pairwise: list of accepted pairwise (unicast) ciphers for WPA 319# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0] 320# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0] 321# NONE = Use only Group Keys (deprecated, should not be included if APs support 322# pairwise keys) 323# If not set, this defaults to: CCMP TKIP 324# 325# group: list of accepted group (broadcast/multicast) ciphers for WPA 326# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0] 327# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0] 328# WEP104 = WEP (Wired Equivalent Privacy) with 104-bit key 329# WEP40 = WEP (Wired Equivalent Privacy) with 40-bit key [IEEE 802.11] 330# If not set, this defaults to: CCMP TKIP WEP104 WEP40 331# 332# psk: WPA preshared key; 256-bit pre-shared key 333# The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e., 334# 32 bytes or as an ASCII passphrase (in which case, the real PSK will be 335# generated using the passphrase and SSID). ASCII passphrase must be between 336# 8 and 63 characters (inclusive). 337# This field is not needed, if WPA-EAP is used. 338# Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys 339# from ASCII passphrase. This process uses lot of CPU and wpa_supplicant 340# startup and reconfiguration time can be optimized by generating the PSK only 341# only when the passphrase or SSID has actually changed. 342# 343# eapol_flags: IEEE 802.1X/EAPOL options (bit field) 344# Dynamic WEP key required for non-WPA mode 345# bit0 (1): require dynamically generated unicast WEP key 346# bit1 (2): require dynamically generated broadcast WEP key 347# (3 = require both keys; default) 348# Note: When using wired authentication, eapol_flags must be set to 0 for the 349# authentication to be completed successfully. 350# 351# mixed_cell: This option can be used to configure whether so called mixed 352# cells, i.e., networks that use both plaintext and encryption in the same 353# SSID, are allowed when selecting a BSS form scan results. 354# 0 = disabled (default) 355# 1 = enabled 356# 357# proactive_key_caching: 358# Enable/disable opportunistic PMKSA caching for WPA2. 359# 0 = disabled (default) 360# 1 = enabled 361# 362# wep_key0..3: Static WEP key (ASCII in double quotation, e.g. "abcde" or 363# hex without quotation, e.g., 0102030405) 364# wep_tx_keyidx: Default WEP key index (TX) (0..3) 365# 366# peerkey: Whether PeerKey negotiation for direct links (IEEE 802.11e DLS) is 367# allowed. This is only used with RSN/WPA2. 368# 0 = disabled (default) 369# 1 = enabled 370#peerkey=1 371# 372# wpa_ptk_rekey: Maximum lifetime for PTK in seconds. This can be used to 373# enforce rekeying of PTK to mitigate some attacks against TKIP deficiencies. 374# 375# Following fields are only used with internal EAP implementation. 376# eap: space-separated list of accepted EAP methods 377# MD5 = EAP-MD5 (unsecure and does not generate keying material -> 378# cannot be used with WPA; to be used as a Phase 2 method 379# with EAP-PEAP or EAP-TTLS) 380# MSCHAPV2 = EAP-MSCHAPv2 (cannot be used separately with WPA; to be used 381# as a Phase 2 method with EAP-PEAP or EAP-TTLS) 382# OTP = EAP-OTP (cannot be used separately with WPA; to be used 383# as a Phase 2 method with EAP-PEAP or EAP-TTLS) 384# GTC = EAP-GTC (cannot be used separately with WPA; to be used 385# as a Phase 2 method with EAP-PEAP or EAP-TTLS) 386# TLS = EAP-TLS (client and server certificate) 387# PEAP = EAP-PEAP (with tunnelled EAP authentication) 388# TTLS = EAP-TTLS (with tunnelled EAP or PAP/CHAP/MSCHAP/MSCHAPV2 389# authentication) 390# If not set, all compiled in methods are allowed. 391# 392# identity: Identity string for EAP 393# This field is also used to configure user NAI for 394# EAP-PSK/PAX/SAKE/GPSK. 395# anonymous_identity: Anonymous identity string for EAP (to be used as the 396# unencrypted identity with EAP types that support different tunnelled 397# identity, e.g., EAP-TTLS) 398# password: Password string for EAP. This field can include either the 399# plaintext password (using ASCII or hex string) or a NtPasswordHash 400# (16-byte MD4 hash of password) in hash:<32 hex digits> format. 401# NtPasswordHash can only be used when the password is for MSCHAPv2 or 402# MSCHAP (EAP-MSCHAPv2, EAP-TTLS/MSCHAPv2, EAP-TTLS/MSCHAP, LEAP). 403# EAP-PSK (128-bit PSK), EAP-PAX (128-bit PSK), and EAP-SAKE (256-bit 404# PSK) is also configured using this field. For EAP-GPSK, this is a 405# variable length PSK. 406# ca_cert: File path to CA certificate file (PEM/DER). This file can have one 407# or more trusted CA certificates. If ca_cert and ca_path are not 408# included, server certificate will not be verified. This is insecure and 409# a trusted CA certificate should always be configured when using 410# EAP-TLS/TTLS/PEAP. Full path should be used since working directory may 411# change when wpa_supplicant is run in the background. 412# 413# Alternatively, this can be used to only perform matching of the server 414# certificate (SHA-256 hash of the DER encoded X.509 certificate). In 415# this case, the possible CA certificates in the server certificate chain 416# are ignored and only the server certificate is verified. This is 417# configured with the following format: 418# hash:://server/sha256/cert_hash_in_hex 419# For example: "hash://server/sha256/ 420# 5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a" 421# 422# On Windows, trusted CA certificates can be loaded from the system 423# certificate store by setting this to cert_store://<name>, e.g., 424# ca_cert="cert_store://CA" or ca_cert="cert_store://ROOT". 425# Note that when running wpa_supplicant as an application, the user 426# certificate store (My user account) is used, whereas computer store 427# (Computer account) is used when running wpasvc as a service. 428# ca_path: Directory path for CA certificate files (PEM). This path may 429# contain multiple CA certificates in OpenSSL format. Common use for this 430# is to point to system trusted CA list which is often installed into 431# directory like /etc/ssl/certs. If configured, these certificates are 432# added to the list of trusted CAs. ca_cert may also be included in that 433# case, but it is not required. 434# client_cert: File path to client certificate file (PEM/DER) 435# Full path should be used since working directory may change when 436# wpa_supplicant is run in the background. 437# Alternatively, a named configuration blob can be used by setting this 438# to blob://<blob name>. 439# private_key: File path to client private key file (PEM/DER/PFX) 440# When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be 441# commented out. Both the private key and certificate will be read from 442# the PKCS#12 file in this case. Full path should be used since working 443# directory may change when wpa_supplicant is run in the background. 444# Windows certificate store can be used by leaving client_cert out and 445# configuring private_key in one of the following formats: 446# cert://substring_to_match 447# hash://certificate_thumbprint_in_hex 448# for example: private_key="hash://63093aa9c47f56ae88334c7b65a4" 449# Note that when running wpa_supplicant as an application, the user 450# certificate store (My user account) is used, whereas computer store 451# (Computer account) is used when running wpasvc as a service. 452# Alternatively, a named configuration blob can be used by setting this 453# to blob://<blob name>. 454# private_key_passwd: Password for private key file (if left out, this will be 455# asked through control interface) 456# dh_file: File path to DH/DSA parameters file (in PEM format) 457# This is an optional configuration file for setting parameters for an 458# ephemeral DH key exchange. In most cases, the default RSA 459# authentication does not use this configuration. However, it is possible 460# setup RSA to use ephemeral DH key exchange. In addition, ciphers with 461# DSA keys always use ephemeral DH keys. This can be used to achieve 462# forward secrecy. If the file is in DSA parameters format, it will be 463# automatically converted into DH params. 464# subject_match: Substring to be matched against the subject of the 465# authentication server certificate. If this string is set, the server 466# sertificate is only accepted if it contains this string in the subject. 467# The subject string is in following format: 468# /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com 469# altsubject_match: Semicolon separated string of entries to be matched against 470# the alternative subject name of the authentication server certificate. 471# If this string is set, the server sertificate is only accepted if it 472# contains one of the entries in an alternative subject name extension. 473# altSubjectName string is in following format: TYPE:VALUE 474# Example: EMAIL:server@example.com 475# Example: DNS:server.example.com;DNS:server2.example.com 476# Following types are supported: EMAIL, DNS, URI 477# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters 478# (string with field-value pairs, e.g., "peapver=0" or 479# "peapver=1 peaplabel=1") 480# 'peapver' can be used to force which PEAP version (0 or 1) is used. 481# 'peaplabel=1' can be used to force new label, "client PEAP encryption", 482# to be used during key derivation when PEAPv1 or newer. Most existing 483# PEAPv1 implementation seem to be using the old label, "client EAP 484# encryption", and wpa_supplicant is now using that as the default value. 485# Some servers, e.g., Radiator, may require peaplabel=1 configuration to 486# interoperate with PEAPv1; see eap_testing.txt for more details. 487# 'peap_outer_success=0' can be used to terminate PEAP authentication on 488# tunneled EAP-Success. This is required with some RADIUS servers that 489# implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g., 490# Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode) 491# include_tls_length=1 can be used to force wpa_supplicant to include 492# TLS Message Length field in all TLS messages even if they are not 493# fragmented. 494# sim_min_num_chal=3 can be used to configure EAP-SIM to require three 495# challenges (by default, it accepts 2 or 3) 496# result_ind=1 can be used to enable EAP-SIM and EAP-AKA to use 497# protected result indication. 498# 'crypto_binding' option can be used to control PEAPv0 cryptobinding 499# behavior: 500# * 0 = do not use cryptobinding (default) 501# * 1 = use cryptobinding if server supports it 502# * 2 = require cryptobinding 503# EAP-WSC (WPS) uses following options: pin=<Device Password> or 504# pbc=1. 505# phase2: Phase2 (inner authentication with TLS tunnel) parameters 506# (string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or 507# "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS) 508# Following certificate/private key fields are used in inner Phase2 509# authentication when using EAP-TTLS or EAP-PEAP. 510# ca_cert2: File path to CA certificate file. This file can have one or more 511# trusted CA certificates. If ca_cert2 and ca_path2 are not included, 512# server certificate will not be verified. This is insecure and a trusted 513# CA certificate should always be configured. 514# ca_path2: Directory path for CA certificate files (PEM) 515# client_cert2: File path to client certificate file 516# private_key2: File path to client private key file 517# private_key2_passwd: Password for private key file 518# dh_file2: File path to DH/DSA parameters file (in PEM format) 519# subject_match2: Substring to be matched against the subject of the 520# authentication server certificate. 521# altsubject_match2: Substring to be matched against the alternative subject 522# name of the authentication server certificate. 523# 524# fragment_size: Maximum EAP fragment size in bytes (default 1398). 525# This value limits the fragment size for EAP methods that support 526# fragmentation (e.g., EAP-TLS and EAP-PEAP). This value should be set 527# small enough to make the EAP messages fit in MTU of the network 528# interface used for EAPOL. The default value is suitable for most 529# cases. 530# 531# EAP-FAST variables: 532# pac_file: File path for the PAC entries. wpa_supplicant will need to be able 533# to create this file and write updates to it when PAC is being 534# provisioned or refreshed. Full path to the file should be used since 535# working directory may change when wpa_supplicant is run in the 536# background. Alternatively, a named configuration blob can be used by 537# setting this to blob://<blob name> 538# phase1: fast_provisioning option can be used to enable in-line provisioning 539# of EAP-FAST credentials (PAC): 540# 0 = disabled, 541# 1 = allow unauthenticated provisioning, 542# 2 = allow authenticated provisioning, 543# 3 = allow both unauthenticated and authenticated provisioning 544# fast_max_pac_list_len=<num> option can be used to set the maximum 545# number of PAC entries to store in a PAC list (default: 10) 546# fast_pac_format=binary option can be used to select binary format for 547# storing PAC entries in order to save some space (the default 548# text format uses about 2.5 times the size of minimal binary 549# format) 550# 551# wpa_supplicant supports number of "EAP workarounds" to work around 552# interoperability issues with incorrectly behaving authentication servers. 553# These are enabled by default because some of the issues are present in large 554# number of authentication servers. Strict EAP conformance mode can be 555# configured by disabling workarounds with eap_workaround=0. 556 557# Example blocks: 558 559# Simple case: WPA-PSK, PSK as an ASCII passphrase, allow all valid ciphers 560network={ 561 ssid="simple" 562 psk="very secret passphrase" 563 priority=5 564} 565 566# Same as previous, but request SSID-specific scanning (for APs that reject 567# broadcast SSID) 568network={ 569 ssid="second ssid" 570 scan_ssid=1 571 psk="very secret passphrase" 572 priority=2 573} 574 575# Only WPA-PSK is used. Any valid cipher combination is accepted. 576network={ 577 ssid="example" 578 proto=WPA 579 key_mgmt=WPA-PSK 580 pairwise=CCMP TKIP 581 group=CCMP TKIP WEP104 WEP40 582 psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb 583 priority=2 584} 585 586# WPA-Personal(PSK) with TKIP and enforcement for frequent PTK rekeying 587network={ 588 ssid="example" 589 proto=WPA 590 key_mgmt=WPA-PSK 591 pairwise=TKIP 592 group=TKIP 593 psk="not so secure passphrase" 594 wpa_ptk_rekey=600 595} 596 597# Only WPA-EAP is used. Both CCMP and TKIP is accepted. An AP that used WEP104 598# or WEP40 as the group cipher will not be accepted. 599network={ 600 ssid="example" 601 proto=RSN 602 key_mgmt=WPA-EAP 603 pairwise=CCMP TKIP 604 group=CCMP TKIP 605 eap=TLS 606 identity="user@example.com" 607 ca_cert="/etc/cert/ca.pem" 608 client_cert="/etc/cert/user.pem" 609 private_key="/etc/cert/user.prv" 610 private_key_passwd="password" 611 priority=1 612} 613 614# EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new peaplabel 615# (e.g., Radiator) 616network={ 617 ssid="example" 618 key_mgmt=WPA-EAP 619 eap=PEAP 620 identity="user@example.com" 621 password="foobar" 622 ca_cert="/etc/cert/ca.pem" 623 phase1="peaplabel=1" 624 phase2="auth=MSCHAPV2" 625 priority=10 626} 627 628# EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the 629# unencrypted use. Real identity is sent only within an encrypted TLS tunnel. 630network={ 631 ssid="example" 632 key_mgmt=WPA-EAP 633 eap=TTLS 634 identity="user@example.com" 635 anonymous_identity="anonymous@example.com" 636 password="foobar" 637 ca_cert="/etc/cert/ca.pem" 638 priority=2 639} 640 641# EAP-TTLS/MSCHAPv2 configuration with anonymous identity for the unencrypted 642# use. Real identity is sent only within an encrypted TLS tunnel. 643network={ 644 ssid="example" 645 key_mgmt=WPA-EAP 646 eap=TTLS 647 identity="user@example.com" 648 anonymous_identity="anonymous@example.com" 649 password="foobar" 650 ca_cert="/etc/cert/ca.pem" 651 phase2="auth=MSCHAPV2" 652} 653 654# WPA-EAP, EAP-TTLS with different CA certificate used for outer and inner 655# authentication. 656network={ 657 ssid="example" 658 key_mgmt=WPA-EAP 659 eap=TTLS 660 # Phase1 / outer authentication 661 anonymous_identity="anonymous@example.com" 662 ca_cert="/etc/cert/ca.pem" 663 # Phase 2 / inner authentication 664 phase2="autheap=TLS" 665 ca_cert2="/etc/cert/ca2.pem" 666 client_cert2="/etc/cer/user.pem" 667 private_key2="/etc/cer/user.prv" 668 private_key2_passwd="password" 669 priority=2 670} 671 672# Both WPA-PSK and WPA-EAP is accepted. Only CCMP is accepted as pairwise and 673# group cipher. 674network={ 675 ssid="example" 676 bssid=00:11:22:33:44:55 677 proto=WPA RSN 678 key_mgmt=WPA-PSK WPA-EAP 679 pairwise=CCMP 680 group=CCMP 681 psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb 682} 683 684# Special characters in SSID, so use hex string. Default to WPA-PSK, WPA-EAP 685# and all valid ciphers. 686network={ 687 ssid=00010203 688 psk=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f 689} 690 691 692# EAP-SIM with a GSM SIM or USIM 693network={ 694 ssid="eap-sim-test" 695 key_mgmt=WPA-EAP 696 eap=SIM 697 pin="1234" 698 pcsc="" 699} 700 701 702# EAP-PSK 703network={ 704 ssid="eap-psk-test" 705 key_mgmt=WPA-EAP 706 eap=PSK 707 anonymous_identity="eap_psk_user" 708 password=06b4be19da289f475aa46a33cb793029 709 identity="eap_psk_user@example.com" 710} 711 712 713# IEEE 802.1X/EAPOL with dynamically generated WEP keys (i.e., no WPA) using 714# EAP-TLS for authentication and key generation; require both unicast and 715# broadcast WEP keys. 716network={ 717 ssid="1x-test" 718 key_mgmt=IEEE8021X 719 eap=TLS 720 identity="user@example.com" 721 ca_cert="/etc/cert/ca.pem" 722 client_cert="/etc/cert/user.pem" 723 private_key="/etc/cert/user.prv" 724 private_key_passwd="password" 725 eapol_flags=3 726} 727 728 729# LEAP with dynamic WEP keys 730network={ 731 ssid="leap-example" 732 key_mgmt=IEEE8021X 733 eap=LEAP 734 identity="user" 735 password="foobar" 736} 737 738# EAP-IKEv2 using shared secrets for both server and peer authentication 739network={ 740 ssid="ikev2-example" 741 key_mgmt=WPA-EAP 742 eap=IKEV2 743 identity="user" 744 password="foobar" 745} 746 747# EAP-FAST with WPA (WPA or WPA2) 748network={ 749 ssid="eap-fast-test" 750 key_mgmt=WPA-EAP 751 eap=FAST 752 anonymous_identity="FAST-000102030405" 753 identity="username" 754 password="password" 755 phase1="fast_provisioning=1" 756 pac_file="/etc/wpa_supplicant.eap-fast-pac" 757} 758 759network={ 760 ssid="eap-fast-test" 761 key_mgmt=WPA-EAP 762 eap=FAST 763 anonymous_identity="FAST-000102030405" 764 identity="username" 765 password="password" 766 phase1="fast_provisioning=1" 767 pac_file="blob://eap-fast-pac" 768} 769 770# Plaintext connection (no WPA, no IEEE 802.1X) 771network={ 772 ssid="plaintext-test" 773 key_mgmt=NONE 774} 775 776 777# Shared WEP key connection (no WPA, no IEEE 802.1X) 778network={ 779 ssid="static-wep-test" 780 key_mgmt=NONE 781 wep_key0="abcde" 782 wep_key1=0102030405 783 wep_key2="1234567890123" 784 wep_tx_keyidx=0 785 priority=5 786} 787 788 789# Shared WEP key connection (no WPA, no IEEE 802.1X) using Shared Key 790# IEEE 802.11 authentication 791network={ 792 ssid="static-wep-test2" 793 key_mgmt=NONE 794 wep_key0="abcde" 795 wep_key1=0102030405 796 wep_key2="1234567890123" 797 wep_tx_keyidx=0 798 priority=5 799 auth_alg=SHARED 800} 801 802 803# IBSS/ad-hoc network with WPA-None/TKIP. 804network={ 805 ssid="test adhoc" 806 mode=1 807 frequency=2412 808 proto=WPA 809 key_mgmt=WPA-NONE 810 pairwise=NONE 811 group=TKIP 812 psk="secret passphrase" 813} 814 815 816# Catch all example that allows more or less all configuration modes 817network={ 818 ssid="example" 819 scan_ssid=1 820 key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE 821 pairwise=CCMP TKIP 822 group=CCMP TKIP WEP104 WEP40 823 psk="very secret passphrase" 824 eap=TTLS PEAP TLS 825 identity="user@example.com" 826 password="foobar" 827 ca_cert="/etc/cert/ca.pem" 828 client_cert="/etc/cert/user.pem" 829 private_key="/etc/cert/user.prv" 830 private_key_passwd="password" 831 phase1="peaplabel=0" 832} 833 834# Example of EAP-TLS with smartcard (openssl engine) 835network={ 836 ssid="example" 837 key_mgmt=WPA-EAP 838 eap=TLS 839 proto=RSN 840 pairwise=CCMP TKIP 841 group=CCMP TKIP 842 identity="user@example.com" 843 ca_cert="/etc/cert/ca.pem" 844 client_cert="/etc/cert/user.pem" 845 846 engine=1 847 848 # The engine configured here must be available. Look at 849 # OpenSSL engine support in the global section. 850 # The key available through the engine must be the private key 851 # matching the client certificate configured above. 852 853 # use the opensc engine 854 #engine_id="opensc" 855 #key_id="45" 856 857 # use the pkcs11 engine 858 engine_id="pkcs11" 859 key_id="id_45" 860 861 # Optional PIN configuration; this can be left out and PIN will be 862 # asked through the control interface 863 pin="1234" 864} 865 866# Example configuration showing how to use an inlined blob as a CA certificate 867# data instead of using external file 868network={ 869 ssid="example" 870 key_mgmt=WPA-EAP 871 eap=TTLS 872 identity="user@example.com" 873 anonymous_identity="anonymous@example.com" 874 password="foobar" 875 ca_cert="blob://exampleblob" 876 priority=20 877} 878 879blob-base64-exampleblob={ 880SGVsbG8gV29ybGQhCg== 881} 882 883 884# Wildcard match for SSID (plaintext APs only). This example select any 885# open AP regardless of its SSID. 886network={ 887 key_mgmt=NONE 888} 889