xref: /freebsd/contrib/wpa/wpa_supplicant/wpa_supplicant.conf (revision 8d20be1e22095c27faf8fe8b2f0d089739cc742e)
1##### Example wpa_supplicant configuration file ###############################
2#
3# ***** Please check wpa_supplicant.conf(5) for details on these options *****
4#
5# This file describes configuration file format and lists all available option.
6# Please also take a look at simpler configuration examples in 'examples'
7# subdirectory.
8#
9# Empty lines and lines starting with # are ignored
10
11# NOTE! This file may contain password information and should probably be made
12# readable only by root user on multiuser systems.
13
14# Note: All file paths in this configuration file should use full (absolute,
15# not relative to working directory) path in order to allow working directory
16# to be changed. This can happen if wpa_supplicant is run in the background.
17
18# Whether to allow wpa_supplicant to update (overwrite) configuration
19#
20# This option can be used to allow wpa_supplicant to overwrite configuration
21# file whenever configuration is changed (e.g., new network block is added with
22# wpa_cli or wpa_gui, or a password is changed). This is required for
23# wpa_cli/wpa_gui to be able to store the configuration changes permanently.
24# Please note that overwriting configuration file will remove the comments from
25# it.
26#update_config=1
27
28# global configuration (shared by all network blocks)
29#
30# Parameters for the control interface. If this is specified, wpa_supplicant
31# will open a control interface that is available for external programs to
32# manage wpa_supplicant. The meaning of this string depends on which control
33# interface mechanism is used. For all cases, the existence of this parameter
34# in configuration is used to determine whether the control interface is
35# enabled.
36#
37# For UNIX domain sockets (default on Linux and BSD): This is a directory that
38# will be created for UNIX domain sockets for listening to requests from
39# external programs (CLI/GUI, etc.) for status information and configuration.
40# The socket file will be named based on the interface name, so multiple
41# wpa_supplicant processes can be run at the same time if more than one
42# interface is used.
43# /var/run/wpa_supplicant is the recommended directory for sockets and by
44# default, wpa_cli will use it when trying to connect with wpa_supplicant.
45#
46# Access control for the control interface can be configured by setting the
47# directory to allow only members of a group to use sockets. This way, it is
48# possible to run wpa_supplicant as root (since it needs to change network
49# configuration and open raw sockets) and still allow GUI/CLI components to be
50# run as non-root users. However, since the control interface can be used to
51# change the network configuration, this access needs to be protected in many
52# cases. By default, wpa_supplicant is configured to use gid 0 (root). If you
53# want to allow non-root users to use the control interface, add a new group
54# and change this value to match with that group. Add users that should have
55# control interface access to this group. If this variable is commented out or
56# not included in the configuration file, group will not be changed from the
57# value it got by default when the directory or socket was created.
58#
59# When configuring both the directory and group, use following format:
60# DIR=/var/run/wpa_supplicant GROUP=wheel
61# DIR=/var/run/wpa_supplicant GROUP=0
62# (group can be either group name or gid)
63#
64ctrl_interface=/var/run/wpa_supplicant
65
66# IEEE 802.1X/EAPOL version
67# wpa_supplicant is implemented based on IEEE Std 802.1X-2004 which defines
68# EAPOL version 2. However, there are many APs that do not handle the new
69# version number correctly (they seem to drop the frames completely). In order
70# to make wpa_supplicant interoperate with these APs, the version number is set
71# to 1 by default. This configuration value can be used to set it to the new
72# version (2).
73eapol_version=1
74
75# AP scanning/selection
76# By default, wpa_supplicant requests driver to perform AP scanning and then
77# uses the scan results to select a suitable AP. Another alternative is to
78# allow the driver to take care of AP scanning and selection and use
79# wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association
80# information from the driver.
81# 1: wpa_supplicant initiates scanning and AP selection; if no APs matching to
82#    the currently enabled networks are found, a new network (IBSS or AP mode
83#    operation) may be initialized (if configured) (default)
84# 0: driver takes care of scanning, AP selection, and IEEE 802.11 association
85#    parameters (e.g., WPA IE generation); this mode can also be used with
86#    non-WPA drivers when using IEEE 802.1X mode; do not try to associate with
87#    APs (i.e., external program needs to control association). This mode must
88#    also be used when using wired Ethernet drivers.
89# 2: like 0, but associate with APs using security policy and SSID (but not
90#    BSSID); this can be used, e.g., with ndiswrapper and NDIS drivers to
91#    enable operation with hidden SSIDs and optimized roaming; in this mode,
92#    the network blocks in the configuration file are tried one by one until
93#    the driver reports successful association; each network block should have
94#    explicit security policy (i.e., only one option in the lists) for
95#    key_mgmt, pairwise, group, proto variables
96#
97# For use in FreeBSD with the wlan module ap_scan must be set to 1.
98# When using IBSS or AP mode, ap_scan=2 mode can force the new network to be
99# created immediately regardless of scan results. ap_scan=1 mode will first try
100# to scan for existing networks and only if no matches with the enabled
101# networks are found, a new IBSS or AP mode network is created.
102ap_scan=1
103
104# EAP fast re-authentication
105# By default, fast re-authentication is enabled for all EAP methods that
106# support it. This variable can be used to disable fast re-authentication.
107# Normally, there is no need to disable this.
108fast_reauth=1
109
110# OpenSSL Engine support
111# These options can be used to load OpenSSL engines.
112# The two engines that are supported currently are shown below:
113# They are both from the opensc project (http://www.opensc.org/)
114# By default no engines are loaded.
115# make the opensc engine available
116#opensc_engine_path=/usr/lib/opensc/engine_opensc.so
117# make the pkcs11 engine available
118#pkcs11_engine_path=/usr/lib/opensc/engine_pkcs11.so
119# configure the path to the pkcs11 module required by the pkcs11 engine
120#pkcs11_module_path=/usr/lib/pkcs11/opensc-pkcs11.so
121
122# Dynamic EAP methods
123# If EAP methods were built dynamically as shared object files, they need to be
124# loaded here before being used in the network blocks. By default, EAP methods
125# are included statically in the build, so these lines are not needed
126#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_tls.so
127#load_dynamic_eap=/usr/lib/wpa_supplicant/eap_md5.so
128
129# Driver interface parameters
130# This field can be used to configure arbitrary driver interace parameters. The
131# format is specific to the selected driver interface. This field is not used
132# in most cases.
133#driver_param="field=value"
134
135# Country code
136# The ISO/IEC alpha2 country code for the country in which this device is
137# currently operating.
138#country=US
139
140# Maximum lifetime for PMKSA in seconds; default 43200
141#dot11RSNAConfigPMKLifetime=43200
142# Threshold for reauthentication (percentage of PMK lifetime); default 70
143#dot11RSNAConfigPMKReauthThreshold=70
144# Timeout for security association negotiation in seconds; default 60
145#dot11RSNAConfigSATimeout=60
146
147# Wi-Fi Protected Setup (WPS) parameters
148
149# Universally Unique IDentifier (UUID; see RFC 4122) of the device
150# If not configured, UUID will be generated based on the local MAC address.
151#uuid=12345678-9abc-def0-1234-56789abcdef0
152
153# Device Name
154# User-friendly description of device; up to 32 octets encoded in UTF-8
155#device_name=Wireless Client
156
157# Manufacturer
158# The manufacturer of the device (up to 64 ASCII characters)
159#manufacturer=Company
160
161# Model Name
162# Model of the device (up to 32 ASCII characters)
163#model_name=cmodel
164
165# Model Number
166# Additional device description (up to 32 ASCII characters)
167#model_number=123
168
169# Serial Number
170# Serial number of the device (up to 32 characters)
171#serial_number=12345
172
173# Primary Device Type
174# Used format: <categ>-<OUI>-<subcateg>
175# categ = Category as an integer value
176# OUI = OUI and type octet as a 4-octet hex-encoded value; 0050F204 for
177#       default WPS OUI
178# subcateg = OUI-specific Sub Category as an integer value
179# Examples:
180#   1-0050F204-1 (Computer / PC)
181#   1-0050F204-2 (Computer / Server)
182#   5-0050F204-1 (Storage / NAS)
183#   6-0050F204-1 (Network Infrastructure / AP)
184#device_type=1-0050F204-1
185
186# OS Version
187# 4-octet operating system version number (hex string)
188#os_version=01020300
189
190# Config Methods
191# List of the supported configuration methods
192# Available methods: usba ethernet label display ext_nfc_token int_nfc_token
193#	nfc_interface push_button keypad virtual_display physical_display
194#	virtual_push_button physical_push_button
195# For WSC 1.0:
196#config_methods=label display push_button keypad
197# For WSC 2.0:
198#config_methods=label virtual_display virtual_push_button keypad
199
200# Credential processing
201#   0 = process received credentials internally (default)
202#   1 = do not process received credentials; just pass them over ctrl_iface to
203#	external program(s)
204#   2 = process received credentials internally and pass them over ctrl_iface
205#	to external program(s)
206#wps_cred_processing=0
207
208# Vendor attribute in WPS M1, e.g., Windows 7 Vertical Pairing
209# The vendor attribute contents to be added in M1 (hex string)
210#wps_vendor_ext_m1=000137100100020001
211
212# NFC password token for WPS
213# These parameters can be used to configure a fixed NFC password token for the
214# station. This can be generated, e.g., with nfc_pw_token. When these
215# parameters are used, the station is assumed to be deployed with a NFC tag
216# that includes the matching NFC password token (e.g., written based on the
217# NDEF record from nfc_pw_token).
218#
219#wps_nfc_dev_pw_id: Device Password ID (16..65535)
220#wps_nfc_dh_pubkey: Hexdump of DH Public Key
221#wps_nfc_dh_privkey: Hexdump of DH Private Key
222#wps_nfc_dev_pw: Hexdump of Device Password
223
224# Maximum number of BSS entries to keep in memory
225# Default: 200
226# This can be used to limit memory use on the BSS entries (cached scan
227# results). A larger value may be needed in environments that have huge number
228# of APs when using ap_scan=1 mode.
229#bss_max_count=200
230
231# Automatic scan
232# This is an optional set of parameters for automatic scanning
233# within an interface in following format:
234#autoscan=<autoscan module name>:<module parameters>
235# autoscan is like bgscan but on disconnected or inactive state.
236# For instance, on exponential module parameters would be <base>:<limit>
237#autoscan=exponential:3:300
238# Which means a delay between scans on a base exponential of 3,
239# up to the limit of 300 seconds (3, 9, 27 ... 300)
240# For periodic module, parameters would be <fixed interval>
241#autoscan=periodic:30
242# So a delay of 30 seconds will be applied between each scan
243
244# filter_ssids - SSID-based scan result filtering
245# 0 = do not filter scan results (default)
246# 1 = only include configured SSIDs in scan results/BSS table
247#filter_ssids=0
248
249# Password (and passphrase, etc.) backend for external storage
250# format: <backend name>[:<optional backend parameters>]
251#ext_password_backend=test:pw1=password|pw2=testing
252
253# Timeout in seconds to detect STA inactivity (default: 300 seconds)
254#
255# This timeout value is used in P2P GO mode to clean up
256# inactive stations.
257#p2p_go_max_inactivity=300
258
259# Opportunistic Key Caching (also known as Proactive Key Caching) default
260# This parameter can be used to set the default behavior for the
261# proactive_key_caching parameter. By default, OKC is disabled unless enabled
262# with the global okc=1 parameter or with the per-network
263# proactive_key_caching=1 parameter. With okc=1, OKC is enabled by default, but
264# can be disabled with per-network proactive_key_caching=0 parameter.
265#okc=0
266
267# Protected Management Frames default
268# This parameter can be used to set the default behavior for the ieee80211w
269# parameter. By default, PMF is disabled unless enabled with the global pmf=1/2
270# parameter or with the per-network ieee80211w=1/2 parameter. With pmf=1/2, PMF
271# is enabled/required by default, but can be disabled with the per-network
272# ieee80211w parameter.
273#pmf=0
274
275# Interworking (IEEE 802.11u)
276
277# Enable Interworking
278# interworking=1
279
280# Homogenous ESS identifier
281# If this is set, scans will be used to request response only from BSSes
282# belonging to the specified Homogeneous ESS. This is used only if interworking
283# is enabled.
284# hessid=00:11:22:33:44:55
285
286# Automatic network selection behavior
287# 0 = do not automatically go through Interworking network selection
288#     (i.e., require explicit interworking_select command for this; default)
289# 1 = perform Interworking network selection if one or more
290#     credentials have been configured and scan did not find a
291#     matching network block
292#auto_interworking=0
293
294# credential block
295#
296# Each credential used for automatic network selection is configured as a set
297# of parameters that are compared to the information advertised by the APs when
298# interworking_select and interworking_connect commands are used.
299#
300# credential fields:
301#
302# priority: Priority group
303#	By default, all networks and credentials get the same priority group
304#	(0). This field can be used to give higher priority for credentials
305#	(and similarly in struct wpa_ssid for network blocks) to change the
306#	Interworking automatic networking selection behavior. The matching
307#	network (based on either an enabled network block or a credential)
308#	with the highest priority value will be selected.
309#
310# pcsc: Use PC/SC and SIM/USIM card
311#
312# realm: Home Realm for Interworking
313#
314# username: Username for Interworking network selection
315#
316# password: Password for Interworking network selection
317#
318# ca_cert: CA certificate for Interworking network selection
319#
320# client_cert: File path to client certificate file (PEM/DER)
321#	This field is used with Interworking networking selection for a case
322#	where client certificate/private key is used for authentication
323#	(EAP-TLS). Full path to the file should be used since working
324#	directory may change when wpa_supplicant is run in the background.
325#
326#	Alternatively, a named configuration blob can be used by setting
327#	this to blob://blob_name.
328#
329# private_key: File path to client private key file (PEM/DER/PFX)
330#	When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
331#	commented out. Both the private key and certificate will be read
332#	from the PKCS#12 file in this case. Full path to the file should be
333#	used since working directory may change when wpa_supplicant is run
334#	in the background.
335#
336#	Windows certificate store can be used by leaving client_cert out and
337#	configuring private_key in one of the following formats:
338#
339#	cert://substring_to_match
340#
341#	hash://certificate_thumbprint_in_hex
342#
343#	For example: private_key="hash://63093aa9c47f56ae88334c7b65a4"
344#
345#	Note that when running wpa_supplicant as an application, the user
346#	certificate store (My user account) is used, whereas computer store
347#	(Computer account) is used when running wpasvc as a service.
348#
349#	Alternatively, a named configuration blob can be used by setting
350#	this to blob://blob_name.
351#
352# private_key_passwd: Password for private key file
353#
354# imsi: IMSI in <MCC> | <MNC> | '-' | <MSIN> format
355#
356# milenage: Milenage parameters for SIM/USIM simulator in <Ki>:<OPc>:<SQN>
357#	format
358#
359# domain: Home service provider FQDN
360#	This is used to compare against the Domain Name List to figure out
361#	whether the AP is operated by the Home SP.
362#
363# roaming_consortium: Roaming Consortium OI
364#	If roaming_consortium_len is non-zero, this field contains the
365#	Roaming Consortium OI that can be used to determine which access
366#	points support authentication with this credential. This is an
367#	alternative to the use of the realm parameter. When using Roaming
368#	Consortium to match the network, the EAP parameters need to be
369#	pre-configured with the credential since the NAI Realm information
370#	may not be available or fetched.
371#
372# eap: Pre-configured EAP method
373#	This optional field can be used to specify which EAP method will be
374#	used with this credential. If not set, the EAP method is selected
375#	automatically based on ANQP information (e.g., NAI Realm).
376#
377# phase1: Pre-configure Phase 1 (outer authentication) parameters
378#	This optional field is used with like the 'eap' parameter.
379#
380# phase2: Pre-configure Phase 2 (inner authentication) parameters
381#	This optional field is used with like the 'eap' parameter.
382#
383# excluded_ssid: Excluded SSID
384#	This optional field can be used to excluded specific SSID(s) from
385#	matching with the network. Multiple entries can be used to specify more
386#	than one SSID.
387#
388# for example:
389#
390#cred={
391#	realm="example.com"
392#	username="user@example.com"
393#	password="password"
394#	ca_cert="/etc/wpa_supplicant/ca.pem"
395#	domain="example.com"
396#}
397#
398#cred={
399#	imsi="310026-000000000"
400#	milenage="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82"
401#}
402#
403#cred={
404#	realm="example.com"
405#	username="user"
406#	password="password"
407#	ca_cert="/etc/wpa_supplicant/ca.pem"
408#	domain="example.com"
409#	roaming_consortium=223344
410#	eap=TTLS
411#	phase2="auth=MSCHAPV2"
412#}
413
414# Hotspot 2.0
415# hs20=1
416
417# network block
418#
419# Each network (usually AP's sharing the same SSID) is configured as a separate
420# block in this configuration file. The network blocks are in preference order
421# (the first match is used).
422#
423# network block fields:
424#
425# disabled:
426#	0 = this network can be used (default)
427#	1 = this network block is disabled (can be enabled through ctrl_iface,
428#	    e.g., with wpa_cli or wpa_gui)
429#
430# id_str: Network identifier string for external scripts. This value is passed
431#	to external action script through wpa_cli as WPA_ID_STR environment
432#	variable to make it easier to do network specific configuration.
433#
434# ssid: SSID (mandatory); network name in one of the optional formats:
435#	- an ASCII string with double quotation
436#	- a hex string (two characters per octet of SSID)
437#	- a printf-escaped ASCII string P"<escaped string>"
438#
439# scan_ssid:
440#	0 = do not scan this SSID with specific Probe Request frames (default)
441#	1 = scan with SSID-specific Probe Request frames (this can be used to
442#	    find APs that hide (do not broadcast) SSID or use multiple SSIDs;
443#	    this will add latency to scanning, so enable this only when needed)
444#
445# bssid: BSSID (optional); if set, this network block is used only when
446#	associating with the AP using the configured BSSID
447#
448# priority: priority group (integer)
449# By default, all networks will get same priority group (0). If some of the
450# networks are more desirable, this field can be used to change the order in
451# which wpa_supplicant goes through the networks when selecting a BSS. The
452# priority groups will be iterated in decreasing priority (i.e., the larger the
453# priority value, the sooner the network is matched against the scan results).
454# Within each priority group, networks will be selected based on security
455# policy, signal strength, etc.
456# Please note that AP scanning with scan_ssid=1 and ap_scan=2 mode are not
457# using this priority to select the order for scanning. Instead, they try the
458# networks in the order that they are listed in the configuration file.
459#
460# mode: IEEE 802.11 operation mode
461# 0 = infrastructure (Managed) mode, i.e., associate with an AP (default)
462# 1 = IBSS (ad-hoc, peer-to-peer)
463# 2 = AP (access point)
464# Note: IBSS can only be used with key_mgmt NONE (plaintext and static WEP)
465# and key_mgmt=WPA-NONE (fixed group key TKIP/CCMP). WPA-None requires
466# following network block options:
467# proto=WPA, key_mgmt=WPA-NONE, pairwise=NONE, group=TKIP (or CCMP, but not
468# both), and psk must also be set.
469#
470# frequency: Channel frequency in megahertz (MHz) for IBSS, e.g.,
471# 2412 = IEEE 802.11b/g channel 1. This value is used to configure the initial
472# channel for IBSS (adhoc) networks. It is ignored in the infrastructure mode.
473# In addition, this value is only used by the station that creates the IBSS. If
474# an IBSS network with the configured SSID is already present, the frequency of
475# the network will be used instead of this configured value.
476#
477# scan_freq: List of frequencies to scan
478# Space-separated list of frequencies in MHz to scan when searching for this
479# BSS. If the subset of channels used by the network is known, this option can
480# be used to optimize scanning to not occur on channels that the network does
481# not use. Example: scan_freq=2412 2437 2462
482#
483# freq_list: Array of allowed frequencies
484# Space-separated list of frequencies in MHz to allow for selecting the BSS. If
485# set, scan results that do not match any of the specified frequencies are not
486# considered when selecting a BSS.
487#
488# bgscan: Background scanning
489# wpa_supplicant behavior for background scanning can be specified by
490# configuring a bgscan module. These modules are responsible for requesting
491# background scans for the purpose of roaming within an ESS (i.e., within a
492# single network block with all the APs using the same SSID). The bgscan
493# parameter uses following format: "<bgscan module name>:<module parameters>"
494# Following bgscan modules are available:
495# simple - Periodic background scans based on signal strength
496# bgscan="simple:<short bgscan interval in seconds>:<signal strength threshold>:
497# <long interval>"
498# bgscan="simple:30:-45:300"
499# learn - Learn channels used by the network and try to avoid bgscans on other
500# channels (experimental)
501# bgscan="learn:<short bgscan interval in seconds>:<signal strength threshold>:
502# <long interval>[:<database file name>]"
503# bgscan="learn:30:-45:300:/etc/wpa_supplicant/network1.bgscan"
504#
505# proto: list of accepted protocols
506# WPA = WPA/IEEE 802.11i/D3.0
507# RSN = WPA2/IEEE 802.11i (also WPA2 can be used as an alias for RSN)
508# If not set, this defaults to: WPA RSN
509#
510# key_mgmt: list of accepted authenticated key management protocols
511# WPA-PSK = WPA pre-shared key (this requires 'psk' field)
512# WPA-EAP = WPA using EAP authentication
513# IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
514#	generated WEP keys
515# NONE = WPA is not used; plaintext or static WEP could be used
516# WPA-PSK-SHA256 = Like WPA-PSK but using stronger SHA256-based algorithms
517# WPA-EAP-SHA256 = Like WPA-EAP but using stronger SHA256-based algorithms
518# If not set, this defaults to: WPA-PSK WPA-EAP
519#
520# ieee80211w: whether management frame protection is enabled
521# 0 = disabled (default unless changed with the global pmf parameter)
522# 1 = optional
523# 2 = required
524# The most common configuration options for this based on the PMF (protected
525# management frames) certification program are:
526# PMF enabled: ieee80211w=1 and key_mgmt=WPA-EAP WPA-EAP-SHA256
527# PMF required: ieee80211w=2 and key_mgmt=WPA-EAP-SHA256
528# (and similarly for WPA-PSK and WPA-WPSK-SHA256 if WPA2-Personal is used)
529#
530# auth_alg: list of allowed IEEE 802.11 authentication algorithms
531# OPEN = Open System authentication (required for WPA/WPA2)
532# SHARED = Shared Key authentication (requires static WEP keys)
533# LEAP = LEAP/Network EAP (only used with LEAP)
534# If not set, automatic selection is used (Open System with LEAP enabled if
535# LEAP is allowed as one of the EAP methods).
536#
537# pairwise: list of accepted pairwise (unicast) ciphers for WPA
538# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
539# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
540# NONE = Use only Group Keys (deprecated, should not be included if APs support
541#	pairwise keys)
542# If not set, this defaults to: CCMP TKIP
543#
544# group: list of accepted group (broadcast/multicast) ciphers for WPA
545# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
546# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
547# WEP104 = WEP (Wired Equivalent Privacy) with 104-bit key
548# WEP40 = WEP (Wired Equivalent Privacy) with 40-bit key [IEEE 802.11]
549# If not set, this defaults to: CCMP TKIP WEP104 WEP40
550#
551# psk: WPA preshared key; 256-bit pre-shared key
552# The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e.,
553# 32 bytes or as an ASCII passphrase (in which case, the real PSK will be
554# generated using the passphrase and SSID). ASCII passphrase must be between
555# 8 and 63 characters (inclusive). ext:<name of external PSK field> format can
556# be used to indicate that the PSK/passphrase is stored in external storage.
557# This field is not needed, if WPA-EAP is used.
558# Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys
559# from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
560# startup and reconfiguration time can be optimized by generating the PSK only
561# only when the passphrase or SSID has actually changed.
562#
563# eapol_flags: IEEE 802.1X/EAPOL options (bit field)
564# Dynamic WEP key required for non-WPA mode
565# bit0 (1): require dynamically generated unicast WEP key
566# bit1 (2): require dynamically generated broadcast WEP key
567# 	(3 = require both keys; default)
568# Note: When using wired authentication, eapol_flags must be set to 0 for the
569# authentication to be completed successfully.
570#
571# mixed_cell: This option can be used to configure whether so called mixed
572# cells, i.e., networks that use both plaintext and encryption in the same
573# SSID, are allowed when selecting a BSS from scan results.
574# 0 = disabled (default)
575# 1 = enabled
576#
577# proactive_key_caching:
578# Enable/disable opportunistic PMKSA caching for WPA2.
579# 0 = disabled (default unless changed with the global okc parameter)
580# 1 = enabled
581#
582# wep_key0..3: Static WEP key (ASCII in double quotation, e.g. "abcde" or
583# hex without quotation, e.g., 0102030405)
584# wep_tx_keyidx: Default WEP key index (TX) (0..3)
585#
586# peerkey: Whether PeerKey negotiation for direct links (IEEE 802.11e DLS) is
587# allowed. This is only used with RSN/WPA2.
588# 0 = disabled (default)
589# 1 = enabled
590#peerkey=1
591#
592# wpa_ptk_rekey: Maximum lifetime for PTK in seconds. This can be used to
593# enforce rekeying of PTK to mitigate some attacks against TKIP deficiencies.
594#
595# Following fields are only used with internal EAP implementation.
596# eap: space-separated list of accepted EAP methods
597#	MD5 = EAP-MD5 (unsecure and does not generate keying material ->
598#			cannot be used with WPA; to be used as a Phase 2 method
599#			with EAP-PEAP or EAP-TTLS)
600#       MSCHAPV2 = EAP-MSCHAPv2 (cannot be used separately with WPA; to be used
601#		as a Phase 2 method with EAP-PEAP or EAP-TTLS)
602#       OTP = EAP-OTP (cannot be used separately with WPA; to be used
603#		as a Phase 2 method with EAP-PEAP or EAP-TTLS)
604#       GTC = EAP-GTC (cannot be used separately with WPA; to be used
605#		as a Phase 2 method with EAP-PEAP or EAP-TTLS)
606#	TLS = EAP-TLS (client and server certificate)
607#	PEAP = EAP-PEAP (with tunnelled EAP authentication)
608#	TTLS = EAP-TTLS (with tunnelled EAP or PAP/CHAP/MSCHAP/MSCHAPV2
609#			 authentication)
610#	If not set, all compiled in methods are allowed.
611#
612# identity: Identity string for EAP
613#	This field is also used to configure user NAI for
614#	EAP-PSK/PAX/SAKE/GPSK.
615# anonymous_identity: Anonymous identity string for EAP (to be used as the
616#	unencrypted identity with EAP types that support different tunnelled
617#	identity, e.g., EAP-TTLS). This field can also be used with
618#	EAP-SIM/AKA/AKA' to store the pseudonym identity.
619# password: Password string for EAP. This field can include either the
620#	plaintext password (using ASCII or hex string) or a NtPasswordHash
621#	(16-byte MD4 hash of password) in hash:<32 hex digits> format.
622#	NtPasswordHash can only be used when the password is for MSCHAPv2 or
623#	MSCHAP (EAP-MSCHAPv2, EAP-TTLS/MSCHAPv2, EAP-TTLS/MSCHAP, LEAP).
624#	EAP-PSK (128-bit PSK), EAP-PAX (128-bit PSK), and EAP-SAKE (256-bit
625#	PSK) is also configured using this field. For EAP-GPSK, this is a
626#	variable length PSK. ext:<name of external password field> format can
627#	be used to indicate that the password is stored in external storage.
628# ca_cert: File path to CA certificate file (PEM/DER). This file can have one
629#	or more trusted CA certificates. If ca_cert and ca_path are not
630#	included, server certificate will not be verified. This is insecure and
631#	a trusted CA certificate should always be configured when using
632#	EAP-TLS/TTLS/PEAP. Full path should be used since working directory may
633#	change when wpa_supplicant is run in the background.
634#
635#	Alternatively, this can be used to only perform matching of the server
636#	certificate (SHA-256 hash of the DER encoded X.509 certificate). In
637#	this case, the possible CA certificates in the server certificate chain
638#	are ignored and only the server certificate is verified. This is
639#	configured with the following format:
640#	hash:://server/sha256/cert_hash_in_hex
641#	For example: "hash://server/sha256/
642#	5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a"
643#
644#	On Windows, trusted CA certificates can be loaded from the system
645#	certificate store by setting this to cert_store://<name>, e.g.,
646#	ca_cert="cert_store://CA" or ca_cert="cert_store://ROOT".
647#	Note that when running wpa_supplicant as an application, the user
648#	certificate store (My user account) is used, whereas computer store
649#	(Computer account) is used when running wpasvc as a service.
650# ca_path: Directory path for CA certificate files (PEM). This path may
651#	contain multiple CA certificates in OpenSSL format. Common use for this
652#	is to point to system trusted CA list which is often installed into
653#	directory like /etc/ssl/certs. If configured, these certificates are
654#	added to the list of trusted CAs. ca_cert may also be included in that
655#	case, but it is not required.
656# client_cert: File path to client certificate file (PEM/DER)
657#	Full path should be used since working directory may change when
658#	wpa_supplicant is run in the background.
659#	Alternatively, a named configuration blob can be used by setting this
660#	to blob://<blob name>.
661# private_key: File path to client private key file (PEM/DER/PFX)
662#	When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
663#	commented out. Both the private key and certificate will be read from
664#	the PKCS#12 file in this case. Full path should be used since working
665#	directory may change when wpa_supplicant is run in the background.
666#	Windows certificate store can be used by leaving client_cert out and
667#	configuring private_key in one of the following formats:
668#	cert://substring_to_match
669#	hash://certificate_thumbprint_in_hex
670#	for example: private_key="hash://63093aa9c47f56ae88334c7b65a4"
671#	Note that when running wpa_supplicant as an application, the user
672#	certificate store (My user account) is used, whereas computer store
673#	(Computer account) is used when running wpasvc as a service.
674#	Alternatively, a named configuration blob can be used by setting this
675#	to blob://<blob name>.
676# private_key_passwd: Password for private key file (if left out, this will be
677#	asked through control interface)
678# dh_file: File path to DH/DSA parameters file (in PEM format)
679#	This is an optional configuration file for setting parameters for an
680#	ephemeral DH key exchange. In most cases, the default RSA
681#	authentication does not use this configuration. However, it is possible
682#	setup RSA to use ephemeral DH key exchange. In addition, ciphers with
683#	DSA keys always use ephemeral DH keys. This can be used to achieve
684#	forward secrecy. If the file is in DSA parameters format, it will be
685#	automatically converted into DH params.
686# subject_match: Substring to be matched against the subject of the
687#	authentication server certificate. If this string is set, the server
688#	sertificate is only accepted if it contains this string in the subject.
689#	The subject string is in following format:
690#	/C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com
691# altsubject_match: Semicolon separated string of entries to be matched against
692#	the alternative subject name of the authentication server certificate.
693#	If this string is set, the server sertificate is only accepted if it
694#	contains one of the entries in an alternative subject name extension.
695#	altSubjectName string is in following format: TYPE:VALUE
696#	Example: EMAIL:server@example.com
697#	Example: DNS:server.example.com;DNS:server2.example.com
698#	Following types are supported: EMAIL, DNS, URI
699# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
700#	(string with field-value pairs, e.g., "peapver=0" or
701#	"peapver=1 peaplabel=1")
702#	'peapver' can be used to force which PEAP version (0 or 1) is used.
703#	'peaplabel=1' can be used to force new label, "client PEAP encryption",
704#	to be used during key derivation when PEAPv1 or newer. Most existing
705#	PEAPv1 implementation seem to be using the old label, "client EAP
706#	encryption", and wpa_supplicant is now using that as the default value.
707#	Some servers, e.g., Radiator, may require peaplabel=1 configuration to
708#	interoperate with PEAPv1; see eap_testing.txt for more details.
709#	'peap_outer_success=0' can be used to terminate PEAP authentication on
710#	tunneled EAP-Success. This is required with some RADIUS servers that
711#	implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g.,
712#	Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode)
713#	include_tls_length=1 can be used to force wpa_supplicant to include
714#	TLS Message Length field in all TLS messages even if they are not
715#	fragmented.
716#	sim_min_num_chal=3 can be used to configure EAP-SIM to require three
717#	challenges (by default, it accepts 2 or 3)
718#	result_ind=1 can be used to enable EAP-SIM and EAP-AKA to use
719#	protected result indication.
720#	'crypto_binding' option can be used to control PEAPv0 cryptobinding
721#	behavior:
722#	 * 0 = do not use cryptobinding (default)
723#	 * 1 = use cryptobinding if server supports it
724#	 * 2 = require cryptobinding
725#	EAP-WSC (WPS) uses following options: pin=<Device Password> or
726#	pbc=1.
727# phase2: Phase2 (inner authentication with TLS tunnel) parameters
728#	(string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
729#	"autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS)
730#
731# TLS-based methods can use the following parameters to control TLS behavior
732# (these are normally in the phase1 parameter, but can be used also in the
733# phase2 parameter when EAP-TLS is used within the inner tunnel):
734# tls_allow_md5=1 - allow MD5-based certificate signatures (depending on the
735#	TLS library, these may be disabled by default to enforce stronger
736#	security)
737# tls_disable_time_checks=1 - ignore certificate validity time (this requests
738#	the TLS library to accept certificates even if they are not currently
739#	valid, i.e., have expired or have not yet become valid; this should be
740#	used only for testing purposes)
741# tls_disable_session_ticket=1 - disable TLS Session Ticket extension
742# tls_disable_session_ticket=0 - allow TLS Session Ticket extension to be used
743#	Note: If not set, this is automatically set to 1 for EAP-TLS/PEAP/TTLS
744#	as a workaround for broken authentication server implementations unless
745#	EAP workarounds are disabled with eap_workarounds=0.
746#	For EAP-FAST, this must be set to 0 (or left unconfigured for the
747#	default value to be used automatically).
748#
749# Following certificate/private key fields are used in inner Phase2
750# authentication when using EAP-TTLS or EAP-PEAP.
751# ca_cert2: File path to CA certificate file. This file can have one or more
752#	trusted CA certificates. If ca_cert2 and ca_path2 are not included,
753#	server certificate will not be verified. This is insecure and a trusted
754#	CA certificate should always be configured.
755# ca_path2: Directory path for CA certificate files (PEM)
756# client_cert2: File path to client certificate file
757# private_key2: File path to client private key file
758# private_key2_passwd: Password for private key file
759# dh_file2: File path to DH/DSA parameters file (in PEM format)
760# subject_match2: Substring to be matched against the subject of the
761#	authentication server certificate.
762# altsubject_match2: Substring to be matched against the alternative subject
763#	name of the authentication server certificate.
764#
765# fragment_size: Maximum EAP fragment size in bytes (default 1398).
766#	This value limits the fragment size for EAP methods that support
767#	fragmentation (e.g., EAP-TLS and EAP-PEAP). This value should be set
768#	small enough to make the EAP messages fit in MTU of the network
769#	interface used for EAPOL. The default value is suitable for most
770#	cases.
771#
772# EAP-FAST variables:
773# pac_file: File path for the PAC entries. wpa_supplicant will need to be able
774#	to create this file and write updates to it when PAC is being
775#	provisioned or refreshed. Full path to the file should be used since
776#	working directory may change when wpa_supplicant is run in the
777#	background. Alternatively, a named configuration blob can be used by
778#	setting this to blob://<blob name>
779# phase1: fast_provisioning option can be used to enable in-line provisioning
780#         of EAP-FAST credentials (PAC):
781#         0 = disabled,
782#         1 = allow unauthenticated provisioning,
783#         2 = allow authenticated provisioning,
784#         3 = allow both unauthenticated and authenticated provisioning
785#	fast_max_pac_list_len=<num> option can be used to set the maximum
786#		number of PAC entries to store in a PAC list (default: 10)
787#	fast_pac_format=binary option can be used to select binary format for
788#		storing PAC entries in order to save some space (the default
789#		text format uses about 2.5 times the size of minimal binary
790#		format)
791#
792# wpa_supplicant supports number of "EAP workarounds" to work around
793# interoperability issues with incorrectly behaving authentication servers.
794# These are enabled by default because some of the issues are present in large
795# number of authentication servers. Strict EAP conformance mode can be
796# configured by disabling workarounds with eap_workaround=0.
797
798# Station inactivity limit
799#
800# If a station does not send anything in ap_max_inactivity seconds, an
801# empty data frame is sent to it in order to verify whether it is
802# still in range. If this frame is not ACKed, the station will be
803# disassociated and then deauthenticated. This feature is used to
804# clear station table of old entries when the STAs move out of the
805# range.
806#
807# The station can associate again with the AP if it is still in range;
808# this inactivity poll is just used as a nicer way of verifying
809# inactivity; i.e., client will not report broken connection because
810# disassociation frame is not sent immediately without first polling
811# the STA with a data frame.
812# default: 300 (i.e., 5 minutes)
813#ap_max_inactivity=300
814
815# DTIM period in Beacon intervals for AP mode (default: 2)
816#dtim_period=2
817
818# disable_ht: Whether HT (802.11n) should be disabled.
819# 0 = HT enabled (if AP supports it)
820# 1 = HT disabled
821#
822# disable_ht40: Whether HT-40 (802.11n) should be disabled.
823# 0 = HT-40 enabled (if AP supports it)
824# 1 = HT-40 disabled
825#
826# disable_sgi: Whether SGI (short guard interval) should be disabled.
827# 0 = SGI enabled (if AP supports it)
828# 1 = SGI disabled
829#
830# ht_mcs:  Configure allowed MCS rates.
831#  Parsed as an array of bytes, in base-16 (ascii-hex)
832# ht_mcs=""                                   // Use all available (default)
833# ht_mcs="0xff 00 00 00 00 00 00 00 00 00 "   // Use MCS 0-7 only
834# ht_mcs="0xff ff 00 00 00 00 00 00 00 00 "   // Use MCS 0-15 only
835#
836# disable_max_amsdu:  Whether MAX_AMSDU should be disabled.
837# -1 = Do not make any changes.
838# 0  = Enable MAX-AMSDU if hardware supports it.
839# 1  = Disable AMSDU
840#
841# ampdu_density:  Allow overriding AMPDU density configuration.
842#  Treated as hint by the kernel.
843# -1 = Do not make any changes.
844# 0-3 = Set AMPDU density (aka factor) to specified value.
845
846# Example blocks:
847
848# Simple case: WPA-PSK, PSK as an ASCII passphrase, allow all valid ciphers
849network={
850	ssid="simple"
851	psk="very secret passphrase"
852	priority=5
853}
854
855# Same as previous, but request SSID-specific scanning (for APs that reject
856# broadcast SSID)
857network={
858	ssid="second ssid"
859	scan_ssid=1
860	psk="very secret passphrase"
861	priority=2
862}
863
864# Only WPA-PSK is used. Any valid cipher combination is accepted.
865network={
866	ssid="example"
867	proto=WPA
868	key_mgmt=WPA-PSK
869	pairwise=CCMP TKIP
870	group=CCMP TKIP WEP104 WEP40
871	psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
872	priority=2
873}
874
875# WPA-Personal(PSK) with TKIP and enforcement for frequent PTK rekeying
876network={
877	ssid="example"
878	proto=WPA
879	key_mgmt=WPA-PSK
880	pairwise=TKIP
881	group=TKIP
882	psk="not so secure passphrase"
883	wpa_ptk_rekey=600
884}
885
886# Only WPA-EAP is used. Both CCMP and TKIP is accepted. An AP that used WEP104
887# or WEP40 as the group cipher will not be accepted.
888network={
889	ssid="example"
890	proto=RSN
891	key_mgmt=WPA-EAP
892	pairwise=CCMP TKIP
893	group=CCMP TKIP
894	eap=TLS
895	identity="user@example.com"
896	ca_cert="/etc/cert/ca.pem"
897	client_cert="/etc/cert/user.pem"
898	private_key="/etc/cert/user.prv"
899	private_key_passwd="password"
900	priority=1
901}
902
903# EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new peaplabel
904# (e.g., Radiator)
905network={
906	ssid="example"
907	key_mgmt=WPA-EAP
908	eap=PEAP
909	identity="user@example.com"
910	password="foobar"
911	ca_cert="/etc/cert/ca.pem"
912	phase1="peaplabel=1"
913	phase2="auth=MSCHAPV2"
914	priority=10
915}
916
917# EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the
918# unencrypted use. Real identity is sent only within an encrypted TLS tunnel.
919network={
920	ssid="example"
921	key_mgmt=WPA-EAP
922	eap=TTLS
923	identity="user@example.com"
924	anonymous_identity="anonymous@example.com"
925	password="foobar"
926	ca_cert="/etc/cert/ca.pem"
927	priority=2
928}
929
930# EAP-TTLS/MSCHAPv2 configuration with anonymous identity for the unencrypted
931# use. Real identity is sent only within an encrypted TLS tunnel.
932network={
933	ssid="example"
934	key_mgmt=WPA-EAP
935	eap=TTLS
936	identity="user@example.com"
937	anonymous_identity="anonymous@example.com"
938	password="foobar"
939	ca_cert="/etc/cert/ca.pem"
940	phase2="auth=MSCHAPV2"
941}
942
943# WPA-EAP, EAP-TTLS with different CA certificate used for outer and inner
944# authentication.
945network={
946	ssid="example"
947	key_mgmt=WPA-EAP
948	eap=TTLS
949	# Phase1 / outer authentication
950	anonymous_identity="anonymous@example.com"
951	ca_cert="/etc/cert/ca.pem"
952	# Phase 2 / inner authentication
953	phase2="autheap=TLS"
954	ca_cert2="/etc/cert/ca2.pem"
955	client_cert2="/etc/cer/user.pem"
956	private_key2="/etc/cer/user.prv"
957	private_key2_passwd="password"
958	priority=2
959}
960
961# Both WPA-PSK and WPA-EAP is accepted. Only CCMP is accepted as pairwise and
962# group cipher.
963network={
964	ssid="example"
965	bssid=00:11:22:33:44:55
966	proto=WPA RSN
967	key_mgmt=WPA-PSK WPA-EAP
968	pairwise=CCMP
969	group=CCMP
970	psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
971}
972
973# Special characters in SSID, so use hex string. Default to WPA-PSK, WPA-EAP
974# and all valid ciphers.
975network={
976	ssid=00010203
977	psk=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
978}
979
980
981# EAP-SIM with a GSM SIM or USIM
982network={
983	ssid="eap-sim-test"
984	key_mgmt=WPA-EAP
985	eap=SIM
986	pin="1234"
987	pcsc=""
988}
989
990
991# EAP-PSK
992network={
993	ssid="eap-psk-test"
994	key_mgmt=WPA-EAP
995	eap=PSK
996	anonymous_identity="eap_psk_user"
997	password=06b4be19da289f475aa46a33cb793029
998	identity="eap_psk_user@example.com"
999}
1000
1001
1002# IEEE 802.1X/EAPOL with dynamically generated WEP keys (i.e., no WPA) using
1003# EAP-TLS for authentication and key generation; require both unicast and
1004# broadcast WEP keys.
1005network={
1006	ssid="1x-test"
1007	key_mgmt=IEEE8021X
1008	eap=TLS
1009	identity="user@example.com"
1010	ca_cert="/etc/cert/ca.pem"
1011	client_cert="/etc/cert/user.pem"
1012	private_key="/etc/cert/user.prv"
1013	private_key_passwd="password"
1014	eapol_flags=3
1015}
1016
1017
1018# LEAP with dynamic WEP keys
1019network={
1020	ssid="leap-example"
1021	key_mgmt=IEEE8021X
1022	eap=LEAP
1023	identity="user"
1024	password="foobar"
1025}
1026
1027# EAP-IKEv2 using shared secrets for both server and peer authentication
1028network={
1029	ssid="ikev2-example"
1030	key_mgmt=WPA-EAP
1031	eap=IKEV2
1032	identity="user"
1033	password="foobar"
1034}
1035
1036# EAP-FAST with WPA (WPA or WPA2)
1037network={
1038	ssid="eap-fast-test"
1039	key_mgmt=WPA-EAP
1040	eap=FAST
1041	anonymous_identity="FAST-000102030405"
1042	identity="username"
1043	password="password"
1044	phase1="fast_provisioning=1"
1045	pac_file="/etc/wpa_supplicant.eap-fast-pac"
1046}
1047
1048network={
1049	ssid="eap-fast-test"
1050	key_mgmt=WPA-EAP
1051	eap=FAST
1052	anonymous_identity="FAST-000102030405"
1053	identity="username"
1054	password="password"
1055	phase1="fast_provisioning=1"
1056	pac_file="blob://eap-fast-pac"
1057}
1058
1059# Plaintext connection (no WPA, no IEEE 802.1X)
1060network={
1061	ssid="plaintext-test"
1062	key_mgmt=NONE
1063}
1064
1065
1066# Shared WEP key connection (no WPA, no IEEE 802.1X)
1067network={
1068	ssid="static-wep-test"
1069	key_mgmt=NONE
1070	wep_key0="abcde"
1071	wep_key1=0102030405
1072	wep_key2="1234567890123"
1073	wep_tx_keyidx=0
1074	priority=5
1075}
1076
1077
1078# Shared WEP key connection (no WPA, no IEEE 802.1X) using Shared Key
1079# IEEE 802.11 authentication
1080network={
1081	ssid="static-wep-test2"
1082	key_mgmt=NONE
1083	wep_key0="abcde"
1084	wep_key1=0102030405
1085	wep_key2="1234567890123"
1086	wep_tx_keyidx=0
1087	priority=5
1088	auth_alg=SHARED
1089}
1090
1091
1092# IBSS/ad-hoc network with WPA-None/TKIP.
1093network={
1094	ssid="test adhoc"
1095	mode=1
1096	frequency=2412
1097	proto=WPA
1098	key_mgmt=WPA-NONE
1099	pairwise=NONE
1100	group=TKIP
1101	psk="secret passphrase"
1102}
1103
1104
1105# Catch all example that allows more or less all configuration modes
1106network={
1107	ssid="example"
1108	scan_ssid=1
1109	key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
1110	pairwise=CCMP TKIP
1111	group=CCMP TKIP WEP104 WEP40
1112	psk="very secret passphrase"
1113	eap=TTLS PEAP TLS
1114	identity="user@example.com"
1115	password="foobar"
1116	ca_cert="/etc/cert/ca.pem"
1117	client_cert="/etc/cert/user.pem"
1118	private_key="/etc/cert/user.prv"
1119	private_key_passwd="password"
1120	phase1="peaplabel=0"
1121}
1122
1123# Example of EAP-TLS with smartcard (openssl engine)
1124network={
1125	ssid="example"
1126	key_mgmt=WPA-EAP
1127	eap=TLS
1128	proto=RSN
1129	pairwise=CCMP TKIP
1130	group=CCMP TKIP
1131	identity="user@example.com"
1132	ca_cert="/etc/cert/ca.pem"
1133	client_cert="/etc/cert/user.pem"
1134
1135	engine=1
1136
1137	# The engine configured here must be available. Look at
1138	# OpenSSL engine support in the global section.
1139	# The key available through the engine must be the private key
1140	# matching the client certificate configured above.
1141
1142	# use the opensc engine
1143	#engine_id="opensc"
1144	#key_id="45"
1145
1146	# use the pkcs11 engine
1147	engine_id="pkcs11"
1148	key_id="id_45"
1149
1150	# Optional PIN configuration; this can be left out and PIN will be
1151	# asked through the control interface
1152	pin="1234"
1153}
1154
1155# Example configuration showing how to use an inlined blob as a CA certificate
1156# data instead of using external file
1157network={
1158	ssid="example"
1159	key_mgmt=WPA-EAP
1160	eap=TTLS
1161	identity="user@example.com"
1162	anonymous_identity="anonymous@example.com"
1163	password="foobar"
1164	ca_cert="blob://exampleblob"
1165	priority=20
1166}
1167
1168blob-base64-exampleblob={
1169SGVsbG8gV29ybGQhCg==
1170}
1171
1172
1173# Wildcard match for SSID (plaintext APs only). This example select any
1174# open AP regardless of its SSID.
1175network={
1176	key_mgmt=NONE
1177}
1178