1.\" Copyright (c) 2005 Sam Leffler <sam@errno.com> 2.\" Copyright (c) 2006 Rui Paulo 3.\" All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 14.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24.\" SUCH DAMAGE. 25.\" 26.\" $FreeBSD$ 27.\" 28.Dd September 2, 2006 29.Dt HOSTAPD.CONF 5 30.Os 31.Sh NAME 32.Nm hostapd.conf 33.Nd configuration file for 34.Xr hostapd 8 35utility 36.Sh DESCRIPTION 37The 38.Xr hostapd 8 39utility 40is an authenticator for IEEE 802.11 networks. 41It provides full support for WPA/IEEE 802.11i and 42can also act as an IEEE 802.1X Authenticator with a suitable 43backend Authentication Server (typically 44.Tn FreeRADIUS ) . 45.Pp 46The configuration file consists of global parameters and domain 47specific configuration: 48.Bl -bullet -offset indent -compact 49.It 50IEEE 802.1X-2004 51.\" XXX not yet 52.\" .It 53.\" Integrated EAP server 54.\" .It 55.\" IEEE 802.11f - Inter-Access Point Protocol (IAPP) 56.It 57RADIUS client 58.It 59RADIUS authentication server 60.It 61WPA/IEEE 802.11i 62.El 63.Sh GLOBAL PARAMETERS 64The following parameters are recognized: 65.Bl -tag -width indent 66.It Va interface 67Interface name. 68Should be set in 69.Dq hostap 70mode. 71.It Va debug 72Debugging mode: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = 73excessive. 74.It Va dump_file 75Dump file for state information (on SIGUSR1). 76.It Va ctrl_interface 77The pathname of the directory in which 78.Xr hostapd 8 79creates 80.Ux 81domain socket files for communication 82with frontend programs such as 83.Xr hostapd_cli 8 . 84.It Va ctrl_interface_group 85A group name or group ID to use in setting protection on the 86control interface file. 87This can be set to allow non-root users to access the 88control interface files. 89If no group is specified, the group ID of the control interface 90is not modified and will, typically, be the 91group ID of the directory in which the socket is created. 92.El 93.Sh IEEE 802.1X-2004 PARAMETERS 94The following parameters are recognized: 95.Bl -tag -width indent 96.It Va ieee8021x 97Require IEEE 802.1X authorization. 98.It Va eap_message 99Optional displayable message sent with EAP Request-Identity. 100.It Va wep_key_len_broadcast 101Key lengths for broadcast keys. 102.It Va wep_key_len_unicast 103Key lengths for unicast keys. 104.It Va wep_rekey_period 105Rekeying period in seconds. 106.It Va eapol_key_index_workaround 107EAPOL-Key index workaround (set bit7) for WinXP Supplicant. 108.It Va eap_reauth_period 109EAP reauthentication period in seconds. 110To disable reauthentication, 111use 112.Dq 0 . 113.\" XXX not yet 114.\" .It Va use_pae_group_addr 115.El 116.\" XXX not yet 117.\" .Sh IEEE 802.11f - IAPP PARAMETERS 118.\" The following parameters are recognized: 119.\" .Bl -tag -width indent 120.\" .It Va iapp_interface 121.\" Interface to be used for IAPP broadcast packets 122.\" .El 123.Sh RADIUS CLIENT PARAMETERS 124The following parameters are recognized: 125.Bl -tag -width indent 126.It Va own_ip_addr 127The own IP address of the access point (used as NAS-IP-Address). 128.It Va nas_identifier 129Optional NAS-Identifier string for RADIUS messages. 130.It Va auth_server_addr , auth_server_port , auth_server_shared_secret 131RADIUS authentication server parameters. 132Can be defined twice for secondary servers to be used if primary one 133does not reply to RADIUS packets. 134.It Va acct_server_addr , acct_server_port , acct_server_shared_secret 135RADIUS accounting server parameters. 136Can be defined twice for secondary servers to be used if primary one 137does not reply to RADIUS packets. 138.It Va radius_retry_primary_interval 139Retry interval for trying to return to the primary RADIUS server (in 140seconds). 141.It Va radius_acct_interim_interval 142Interim accounting update interval. 143If this is set (larger than 0) and acct_server is configured, 144.Xr hostapd 8 145will send interim accounting updates every N seconds. 146.El 147.Sh RADIUS AUTHENTICATION SERVER PARAMETERS 148The following parameters are recognized: 149.Bl -tag -width indent 150.It Va radius_server_clients 151File name of the RADIUS clients configuration for the RADIUS server. 152If this is commented out, RADIUS server is disabled. 153.It Va radius_server_auth_port 154The UDP port number for the RADIUS authentication server. 155.It Va radius_server_ipv6 156Use IPv6 with RADIUS server. 157.El 158.Sh WPA/IEEE 802.11i PARAMETERS 159The following parameters are recognized: 160.Bl -tag -width indent 161.It Va wpa 162Enable WPA. 163Setting this variable configures the AP to require WPA (either 164WPA-PSK or WPA-RADIUS/EAP based on other configuration). 165.It Va wpa_psk , wpa_passphrase 166WPA pre-shared keys for WPA-PSK. 167This can be either entered as a 256-bit secret in hex format (64 hex 168digits), wpa_psk, or as an ASCII passphrase (8..63 characters) that 169will be converted to PSK. 170This conversion uses SSID so the PSK changes when ASCII passphrase is 171used and the SSID is changed. 172.It Va wpa_psk_file 173Optionally, WPA PSKs can be read from a separate text file (containing a 174list of (PSK,MAC address) pairs. 175.It Va wpa_key_mgmt 176Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). 177.It Va wpa_pairwise 178Set of accepted cipher suites (encryption algorithms) for pairwise keys 179(unicast packets). 180See the example file for more information. 181.It Va wpa_group_rekey 182Time interval for rekeying GTK (broadcast/multicast encryption keys) in 183seconds. 184.It Va wpa_strict_rekey 185Rekey GTK when any STA that possesses the current GTK is leaving the 186BSS. 187.It Va wpa_gmk_rekey 188Time interval for rekeying GMK (master key used internally to generate GTKs 189(in seconds). 190.El 191.Sh SEE ALSO 192.Xr hostapd 8 , 193.Xr hostapd_cli 8 194.Sh HISTORY 195The 196.Nm 197manual page and 198.Xr hostapd 8 199functionality first appeared in 200.Fx 6.0 . 201.Sh AUTHORS 202This manual page is derived from the 203.Pa README 204and 205.Pa hostapd.conf 206files in the 207.Nm hostapd 208distribution provided by 209.An Jouni Malinen Aq jkmaline@cc.hut.fi . 210