1.\" Copyright (c) 2005 Sam Leffler <sam@errno.com> 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD$ 26.\" 27.Dd February 14, 2006 28.Dt WPA_SUPPLICANT.CONF 5 29.Os 30.Sh NAME 31.Nm wpa_supplicant.conf 32.Nd configuration file for 33.Xr wpa_supplicant 8 34.Sh DESCRIPTION 35The 36.Xr wpa_supplicant 8 37utility is an implementation of the WPA Supplicant component, 38i.e., the part that runs in the client stations. 39It implements WPA key negotiation with a WPA Authenticator 40and EAP authentication with Authentication Server using 41configuration information stored in a text file. 42.Pp 43The configuration file consists of optional global parameter 44settings and one or more network blocks, e.g.\& 45one for each used SSID. 46The 47.Xr wpa_supplicant 8 48utility 49will automatically select the best network based on the order of 50the network blocks in the configuration file, network security level 51(WPA/WPA2 is preferred), and signal strength. 52Comments are indicated with the 53.Ql # 54character; all text to the 55end of the line will be ignored. 56.Sh GLOBAL PARAMETERS 57Default parameters used by 58.Xr wpa_supplicant 8 59may be overridden by specifying 60.Pp 61.Dl parameter=value 62.Pp 63in the configuration file (note no spaces are allowed). 64Values with embedded spaces must be enclosed in quote marks. 65.Pp 66The following parameters are recognized: 67.Bl -tag -width indent 68.It Va ctrl_interface 69The pathname of the directory in which 70.Xr wpa_supplicant 8 71creates 72.Ux 73domain socket files for communication 74with frontend programs such as 75.Xr wpa_cli 8 . 76.It Va ctrl_interface_group 77A group name or group ID to use in setting protection on the 78control interface file. 79This can be set to allow non-root users to access the 80control interface files. 81If no group is specified, the group ID of the control interface 82is not modified and will, typically, be the 83group ID of the directory in which the socket is created. 84.It Va eapol_version 85The IEEE 802.1x/EAPOL protocol version to use; either 1 (default) or 2. 86The 87.Xr wpa_supplicant 8 88utility 89is implemented according to IEEE 802-1X-REV-d8 which defines 90EAPOL version to be 2. 91However, some access points do not work when presented with 92this version so by default 93.Xr wpa_supplicant 8 94will announce that it is using EAPOL version 1. 95If version 2 must be announced for correct operation with an 96access point, this value may be set to 2. 97.It Va ap_scan 98Access point scanning and selection control; one of 0, 1 (default), or 2. 99Only setting 1 should be used with the 100.Xr wlan 4 101module; the other settings are for use on other operating systems. 102.It Va fast_reauth 103EAP fast re-authentication; either 1 (default) or 0. 104Control fast re-authentication support in EAP methods that support it. 105.El 106.Sh NETWORK BLOCKS 107Each potential network/access point should have a 108.Dq "network block" 109that describes how to identify it and how to set up security. 110When multiple network blocks are listed in a configuration file, 111the highest priority one is selected for use or, if multiple networks 112with the same priority are identified, the first one listed in the 113configuration file is used. 114.Pp 115A network block description is of the form: 116.Bd -literal -offset indent 117network={ 118 parameter=value 119 ... 120} 121.Ed 122.Pp 123(note the leading 124.Qq Li "network={" 125may have no spaces). 126The block specification contains one or more parameters 127from the following list: 128.Bl -tag -width indent 129.It Va ssid No (required) 130Network name (as announced by the access point). 131An 132.Tn ASCII 133or hex string enclosed in quotation marks. 134.It Va scan_ssid 135SSID scan technique; 0 (default) or 1. 136Technique 0 scans for the SSID using a broadcast Probe Request 137frame while 1 uses a directed Probe Request frame. 138Access points that cloak themselves by not broadcasting their SSID 139require technique 1, but beware that this scheme can cause scanning 140to take longer to complete. 141.It Va bssid 142Network BSSID (typically the MAC address of the access point). 143.It Va priority 144The priority of a network when selecting among multiple networks; 145a higher value means a network is more desirable. 146By default networks have priority 0. 147When multiple networks with the same priority are considered 148for selection, other information such as security policy and 149signal strength are used to select one. 150.It Va mode 151IEEE 802.11 operation mode; either 0 (infrastructure, default) or 1 (IBSS). 152Note that IBSS (adhoc) mode can only be used with 153.Va key_mgmt 154set to 155.Li NONE 156(plaintext and static WEP). 157.It Va proto 158List of acceptable protocols; one or more of: 159.Li WPA 160(IEEE 802.11i/D3.0) 161and 162.Li RSN 163(IEEE 802.11i). 164.Li WPA2 165is another name for 166.Li RSN . 167If not set this defaults to 168.Qq Li "WPA RSN" . 169.It Va key_mgmt 170List of acceptable key management protocols; one or more of: 171.Li WPA-PSK 172(WPA pre-shared key), 173.Li WPA-EAP 174(WPA using EAP authentication), 175.Li IEEE8021X 176(IEEE 802.1x using EAP authentication and, 177optionally, dynamically generated WEP keys), 178.Li NONE 179(plaintext or static WEP keys). 180If not set this defaults to 181.Qq Li "WPA-PSK WPA-EAP" . 182.It Va auth_alg 183List of allowed IEEE 802.11 authentication algorithms; one or more of: 184.Li OPEN 185(Open System authentication, required for WPA/WPA2), 186.Li SHARED 187(Shared Key authentication), 188.Li LEAP 189(LEAP/Network EAP). 190If not set automatic selection is used (Open System with LEAP 191enabled if LEAP is allowed as one of the EAP methods). 192.It Va pairwise 193List of acceptable pairwise (unicast) ciphers for WPA; one or more of: 194.Li CCMP 195(AES in Counter mode with CBC-MAC, RFC 3610, IEEE 802.11i/D7.0), 196.Li TKIP 197(Temporal Key Integrity Protocol, IEEE 802.11i/D7.0), 198.Li NONE 199(deprecated). 200If not set this defaults to 201.Qq Li "CCMP TKIP" . 202.It Va group 203List of acceptable group (multicast) ciphers for WPA; one or more of: 204.Li CCMP 205(AES in Counter mode with CBC-MAC, RFC 3610, IEEE 802.11i/D7.0), 206.Li TKIP 207(Temporal Key Integrity Protocol, IEEE 802.11i/D7.0), 208.Li WEP104 209(WEP with 104-bit key), 210.Li WEP40 211(WEP with 40-bit key). 212If not set this defaults to 213.Qq Li "CCMP TKIP WEP104 WEP40" . 214.It Va psk 215WPA preshared key used in WPA-PSK mode. 216The key is specified as 64 hex digits or as 217an 8-63 character 218.Tn ASCII 219passphrase. 220.Tn ASCII 221passphrases are converted to a 256-bit key using the network SSID. 222.It Va eapol_flags 223Dynamic WEP key usage for non-WPA mode, specified as a bit field. 224Bit 0 (1) forces dynamically generated unicast WEP keys to be used. 225Bit 1 (2) forces dynamically generated broadcast WEP keys to be used. 226By default this is set to 3 (use both). 227.It Va eap 228List of acceptable EAP methods; one or more of: 229.Li MD5 230(EAP-MD5, cannot be used with WPA, 231used only as a Phase 2 method with EAP-PEAP or EAP-TTLS), 232.Li MSCHAPV2 233(EAP-MSCHAPV2, cannot be used with WPA; 234used only as a Phase 2 method with EAP-PEAP or EAP-TTLS), 235.Li OTP 236(EAP-OTP, cannot be used with WPA; 237used only as a Phase 2 metod with EAP-PEAP or EAP-TTLS), 238.Li GTC 239(EAP-GTC, cannot be used with WPA; 240used only as a Phase 2 metod with EAP-PEAP or EAP-TTLS), 241.Li TLS 242(EAP-TLS, client and server certificate), 243.Li PEAP 244(EAP-PEAP, with tunneled EAP authentication), 245.Li TTLS 246(EAP-TTLS, with tunneled EAP or PAP/CHAP/MSCHAP/MSCHAPV2 authentication). 247If not set this defaults to all available methods compiled in to 248.Xr wpa_supplicant 8 . 249Note that by default 250.Xr wpa_supplicant 8 251is compiled with EAP support; see 252.Xr make.conf 5 253for the 254.Va NO_WPA_SUPPLICANT_EAPOL 255configuration variable that can be used to disable EAP support. 256.It Va identity 257Identity string for EAP. 258.It Va anonymous_identity 259Anonymous identity string for EAP (to be used as the unencrypted identity 260with EAP types that support different tunneled identities; e.g.\& EAP-TTLS). 261.It Va password 262Password string for EAP. 263.It Va ca_cert 264Pathname to CA certificate file. 265This file can have one or more trusted CA certificates. 266If 267.Va ca_cert 268is not included, server certificates will not be verified (not recommended). 269.It Va client_cert 270Pathname to client certificate file (PEM/DER). 271.It Va private_key 272Pathname to a client private key file (PEM/DER/PFX). 273When a PKCS#12/PFX file is used, then 274.Va client_cert 275should not be specified as both the private key and certificate will be 276read from PKCS#12 file. 277.It Va private_key_passwd 278Password for any private key file. 279.It Va dh_file 280Pathname to a file holding DH/DSA parameters (in PEM format). 281This file holds parameters for an ephemeral DH key exchange. 282In most cases, the default RSA authentication does not use this configuration. 283However, it is possible to set up RSA to use an ephemeral DH key exchange. 284In addition, ciphers with 285DSA keys always use ephemeral DH keys. 286This can be used to achieve forward secrecy. 287If the 288.Va dh_file 289is in DSA parameters format, it will be automatically converted 290into DH params. 291.It Va subject_match 292Substring to be matched against the subject of the 293authentication server certificate. 294If this string is set, the server 295certificate is only accepted if it contains this string in the subject. 296The subject string is in following format: 297.Pp 298.Dl "/C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com" 299.It Va phase1 300Phase1 (outer authentication, i.e., TLS tunnel) parameters 301(string with field-value pairs, e.g., 302.Qq Li peapver=0 303or 304.Qq Li "peapver=1 peaplabel=1" ) . 305.Bl -inset 306.It Li peapver 307can be used to force which PEAP version (0 or 1) is used. 308.It Li peaplabel=1 309can be used to force new label, 310.Dq "client PEAP encryption" , 311to be used during key derivation when PEAPv1 or newer. 312Most existing PEAPv1 implementations seem to be using the old label, 313.Dq Li "client EAP encryption" , 314and 315.Xr wpa_supplicant 8 316is now using that as the 317default value. 318Some servers, e.g., 319.Tn Radiator , 320may require 321.Li peaplabel=1 322configuration to interoperate with PEAPv1; see 323.Pa eap_testing.txt 324for more details. 325.It Li peap_outer_success=0 326can be used to terminate PEAP authentication on 327tunneled EAP-Success. 328This is required with some RADIUS servers that 329implement 330.Pa draft-josefsson-pppext-eap-tls-eap-05.txt 331(e.g., 332.Tn Lucent NavisRadius v4.4.0 333with PEAP in 334.Dq "IETF Draft 5" 335mode). 336.It Li include_tls_length=1 337can be used to force 338.Xr wpa_supplicant 8 339to include 340TLS Message Length field in all TLS messages even if they are not 341fragmented. 342.It Li sim_min_num_chal=3 343can be used to configure EAP-SIM to require three 344challenges (by default, it accepts 2 or 3) 345.It Li fast_provisioning=1 346option enables in-line provisioning of EAP-FAST 347credentials (PAC). 348.El 349.It Va phase2 350phase2: Phase2 (inner authentication with TLS tunnel) parameters 351(string with field-value pairs, e.g., 352.Qq Li "auth=MSCHAPV2" 353for EAP-PEAP or 354.Qq Li "autheap=MSCHAPV2 autheap=MD5" 355for EAP-TTLS). 356.It Va ca_cert2 357Like 358.Va ca_cert 359but for EAP inner Phase 2. 360.It Va client_cert2 361Like 362.Va client_cert 363but for EAP inner Phase 2. 364.It Va private_key2 365Like 366.Va private_key 367but for EAP inner Phase 2. 368.It Va private_key2_passwd 369Like 370.Va private_key_passwd 371but for EAP inner Phase 2. 372.It Va dh_file2 373Like 374.Va dh_file 375but for EAP inner Phase 2. 376.It Va subject_match2 377Like 378.Va subject_match 379but for EAP inner Phase 2. 380.It Va eappsk 38116-byte pre-shared key in hex format for use with EAP-PSK. 382.It Va nai 383User NAI for use with EAP-PSK. 384.It Va server_nai 385Authentication Server NAI for use with EAP-PSK. 386.It Va pac_file 387Pathname to the file to use for PAC entries with EAP-FAST. 388The 389.Xr wpa_supplicant 8 390utility 391must be able to create this file and write updates to it when 392PAC is being provisioned or refreshed. 393.It Va eap_workaround 394Enable/disable EAP workarounds for various interoperability issues 395with misbehaving authentication servers. 396By default these workarounds are enabled. 397String EAP conformance can be configured by setting this to 0. 398.El 399.Sh CERTIFICATES 400Some EAP authentication methods require use of certificates. 401EAP-TLS uses both server- and client-side certificates, 402whereas EAP-PEAP and EAP-TTLS only require a server-side certificate. 403When a client certificate is used, a matching private key file must 404also be included in configuration. 405If the private key uses a passphrase, this 406has to be configured in the 407.Nm 408file as 409.Va private_key_passwd . 410.Pp 411The 412.Xr wpa_supplicant 8 413utility 414supports X.509 certificates in PEM and DER formats. 415User certificate and private key can be included in the same file. 416.Pp 417If the user certificate and private key is received in PKCS#12/PFX 418format, they need to be converted to a suitable PEM/DER format for 419use by 420.Xr wpa_supplicant 8 . 421This can be done using the 422.Xr openssl 1 423program, e.g.\& with the following commands: 424.Bd -literal 425# convert client certificate and private key to PEM format 426openssl pkcs12 -in example.pfx -out user.pem -clcerts 427# convert CA certificate (if included in PFX file) to PEM format 428openssl pkcs12 -in example.pfx -out ca.pem -cacerts -nokeys 429.Ed 430.Sh EXAMPLES 431WPA-Personal (PSK) as a home network and WPA-Enterprise with EAP-TLS 432as a work network: 433.Bd -literal 434# allow frontend (e.g., wpa_cli) to be used by all users in 'wheel' group 435ctrl_interface=/var/run/wpa_supplicant 436ctrl_interface_group=wheel 437# 438# home network; allow all valid ciphers 439network={ 440 ssid="home" 441 scan_ssid=1 442 key_mgmt=WPA-PSK 443 psk="very secret passphrase" 444} 445# 446# work network; use EAP-TLS with WPA; allow only CCMP and TKIP ciphers 447network={ 448 ssid="work" 449 scan_ssid=1 450 key_mgmt=WPA-EAP 451 pairwise=CCMP TKIP 452 group=CCMP TKIP 453 eap=TLS 454 identity="user@example.com" 455 ca_cert="/etc/cert/ca.pem" 456 client_cert="/etc/cert/user.pem" 457 private_key="/etc/cert/user.prv" 458 private_key_passwd="password" 459} 460.Ed 461.Pp 462WPA-RADIUS/EAP-PEAP/MSCHAPv2 with RADIUS servers that use old peaplabel 463(e.g., Funk Odyssey and SBR, Meetinghouse Aegis, Interlink RAD-Series): 464.Bd -literal 465ctrl_interface=/var/run/wpa_supplicant 466ctrl_interface_group=wheel 467network={ 468 ssid="example" 469 scan_ssid=1 470 key_mgmt=WPA-EAP 471 eap=PEAP 472 identity="user@example.com" 473 password="foobar" 474 ca_cert="/etc/cert/ca.pem" 475 phase1="peaplabel=0" 476 phase2="auth=MSCHAPV2" 477} 478.Ed 479.Pp 480EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the 481unencrypted use. 482Real identity is sent only within an encrypted TLS tunnel. 483.Bd -literal 484ctrl_interface=/var/run/wpa_supplicant 485ctrl_interface_group=wheel 486network={ 487 ssid="example" 488 scan_ssid=1 489 key_mgmt=WPA-EAP 490 eap=TTLS 491 identity="user@example.com" 492 anonymous_identity="anonymous@example.com" 493 password="foobar" 494 ca_cert="/etc/cert/ca.pem" 495 phase2="auth=MD5" 496} 497.Ed 498.Pp 499Traditional WEP configuration with 104 bit key specified in hexadecimal. 500Note the WEP key is not quoted. 501.Bd -literal 502ctrl_interface=/var/run/wpa_supplicant 503ctrl_interface_group=wheel 504network={ 505 ssid="example" 506 scan_ssid=1 507 key_mgmt=NONE 508 wep_tx_keyidx=0 509 wep_key0=42FEEDDEAFBABEDEAFBEEFAA55 510} 511.Ed 512.Sh SEE ALSO 513.Xr wpa_cli 8 , 514.Xr wpa_supplicant 8 515.Sh HISTORY 516The 517.Nm 518manual page and 519.Xr wpa_supplicant 8 520functionality first appeared in 521.Fx 6.0 . 522.Sh AUTHORS 523This manual page is derived from the 524.Pa README 525and 526.Pa wpa_supplicant.conf 527files in the 528.Nm wpa_supplicant 529distribution provided by 530.An Jouni Malinen Aq jkmaline@cc.hut.fi . 531