Advertisement
Guest User

Untitled

a guest
May 15th, 2017
605
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 20.99 KB | None | 0 0
  1. ##### Example wpa_supplicant configuration file ###############################
  2. # Empty lines and lines starting with # are ignored
  3. # NOTE! This file may contain password information and should probably be made
  4. # readable only by root user on multiuser systems.
  5. # global configuration (shared by all network blocks)
  6. #
  7. # Interface for separate control program. If this is specified, wpa_supplicant
  8. # will create this directory and a UNIX domain socket for listening to requests
  9. # from external programs (CLI/GUI, etc.) for status information and
  10. # configuration. The socket file will be named based on the interface name, so
  11. # multiple wpa_supplicant processes can be run at the same time if more than
  12. # one interface is used.
  13. # /var/run/wpa_supplicant is the recommended directory for sockets and by
  14. # default, wpa_cli will use it when trying to connect with wpa_supplicant.
  15. ctrl_interface=/var/run/wpa_supplicant
  16. # Access control for the control interface can be configured by setting the
  17. # directory to allow only members of a group to use sockets. This way, it is
  18. # possible to run wpa_supplicant as root (since it needs to change network
  19. # configuration and open raw sockets) and still allow GUI/CLI components to be
  20. # run as non-root users. However, since the control interface can be used to
  21. # change the network configuration, this access needs to be protected in many
  22. # cases. By default, wpa_supplicant is configured to use gid 0 (root). If you
  23. # want to allow non-root users to use the control interface, add a new group
  24. # and change this value to match with that group. Add users that should have
  25. # control interface access to this group. If this variable is commented out or
  26. # not included in the configuration file, group will not be changed from the
  27. # value it got by default when the directory or socket was created.
  28. #
  29. # This variable can be a group name or gid.
  30. #ctrl_interface_group=wheel
  31. ctrl_interface_group=0
  32. # IEEE 802.1X/EAPOL version
  33. # wpa_supplicant was implemented based on IEEE 802-1X-REV-d8 which defines
  34. # EAPOL version 2. However, there are many APs that do not handle the new
  35. # version number correctly (they seem to drop the frames completely). In order
  36. # to make wpa_supplicant interoperate with these APs, the version number is set
  37. # to 1 by default. This configuration value can be used to set it to the new
  38. # version (2).
  39. eapol_version=1
  40. # AP scanning/selection
  41. # By default, wpa_supplicant requests driver to perform AP scanning and then
  42. # uses the scan results to select a suitable AP. Another alternative is to
  43. # allow the driver to take care of AP scanning and selection and use
  44. # wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association
  45. # information from the driver.
  46. # 1: wpa_supplicant initiates scanning and AP selection
  47. # 0: driver takes care of scanning, AP selection, and IEEE 802.11 association
  48. # parameters (e.g., WPA IE generation); this mode can also be used with
  49. # non-WPA drivers when using IEEE 802.1X mode; do not try to associate with
  50. # APs (i.e., external program needs to control association)
  51. # 2: like 0, but associate with APs using security policy and SSID (but not
  52. # BSSID); this can be used, e.g., with ndiswrapper and NDIS driver to
  53. # enable operation with hidden SSIDs and optimized roaming; in this mode,
  54. # only the first network block in the configuration file is used and this
  55. # configuration should have explicit security policy (i.e., only one option
  56. # in the lists) for key_mgmt, pairwise, group, proto variables
  57. ap_scan=1
  58. # EAP fast re-authentication
  59. # By default, fast re-authentication is enabled for all EAP methods that
  60. # support it. This variable can be used to disable fast re-authentication.
  61. # Normally, there is no need to disable this.
  62. fast_reauth=1
  63. # network block
  64. #
  65. # Each network (usually AP's sharing the same SSID) is configured as a separate
  66. # block in this configuration file. The network blocks are in preference order
  67. # (the first match is used).
  68. #
  69. # network block fields:
  70. #
  71. # ssid: SSID (mandatory); either as an ASCII string with double quotation or
  72. # as hex string; network name
  73. #
  74. # scan_ssid:
  75. # 0 = do not scan this SSID with specific Probe Request frames (default)
  76. # 1 = scan with SSID-specific Probe Request frames (this can be used to
  77. # find APs that do not accept broadcast SSID or use multiple SSIDs;
  78. # this will add latency to scanning, so enable this only when needed)
  79. #
  80. # bssid: BSSID (optional); if set, this network block is used only when
  81. # associating with the AP using the configured BSSID
  82. #
  83. # priority: priority group (integer)
  84. # By default, all networks will get same priority group (0). If some of the
  85. # networks are more desirable, this field can be used to change the order in
  86. # which wpa_supplicant goes through the networks when selecting a BSS. The
  87. # priority groups will be iterated in decreasing priority (i.e., the larger the
  88. # priority value, the sooner the network is matched against the scan results).
  89. # Within each priority group, networks will be selected based on security
  90. # policy, signal strength, etc.
  91. # Please note that AP scanning with scan_ssid=1 is not using this priority to
  92. # select the order for scanning. Instead, it uses the order the networks are in
  93. # the configuration file.
  94. #
  95. # mode: IEEE 802.11 operation mode
  96. # 0 = infrastructure (Managed) mode, i.e., associate with an AP (default)
  97. # 1 = IBSS (ad-hoc, peer-to-peer)
  98. # Note: IBSS can only be used with key_mgmt NONE (plaintext and static WEP)
  99. # and key_mgmt=WPA-NONE (fixed group key TKIP/CCMP). In addition, ap_scan has
  100. # to be set to 2 for IBSS. WPA-None requires following network block options:
  101. # proto=WPA, key_mgmt=WPA-NONE, pairwise=NONE, group=TKIP (or CCMP, but not
  102. # both), and psk must also be set.
  103. #
  104. # proto: list of accepted protocols
  105. # WPA = WPA/IEEE 802.11i/D3.0
  106. # RSN = WPA2/IEEE 802.11i (also WPA2 can be used as an alias for RSN)
  107. # If not set, this defaults to: WPA RSN
  108. #
  109. # key_mgmt: list of accepted authenticated key management protocols
  110. # WPA-PSK = WPA pre-shared key (this requires 'psk' field)
  111. # WPA-EAP = WPA using EAP authentication (this can use an external
  112. # program, e.g., Xsupplicant, for IEEE 802.1X EAP Authentication
  113. # IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
  114. # generated WEP keys
  115. # NONE = WPA is not used; plaintext or static WEP could be used
  116. # If not set, this defaults to: WPA-PSK WPA-EAP
  117. #
  118. # auth_alg: list of allowed IEEE 802.11 authentication algorithms
  119. # OPEN = Open System authentication (required for WPA/WPA2)
  120. # SHARED = Shared Key authentication (requires static WEP keys)
  121. # LEAP = LEAP/Network EAP (only used with LEAP)
  122. # If not set, automatic selection is used (Open System with LEAP enabled if
  123. # LEAP is allowed as one of the EAP methods).
  124. #
  125. # pairwise: list of accepted pairwise (unicast) ciphers for WPA
  126. # CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
  127. # TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
  128. # NONE = Use only Group Keys (deprecated, should not be included if APs support
  129. # pairwise keys)
  130. # If not set, this defaults to: CCMP TKIP
  131. #
  132. # group: list of accepted group (broadcast/multicast) ciphers for WPA
  133. # CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
  134. # TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
  135. # WEP104 = WEP (Wired Equivalent Privacy) with 104-bit key
  136. # WEP40 = WEP (Wired Equivalent Privacy) with 40-bit key [IEEE 802.11]
  137. # If not set, this defaults to: CCMP TKIP WEP104 WEP40
  138. #
  139. # psk: WPA preshared key; 256-bit pre-shared key
  140. # The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e.,
  141. # 32 bytes or as an ASCII passphrase (in which case, the real PSK will be
  142. # generated using the passphrase and SSID). ASCII passphrase must be between
  143. # 8 and 63 characters (inclusive).
  144. # This field is not needed, if WPA-EAP is used.
  145. # Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys
  146. # from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
  147. # startup and reconfiguration time can be optimized by generating the PSK only
  148. # only when the passphrase or SSID has actually changed.
  149. #
  150. # eapol_flags: IEEE 802.1X/EAPOL options (bit field)
  151. # Dynamic WEP key require for non-WPA mode
  152. # bit0 (1): require dynamically generated unicast WEP key
  153. # bit1 (2): require dynamically generated broadcast WEP key
  154. # (3 = require both keys; default)
  155. #
  156. # Following fields are only used with internal EAP implementation.
  157. # eap: space-separated list of accepted EAP methods
  158. # MD5 = EAP-MD5 (unsecure and does not generate keying material ->
  159. # cannot be used with WPA; to be used as a Phase 2 method
  160. # with EAP-PEAP or EAP-TTLS)
  161. # MSCHAPV2 = EAP-MSCHAPv2 (cannot be used separately with WPA; to be used
  162. # as a Phase 2 method with EAP-PEAP or EAP-TTLS)
  163. # OTP = EAP-OTP (cannot be used separately with WPA; to be used
  164. # as a Phase 2 method with EAP-PEAP or EAP-TTLS)
  165. # GTC = EAP-GTC (cannot be used separately with WPA; to be used
  166. # as a Phase 2 method with EAP-PEAP or EAP-TTLS)
  167. # TLS = EAP-TLS (client and server certificate)
  168. # PEAP = EAP-PEAP (with tunnelled EAP authentication)
  169. # TTLS = EAP-TTLS (with tunnelled EAP or PAP/CHAP/MSCHAP/MSCHAPV2
  170. # authentication)
  171. # If not set, all compiled in methods are allowed.
  172. #
  173. # identity: Identity string for EAP
  174. # anonymous_identity: Anonymous identity string for EAP (to be used as the
  175. # unencrypted identity with EAP types that support different tunnelled
  176. # identity, e.g., EAP-TTLS)
  177. # password: Password string for EAP
  178. # ca_cert: File path to CA certificate file. This file can have one or more
  179. # trusted CA certificates. If ca_cert is not included, server certificate
  180. # will not be verified. This is insecure and the CA file should always be
  181. # configured.
  182. # client_cert: File path to client certificate file (PEM/DER)
  183. # private_key: File path to client private key file (PEM/DER/PFX)
  184. # When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
  185. # commented out. Both the private key and certificate will be read from
  186. # the PKCS#12 file in this case.
  187. # private_key_passwd: Password for private key file
  188. # dh_file: File path to DH/DSA parameters file (in PEM format)
  189. # This is an optional configuration file for setting parameters for an
  190. # ephemeral DH key exchange. In most cases, the default RSA
  191. # authentication does not use this configuration. However, it is possible
  192. # setup RSA to use ephemeral DH key exchange. In addition, ciphers with
  193. # DSA keys always use ephemeral DH keys. This can be used to achieve
  194. # forward secrecy. If the file is in DSA parameters format, it will be
  195. # automatically converted into DH params.
  196. # subject_match: Substring to be matched against the subject of the
  197. # authentication server certificate. If this string is set, the server
  198. # sertificate is only accepted if it contains this string in the subject.
  199. # The subject string is in following format:
  200. # /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com
  201. # phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
  202. # (string with field-value pairs, e.g., "peapver=0" or
  203. # "peapver=1 peaplabel=1")
  204. # 'peapver' can be used to force which PEAP version (0 or 1) is used.
  205. # 'peaplabel=1' can be used to force new label, "client PEAP encryption",
  206. # to be used during key derivation when PEAPv1 or newer. Most existing
  207. # PEAPv1 implementation seem to be using the old label, "client EAP
  208. # encryption", and wpa_supplicant is now using that as the default value.
  209. # Some servers, e.g., Radiator, may require peaplabel=1 configuration to
  210. # interoperate with PEAPv1; see eap_testing.txt for more details.
  211. # 'peap_outer_success=0' can be used to terminate PEAP authentication on
  212. # tunneled EAP-Success. This is required with some RADIUS servers that
  213. # implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g.,
  214. # Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode)
  215. # include_tls_length=1 can be used to force wpa_supplicant to include
  216. # TLS Message Length field in all TLS messages even if they are not
  217. # fragmented.
  218. # sim_min_num_chal=3 can be used to configure EAP-SIM to require three
  219. # challenges (by default, it accepts 2 or 3)
  220. # phase2: Phase2 (inner authentication with TLS tunnel) parameters
  221. # (string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
  222. # "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS)
  223. # Following certificate/private key fields are used in inner Phase2
  224. # authentication when using EAP-TTLS or EAP-PEAP.
  225. # ca_cert2: File path to CA certificate file. This file can have one or more
  226. # trusted CA certificates. If ca_cert2 is not included, server
  227. # certificate will not be verified. This is insecure and the CA file
  228. # should always be configured.
  229. # client_cert2: File path to client certificate file
  230. # private_key2: File path to client private key file
  231. # private_key2_passwd: Password for private key file
  232. # dh_file2: File path to DH/DSA parameters file (in PEM format)
  233. # subject_match2: Substring to be matched against the subject of the
  234. # authentication server certificate.
  235. #
  236. # EAP-PSK variables:
  237. # eappsk: 16-byte (128-bit, 32 hex digits) pre-shared key in hex format
  238. # nai: user NAI
  239. # server_nai: authentication server NAI
  240. #
  241. # EAP-FAST variables:
  242. # pac_file: File path for the PAC entries. wpa_supplicant will need to be able
  243. # to create this file and write updates to it when PAC is being
  244. # provisioned or refreshed.
  245. # phase1: fast_provisioning=1 option enables in-line provisioning of EAP-FAST
  246. # credentials (PAC)
  247. #
  248. # wpa_supplicant supports number of "EAP workarounds" to work around
  249. # interoperability issues with incorrectly behaving authentication servers.
  250. # These are enabled by default because some of the issues are present in large
  251. # number of authentication servers. Strict EAP conformance mode can be
  252. # configured by disabling workarounds with eap_workaround=0.
  253. # Example blocks:
  254. # Simple case: WPA-PSK, PSK as an ASCII passphrase, allow all valid ciphers
  255. #network={
  256. # ssid="GST_AP_63"
  257. # psk="1234567890"
  258. # priority=5
  259. # scan_ssid=1
  260. #}
  261. # Same as previous, but request SSID-specific scanning (for APs that reject
  262. # broadcast SSID)
  263. #network={
  264. # ssid="GST_AP_63"
  265. # scan_ssid=1
  266. # psk="1234567890"
  267. # priority=2
  268. #}
  269. # Only WPA-PSK is used. Any valid cipher combination is accepted.
  270. #network={
  271. # ssid="GST_AP_63"
  272. # proto=WPA
  273. # key_mgmt=WPA-PSK
  274. # pairwise=CCMP TKIP
  275. # group=CCMP TKIP WEP104 WEP40
  276. # psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
  277. # priority=2
  278. #}
  279. # Only WPA-EAP is used. Both CCMP and TKIP is accepted. An AP that used WEP104
  280. # or WEP40 as the group cipher will not be accepted.
  281. #network={
  282. # ssid="GST_AP_63"
  283. # proto=RSN # can be WPA?
  284. # key_mgmt=WPA-EAP
  285. # pairwise=CCMP TKIP
  286. # group=CCMP TKIP
  287. # eap=TLS
  288. # identity="user@example.com"
  289. # ca_cert="/etc/cert/ca.pem"
  290. # client_cert="/etc/cert/user.pem"
  291. # private_key="/etc/cert/user.prv"
  292. # private_key_passwd="password"
  293. # priority=1
  294. #}
  295. # EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the old peaplabel
  296. # (e.g., Funk Odyssey and SBR, Meetinghouse Aegis, Interlink PAD-Series)
  297. #network={
  298. # ssid="GST_AP_63"
  299. # key_mgmt=WPA-EAP
  300. # eap=PEAP
  301. # identity="user@example.com"
  302. # password="foobar"
  303. # ca_cert="/etc/cert/ca.pem"
  304. # phase1="peaplabel=0"
  305. # phase2="auth=MSCHAPV2"
  306. # priority=10
  307. #}
  308. # EAP-TTLS/EAP-MD5-Challenge configuration with anonymous identity for the
  309. # unencrypted use. Real identity is sent only within an encrypted TLS tunnel.
  310. #network={
  311. # ssid="GST_AP_63"
  312. # key_mgmt=WPA-EAP
  313. # eap=TTLS
  314. # identity="user@example.com"
  315. # anonymous_identity="anonymous@example.com"
  316. # password="foobar"
  317. # ca_cert="/etc/cert/ca.pem"
  318. # priority=2
  319. #}
  320. # EAP-TTLS/MSCHAPv2 configuration with anonymous identity for the unencrypted
  321. # use. Real identity is sent only within an encrypted TLS tunnel.
  322. #network={
  323. # ssid="GST_AP_63"
  324. # key_mgmt=WPA-EAP
  325. # eap=TTLS
  326. # identity="user@example.com"
  327. # anonymous_identity="anonymous@example.com"
  328. # password="foobar"
  329. # ca_cert="/etc/cert/ca.pem"
  330. # phase2="auth=MSCHAPV2"
  331. #}
  332. # WPA-EAP, EAP-TTLS with different CA certificate used for outer and inner
  333. # authentication.
  334. #network={
  335. # ssid="GST_AP_63"
  336. # key_mgmt=WPA-EAP
  337. # eap=TTLS
  338. # # Phase1 / outer authentication
  339. # anonymous_identity="anonymous@example.com"
  340. # ca_cert="/etc/cert/ca.pem"
  341. # # Phase 2 / inner authentication
  342. # phase2="autheap=TLS"
  343. # ca_cert2="/etc/cert/ca2.pem"
  344. # client_cert2="/etc/cer/user.pem"
  345. # private_key2="/etc/cer/user.prv"
  346. # private_key2_passwd="password"
  347. # priority=2
  348. #}
  349. # Both WPA-PSK and WPA-EAP is accepted. Only CCMP is accepted as pairwise and
  350. # group cipher.
  351. #network={
  352. # ssid="GST_AP_63"
  353. # bssid=00:11:22:33:44:55
  354. # proto=WPA RSN
  355. # key_mgmt=WPA-PSK WPA-EAP
  356. # pairwise=CCMP
  357. # group=CCMP
  358. # psk=06b4be19da289f475aa46a33cb793029d4ab3db7a23ee92382eb0106c72ac7bb
  359. #}
  360. # Special characters in SSID, so use hex string. Default to WPA-PSK, WPA-EAP
  361. # and all valid ciphers.
  362. #network={
  363. # ssid=00010203
  364. # psk=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
  365. #}
  366. # EAP-SIM with a GSM SIM or USIM
  367. #network={
  368. # ssid="eap-sim-test"
  369. # key_mgmt=WPA-EAP
  370. # eap=SIM
  371. # pin="1234"
  372. # pcsc=""
  373. #}
  374. # EAP-PSK
  375. #network={
  376. # ssid="eap-psk-test"
  377. # key_mgmt=WPA-EAP
  378. # eap=PSK
  379. # identity="eap_psk_user"
  380. # eappsk=06b4be19da289f475aa46a33cb793029
  381. # nai="eap_psk_user@example.com"
  382. # server_nai="as@example.com"
  383. #}
  384. # IEEE 802.1X/EAPOL with dynamically generated WEP keys (i.e., no WPA) using
  385. # EAP-TLS for authentication and key generation; require both unicast and
  386. # broadcast WEP keys.
  387. #network={
  388. # ssid="GST_AP_63"
  389. # key_mgmt=IEEE8021X
  390. # eap=TLS
  391. # identity="user@example.com"
  392. # ca_cert="/etc/cert/ca.pem"
  393. # client_cert="/etc/cert/user.pem"
  394. # private_key="/etc/cert/user.prv"
  395. # private_key_passwd="password"
  396. # eapol_flags=3
  397. #}
  398. # LEAP with dynamic WEP keys
  399. #network={
  400. # ssid="leap-example"
  401. # key_mgmt=IEEE8021X
  402. # eap=LEAP
  403. # identity="user"
  404. # password="foobar"
  405. #}
  406. # EAP-FAST with WPA (WPA or WPA2)
  407. #network={
  408. # ssid="eap-fast-test"
  409. # key_mgmt=WPA-EAP
  410. # eap=FAST
  411. # anonymous_identity="FAST-000102030405"
  412. # identity="username"
  413. # password="password"
  414. # phase1="fast_provisioning=1"
  415. # pac_file="/etc/wpa_supplicant.eap-fast-pac"
  416. #}
  417. # Plaintext connection (no WPA, no IEEE 802.1X)
  418. #network={
  419. # ssid="GST_AP_63"
  420. # key_mgmt=NONE
  421. #}
  422. # Shared WEP key connection (no WPA, no IEEE 802.1X)
  423. #network={
  424. # ssid="GST_AP_63"
  425. # key_mgmt=NONE
  426. # wep_key0="abcde"
  427. # wep_key1=0102030405
  428. # wep_key2="1234567890123"
  429. # wep_tx_keyidx=0
  430. # priority=5
  431. #}
  432. # Shared WEP key connection (no WPA, no IEEE 802.1X) using Shared Key
  433. # IEEE 802.11 authentication
  434. #network={
  435. # ssid="GST_AP_63"
  436. # key_mgmt=NONE
  437. # wep_key0="abcde"
  438. # wep_key1=0102030405
  439. # wep_key2="1234567890123"
  440. # wep_tx_keyidx=0
  441. # priority=5
  442. # auth_alg=SHARED
  443. #}
  444. # IBSS/ad-hoc network with WPA-None/TKIP.
  445. #network={
  446. # ssid="test adhoc"
  447. # mode=1
  448. # proto=WPA
  449. # key_mgmt=WPA-NONE
  450. # pairwise=NONE
  451. # group=TKIP
  452. # psk="secret passphrase"
  453. #}
  454. # Catch all example that allows more or less all configuration modes
  455. #network={
  456. # ssid="GST_AP_63"
  457. # scan_ssid=1
  458. # key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
  459. # pairwise=CCMP TKIP
  460. # group=CCMP TKIP WEP104 WEP40
  461. # psk="very secret passphrase"
  462. # eap=TTLS PEAP TLS
  463. # identity="user@example.com"
  464. # password="foobar"
  465. # ca_cert="/etc/cert/ca.pem"
  466. # client_cert="/etc/cert/user.pem"
  467. # private_key="/etc/cert/user.prv"
  468. # private_key_passwd="password"
  469. # phase1="peaplabel=0"
  470. #}
  471. # LEAP plus Network EAP.
  472. #network={
  473. # ssid="GST_AP_61"
  474. # scan_ssid=1
  475. # key_mgmt=IEEE8021X
  476. # pairwise=NONE
  477. # group=WEP40
  478. # eap=LEAP
  479. # auth_alg=LEAP #(could be set to OPEN or SHARED)
  480. # identity="user"
  481. # password="password"
  482. #}
  483. network={
  484. ssid="mamalala"
  485. scan_ssid=1
  486. proto=WPA
  487. key_mgmt=WPA-PSK
  488. pairwise=TKIP
  489. group=TKIP
  490. psk="minkimizisheelatwiggy"
  491. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement