Please note: This project is no longer active. The website is kept online for historic purposes only.
If you´re looking for a Linux driver for your Atheros WLAN device, you should continue here .

Ticket #191: hostapd-ath0.conf

File hostapd-ath0.conf, 10.0 kB (added by dimitris@NoGSMaiPaml.com, 14 years ago)

WPA-PSK hostapd config

Line 
1 interface=ath0
2
3 driver=madwifi
4
5 logger_syslog=-1
6
7 logger_syslog_level=2
8
9 logger_stdout=-1
10
11 logger_stdout_level=2
12
13 debug=0
14
15 dump_file=/tmp/hostapd.dump
16
17 ctrl_interface=/var/run/hostapd
18
19 ctrl_interface_group=0
20
21 ssid=whirlpool
22
23 # 0 = accept unless in deny list
24 # 1 = deny unless in accept list
25 # 2 = use external RADIUS server (accept/deny lists are searched first)
26 macaddr_acl=0
27
28 #accept_mac_file=/etc/hostapd/accept
29 #deny_mac_file=/etc/hostapd/deny
30
31 # IEEE 802.11 specifies two authentication algorithms. hostapd can be
32 # configured to allow both of these or only one. Open system authentication
33 # should be used with IEEE 802.1X.
34 # Bit fields of allowed authentication algorithms:
35 # bit 0 = Open System Authentication
36 # bit 1 = Shared Key Authentication (requires WEP)
37 auth_algs=3
38
39 ##### IEEE 802.1X-REV related configuration ###################################
40
41 # Require IEEE 802.1X authorization
42 #ieee8021x=1
43
44 # Optional displayable message sent with EAP Request-Identity. The first \0
45 # in this string will be converted to ASCII-0 (nul). This can be used to
46 # separate network info (comma separated list of attribute=value pairs); see,
47 # e.g., draft-adrangi-eap-network-discovery-07.txt.
48 #eap_message=hello
49 #eap_message=hello\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com
50
51 # WEP rekeying (disabled if key lengths are not set or are set to 0)
52 # Key lengths for default/broadcast and individual/unicast keys:
53 # 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
54 # 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
55 #wep_key_len_broadcast=5
56 #wep_key_len_unicast=5
57 # Rekeying period in seconds. 0 = do not rekey (i.e., set keys only once)
58 #wep_rekey_period=300
59
60 # EAPOL-Key index workaround (set bit7) for WinXP Supplicant (needed only if
61 # only broadcast keys are used)
62 eapol_key_index_workaround=0
63
64 # EAP reauthentication period in seconds (default: 3600 seconds; 0 = disable
65 # reauthentication).
66 #eap_reauth_period=3600
67
68
69 ##### Integrated EAP server ###################################################
70
71 # Optionally, hostapd can be configured to use an integrated EAP server
72 # to process EAP authentication locally without need for an external RADIUS
73 # server. This functionality can be used both as a local authentication server
74 # for IEEE 802.1X/EAPOL and as a RADIUS server for other devices.
75
76 # Use integrated EAP server instead of external RADIUS authentication
77 # server. This is also needed if hostapd is configured to act as a RADIUS
78 # authentication server.
79 eap_server=0
80
81 # Path for EAP server user database
82 #eap_user_file=/etc/hostapd/eap_user
83
84 # CA certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
85 #ca_cert=/etc/hostapd/ca.pem
86
87 # Server certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
88 #server_cert=/etc/hostapd/server.pem
89
90 # Private key matching with the server certificate for EAP-TLS/PEAP/TTLS
91 # This may point to the same file as server_cert if both certificate and key
92 # are included in a single file. PKCS#12 (PFX) file (.p12/.pfx) can also be
93 # used by commenting out server_cert and specifying the PFX file as the
94 # private_key.
95 #private_key=/etc/hostapd/server.prv
96
97 # Passphrase for private key
98 #private_key_passwd=secret passphrase
99
100 # Enable CRL verification.
101 # Note: hostapd does not yet support CRL downloading based on CDP. Thus, a
102 # valid CRL signed by the CA is required to be included in the ca_cert file.
103 # This can be done by using PEM format for CA certificate and CRL and
104 # concatenating these into one file. Whenever CRL changes, hostapd needs to be
105 # restarted to take the new CRL into use.
106 # 0 = do not verify CRLs (default)
107 # 1 = check the CRL of the user certificate
108 # 2 = check all CRLs in the certificate path
109 #check_crl=1
110
111 # Configuration data for EAP-SIM database/authentication gateway interface.
112 # This is a text string in implementation specific format. The example
113 # implementation in eap_sim_db.c uses this as the file name for the GSM
114 # authentication triplets.
115 #eap_sim_db=/etc/hostapd/sim_db
116
117
118 ##### IEEE 802.11f - Inter-Access Point Protocol (IAPP) #######################
119
120 # Interface to be used for IAPP broadcast packets
121 #iapp_interface=eth0
122
123
124 ##### RADIUS client configuration #############################################
125 # for IEEE 802.1X with external Authentication Server, IEEE 802.11
126 # authentication with external ACL for MAC addresses, and accounting
127
128 # The own IP address of the access point (used as NAS-IP-Address)
129 own_ip_addr=192.168.2.1
130
131 # Optional NAS-Identifier string for RADIUS messages. When used, this should be
132 # a unique to the NAS within the scope of the RADIUS server. For example, a
133 # fully qualified domain name can be used here.
134 #nas_identifier=ap.example.com
135
136 # RADIUS authentication server
137 #auth_server_addr=127.0.0.1
138 #auth_server_port=1812
139 #auth_server_shared_secret=secret
140
141 # RADIUS accounting server
142 #acct_server_addr=127.0.0.1
143 #acct_server_port=1813
144 #acct_server_shared_secret=secret
145
146 # Secondary RADIUS servers; to be used if primary one does not reply to
147 # RADIUS packets. These are optional and there can be more than one secondary
148 # server listed.
149 #auth_server_addr=127.0.0.2
150 #auth_server_port=1812
151 #auth_server_shared_secret=secret2
152 #
153 #acct_server_addr=127.0.0.2
154 #acct_server_port=1813
155 #acct_server_shared_secret=secret2
156
157 # Retry interval for trying to return to the primary RADIUS server (in
158 # seconds). RADIUS client code will automatically try to use the next server
159 # when the current server is not replying to requests. If this interval is set,
160 # primary server will be retried after configured amount of time even if the
161 # currently used secondary server is still working.
162 #radius_retry_primary_interval=600
163
164
165 # Interim accounting update interval
166 # If this is set (larger than 0) and acct_server is configured, hostapd will
167 # send interim accounting updates every N seconds. Note: if set, this overrides
168 # possible Acct-Interim-Interval attribute in Access-Accept message. Thus, this
169 # value should not be configured in hostapd.conf, if RADIUS server is used to
170 # control the interim interval.
171 # This value should not be less 600 (10 minutes) and must not be less than
172 # 60 (1 minute).
173 #radius_acct_interim_interval=600
174
175
176 ##### RADIUS authentication server configuration ##############################
177
178 # hostapd can be used as a RADIUS authentication server for other hosts. This
179 # requires that the integrated EAP authenticator is also enabled and both
180 # authentication services are sharing the same configuration.
181
182 # File name of the RADIUS clients configuration for the RADIUS server. If this
183 # commented out, RADIUS server is disabled.
184 #radius_server_clients=/etc/hostapd/radius_clients
185
186 # The UDP port number for the RADIUS authentication server
187 #radius_server_auth_port=1812
188
189 # Use IPv6 with RADIUS server (IPv4 will also be supported using IPv6 API)
190 #radius_server_ipv6=1
191
192
193 ##### WPA/IEEE 802.11i configuration ##########################################
194
195 # Enable WPA. Setting this variable configures the AP to require WPA (either
196 # WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either
197 # wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK.
198 # For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
199 # RADIUS authentication server must be configured, and WPA-EAP must be included
200 # in wpa_key_mgmt.
201 # This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0)
202 # and/or WPA2 (full IEEE 802.11i/RSN):
203 # bit0 = WPA
204 # bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
205 wpa=1
206
207 # WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
208 # secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
209 # (8..63 characters) that will be converted to PSK. This conversion uses SSID
210 # so the PSK changes when ASCII passphrase is used and the SSID is changed.
211 # wpa_psk (dot11RSNAConfigPSKValue)
212 # wpa_passphrase (dot11RSNAConfigPSKPassPhrase)
213 wpa_psk=<psk>
214 #wpa_passphrase=secret passphrase
215
216 # Optionally, WPA PSKs can be read from a separate text file (containing list
217 # of (PSK,MAC address) pairs. This allows more than one PSK to be configured.
218 # Use absolute path name to make sure that the files can be read on SIGHUP
219 # configuration reloads.
220 #wpa_psk_file=/etc/hostapd/wpa_psk
221
222 # Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
223 # entries are separated with a space.
224 # (dot11RSNAConfigAuthenticationSuitesTable)
225 #wpa_key_mgmt=WPA-PSK WPA-EAP
226 wpa_key_mgmt=WPA-PSK
227
228 # Set of accepted cipher suites (encryption algorithms) for pairwise keys
229 # (unicast packets). This is a space separated list of algorithms:
230 # CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
231 # TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
232 # Group cipher suite (encryption algorithm for broadcast and multicast frames)
233 # is automatically selected based on this configuration. If only CCMP is
234 # allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
235 # TKIP will be used as the group cipher.
236 # (dot11RSNAConfigPairwiseCiphersTable)
237 #wpa_pairwise=TKIP CCMP
238 wpa_pairwise=CCMP
239
240 # Time interval for rekeying GTK (broadcast/multicast encryption keys) in
241 # seconds. (dot11RSNAConfigGroupRekeyTime)
242 #wpa_group_rekey=600
243
244 # Rekey GTK when any STA that possesses the current GTK is leaving the BSS.
245 # (dot11RSNAConfigGroupRekeyStrict)
246 #wpa_strict_rekey=1
247
248 # Time interval for rekeying GMK (master key used internally to generate GTKs
249 # (in seconds).
250 #wpa_gmk_rekey=86400
251
252 # Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
253 # roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
254 # authentication and key handshake before actually associating with a new AP.
255 # (dot11RSNAPreauthenticationEnabled)
256 #rsn_preauth=1
257 #
258 # Space separated list of interfaces from which pre-authentication frames are
259 # accepted (e.g., 'eth0' or 'eth0 wlan0wds0'. This list should include all
260 # interface that are used for connections to other APs. This could include
261 # wired interfaces and WDS links. The normal wireless data interface towards
262 # associated stations (e.g., wlan0) should not be added, since
263 # pre-authentication is only used with APs other than the currently associated
264 # one.
265 #rsn_preauth_interfaces=eth0