.\" This manpage has been automatically generated by docbook2man .\" from a DocBook document.  This tool can be found at:.\" <http://shell.ipoline.com/~elmert/comp/docbook2X/> .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng <steve@ggi-project.org>..TH "WPA_SUPPLICANT.CONF" "5" "06 May 2006" "" "".SH NAMEwpa_supplicant.conf \- configuration file for wpa_supplicant.SH "OVERVIEW".PP\fBwpa_supplicant\fR is configured using a textfile that lists all accepted networks and security policies,including pre-shared keys. See the example configuration file,probably in \fB/usr/share/doc/wpa_supplicant/\fR, fordetailed information about the configuration format and supportedfields..PPAll file paths in this configuration file should use full(absolute, not relative to working directory) path in order to allowworking directory to be changed. This can happen if wpa_supplicant isrun in the background..PPChanges to configuration file can be reloaded be sendingSIGHUP signal to \fBwpa_supplicant\fR ('killall -HUPwpa_supplicant'). Similarly, reloading can be triggered with'wpa_cli reconfigure' command..PPConfiguration file can include one or more network blocks,e.g., one for each used SSID. wpa_supplicant will automaticallyselect the best betwork based on the order of network blocks inthe configuration file, network security level (WPA/WPA2 isprefered), and signal strength..SH "QUICK EXAMPLES".TP 31. WPA-Personal (PSK) as home network and WPA-Enterprise withEAP-TLS as work network..sp.RS.nf# allow frontend (e.g., wpa_cli) to be used by all users in 'wheel' groupctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheel## home network; allow all valid ciphersnetwork={	ssid="home"	scan_ssid=1	key_mgmt=WPA-PSK	psk="very secret passphrase"}## work network; use EAP-TLS with WPA; allow only CCMP and TKIP ciphersnetwork={	ssid="work"	scan_ssid=1	key_mgmt=WPA-EAP	pairwise=CCMP TKIP	group=CCMP TKIP	eap=TLS	identity="user@example.com"	ca_cert="/etc/cert/ca.pem"	client_cert="/etc/cert/user.pem"	private_key="/etc/cert/user.prv"	private_key_passwd="password"}.fi.RE.TP 32. WPA-RADIUS/EAP-PEAP/MSCHAPv2 with RADIUS servers thatuse old peaplabel (e.g., Funk Odyssey and SBR, MeetinghouseAegis, Interlink RAD-Series).sp.RS.nfctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheelnetwork={	ssid="example"	scan_ssid=1	key_mgmt=WPA-EAP	eap=PEAP	identity="user@example.com"	password="foobar"	ca_cert="/etc/cert/ca.pem"	phase1="peaplabel=0"	phase2="auth=MSCHAPV2"}.fi.RE.TP 33. EAP-TTLS/EAP-MD5-Challenge configuration with anonymousidentity for the unencrypted use. Real identity is sent onlywithin an encrypted TLS tunnel..sp.RS.nfctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheelnetwork={	ssid="example"	scan_ssid=1	key_mgmt=WPA-EAP	eap=TTLS	identity="user@example.com"	anonymous_identity="anonymous@example.com"	password="foobar"	ca_cert="/etc/cert/ca.pem"	phase2="auth=MD5"}.fi.RE.TP 34. IEEE 802.1X (i.e., no WPA) with dynamic WEP keys(require both unicast and broadcast); use EAP-TLS forauthentication.sp.RS.nfctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheelnetwork={	ssid="1x-test"	scan_ssid=1	key_mgmt=IEEE8021X	eap=TLS	identity="user@example.com"	ca_cert="/etc/cert/ca.pem"	client_cert="/etc/cert/user.pem"	private_key="/etc/cert/user.prv"	private_key_passwd="password"	eapol_flags=3}.fi.RE.TP 35. Catch all example that allows more or less allconfiguration modes. The configuration options are used basedon what security policy is used in the selected SSID. This ismostly for testing and is not recommended for normaluse..sp.RS.nfctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheelnetwork={	ssid="example"	scan_ssid=1	key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE	pairwise=CCMP TKIP	group=CCMP TKIP WEP104 WEP40	psk="very secret passphrase"	eap=TTLS PEAP TLS	identity="user@example.com"	password="foobar"	ca_cert="/etc/cert/ca.pem"	client_cert="/etc/cert/user.pem"	private_key="/etc/cert/user.prv"	private_key_passwd="password"	phase1="peaplabel=0"	ca_cert2="/etc/cert/ca2.pem"	client_cert2="/etc/cer/user.pem"	private_key2="/etc/cer/user.prv"	private_key2_passwd="password"}.fi.RE.TP 36. Authentication for wired Ethernet. This can be used with'wired' interface (-Dwired on command line)..sp.RS.nfctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheelap_scan=0network={	key_mgmt=IEEE8021X	eap=MD5	identity="user"	password="password"	eapol_flags=0}.fi.RE.SH "CERTIFICATES".PPSome EAP authentication methods require use ofcertificates. EAP-TLS uses both server side and clientcertificates whereas EAP-PEAP and EAP-TTLS only require the serverside certificate. When client certificate is used, a matchingprivate key file has to also be included in configuration. If theprivate key uses a passphrase, this has to be configured inwpa_supplicant.conf ("private_key_passwd")..PPwpa_supplicant supports X.509 certificates in PEM and DERformats. User certificate and private key can be included in thesame file..PPIf the user certificate and private key is received inPKCS#12/PFX format, they need to be converted to suitable PEM/DERformat for wpa_supplicant. This can be done, e.g., with followingcommands:.sp.RS.nf# convert client certificate and private key to PEM formatopenssl pkcs12 -in example.pfx -out user.pem -clcerts# convert CA certificate (if included in PFX file) to PEM formatopenssl pkcs12 -in example.pfx -out ca.pem -cacerts -nokeys.fi.RE.SH "SEE ALSO".PP\fBwpa_supplicant\fR(8)\fBopenssl\fR(1)