Wi-Fi Protected Access client and IEEE 802.1X supplicant
wpa_supplicant [-BhKLNptuvW] [-b br_ifname] [-C ctrl_interface] [-c config file] [-d[d]] [-f output_file] [-g global ctrl_interface] [-i ifname] [-P file] [-q[q]]
Most command-line options have global scope. Some are given per interface, and are valid only if you've specified at least one -i option; otherwise they're ignored. Option groups for different interfaces must be separated by an -N option.
Wireless networks don't require physical access to the network equipment in the same way as wired networks. This makes it easier for unauthorized users to passively monitor a network and capture all transmitted frames. In addition, unauthorized use of the network is much easier. In many cases, this can happen even without the user's explicit knowledge, because the wireless LAN adapter may have been configured to automatically join any available network.
Link-layer encryption can be used to provide a layer of security for wireless networks. The original wireless LAN standard, IEEE 802.11, included a simple encryption mechanism, WEP. However, that proved to be flawed in many areas, and networks protected with WEP cannot be considered to be secure.
IEEE 802.1X authentication and frequently-changed dynamic WEP keys can be used to improve the network security, but even that has inherent security issues, due to the use of WEP for encryption. Wi-Fi Protected Access and the IEEE 802.11i amendment to the wireless LAN standard introduce a much-improved mechanism for securing wireless networks. IEEE 802.11i-enabled networks that are using CCMP (an encryption mechanism based on the strong cryptographic algorithm AES) can finally be called secure and used for applications that require efficient protection against unauthorized access.
The wpa_supplicant utility is an implementation of the WPA Supplicant component, i.e., the part that runs in the client stations. It implements WPA key negotiation with a WPA Authenticator and EAP authentication with Authentication Server. In addition, it controls the roaming and IEEE 802.11 authentication/association of the wireless LAN driver.
The wpa_supplicant utility is designed to be a daemon that runs in the background and acts as the backend component controlling the wireless connection. It supports separate front-end programs and a sample text-based front-end, wpa_cli, is included with wpa_supplicant.
Before wpa_supplicant can do its work, the network interface must be available. That means that the physical device must be present and enabled, and the driver for the device must have been loaded. The daemon exits immediately if the device isn't already available.
After wpa_supplicant has configured the network device, higher-level configuration such as DHCP may proceed. There's a variety of ways to integrate wpa_supplicant into a machine's networking scripts, a few of which are described in the sections below.
The following steps are used when associating with an AP using WPA:
Supported WPA/IEEE 802.11i features:
The following methods are supported, but since they don't generate keying material, they can't be used with WPA or IEEE 802.1X WEP keying:
The wpa_supplicant requires the following libraries and binaries be present:
The wpa_supplicant also needs a read/write filesystem for creation of a ctrl_interface directory (see the sample wpa_supplicant.conf configuration file).
|You can't use /dev/shmem because it isn't possible to create a directory there.|
wpa_supplicant.conf in the NetBSD documentation.
Wi-Fi Configuration Using WPA and WEP in the Core Networking User's Guide