Wi-Fi Protected Access (WPA) client and IEEE 802.1X supplicant
Syntax:
wpa_supplicant-version [-BhKLNptuvWw] [-b br_ifname]
[-C ctrl_interface] [-c filename] [-D driver] [-d[d]]
[-f output_file] [-G group] [-g global_ctrl_interface] [-i ifname]
[-m P2P_device_config_file] [-P file] [-q[q]] [-Z num]
Options:
Most command-line options have global scope. Some are given per interface, and are valid only if
you've specified at least one -i option; otherwise they're ignored. Option groups
for different interfaces must be separated by an -N option.
- -B
- Run as a daemon in the background.
- -b br_ifname
- Optional bridge interface name. (Per interface)
- -C ctrl_interface
- Path to the ctrl_interface socket.
(Per interface; used only if -c is not)
- -c filename
- Path to the configuration file. (Per interface)
- -D driver
- Name of the driver. You can list more than one driver, separated by commas; for example, n180211,wext.
- -d
- Increase debugging verbosity (specify -dd for even more).
- -f output_file
- Send the debug output to the specified file, instead of to standard output.
- -G group
- Name of the global_ctrl_interface group.
- -g global_ctrl_interface
- Path to the global_ctrl_interface socket.
If you specify this option, you can omit the interface definitions.
- -h
- Help; display a usage message.
- -i ifname
- Interface to listen on.
Multiple instances of this option can be present, one per interface,
separated by an -N option (see below).
- -K
- Include keys (passwords, etc.) in the debugging output.
- -L
- Show the license (GPL and BSD).
- -m P2P_device_config_file
- Name of the P2P device configuration file.
- -N
- Start describing a new interface. The options that follow on the command-line will apply to that new interface.
- -P file
- Specify the location of the PID file.
- -p
- Driver parameters. (Per interface)
- -q
- Decrease debugging verbosity (specify -qq for even less).
- -t
- Include the timestamp in debugging messages.
- -u
- Enable the DBus control interface.
If you specify this option, you can omit the interface definitions.
- -v
- Show version information.
- -W
- Wait for a control interface monitor before starting.
- -w
- If needed, wait for an interface to be added.
- -Z num
- (QNX Neutrino extension; QNX Neutrino 7.0 or later)
Specify the number of 4 KB pages for the slog2 buffer.
The minimum is 5, the default is 10, and the maximum is 500.
Description:
Wireless networks don't require physical access to the network equipment in the same way as wired
networks. This makes it easier for unauthorized users to passively monitor a network and capture all
transmitted frames. In addition, unauthorized use of the network is much easier. In many cases, this
can happen even without the user's explicit knowledge, because the wireless LAN adapter may have
been configured to automatically join any available network.
Link-layer encryption can be used to provide a layer of security for wireless networks. The
original wireless LAN standard, IEEE 802.11, included a simple encryption mechanism, WEP. But
that proved to be flawed in many areas, and networks protected with WEP cannot be considered to be
secure.
IEEE 802.1X authentication and frequently-changed dynamic WEP keys can be used to improve the
network security, but even that has inherent security issues, due to the use of WEP for encryption.
Wi-Fi Protected Access and the IEEE 802.11i amendment to the wireless LAN standard introduce a
much-improved mechanism for securing wireless networks. IEEE 802.11i-enabled networks that are using
CCMP (an encryption mechanism based on the strong cryptographic algorithm AES) can finally be called
secure and used for applications that require efficient protection against unauthorized access.
The wpa_supplicant utility is an implementation of the WPA Supplicant
component (i.e., the part that runs in client stations). It implements WPA key negotiation with a
WPA Authenticator and EAP authentication with Authentication Server. In addition, it controls the
roaming and IEEE 802.11 authentication/association of the wireless LAN driver.
The number in the wpa_supplicant utility name indicates the supported WPA
version. For example, wpa_supplicant-2.9 supports version 2.9.
The utility is designed to be a daemon that runs in the
background and acts as the backend component controlling the wireless connection. It supports
separate front-end programs such as the text-based wpa_cli.
Before wpa_supplicant can do its work, the network interface must be
available. That means that the physical device must be present and enabled, and the driver for the
device must have been loaded. The daemon exits immediately if the device isn't already available.
This program uses the OpenSSL library for cryptography services.
Configuring the wpa_supplicant utility
The wpa_supplicant utility is configured using a text file that lists all accepted networks and
security policies, including pre-shared keys. See the sample configuration file,
wpa_supplicant.conf, for detailed information about the configuration format and supported fields.
Simpler sample configurations are available for plain text, static WEP, IEEE 802.1X
with dynamic WEP (EAP-PEAP/MSCHAPv2), WPA-PSK/TKIP, and WPA2-EAP/CCMP (EAP-TLS). In addition, the
utility can use the OpenSSL engine to avoid exposing private keys in the filesystem.
Integrating the wpa_supplicant utility
After wpa_supplicant has configured the network device, higher-level
configuration such as DHCP may proceed. There are many ways to integrate
wpa_supplicant into a machine's networking scripts, a few of which are described
in the sections below.
The following steps are used when associating with an Access Point (AP) using WPA:
- wpa_supplicant requests the driver to scan neighboring BSSs.
- wpa_supplicant selects a BSS based on its configuration.
- wpa_supplicant requests the driver to associate with the chosen BSS.
- If WPA-EAP: the integrated IEEE 802.1X Supplicant or external Xsupplicant
completes EAP authentication with the authentication server (proxied by the Authenticator in the AP).
- If WPA-EAP: the master key is received from the IEEE 802.1X Supplicant.
- If WPA-PSK: wpa_supplicant uses PSK as the master session key.
- wpa_supplicant completes WPA 4-Way Handshake and Group Key Handshake
with the Authenticator in the AP.
- wpa_supplicant configures encryption keys for unicast and broadcast.
- Normal data packets can be transmitted and received.
Supported WPA/IEEE 802.11i features
- WPA-PSK (WPA-Personal)
- WPA with EAP (e.g., with RADIUS authentication server) (WPA-Enterprise)
- IEEE 802.11r
- IEEE 802.11w
- Wi-Fi Protected Setup (WPS)
- The following authentication methods are supported with an integrated IEEE 802.1X Supplicant:
- EAP-TLS
- EAP-PEAP/MSCHAPv2 (both PEAPv0 and PEAPv1)
- EAP-PEAP/TLS (both PEAPv0 and PEAPv1)
- EAP-PEAP/GTC (both PEAPv0 and PEAPv1)
- EAP-PEAP/OTP (both PEAPv0 and PEAPv1)
- EAP-PEAP/MD5-Challenge (both PEAPv0 and PEAPv1)
- EAP-TTLS/EAP-MD5-Challenge
- EAP-TTLS/EAP-GTC
- EAP-TTLS/EAP-OTP
- EAP-TTLS/EAP-MSCHAPv2
- EAP-TTLS/EAP-TLS
- EAP-TTLS/MSCHAPv2
- EAP-TTLS/MSCHAP
- EAP-TTLS/PAP
- EAP-TTLS/CHAP
- EAP-SIM
- EAP-AKA
- EAP-PSK
- EAP-FAST
- EAP-PAX
- EAP-SAKE
- EAP-IKEv2
- EAP-GPSK
- LEAP (note: requires special support from the driver for IEEE 802.11 authentication)
The following methods are supported, but since they don't generate keying material, they can't be
used with WPA or IEEE 802.1X WEP keying:
- EAP-MD5-Challenge
- EAP-MSCHAPv2
- EAP-GTC
- EAP-OTP
- EAP-TNC (Trusted Network Connect; TNCC, IF-IMC, IF-T, IF-TNCCS_)
- key management for CCMP, TKIP, WEP104, WEP40
- RSN:
- pre-authentication
- PMKSA caching
- Crypto libraries, including OpenSSL version 1.2
Files:
The wpa_supplicant requires the following libraries and binaries be present:
- libcrypto.so — crypto library
- libssl.so — Secure Socket Library (created from OpenSSL)
- libsocket — Socket interface library
- libc — QNX C library
- random
— executable that creates
/dev/urandom for random-number generation
The wpa_supplicant also needs a read/write filesystem for
creating a ctrl_interface directory (see the sample
wpa_supplicant.conf configuration file).
Note:
You can't use /dev/shmem because it isn't possible to create
a directory there.