mirror of
https://github.com/pentoo/pentoo-overlay
synced 2025-12-09 18:02:56 +01:00
252 lines
9.4 KiB
Text
252 lines
9.4 KiB
Text
#This is example of using hostapd with a build-in radius server
|
|
|
|
#enable_karma=0
|
|
#karma_black_white=1
|
|
#karma_ssid_file=/etc/hostapd/hostapd_karma_ssid
|
|
|
|
interface=wlan1
|
|
ssid=PentooTest
|
|
|
|
driver=nl80211
|
|
|
|
logger_syslog=-1
|
|
logger_syslog_level=2
|
|
logger_stdout=-1
|
|
logger_stdout_level=2
|
|
|
|
# Dump file for state information (on SIGUSR1)
|
|
dump_file=/tmp/hostapd.dump
|
|
|
|
ctrl_interface=/var/run/hostapd
|
|
|
|
#ctrl_interface_group=wheel
|
|
ctrl_interface_group=0
|
|
|
|
country_code=US
|
|
hw_mode=b
|
|
channel=1
|
|
|
|
# Beacon interval in kus (1.024 ms) (default: 100; range 15..65535)
|
|
beacon_int=100
|
|
|
|
# DTIM (delivery trafic information message) period (range 1..255):
|
|
# number of beacons between DTIMs (1 = every beacon includes DTIM element)
|
|
# (default: 2)
|
|
dtim_period=2
|
|
|
|
# Maximum number of stations allowed in station table. New stations will be
|
|
# rejected after the station table is full. IEEE 802.11 has a limit of 2007
|
|
# different association IDs, so this number should not be larger than that.
|
|
# (default: 2007)
|
|
max_num_sta=255
|
|
|
|
rts_threshold=2347
|
|
fragm_threshold=2346
|
|
macaddr_acl=0
|
|
auth_algs=3
|
|
|
|
# Send empty SSID in beacons and ignore probe request frames that do not
|
|
# specify full SSID, i.e., require stations to know SSID.
|
|
# default: disabled (0)
|
|
# 1 = send empty (length=0) SSID in beacon and ignore probe request for
|
|
# broadcast SSID
|
|
# 2 = clear SSID (ASCII 0), but keep the original length (this may be required
|
|
# with some clients that do not support empty SSID) and ignore probe
|
|
# requests for broadcast SSID
|
|
ignore_broadcast_ssid=0
|
|
|
|
##### IEEE 802.11n related configuration ######################################
|
|
|
|
# ieee80211n: Whether IEEE 802.11n (HT) is enabled
|
|
# 0 = disabled (default)
|
|
# 1 = enabled
|
|
# Note: You will also need to enable WMM for full HT functionality.
|
|
#ieee80211n=1
|
|
|
|
|
|
##### IEEE 802.1X-2004 related configuration ##################################
|
|
|
|
# Require IEEE 802.1X authorization
|
|
ieee8021x=1
|
|
|
|
# IEEE 802.1X/EAPOL version
|
|
# hostapd is implemented based on IEEE Std 802.1X-2004 which defines EAPOL
|
|
# version 2. However, there are many client implementations that do not handle
|
|
# the new version number correctly (they seem to drop the frames completely).
|
|
# In order to make hostapd interoperate with these clients, the version number
|
|
# can be set to the older version (1) with this configuration value.
|
|
eapol_version=1
|
|
|
|
# Optional displayable message sent with EAP Request-Identity. The first \0
|
|
# in this string will be converted to ASCII-0 (nul). This can be used to
|
|
# separate network info (comma separated list of attribute=value pairs); see,
|
|
# e.g., RFC 4284.
|
|
#eap_message=hello
|
|
#eap_message=hello\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com
|
|
|
|
# WEP rekeying (disabled if key lengths are not set or are set to 0)
|
|
# Key lengths for default/broadcast and individual/unicast keys:
|
|
# 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
|
|
# 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
|
|
#wep_key_len_broadcast=5
|
|
#wep_key_len_unicast=5
|
|
# Rekeying period in seconds. 0 = do not rekey (i.e., set keys only once)
|
|
#wep_rekey_period=300
|
|
|
|
# EAPOL-Key index workaround (set bit7) for WinXP Supplicant (needed only if
|
|
# only broadcast keys are used)
|
|
eapol_key_index_workaround=0
|
|
|
|
# EAP reauthentication period in seconds (default: 3600 seconds; 0 = disable
|
|
# reauthentication).
|
|
#eap_reauth_period=3600
|
|
|
|
# Use PAE group address (01:80:c2:00:00:03) instead of individual target
|
|
# address when sending EAPOL frames with driver=wired. This is the most common
|
|
# mechanism used in wired authentication, but it also requires that the port
|
|
# is only used by one station.
|
|
#use_pae_group_addr=1
|
|
|
|
##### Integrated EAP server ###################################################
|
|
|
|
# Optionally, hostapd can be configured to use an integrated EAP server
|
|
# to process EAP authentication locally without need for an external RADIUS
|
|
# server. This functionality can be used both as a local authentication server
|
|
# for IEEE 802.1X/EAPOL and as a RADIUS server for other devices.
|
|
|
|
# Use integrated EAP server instead of external RADIUS authentication
|
|
# server. This is also needed if hostapd is configured to act as a RADIUS
|
|
# authentication server.
|
|
eap_server=1
|
|
|
|
# Path for EAP server user database
|
|
#eap_user_file=/etc/hostapd/hostapd.eap_user
|
|
|
|
# CA certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
|
|
|
|
ca_cert=/etc/hostapd/hostapd/ca.pem
|
|
server_cert=/etc/hostapd/hostapd/server.pem
|
|
private_key=/etc/hostapd/hostapd/server.pem
|
|
private_key_passwd=whatever
|
|
|
|
# Enable CRL verification.
|
|
# Note: hostapd does not yet support CRL downloading based on CDP. Thus, a
|
|
# valid CRL signed by the CA is required to be included in the ca_cert file.
|
|
# This can be done by using PEM format for CA certificate and CRL and
|
|
# concatenating these into one file. Whenever CRL changes, hostapd needs to be
|
|
# restarted to take the new CRL into use.
|
|
# 0 = do not verify CRLs (default)
|
|
# 1 = check the CRL of the user certificate
|
|
# 2 = check all CRLs in the certificate path
|
|
#check_crl=1
|
|
|
|
# dh_file: File path to DH/DSA parameters file (in PEM format)
|
|
# This is an optional configuration file for setting parameters for an
|
|
# ephemeral DH key exchange. In most cases, the default RSA authentication does
|
|
# not use this configuration. However, it is possible setup RSA to use
|
|
# ephemeral DH key exchange. In addition, ciphers with DSA keys always use
|
|
# ephemeral DH keys. This can be used to achieve forward secrecy. If the file
|
|
# is in DSA parameters format, it will be automatically converted into DH
|
|
# params. This parameter is required if anonymous EAP-FAST is used.
|
|
# You can generate DH parameters file with OpenSSL, e.g.,
|
|
# "openssl dhparam -out /etc/hostapd/hostapd.dh.pem 1024"
|
|
#dh_file=/etc/hostapd/hostapd.dh.pem
|
|
|
|
# Enable/disable different EAP-FAST provisioning modes:
|
|
#0 = provisioning disabled
|
|
#1 = only anonymous provisioning allowed
|
|
#2 = only authenticated provisioning allowed
|
|
#3 = both provisioning modes allowed (default)
|
|
#eap_fast_prov=3
|
|
|
|
|
|
##### RADIUS client configuration #############################################
|
|
# for IEEE 802.1X with external Authentication Server, IEEE 802.11
|
|
# authentication with external ACL for MAC addresses, and accounting
|
|
|
|
# The own IP address of the access point (used as NAS-IP-Address)
|
|
own_ip_addr=127.0.0.1
|
|
|
|
# Optional NAS-Identifier string for RADIUS messages. When used, this should be
|
|
# a unique to the NAS within the scope of the RADIUS server. For example, a
|
|
# fully qualified domain name can be used here.
|
|
# When using IEEE 802.11r, nas_identifier must be set and must be between 1 and
|
|
# 48 octets long.
|
|
#nas_identifier=ap.example.com
|
|
|
|
# RADIUS authentication server
|
|
#auth_server_addr=127.0.0.1
|
|
#auth_server_port=1812
|
|
#auth_server_shared_secret=secret
|
|
|
|
# RADIUS accounting server
|
|
#acct_server_addr=127.0.0.1
|
|
#acct_server_port=1813
|
|
#acct_server_shared_secret=secret
|
|
|
|
# Secondary RADIUS servers; to be used if primary one does not reply to
|
|
# RADIUS packets. These are optional and there can be more than one secondary
|
|
# server listed.
|
|
#auth_server_addr=127.0.0.2
|
|
#auth_server_port=1812
|
|
#auth_server_shared_secret=secret2
|
|
#
|
|
#acct_server_addr=127.0.0.2
|
|
#acct_server_port=1813
|
|
#acct_server_shared_secret=secret2
|
|
|
|
|
|
##### RADIUS authentication server configuration ##############################
|
|
|
|
# hostapd can be used as a RADIUS authentication server for other hosts. This
|
|
# requires that the integrated EAP server is also enabled and both
|
|
# authentication services are sharing the same configuration.
|
|
|
|
# File name of the RADIUS clients configuration for the RADIUS server. If this
|
|
# commented out, RADIUS server is disabled.
|
|
#radius_server_clients=/etc/hostapd/hostapd.radius_clients
|
|
|
|
# The UDP port number for the RADIUS authentication server
|
|
#radius_server_auth_port=1812
|
|
|
|
# Use IPv6 with RADIUS server (IPv4 will also be supported using IPv6 API)
|
|
#radius_server_ipv6=1
|
|
|
|
|
|
##### WPA/IEEE 802.11i configuration ##########################################
|
|
|
|
# Enable WPA. Setting this variable configures the AP to require WPA (either
|
|
# WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either
|
|
# wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK.
|
|
# For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
|
|
# RADIUS authentication server must be configured, and WPA-EAP must be included
|
|
# in wpa_key_mgmt.
|
|
# This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0)
|
|
# and/or WPA2 (full IEEE 802.11i/RSN):
|
|
# bit0 = WPA
|
|
# bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
|
|
#wpa=1
|
|
wpa=3
|
|
|
|
# WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
|
|
# secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
|
|
# (8..63 characters) that will be converted to PSK. This conversion uses SSID
|
|
# so the PSK changes when ASCII passphrase is used and the SSID is changed.
|
|
# wpa_psk (dot11RSNAConfigPSKValue)
|
|
# wpa_passphrase (dot11RSNAConfigPSKPassPhrase)
|
|
#wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
|
|
#wpa_passphrase=secret passphrase
|
|
|
|
# Optionally, WPA PSKs can be read from a separate text file (containing list
|
|
# of (PSK,MAC address) pairs. This allows more than one PSK to be configured.
|
|
# Use absolute path name to make sure that the files can be read on SIGHUP
|
|
# configuration reloads.
|
|
#wpa_psk_file=/etc/hostapd/hostapd.wpa_psk
|
|
|
|
# Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
|
|
# entries are separated with a space. WPA-PSK-SHA256 and WPA-EAP-SHA256 can be
|
|
# added to enable SHA256-based stronger algorithms.
|
|
# (dot11RSNAConfigAuthenticationSuitesTable)
|
|
#wpa_key_mgmt=WPA-PSK WPA-EAP
|
|
wpa_key_mgmt=WPA-EAP
|
|
|