Home | History | Annotate | Line # | Download | only in hostapd
      1 #	$NetBSD: hostapd.conf,v 1.2 2025/01/07 18:27:26 andvar Exp $
      2 #
      3 # hostapd example configuration file (adapted for NetBSD)
      4 #
      5 # Empty lines and lines starting with # are ignored
      6 
      7 # Interface name. Should be set in ``hostap'' mode.
      8 interface=if0
      9 
     10 # hostapd event logger configuration
     11 #
     12 # Two output method: syslog and stdout (only usable if not forking to
     13 # background).
     14 #
     15 # Module bitfield (ORed bitfield of modules that will be logged; -1 = all
     16 # modules):
     17 # bit 0 (1) = IEEE 802.11
     18 # bit 1 (2) = IEEE 802.1X
     19 # bit 2 (4) = RADIUS
     20 # bit 3 (8) = WPA
     21 # bit 4 (16) = driver interface
     22 # bit 5 (32) = IAPP
     23 #
     24 # Levels (minimum value for logged events):
     25 #  0 = verbose debugging
     26 #  1 = debugging
     27 #  2 = informational messages
     28 #  3 = notification
     29 #  4 = warning
     30 #
     31 logger_syslog=-1
     32 logger_syslog_level=2
     33 logger_stdout=-1
     34 logger_stdout_level=2
     35 
     36 # Debugging: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive
     37 debug=0
     38 
     39 # Dump file for state information (on SIGUSR1)
     40 dump_file=/tmp/hostapd.dump
     41 
     42 # Interface for separate control program. If this is specified, hostapd
     43 # will create this directory and a UNIX domain socket for listening to requests
     44 # from external programs (CLI/GUI, etc.) for status information and
     45 # configuration. The socket file will be named based on the interface name, so
     46 # multiple hostapd processes/interfaces can be run at the same time if more
     47 # than one interface is used.
     48 # /var/run/hostapd is the recommended directory for sockets and by default,
     49 # hostapd_cli will use it when trying to connect with hostapd.
     50 ctrl_interface=/var/run/hostapd
     51 
     52 # Access control for the control interface can be configured by setting the
     53 # directory to allow only members of a group to use sockets. This way, it is
     54 # possible to run hostapd as root (since it needs to change network
     55 # configuration and open raw sockets) and still allow GUI/CLI components to be
     56 # run as non-root users. However, since the control interface can be used to
     57 # change the network configuration, this access needs to be protected in many
     58 # cases. By default, hostapd is configured to use gid 0 (root). If you
     59 # want to allow non-root users to use the control interface, add a new group
     60 # and change this value to match with that group. Add users that should have
     61 # control interface access to this group.
     62 #
     63 # This variable can be a group name or gid.
     64 ctrl_interface_group=wheel
     65 
     66 
     67 ##### IEEE 802.11 related configuration #######################################
     68 
     69 # SSID to be used in IEEE 802.11 management frames
     70 ssid=NetBSD
     71 
     72 # Station MAC address -based authentication
     73 # 0 = accept unless in deny list
     74 # 1 = deny unless in accept list
     75 # 2 = use external RADIUS server (accept/deny lists are searched first)
     76 macaddr_acl=0
     77 
     78 # Accept/deny lists are read from separate files (containing list of
     79 # MAC addresses, one per line). Use absolute path name to make sure that the
     80 # files can be read on SIGHUP configuration reloads.
     81 #accept_mac_file=/etc/hostapd.accept
     82 #deny_mac_file=/etc/hostapd.deny
     83 
     84 # IEEE 802.11 specifies two authentication algorithms. hostapd can be
     85 # configured to allow both of these or only one. Open system authentication
     86 # should be used with IEEE 802.1X.
     87 # Bit fields of allowed authentication algorithms:
     88 # bit 0 = Open System Authentication
     89 # bit 1 = Shared Key Authentication (requires WEP)
     90 auth_algs=3
     91 
     92 # Associate as a station to another AP while still acting as an AP on the same
     93 # channel.
     94 #assoc_ap_addr=00:12:34:56:78:9a
     95 
     96 
     97 ##### IEEE 802.1X-2004 related configuration ##################################
     98 
     99 # Require IEEE 802.1X authorization
    100 #ieee8021x=1
    101 
    102 # Optional displayable message sent with EAP Request-Identity. The first \0
    103 # in this string will be converted to ASCII-0 (nul). This can be used to
    104 # separate network info (comma separated list of attribute=value pairs); see,
    105 # e.g., draft-adrangi-eap-network-discovery-07.txt.
    106 #eap_message=hello
    107 #eap_message=hello\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com
    108 
    109 # WEP rekeying (disabled if key lengths are not set or are set to 0)
    110 # Key lengths for default/broadcast and individual/unicast keys:
    111 # 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
    112 # 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
    113 #wep_key_len_broadcast=5
    114 #wep_key_len_unicast=5
    115 # Rekeying period in seconds. 0 = do not rekey (i.e., set keys only once)
    116 #wep_rekey_period=300
    117 
    118 # EAPOL-Key index workaround (set bit7) for WinXP Supplicant (needed only if
    119 # only broadcast keys are used)
    120 #eapol_key_index_workaround=0
    121 
    122 # EAP reauthentication period in seconds (default: 3600 seconds; 0 = disable
    123 # reauthentication).
    124 #eap_reauth_period=3600
    125 
    126 # Use PAE group address (01:80:c2:00:00:03) instead of individual target
    127 # address when sending EAPOL frames with driver=wired. This is the most common
    128 # mechanism used in wired authentication, but it also requires that the port
    129 # is only used by one station.
    130 #use_pae_group_addr=1
    131 
    132 ##### Integrated EAP server ###################################################
    133 
    134 # Optionally, hostapd can be configured to use an integrated EAP server
    135 # to process EAP authentication locally without need for an external RADIUS
    136 # server. This functionality can be used both as a local authentication server
    137 # for IEEE 802.1X/EAPOL and as a RADIUS server for other devices.
    138 
    139 # Use integrated EAP server instead of external RADIUS authentication
    140 # server. This is also needed if hostapd is configured to act as a RADIUS
    141 # authentication server.
    142 #eap_server=0
    143 
    144 # Path for EAP server user database
    145 #eap_user_file=/etc/hostapd.eap_user
    146 
    147 # CA certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
    148 #ca_cert=/etc/hostapd.ca.pem
    149 
    150 # Server certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
    151 #server_cert=/etc/hostapd.server.pem
    152 
    153 # Private key matching with the server certificate for EAP-TLS/PEAP/TTLS
    154 # This may point to the same file as server_cert if both certificate and key
    155 # are included in a single file. PKCS#12 (PFX) file (.p12/.pfx) can also be
    156 # used by commenting out server_cert and specifying the PFX file as the
    157 # private_key.
    158 #private_key=/etc/hostapd.server.prv
    159 
    160 # Passphrase for private key
    161 #private_key_passwd=secret passphrase
    162 
    163 # Enable CRL verification.
    164 # Note: hostapd does not yet support CRL downloading based on CDP. Thus, a
    165 # valid CRL signed by the CA is required to be included in the ca_cert file.
    166 # This can be done by using PEM format for CA certificate and CRL and
    167 # concatenating these into one file. Whenever CRL changes, hostapd needs to be
    168 # restarted to take the new CRL into use.
    169 # 0 = do not verify CRLs (default)
    170 # 1 = check the CRL of the user certificate
    171 # 2 = check all CRLs in the certificate path
    172 #check_crl=1
    173 
    174 # Configuration data for EAP-SIM database/authentication gateway interface.
    175 # This is a text string in implementation specific format. The example
    176 # implementation in eap_sim_db.c uses this as the file name for the GSM
    177 # authentication triplets.
    178 #eap_sim_db=/etc/hostapd.sim_db
    179 
    180 
    181 ##### IEEE 802.11f - Inter-Access Point Protocol (IAPP) #######################
    182 
    183 # Interface to be used for IAPP broadcast packets
    184 #iapp_interface=if1
    185 
    186 
    187 ##### RADIUS client configuration #############################################
    188 # for IEEE 802.1X with external Authentication Server, IEEE 802.11
    189 # authentication with external ACL for MAC addresses, and accounting
    190 
    191 # The own IP address of the access point (used as NAS-IP-Address)
    192 #own_ip_addr=127.0.0.1
    193 
    194 # Optional NAS-Identifier string for RADIUS messages. When used, this should be
    195 # a unique to the NAS within the scope of the RADIUS server. For example, a
    196 # fully qualified domain name can be used here.
    197 #nas_identifier=ap.example.com
    198 
    199 # RADIUS authentication server
    200 #auth_server_addr=127.0.0.1
    201 #auth_server_port=1812
    202 #auth_server_shared_secret=secret
    203 
    204 # RADIUS accounting server
    205 #acct_server_addr=127.0.0.1
    206 #acct_server_port=1813
    207 #acct_server_shared_secret=secret
    208 
    209 # Secondary RADIUS servers; to be used if primary one does not reply to
    210 # RADIUS packets. These are optional and there can be more than one secondary
    211 # server listed.
    212 #auth_server_addr=127.0.0.2
    213 #auth_server_port=1812
    214 #auth_server_shared_secret=secret2
    215 #
    216 #acct_server_addr=127.0.0.2
    217 #acct_server_port=1813
    218 #acct_server_shared_secret=secret2
    219 
    220 # Retry interval for trying to return to the primary RADIUS server (in
    221 # seconds). RADIUS client code will automatically try to use the next server
    222 # when the current server is not replying to requests. If this interval is set,
    223 # primary server will be retried after configured amount of time even if the
    224 # currently used secondary server is still working.
    225 #radius_retry_primary_interval=600
    226 
    227 
    228 # Interim accounting update interval
    229 # If this is set (larger than 0) and acct_server is configured, hostapd will
    230 # send interim accounting updates every N seconds. Note: if set, this overrides
    231 # possible Acct-Interim-Interval attribute in Access-Accept message. Thus, this
    232 # value should not be configured in hostapd.conf, if RADIUS server is used to
    233 # control the interim interval.
    234 # This value should not be less 600 (10 minutes) and must not be less than
    235 # 60 (1 minute).
    236 #radius_acct_interim_interval=600
    237 
    238 
    239 ##### RADIUS authentication server configuration ##############################
    240 
    241 # hostapd can be used as a RADIUS authentication server for other hosts. This
    242 # requires that the integrated EAP authenticator is also enabled and both
    243 # authentication services are sharing the same configuration.
    244 
    245 # File name of the RADIUS clients configuration for the RADIUS server. If this
    246 # commented out, RADIUS server is disabled.
    247 #radius_server_clients=/etc/hostapd.radius_clients
    248 
    249 # The UDP port number for the RADIUS authentication server
    250 #radius_server_auth_port=1812
    251 
    252 # Use IPv6 with RADIUS server (IPv4 will also be supported using IPv6 API)
    253 #radius_server_ipv6=1
    254 
    255 
    256 ##### WPA/IEEE 802.11i configuration ##########################################
    257 
    258 # Enable WPA. Setting this variable configures the AP to require WPA (either
    259 # WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either
    260 # wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK.
    261 # For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
    262 # RADIUS authentication server must be configured, and WPA-EAP must be included
    263 # in wpa_key_mgmt.
    264 # This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0)
    265 # and/or WPA2 (full IEEE 802.11i/RSN):
    266 # bit0 = WPA
    267 # bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
    268 #wpa=1
    269 
    270 # WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
    271 # secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
    272 # (8..63 characters) that will be converted to PSK. This conversion uses SSID
    273 # so the PSK changes when ASCII passphrase is used and the SSID is changed.
    274 # wpa_psk (dot11RSNAConfigPSKValue)
    275 # wpa_passphrase (dot11RSNAConfigPSKPassPhrase)
    276 #wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
    277 #wpa_passphrase=secret passphrase
    278 
    279 # Optionally, WPA PSKs can be read from a separate text file (containing list
    280 # of (PSK,MAC address) pairs. This allows more than one PSK to be configured.
    281 # Use absolute path name to make sure that the files can be read on SIGHUP
    282 # configuration reloads.
    283 #wpa_psk_file=/etc/hostapd.wpa_psk
    284 
    285 # Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
    286 # entries are separated with a space.
    287 # (dot11RSNAConfigAuthenticationSuitesTable)
    288 #wpa_key_mgmt=WPA-PSK WPA-EAP
    289 
    290 # Set of accepted cipher suites (encryption algorithms) for pairwise keys
    291 # (unicast packets). This is a space separated list of algorithms:
    292 # CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
    293 # TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
    294 # Group cipher suite (encryption algorithm for broadcast and multicast frames)
    295 # is automatically selected based on this configuration. If only CCMP is
    296 # allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
    297 # TKIP will be used as the group cipher.
    298 # (dot11RSNAConfigPairwiseCiphersTable)
    299 #wpa_pairwise=TKIP CCMP
    300 
    301 # Time interval for rekeying GTK (broadcast/multicast encryption keys) in
    302 # seconds. (dot11RSNAConfigGroupRekeyTime)
    303 #wpa_group_rekey=600
    304 
    305 # Rekey GTK when any STA that possesses the current GTK is leaving the BSS.
    306 # (dot11RSNAConfigGroupRekeyStrict)
    307 #wpa_strict_rekey=1
    308 
    309 # Time interval for rekeying GMK (master key used internally to generate GTKs
    310 # (in seconds).
    311 #wpa_gmk_rekey=86400
    312 
    313 # Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
    314 # roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
    315 # authentication and key handshake before actually associating with a new AP.
    316 # (dot11RSNAPreauthenticationEnabled)
    317 #rsn_preauth=1
    318 #
    319 # Space separated list of interfaces from which pre-authentication frames are
    320 # accepted (e.g., 'eth0' or 'eth0 wlan0wds0'. This list should include all
    321 # interface that are used for connections to other APs. This could include
    322 # wired interfaces and WDS links. The normal wireless data interface towards
    323 # associated stations (e.g., wlan0) should not be added, since
    324 # pre-authentication is only used with APs other than the currently associated
    325 # one.
    326 #rsn_preauth_interfaces=eth0
    327