Wpa supplicant

# Allow users in the 'wheel' group to control wpa_supplicant
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel

# Make this file writable for wpa_gui / wpa_cli
update_config=1

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
#ap_scan=0
#update_config=1

network={
        ssid="YourSSID"
        psk="your-secret-key"
        scan_ssid=1
        proto=RSN
        key_mgmt=WPA-PSK
        group=CCMP TKIP
        pairwise=CCMP TKIP
        priority=5
}

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
network={
	ssid="1x-test"
	scan_ssid=1
	key_mgmt=IEEE8021X
	eap=TLS
	identity="user@example.com"
	ca_cert="/etc/cert/ca.pem"
	client_cert="/etc/cert/user.pem"
	private_key="/etc/cert/user.prv"
	private_key_passwd="password"
	eapol_flags=3
}

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
network={
	ssid="example"
	scan_ssid=1
	key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
	pairwise=CCMP TKIP
	group=CCMP TKIP WEP104 WEP40
	psk="very secret passphrase"
	eap=TTLS PEAP TLS
	identity="user@example.com"
	password="foobar"
	ca_cert="/etc/cert/ca.pem"
	client_cert="/etc/cert/user.pem"
	private_key="/etc/cert/user.prv"
	private_key_passwd="password"
	phase1="peaplabel=0"
	ca_cert2="/etc/cert/ca2.pem"
	client_cert2="/etc/cer/user.pem"
	private_key2="/etc/cer/user.prv"
	private_key2_passwd="password"
}

ctrl_interface=/var/run/wpa_supplicant
eapol_version=1
ap_scan=0
fast_reauth=1

network={
	key_mgmt=IEEE8021X
	eap=TLS
	identity="COMPUTERAACT$@DOMAIN"
	ca_cert="/etc/wpa_supplicant/ca.pem"
	client_cert="/etc/wpa_supplicant/COMPUTERACCT.pem"
	private_key="/etc/wpa_supplicant/COMPUTERAACT.key"
	private_key_passwd="secret_password"
	eapol_flags=0
}

wpa_supplicant_args="-ieth0 -Dwired -c/etc/wpa_supplicant/wpa_supplicant_wired.conf -M -c/etc/wpa_supplicant/wpa_supplicant.conf"

wpa_cli v2.8
Copyright (c) 2004-2019, Jouni Malinen <j@w1.fi> and contributors

This software may be distributed under the terms of the BSD license.
See README for more details.

Selected interface 'p2p-dev-wlan0'

Interactive mode

> interface eth0
Connected to interface 'eth0.
> status
bssid=00:00:00:00:00:00
freq=0
ssid=
id=0
mode=station
pairwise_cipher=NONE
group_cipher=NONE
key_mgmt=IEEE 802.1X (no WPA)
wpa_state=COMPLETED
ip_address=10.10.10.100
p2p_device_address=bb:bb:bb:bb:bb:bb
address=aa:aa:aa:aa:aa:aa
Supplicant PAE state=AUTHENTICATED
suppPortStatus=Authorized
EAP state=SUCCESS
selectedMethod=13 (EAP-TLS)
eap_tls_version=TLSv1
EAP TLS cipher=ECDHE-RSA-AES256-SHA
...

wpa_supplicant_args="-B -M -c /etc/wpa_supplicant/wpa_supplicant.conf"

wpa_supplicant_args="-ieth0 -Dwired -c/etc/wpa_supplicant/wpa_supplicant_wired.conf -B -M -c/etc/wpa_supplicant/wpa_supplicant.conf"

wpa_supplicant_args="-D wext"

modules_wlan0="wpa_supplicant"
config_wlan0="dhcp"

wpa_cli v2.5
 Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> and contributors

 This software may be distributed under the terms of the BSD license.
 See README for more details.

 Selected interface 'wlan0'

 Interactive mode

 > scan
 OK
 > scan_results
 bssid / frequency / signal level / flags / ssid
 01:23:45:67:89:ab       2437    0       [WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]    hotel-free-wifi
 > add_network
 0
 > set_network 0 ssid "hotel-free-wifi"
 OK
 > set_network 0 psk "password"
 OK
 > enable_network 0
 OK
 <3>CTRL-EVENT-SCAN-RESULTS 
 <3>WPS-AP-AVAILABLE 
 <3>Trying to associate with 01:23:45:67:89:ab (SSID='hotel-free-wifi' freq=2437 MHz)
 <3>Associated with 01:23:45:67:89:ab
 <3>WPA: Key negotiation completed with 01:23:45:67:89:ab [PTK=CCMP GTK=TKIP]
 <3>CTRL-EVENT-CONNECTED - Connection to 01:23:45:67:89:ab completed [id=0 id_str=]
 > save_config 
 OK
 > quit

wpa_cli v2.5
 Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> and contributors

 This software may be distributed under the terms of the BSD license.
 See README for more details.
> list_networks
network id / ssid / bssid / flags
0	TAMO	any	
1	ORBI705	any	
2	ORBI	any	
3	Tangerine	any	
4	271	any	
5	POCO X3 Pro	any	
6	Orbi Guest	any	
7	hackerspace	any	
8	HUAWEI-25 a-2	any	
9	A1-13	any	

> select_network 1

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
ap_scan=1

network={
        bssid=00:50:17:31:1a:11
        ssid="YourSSID"
        psk="your-secret-key"
        scan_ssid=1
        proto=RSN
        key_mgmt=WPA-PSK
        group=CCMP TKIP
        pairwise=CCMP TKIP
        priority=5
}

network={
        key_mgmt=NONE
        priority=-999
}

0: ideapad_wlan: Wireless LAN
	Soft blocked: yes
	Hard blocked: no
1: ideapad_bluetooth: Bluetooth
	Soft blocked: yes
	Hard blocked: no
2: hci0: Bluetooth
	Soft blocked: yes
	Hard blocked: no
3: phy0: Wireless LAN
	Soft blocked: yes
	Hard blocked: no
wpa_supplicant v2.2
random: Trying to read entropy from /dev/random
Successfully initialized wpa_supplicant
Initializing interface 'wlp8s0' conf '/etc/wpa_supplicant/wpa_supplicant.conf' driver 'nl80211' ctrl_interface '/var/run/wpa_supplicant' bridge 'N/A'
Configuration file '/etc/wpa_supplicant/wpa_supplicant.conf' -> '/etc/wpa_supplicant/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant/wpa_supplicant.conf'
ctrl_interface='DIR=/var/run/wpa_supplicant GROUP=wheel'
update_config=1
Line: 6 - start of a new network block

modules_wlan0="wpa_supplicant"
wpa_supplicant_wlan0="-Dnl80211 -d -f /var/log/wpa_supplicant.log"
config_wlan0="dhcp"

`+fils`	Add support for Fast Initial Link Setup (802.11ai)
`+hs2-0`	Add support for 802.11u and Passpoint for HotSpot 2.0
`+mbo`	Add support Multiband Operation
`+mesh`	Add support for mesh mode
`ap`	Add support for access point mode
`broadcom-sta`	Flag to help users disable features not supported by broadcom-sta driver
`dbus`	Enable dbus support for anything that needs it (gpsd, gnomemeeting, etc)
`eap-sim`	Add support for EAP-SIM authentication algorithm
`eapol-test`	Build and install eapol_test binary
`fasteap`	Add support for FAST-EAP authentication algorithm
`macsec`	Add support for wired macsec
`p2p`	Add support for Wi-Fi Direct mode
`privsep`	Enable wpa_priv privledge separation binary
`ps3`	Add support for ps3 hypervisor driven gelic wifi
`qt5`	Add support for the Qt 5 application and UI framework
`readline`	Enable support for libreadline, a GNU line-editing library that almost everyone wants
`selinux`	!!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur
`smartcard`	Add support for smartcards
`tdls`	Add support for Tunneled Direct Link Setup (802.11z)
`tkip`	Add support for WPA TKIP (deprecated due to security flaws in 2009)
`uncommon-eap-types`	Add support for GPSK, SAKE, GPSK_SHA256, IKEV2 and EKE
`wep`	Add support for Wired Equivalent Privacy (deprecated due to security flaws in 2004)
`wimax`	Add support for Wimax EAP-PEER authentication algorithm
`wps`	Add support for Wi-Fi Protected Setup

Wpa supplicant

Contents

Installation

USE flags

USE flags for net-wireless/wpa_supplicant IEEE 802.1X/WPA supplicant for secure wireless transfers

Emerge

Direct connect

Quick Connect

Connection for two interfaces

Configuration

Files

Minimal configuration

Setup for wireless interface

WPA2 with wpa_supplicant

Configuration file with dynamic WEP keys

Allows more or less all configuration modes

Setup wired 802.1X

Setup the network manager

Setup for dhcpcd as network manager

Using OpenRC

Using Systemd

Setup for Netifrc

Setup for NetworkManager

Usage

Using wpa_gui

Using wpa_cli

Editing manually

Auto-connect to any unsecured network

Troubleshooting

Check for known bugs

Check USE Flags

rfkill: WLAN soft blocked

Run wpa_supplicant in debug mode

Enable logging

Enable logging for Gentoo net.* scripts

References

See also

External resources