R: Incompatibility hostapd - windows
jers at inwind.it
jers
Wed Mar 8 03:08:59 PST 2006
Hi,
Thanks for your reply. I used the supplicant for windows provided with the WiFi card. It was the cause of my problem. The problem has never occurred by utilizing the Microsoft supplicant.
Unfortunately I have not solved yet the problem with the VoIP phone.
When I try to connect the phone to the AP, the first repeats the steps: Scanning, Associated and IP configuring while the latter prints the following debug as in the follow.
Hostapd AP / WiFi phone debug
Configuration file: hostapd.conf
madwifi_set_iface_flags: dev_up=0
Using interface ath0 with hwaddr 00:40:f4:e6:29:37 and ssid 'wpa'
madwifi_set_ieee8021x: enabled=1
madwifi_configure_wpa: group key cipher=1
madwifi_configure_wpa: pairwise key ciphers=0x2
madwifi_configure_wpa: key management algorithms=0x2
madwifi_configure_wpa: rsn capabilities=0x0
madwifi_configure_wpa: enable WPA= 0x1
madwifi_set_iface_flags: dev_up=1
madwifi_set_privacy: enabled=1
WPA: group state machine entering state GTK_INIT
GMK - hexdump(len=32): 06 31 2e 17 eb f7 34 59 33 fa 28 4b 1f fc a9 f9 91 35 90 fe 99 13 8c 1c d5 cc 7a d8 34 63 e7 72
GTK - hexdump(len=32): 11 09 3c 21 83 f4 b2 55 b6 3e 67 2e 93 da 42 b9 2f 32 ed b5 77 d7 65 3b 00 c3 00 1d 0a f0 15 40
WPA: group state machine entering state SETKEYSDONE
madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1
Flushing old station entries
madwifi_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=3
Deauthenticate all stations
l2_packet_receive - recvfrom: Network is down
Wireless event: cmd=0x8c03 len=20
New STA
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state INITIALIZE
madwifi_del_key: addr=00:02:6f:0a:3a:92 key_idx=0
madwifi_set_sta_authorized: addr=00:02:6f:0a:3a:92 authorized=0
WPA: 00:02:6f:0a:3a:92 WPA_PTK_GROUP entering state IDLE
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state AUTHENTICATION
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state AUTHENTICATION2
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state INITPSK
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state PTKSTART
TX EAPOL - hexdump(len=113): 00 02 6f 0a 3a 92 00 40 f4 e6 29 37 88 8e 02 03 00 5f fe 00 89 00 20 00 00 00 00 00 00 00 01 5d f9 66 ed cf bc aa 17 76 b1 64 9b 57 4c 36 e6 13 56 8e e3 31 76 19 11 16 4e 0a 3c 65 d5 51 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X: 123 bytes from 00:02:6f:0a:3a:92
IEEE 802.1X: version=1 type=3 length=119
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state PTKCALCNEGOTIATING
PMK - hexdump(len=32): f5 41 0e ab fd 0c 80 69 56 e4 ac d6 f8 25 aa 06 01 54 b9 62 b1 76 a6 54 34 90 b2 5e e3 03 94 61
PTK - hexdump(len=64): d3 2d f3 f4 96 dc 57 32 62 45 19 ae 95 ac 84 5e b9 76 cb 2a 17 12 aa 19 5d 56 e8 b8 ed b7 f4 4a f2 36 3c 2d 85 0f 96 46 a4 98 23 4e fb 96 56 b8 46 1c ea 4a c6 9c d9 d6 af 38 c5 23 03 f9 6a f9
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state PTKCALCNEGOTIATING2
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state PTKINITNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
TX EAPOL - hexdump(len=137): 00 02 6f 0a 3a 92 00 40 f4 e6 29 37 88 8e 02 03 00 77 fe 01 c9 00 20 00 00 00 00 00 00 00 02 5d f9 66 ed cf bc aa 17 76 b1 64 9b 57 4c 36 e6 13 56 8e e3 31 76 19 11 16 4e 0a 3c 65 d5 51 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a9 6b 93 1b 11 8e e5 1b fc a0 a9 e8 40 20 ca 0e 00 18 dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 02
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state PTKINITNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
TX EAPOL - hexdump(len=137): 00 02 6f 0a 3a 92 00 40 f4 e6 29 37 88 8e 02 03 00 77 fe 01 c9 00 20 00 00 00 00 00 00 00 03 5d f9 66 ed cf bc aa 17 76 b1 64 9b 57 4c 36 e6 13 56 8e e3 31 76 19 11 16 4e 0a 3c 65 d5 51 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 0b 9b 8d 3e 8f b7 a4 2a 69 ad e3 d8 b9 f4 29 00 18 dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 02
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state PTKINITNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
TX EAPOL - hexdump(len=137): 00 02 6f 0a 3a 92 00 40 f4 e6 29 37 88 8e 02 03 00 77 fe 01 c9 00 20 00 00 00 00 00 00 00 04 5d f9 66 ed cf bc aa 17 76 b1 64 9b 57 4c 36 e6 13 56 8e e3 31 76 19 11 16 4e 0a 3c 65 d5 51 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 21 f1 e9 e3 e1 a7 b6 4f 56 47 57 e3 d7 49 33 00 18 dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 02
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state PTKINITNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
TX EAPOL - hexdump(len=137): 00 02 6f 0a 3a 92 00 40 f4 e6 29 37 88 8e 02 03 00 77 fe 01 c9 00 20 00 00 00 00 00 00 00 05 5d f9 66 ed cf bc aa 17 76 b1 64 9b 57 4c 36 e6 13 56 8e e3 31 76 19 11 16 4e 0a 3c 65 d5 51 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 95 4d 4f 20 8b 1a 05 2b 89 e2 93 21 c7 dd 31 eb 00 18 dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 02
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state DISCONNECT
madwifi_sta_deauth: addr=00:02:6f:0a:3a:92 reason_code=2
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state DISCONNECTED
WPA: 00:02:6f:0a:3a:92 WPA_PTK entering state INITIALIZE
madwifi_del_key: addr=00:02:6f:0a:3a:92 key_idx=0
ioctl[unknown???]: Invalid argument
madwifi_set_sta_authorized: addr=00:02:6f:0a:3a:92 authorized=0
ioctl[unknown???]: Invalid argument
Wireless event: cmd=0x8c04 len=20
Wireless event: cmd=0x8c03 len=20
New STA
... The same again...
You can see that the AP and the phone cannot negotiate the key. The hostapd.conf file is the same I use to connect Windows stations. Moreover I set the same configuration in a commercial AP and the phone can connect to it. So, the windows stations can connect to the hostapd AP; the wifi phone can connect to commercial AP; the wifi phone cannot connect to the hostapd AP.
I do not understand which is the reason of this behavior of the hostapd AP and the WiFi phone.
In the following the hostapd debug when I connect my notebook and the hostapd.conf file:
Any suggestion is appreciated.
Bye
Jers
Hostapd AP / notebook debug
New STA
WPA: 00:20:a6:52:24:9e WPA_PTK entering state INITIALIZE
madwifi_del_key: addr=00:20:a6:52:24:9e key_idx=0
madwifi_set_sta_authorized: addr=00:20:a6:52:24:9e authorized=0
WPA: 00:20:a6:52:24:9e WPA_PTK_GROUP entering state IDLE
WPA: 00:20:a6:52:24:9e WPA_PTK entering state AUTHENTICATION
WPA: 00:20:a6:52:24:9e WPA_PTK entering state AUTHENTICATION2
WPA: 00:20:a6:52:24:9e WPA_PTK entering state INITPSK
WPA: 00:20:a6:52:24:9e WPA_PTK entering state PTKSTART
TX EAPOL - hexdump(len=113): 00 20 a6 52 24 9e 00 40 f4 e6 29 37 88 8e 02 03 00 5f fe 00 89 00 20 00 00 00 00 00 00 00 01 ed 81 47 84 af 89 0e 6e 0d 65 2d c3 91 c1 c3 69 dd 59 03 61 42 4b d3 a6 05 07 81 fc 3e c2 75 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X: 5 bytes from 00:20:a6:52:24:9e
IEEE 802.1X: version=1 type=1 length=0
ignoring 1 extra octets after IEEE 802.1X packet
IEEE 802.1X: 123 bytes from 00:20:a6:52:24:9e
IEEE 802.1X: version=1 type=3 length=119
WPA: 00:20:a6:52:24:9e WPA_PTK entering state PTKCALCNEGOTIATING
PMK - hexdump(len=32): f5 41 0e ab fd 0c 80 69 56 e4 ac d6 f8 25 aa 06 01 54 b9 62 b1 76 a6 54 34 90 b2 5e e3 03 94 61
PTK - hexdump(len=64): f5 27 a3 f3 1f 48 10 c7 1b 01 1a 3b 52 37 32 1a df 0a af 30 7e 09 43 91 dd c2 81 73 0a d0 5a f7 63 1f 82 6e 18 01 2d a0 6f 04 bf 5a d1 db bc 79 d2 4d af 0e 4e 6b ac 7d 9a d9 00 e9 17 1f 77 39
WPA: 00:20:a6:52:24:9e WPA_PTK entering state PTKCALCNEGOTIATING2
WPA: 00:20:a6:52:24:9e WPA_PTK entering state PTKINITNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
TX EAPOL - hexdump(len=137): 00 20 a6 52 24 9e 00 40 f4 e6 29 37 88 8e 02 03 00 77 fe 01 c9 00 20 00 00 00 00 00 00 00 02 ed 81 47 84 af 89 0e 6e 0d 65 2d c3 91 c1 c3 69 dd 59 03 61 42 4b d3 a6 05 07 81 fc 3e c2 75 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7a ad 67 8f e4 cc da bb a8 d1 74 7d 72 55 d3 02 00 18 dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 02
IEEE 802.1X: 99 bytes from 00:20:a6:52:24:9e
IEEE 802.1X: version=1 type=3 length=95
WPA: 00:20:a6:52:24:9e WPA_PTK entering state PTKINITDONE
madwifi_set_key: alg=TKIP addr=00:20:a6:52:24:9e key_idx=0
madwifi_set_sta_authorized: addr=00:20:a6:52:24:9e authorized=1
madwifi_sta_clear_stats: addr=00:20:a6:52:24:9e
madwifi_sta_clear_stats: addr=00:20:a6:52:24:9e
WPA: 00:20:a6:52:24:9e WPA_PTK_GROUP entering state REKEYNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
Plaintext EAPOL-Key Key Data - hexdump(len=32): ba 3d 03 2b fd 37 79 be 2e 90 b6 59 51 69 d6 af fa 69 3f ec 13 a8 cc 5b 46 22 0e 27 a9 b8 7c e1
TX EAPOL - hexdump(len=145): 00 20 a6 52 24 9e 00 40 f4 e6 29 37 88 8e 02 03 00 7f fe 03 91 00 20 00 00 00 00 00 00 00 03 ed 81 47 84 af 89 0e 6e 0d 65 2d c3 91 c1 c3 69 dd 59 03 61 42 4b d3 a6 05 07 81 fc 3e c2 75 78 dd 59 03 61 42 4b d3 a6 05 07 81 fc 3e c2 75 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 15 bd 70 4f e3 be 26 1f f3 58 d3 29 21 30 52 00 20 78 ea 9d 42 f
My hostapd.conf file is
##### hostapd configuration file ##############################################
# Empty lines and lines starting with # are ignored
# AP netdevice name (without 'ap' prefix, i.e., wlan0 uses wlan0ap for
# management frames); ath0 for madwifi
#interface=eth3
interface=ath0
# In case of madwifi driver, an additional configuration parameter, bridge,
# must be used to notify hostapd if the interface is included in a bridge. This
# parameter is not used with Host AP driver.
#bridge=br0
# Driver interface type (hostap/wired/madwifi/prism54; default: hostap)
driver=madwifi
# hostapd event logger configuration
#
# Two output method: syslog and stdout (only usable if not forking to
# background).
#
# Module bitfield (ORed bitfield of modules that will be logged; -1 = all
# modules):
# bit 0 (1) = IEEE 802.11
# bit 1 (2) = IEEE 802.1X
# bit 2 (4) = RADIUS
# bit 3 (8) = WPA
# bit 4 (16) = driver interface
# bit 5 (32) = IAPP
#
# Levels (minimum value for logged events):
# 0 = verbose debugging
# 1 = debugging
# 2 = informational messages
# 3 = notification
# 4 = warning
#
logger_syslog=-1
logger_syslog_level=4
logger_stdout=-1
logger_stdout_level=4
# Debugging: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive
debug=4
# Dump file for state information (on SIGUSR1)
dump_file=/tmp/hostapd.dump
# Interface for separate control program. If this is specified, hostapd
# will create this directory and a UNIX domain socket for listening to requests
# from external programs (CLI/GUI, etc.) for status information and
# configuration. The socket file will be named based on the interface name, so
# multiple hostapd processes/interfaces can be run at the same time if more
# than one interface is used.
# /var/run/hostapd is the recommended directory for sockets and by default,
# hostapd_cli will use it when trying to connect with hostapd.
ctrl_interface=/var/run/hostapd
# Access control for the control interface can be configured by setting the
# directory to allow only members of a group to use sockets. This way, it is
# possible to run hostapd as root (since it needs to change network
# configuration and open raw sockets) and still allow GUI/CLI components to be
# run as non-root users. However, since the control interface can be used to
# change the network configuration, this access needs to be protected in many
# cases. By default, hostapd is configured to use gid 0 (root). If you
# want to allow non-root users to use the contron interface, add a new group
# and change this value to match with that group. Add users that should have
# control interface access to this group.
#
# This variable can be a group name or gid.
#ctrl_interface_group=wheel
ctrl_interface_group=0
##### IEEE 802.11 related configuration #######################################
# SSID to be used in IEEE 802.11 management frames
ssid=wpa
# Station MAC address -based authentication
# 0 = accept unless in deny list
# 1 = deny unless in accept list
# 2 = use external RADIUS server (accept/deny lists are searched first)
macaddr_acl=0
# Accept/deny lists are read from separate files (containing list of
# MAC addresses, one per line). Use absolute path name to make sure that the
# files can be read on SIGHUP configuration reloads.
#accept_mac_file=/etc/hostapd.accept
#deny_mac_file=/etc/hostapd.deny
# IEEE 802.11 specifies two authentication algorithms. hostapd can be
# configured to allow both of these or only one. Open system authentication
# should be used with IEEE 802.1X.
# Bit fields of allowed authentication algorithms:
# bit 0 = Open System Authentication
# bit 1 = Shared Key Authentication (requires WEP)
auth_algs=1
# Associate as a station to another AP while still acting as an AP on the same
# channel.
#assoc_ap_addr=00:12:34:56:78:9a
##### IEEE 802.1X-2004 related configuration ##################################
# Require IEEE 802.1X authorization
#ieee8021x=1
# Optional displayable message sent with EAP Request-Identity. The first \0
# in this string will be converted to ASCII-0 (nul). This can be used to
# separate network info (comma separated list of attribute=value pairs); see,
# e.g., draft-adrangi-eap-network-discovery-07.txt.
#eap_message=hello
#eap_message=hello\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com
# WEP rekeying (disabled if key lengths are not set or are set to 0)
# Key lengths for default/broadcast and individual/unicast keys:
# 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
# 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
#wep_key_len_broadcast=5
#wep_key_len_unicast=5
# Rekeying period in seconds. 0 = do not rekey (i.e., set keys only once)
#wep_rekey_period=300
# EAPOL-Key index workaround (set bit7) for WinXP Supplicant (needed only if
# only broadcast keys are used)
eapol_key_index_workaround=0
# EAP reauthentication period in seconds (default: 3600 seconds; 0 = disable
# reauthentication).
#eap_reauth_period=3600
# Use PAE group address (01:80:c2:00:00:03) instead of individual target
# address when sending EAPOL frames with driver=wired. This is the most common
# mechanism used in wired authentication, but it also requires that the port
# is only used by one station.
#use_pae_group_addr=1
##### Integrated EAP server ###################################################
# Optionally, hostapd can be configured to use an integrated EAP server
# to process EAP authentication locally without need for an external RADIUS
# server. This functionality can be used both as a local authentication server
# for IEEE 802.1X/EAPOL and as a RADIUS server for other devices.
# Use integrated EAP server instead of external RADIUS authentication
# server. This is also needed if hostapd is configured to act as a RADIUS
# authentication server.
eap_server=0
# Path for EAP server user database
#eap_user_file=/etc/hostapd.eap_user
# CA certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
#ca_cert=/etc/hostapd.ca.pem
# Server certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS
#server_cert=/etc/hostapd.server.pem
# Private key matching with the server certificate for EAP-TLS/PEAP/TTLS
# This may point to the same file as server_cert if both certificate and key
# are included in a single file. PKCS#12 (PFX) file (.p12/.pfx) can also be
# used by commenting out server_cert and specifying the PFX file as the
# private_key.
#private_key=/etc/hostapd.server.prv
# Passphrase for private key
#private_key_passwd=secret passphrase
# Enable CRL verification.
# Note: hostapd does not yet support CRL downloading based on CDP. Thus, a
# valid CRL signed by the CA is required to be included in the ca_cert file.
# This can be done by using PEM format for CA certificate and CRL and
# concatenating these into one file. Whenever CRL changes, hostapd needs to be
# restarted to take the new CRL into use.
# 0 = do not verify CRLs (default)
# 1 = check the CRL of the user certificate
# 2 = check all CRLs in the certificate path
#check_crl=1
# Configuration data for EAP-SIM database/authentication gateway interface.
# This is a text string in implementation specific format. The example
# implementation in eap_sim_db.c uses this as the file name for the GSM
# authentication triplets.
#eap_sim_db=/etc/hostapd.sim_db
##### IEEE 802.11f - Inter-Access Point Protocol (IAPP) #######################
# Interface to be used for IAPP broadcast packets
#iapp_interface=eth0
##### RADIUS client configuration #############################################
# for IEEE 802.1X with external Authentication Server, IEEE 802.11
# authentication with external ACL for MAC addresses, and accounting
# The own IP address of the access point (used as NAS-IP-Address)
own_ip_addr=127.0.0.1
# Optional NAS-Identifier string for RADIUS messages. When used, this should be
# a unique to the NAS within the scope of the RADIUS server. For example, a
# fully qualified domain name can be used here.
#nas_identifier=ap.example.com
# RADIUS authentication server
#auth_server_addr=127.0.0.1
#auth_server_port=1812
#auth_server_shared_secret=secret
# RADIUS accounting server
#acct_server_addr=127.0.0.1
#acct_server_port=1813
#acct_server_shared_secret=secret
# Secondary RADIUS servers; to be used if primary one does not reply to
# RADIUS packets. These are optional and there can be more than one secondary
# server listed.
#auth_server_addr=127.0.0.2
#auth_server_port=1812
#auth_server_shared_secret=secret2
#
#acct_server_addr=127.0.0.2
#acct_server_port=1813
#acct_server_shared_secret=secret2
# Retry interval for trying to return to the primary RADIUS server (in
# seconds). RADIUS client code will automatically try to use the next server
# when the current server is not replying to requests. If this interval is set,
# primary server will be retried after configured amount of time even if the
# currently used secondary server is still working.
#radius_retry_primary_interval=600
# Interim accounting update interval
# If this is set (larger than 0) and acct_server is configured, hostapd will
# send interim accounting updates every N seconds. Note: if set, this overrides
# possible Acct-Interim-Interval attribute in Access-Accept message. Thus, this
# value should not be configured in hostapd.conf, if RADIUS server is used to
# control the interim interval.
# This value should not be less 600 (10 minutes) and must not be less than
# 60 (1 minute).
#radius_acct_interim_interval=600
##### RADIUS authentication server configuration ##############################
# hostapd can be used as a RADIUS authentication server for other hosts. This
# requires that the integrated EAP authenticator is also enabled and both
# authentication services are sharing the same configuration.
# File name of the RADIUS clients configuration for the RADIUS server. If this
# commented out, RADIUS server is disabled.
#radius_server_clients=/etc/hostapd.radius_clients
# The UDP port number for the RADIUS authentication server
#radius_server_auth_port=1812
# Use IPv6 with RADIUS server (IPv4 will also be supported using IPv6 API)
#radius_server_ipv6=1
##### WPA/IEEE 802.11i configuration ##########################################
# Enable WPA. Setting this variable configures the AP to require WPA (either
# WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either
# wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK.
# For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
# RADIUS authentication server must be configured, and WPA-EAP must be included
# in wpa_key_mgmt.
# This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0)
# and/or WPA2 (full IEEE 802.11i/RSN):
# bit0 = WPA
# bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
wpa=1
# WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
# secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
# (8..63 characters) that will be converted to PSK. This conversion uses SSID
# so the PSK changes when ASCII passphrase is used and the SSID is changed.
# wpa_psk (dot11RSNAConfigPSKValue)
# wpa_passphrase (dot11RSNAConfigPSKPassPhrase)
#wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
wpa_passphrase=123123123123
# Optionally, WPA PSKs can be read from a separate text file (containing list
# of (PSK,MAC address) pairs. This allows more than one PSK to be configured.
# Use absolute path name to make sure that the files can be read on SIGHUP
# configuration reloads.
#wpa_psk_file=/etc/hostapd.wpa_psk
# Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
# entries are separated with a space.
# (dot11RSNAConfigAuthenticationSuitesTable)
#wpa_key_mgmt=WPA-PSK WPA-EAP
wpa_key_mgmt=WPA-PSK
# Set of accepted cipher suites (encryption algorithms) for pairwise keys
# (unicast packets). This is a space separated list of algorithms:
# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
# Group cipher suite (encryption algorithm for broadcast and multicast frames)
# is automatically selected based on this configuration. If only CCMP is
# allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
# TKIP will be used as the group cipher.
# (dot11RSNAConfigPairwiseCiphersTable)
#wpa_pairwise=TKIP CCMP
wpa_pairwise=TKIP
# Time interval for rekeying GTK (broadcast/multicast encryption keys) in
# seconds. (dot11RSNAConfigGroupRekeyTime)
#wpa_group_rekey=600
# Rekey GTK when any STA that possesses the current GTK is leaving the BSS.
# (dot11RSNAConfigGroupRekeyStrict)
#wpa_strict_rekey=1
# Time interval for rekeying GMK (master key used internally to generate GTKs
# (in seconds).
#wpa_gmk_rekey=86400
# Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
# roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
# authentication and key handshake before actually associating with a new AP.
# (dot11RSNAPreauthenticationEnabled)
#rsn_preauth=1
#
# Space separated list of interfaces from which pre-authentication frames are
# accepted (e.g., 'eth0' or 'eth0 wlan0wds0'. This list should include all
# interface that are used for connections to other APs. This could include
# wired interfaces and WDS links. The normal wireless data interface towards
# associated stations (e.g., wlan0) should not be added, since
# pre-authentication is only used with APs other than the currently associated
# one.
#rsn_preauth_interfaces=eth0
> On Mon, Feb 27, 2006 at 12:51:31PM +0100, jers at inwind.it wrote:
>
> > I carried out a system with a linux AP and Windows clients.
> The used
> > security policy is WPA-PSK. In order to do that I have installed
> > hostapd (working with madwifi) on the AP and the wpa_supplicant for
> > windows on clients, in accordance with the documentation
> provided in
> > hostap site. No problems... the system works very well.
>
> > But... WHY I need to install wpa_supplicant for Windows? Why the AP
> > with hostapd and windows clients without wpa_supplicant
> cannot get the
> > connection? I have also used commercial APs and I have
> configured the
> > same clients in WPA-PSK mode with the normal procedures provided by
> > Windows/card drivers (so without wpa_supplicant). I have
> not found any
> > problem.
>
> You should not need to use wpa_supplicant on Windows because of this.
>
> > I know that WPA is standardized, so I cannot suppose that
> hostapd or
> > Windows systems use different rules, or not? What is the reason of
> > this incompatibility between hostapd and Windows?
>
> I'm not aware of any interoperability issues, i.e., this
> works fine in my tests. Could you please provide more details
> of the configuration (including hostapd.conf and madwifi
> driver version) and send a debug log from hostapd? If this is
> not enough, it would also be useful to get debug information
> from the client side. Which supplicant are you using there? Microsoft?
>
> --
> Jouni Malinen PGP
> id EFC895FA
>
> --
> No virus found in this outgoing message.
> Checked by AVG Free Edition.
> Version: 7.1.375 / Virus Database: 268.2.0/276 - Release
> Date: 07/03/2006
>
>
More information about the Hostap
mailing list