hostapd.conf(5)

📦
version 2.11 · 3 versions
, in centos-stream 10, fedora 43, fedora 44

✨ hostapd.conf — the config file for hostapd(8) ✨

okay bestie, sit down, hydrate, because we're about to talk about the config file for the hostapd(8) utility and it's lowkey iconic. 💅

🌸 NAME 🌸

hostapd.conf — the configuration file for the hostapd(8) utility. yes that's it, that's the name, short and slay. 💖

🦋 DESCRIPTION 🦋

So the tea is: the hostapd.conf utility is an authenticator for IEEE 802.11 networks. 🫶

It gives you full support for WPA/IEEE 802.11i, and it can also act as an IEEE 802.1X Authenticator with a suitable backend Authentication Server (typically FreeRADIUS). main character energy fr fr.

The configuration file is made up of global parameters and domain specific configuration:

  • IEEE 802.1X-2004
  • RADIUS client
  • RADIUS authentication server
  • WPA/IEEE 802.11i

💫 GLOBAL PARAMETERS 💫

The following parameters are recognized:

🎀 interface

Interface name. Should be set in "hostap" mode. 👑

🎀 debug

Debugging mode: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive. pick your vibe check level, no cap.

🎀 dump_file

Dump file for state information (on SIGUSR1). 🗂️

🎀 ctrl_interface

The pathname of the directory in which hostapd(8) creates UNIX domain socket files for communication with frontend programs such as hostapd_cli(8). literally the group chat where hostapd and its friends talk. 💬

🎀 ctrl_interface_group

A group name or group ID to use in setting protection on the control interface file. This can be set to allow non-root users to access the control interface files. If no group is specified, the group ID of the control interface is not modified and will, typically, be the group ID of the directory in which the socket is created. ✨

🔥 IEEE 802.1X-2004 PARAMETERS 🔥

The following parameters are recognized:

🌈 ieee8021x

Require IEEE 802.1X authorization. no auth, no entry, periodt. 🚪

🌈 eap_message

Optional displayable message sent with EAP Request-Identity. 💌

🌈 wep_key_len_broadcast

Key lengths for broadcast keys.

🌈 wep_key_len_unicast

Key lengths for unicast keys.

🌈 wep_rekey_period

Rekeying period in seconds. ⏰

🌈 eapol_key_index_workaround

EAPOL-Key index workaround (set bit7) for WinXP Supplicant. yes it's a whole workaround for WinXP, we don't make the rules. 😭

🌈 eap_reauth_period

EAP reauthentication period in seconds. To disable reauthentication, use "0". 🚫

💜 RADIUS CLIENT PARAMETERS 💜

The following parameters are recognized:

⭐ own_ip_addr

The own IP address of the access point (used as NAS-IP-Address). 🏠

⭐ nas_identifier

Optional NAS-Identifier string for RADIUS messages.

⭐ auth_server_addr, auth_server_port, auth_server_shared_secret

RADIUS authentication server parameters. Can be defined twice for secondary servers to be used if primary one does not reply to RADIUS packets. so basically a backup bestie. 🫶

⭐ acct_server_addr, acct_server_port, acct_server_shared_secret

RADIUS accounting server parameters. Can be defined twice for secondary servers to be used if primary one does not reply to RADIUS packets.

⭐ radius_retry_primary_interval

Retry interval for trying to return to the primary RADIUS server (in seconds). 🔁

⭐ radius_acct_interim_interval

Interim accounting update interval. If this is set (larger than 0) and acct_server is configured, hostapd(8) will send interim accounting updates every N seconds. 🕐

🧚 RADIUS AUTHENTICATION SERVER PARAMETERS 🧚

The following parameters are recognized:

🌸 radius_server_clients

File name of the RADIUS clients configuration for the RADIUS server. If this is commented out, RADIUS server is disabled. 🙈

🌸 radius_server_auth_port

The UDP port number for the RADIUS authentication server. 🔌

🌸 radius_server_ipv6

Use IPv6 with RADIUS server. ✨

👑 WPA/IEEE 802.11i PARAMETERS 👑

The following parameters are recognized:

💖 wpa

Enable WPA. Setting this variable configures the AP to require WPA (either WPA-PSK or WPA-RADIUS/EAP based on other configuration). 💅

💖 wpa_psk, wpa_passphrase

WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase (8..63 characters) that will be converted to PSK. This conversion uses SSID so the PSK changes when ASCII passphrase is used and the SSID is changed. okay so heads up bestie, change your SSID and your passphrase-derived PSK changes too — that's just how it is. 🔑

💖 wpa_psk_file

Optionally, WPA PSKs can be read from a separate text file (containing a list of (PSK,MAC address) pairs. 🗄️

💖 wpa_key_mgmt

Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). 🎯

💖 wpa_pairwise

Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets). See the example file for more information. 📖

💖 wpa_group_rekey

Time interval for rekeying GTK (broadcast/multicast encryption keys) in seconds. ⏳

💖 wpa_strict_rekey

Rekey GTK when any STA that possesses the current GTK is leaving the BSS. bye girl, doors closing, we're rekeying. 👋

💖 wpa_gmk_rekey

Time interval for rekeying GMK (master key used internally to generate GTKs (in seconds). 🔐

🌟 SEE ALSO 🌟

📜 HISTORY 📜

The hostapd.conf manual page and hostapd(8) functionality first appeared in NetBSD 4.0. throwback era fr fr. 🕰️

🫶 AUTHORS 🫶

This manual page is derived from the README and hostapd.conf files in the hostapd distribution provided by Jouni Malinen <jkmaline@cc.hut.fi>. king behavior, thank you for your service. 👑

and that's the whole page bestie, we ate and left no crumbs 💅✨ — this was hostapd.conf(5), version 1.0, dated 10 Feb 2021. mwah, go configure something iconic. 🎀🦋

📦 where this page comes from