请教如何用文本配置无线网卡的WPA等相关参数
-
cately
- 帖子： 51
- 注册时间： 2005-07-19 11:23
- 来自： 广州
请教如何用文本配置无线网卡的WPA等相关参数
不想再共享家里的无线网络了 很危险 想用WPA加密 但小弟不会在文本配置 请DX指导 谢谢
-
cately
- 帖子： 51
- 注册时间： 2005-07-19 11:23
- 来自： 广州
按照这里设置还是不行 真晕
WPAHowto
I installed Ubuntu and stumbled upon this HOWTO when I tried to configure WPA. Unfortunately, the state of the entry was so rough that it hindered my progress and let air out of my sails. My intent is to finish this entry so there is a complete and correct guide to setting up WPA in Ubuntu. I couldn't have written this without the excellent post that luca_linux wrote in the forums detailing how to [http://ubuntuforums.org/showthread.php?t=26623 "Setup IPW2x00 and WPA"].
By no means is this HowTo finished. It is still a work in progress and should be treated as such.
-FishFoot 2005-09-27 13:56 GMT
Brief WPA Introduction
WPA (Wireless Protected Access) is a method of encryption used when connecting to a wireless router. It is based on the same encryption technology that is used in WEP (Wireless Equivilancy Protection) but provides additional security. For more information on the subject you can see the WPA entry on WikiPedia.
Their are 2 methods of connecting to a WPA enabled router.
wpa_supplicant - a client for WPA version 1.0.
xsupplicant - a client for WPA2 (802.11X)
You will need to determine which client is appropriate for connection to your network. Please see the documentation for your router.
Regardless of which client you use, you'll need to bring the client up before you bring your wireless adapter online. Once the WPA connection is in place, you will be able to bring up dhcp and connect to your router.
Method 1: wpa_supplicant
Installation of wpa_supplicant
wpa_supplicant is not included in the default installation of Hoary. It is available as a deb package though from the universe repository. If you haven't already enabled the universe repositories you can do so in a few quick steps:
fishfoot@lappy:~$ sudo nano /etc/apt/sources.list
add (or uncomment) the following line in your /etc/apt/sources.list file
deb http://us.archive.ubuntu.com/ubuntu hoary universe
this will enable the universe repositories. Once done, exit nano and save your changes. Then run:
fishfoot@lappy:~$ sudo apt-get update
fishfoot@lappy:~$ sudo apt-get install wpasupplicant
If all goes well, wpa_supplicant is now installed.
Setting Up Your Network
Generating the WPA Pre-Shared Key
To connect to the WPA enabled network you'll need a an encryption key can be generated from the ESSID of your network and the WPA Pre-Shared Key that you have setup on your router. Assuming that your network name is MyWireless and your Pre-Shared Key is MyPreSharedKey You'll need to run the following command to generate the key:
fishfoot@lappy:~$ wpa_passphrase MyWireless MyPreSharedKey
wpa_passphrase will give you output that you can place into your /etc/wpa_supplicant.conf file. It should look something like this:
network={
ssid="MyWireless"
#psk="MyPreSharedKey"
psk=2955339317cb276c0c0f7b921bd3eaf30727597109366003124e70a5fa0b1abe
}
Editing the wpa_supplicant.conf Config File
You'll need to edit a config file, but don't worry, there isn't much to it. Run:
fishfoot@lappy:~$ sudo nano /etc/wpa_supplicant.conf
and enter the following:
ctrl_interface=/var/run/wpa_supplicant
network={
ssid="MyWireless"
scan_ssid=1
proto=WPA
key_mgmt=WPA-PSK
#You may want to remove this line for security reasons: psk="MyPreSharedKey"
psk=2955339317cb276c0c0f7b921bd3eaf30727597109366003124e70a5fa0b1abe
}
Save your changes and quit.
Testing wpa_supplicant
Next we want to bring wpa_supplicant online and make sure everything is running correctly. To do this, we'll issue a call to wpa_supplicant and check the output to make sure everything is okay. Run:
fishfoot@lappy:~$ sudo wpa_supplicant -i eth1 -c /etc/wpa_supplicant.conf -D ipw
(note: We assume that your wireless card is eth1 and that the driver you're using is ipw for an ipw2x00 based wifi card) You should see output similar to this: (only with the MAC Address of your wireless router)
Trying to associate with 00:ff:00:1e:a7:7d (SSID='MyWireless' freq=0 MHz)
Associated with 00:ff:00:1e:a7:7d
WPA: Key negotiation completed with 00:ff:00:1e:a7:7d [PTK=TKIP GTK=TKIP]
If you don't see a message like this, something may be wrong. You can run wpa_supplicant with the -d or -dd. These will produce debug and extended debug output which you can use to help isolate the problem.
Assuming that everything worked you can quit out of wpa_supplicant by pressing cntrl-c.
Connecting to the Network
At this point, we know that wpa_supplicant is correctly configured to connect to our router with the ESSID: "MyWireless". To connect to our network we're going to need to bring wpa_supplicant online and then we'll need to use ifup to complete the connection. This will grab us an IP Address from DHCP and setup the appropriate entries in the routing tables. (Can somebody please give a better description of what ifup actually does. How does this compare to using dhclient3 as in the scripts below?)
Run the following to start wpa_supplicant in the background
fishfoot@lappy:~$ sudo wpa_supplicant -B -w -i eth1 -c /etc/wpa_supplicant.conf -D ipw
fishfoot@lappy:~$ sudo ifup eth1
(note: We assume that your wireless card is eth1) You should see output that looks like:
Internet Systems Consortium DHCP Client V3.0.1
Copyright 2004 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/products/DHCP
sit0: unknown hardware address type 776
sit0: unknown hardware address type 776
Listening on LPF/eth1/00:0e:35:7b:cf:14
Sending on LPF/eth1/00:0e:35:7b:cf:14
Sending on Socket/fallback
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPOFFER from 192.168.0.1
DHCPREQUEST on eth1 to 255.255.255.255 port 67
DHCPACK from 192.168.0.1
bound to 192.168.0.100 -- renewal in 34748 seconds.
And there you have it... you are now running a WPA-PSK protected network.
Configuring Startup Options
wpa_supplicant will now be set to load on system startup but it's config file: /etc/default/wpasupplicant hasn't been setup to launch the daemon on start. To set it up to launch on start you'll need to edit /etc/default/wpasupplicant:
fishfoot@lappy:~$ sudo nano /etc/default/wpasupplicant
Here's my config file:
# /etc/default/wpasupplicant
# WARNING! Make sure you have a configuration file!
ENABLED=1
# Useful flags:
# -D <driver> Wireless Driver
# -i <ifname> Interface (required, unless specified in config)
# -c <config file> Configuration file
# -d Debugging (-dd for more)
# -w Wait for interface to come up
OPTIONS="-i eth1 -c /etc/wpa_supplicant.conf -D ipw -w"
Basically we make sure ENABLED=1 so that wpa_supplicant is enabled. Then we pass OPTIONS to wpa_supplicant that correspond to our setup. (note: We assume that your wireless card is eth1 and that the driver you're using is ipw for an ipw2x00 based wifi card)
That's pretty much it. You can now restart your system and it should come online ready to connect to your network.
For further information on wpa_supplicant, read the the wpa_supplicant website (really handy, because there is a documentation of the wpa_supplicant.conf file)
Coming Soon
Method 2: xsupplicant
Final Notes
I intend to process what is found below and digest it to be a little more readable. I don't want to delete it yet because there may be some quality information. Hopefully what is above will at least help to get you started with WPA-PSK. Good Luck.
= Original WPAHowTo Entry =
Note that there are multiple methods to do this. Listed in order of appearrance, pick the one you prefer after reading the entire document.
For more information see the comments on the bottom of this page and [ wpa].
How to get WPA working under Ubuntu (method A, V2)
This small howto describes how to get wpa_supplicant running under linux. I assume that your wireless card already is working without WPA, i.e. the driver is installed properly, if not have a look at the WiFiHowto.
UPDATE
wpa_supplicant is available as a deb package - it's in the universe repository.
$ sudo apt-get install wpasupplicant
After installing wpa supplicant, you need to setup the interface correctly, here are two ways to do that. The first one is for a static IP, the second for DHCP
TODO
iface wlan0 inet manual
pre-up ifconfig wlan0 up
up /root/ssidselect wlan0
post-down ifconfig wlan0 down
post-down killall -q wpa_supplicant
The ssidselect script is a more general script that enables you to perform more authetication tricks, such as selecting proper authentication based on the ssid found (xsupplicant, wpa, wep, none) What follows is an example of such a script combining xsupplicant, wpa_supplicant and a wep connection
# I believe the original author intended this script to be run on
# startup but I'm not entirely sure.
##### VARIABLE DEFINITIONS ##############
## WIFI DRIVER ###
# Choose the driver that your wifi card uses
# drivers:
# hostap = Host AP driver (Intersil Prism2/2.5/3)
# prism54 = Prism54.org driver (Intersil Prism GT/Duette/Indigo)
# madwifi = MADWIFI 802.11 support (Atheros, etc.)
# atmel = ATMEL AT76C5XXx (USB, PCMCIA)
# wext = Linux wireless extensions (generic)
# ndiswrapper = Linux ndiswrapper
# ipw = Intel ipw2100/2200 driver
# My Laptop is a Centrino, this works for me. You'll want to see
# this luca_linux's guide to using this card with Ubuntu.
# Basically you'll need to manually get the latest version of the drivers.
DRIVER=ipw
## INTERFACE ###
# the interface will be automatically taken from the commandline's first parameter
# ie: eth1
# (You shouldn't need to change this)
INTERFACE=$1
# Set AUTH to a default value
AUTH=NONE
##### WPA OPTIONS ######
# If you are using WPA you will need to make sure these
# variables are setup correctly.
# The path to the config file that will be used with wpa_supplicant
CONFIG_FILE=/etc/wpa_supplicant.conf
# Set timeout values that will be used when wpa_supplicant is brought online
# (you shouldn't need to change theses)
TIMEOUT=25
INTERVAL=5
STATUS=1
TIME=0
#################### BRING THE NETWORK ONLINE ################################
#### SETUP the interface INTERFACE to connect to the network that is listed
# note: each call to iwconfig sets a value on the specified interface
#
# grab the ESSID from INTERFACE and save it in NET
for NET in `iwlist $INTERFACE scan 2>/dev/null | grep ESSID | cut -d '"' -f 2`
do
# Check NET and see which network matches
case $NET in
"Apple")
#"Apple" uses wpa_supplicant so flag it
AUTH=WPA
# Set "Apple" as the network we're going to connect to using INTERFACE
iwconfig $INTERFACE essid $NET
;;
"Red"|"Yellow"|"Green")
# these ESSID's use xsupplicant
AUTH=X
# load the ESSID that was matched
iwconfig $INTERFACE essid $NET
;;
"Beer")
#"Beer" uses WEP so...
AUTH=WEP
# Set "Beer" as the network to connect to using INTERFACE
iwconfig $INTERFACE essid $NET
# Set the WEP key to be used on INTERFACE
iwconfig $INTERFACE key 0123-4567-89
# Set the encoding to not require encryption?
# (This seems incorrect)
# shouldn't it be iwconfig $INTERFACE enc restricted
iwconfig $INTERFACE enc open
;;
########
## Somebody needs to make a case for open networks
########
esac
done
# Choose the proper form of encryption for the network
case $AUTH in
WPA)
# WPA means we're using wpa_supplicant so
# we'll need to stop any running wpa_supplicants
killall wpa_supplicant
# Start wpa_supplicant
# -w = wait for interface to be added, if needed
# -B = run the wpa_supplicant process in the background
# wpa_supplicant -w -B -i $INTERFACE -c $CONFIG_FILE -D $DRIVER_NAME
/etc/init.d/wpa_supplicant start
# Try to authenticate for $TIMEOUT secs
# while status is on and there is time left before the timeout
while [[ $STATUS == 1 && $TIME -lt $TIMEOUT ]]
do
# check the status of wpa_supplicant and see if it is AUTHENTICATED
wpa_cli status | grep AUTHENTICATED > /dev/null
# save the return value from grep into STATUS. Will be 0 if matches were found, else 1.
STATUS=$?
# Incriment our time counter
TIME=$(($TIME + $INTERVAL))
# wait INTERVAL seconds
sleep $INTERVAL
done
# If authenticated, start dhclient
if [[ $STATUS -ne 1 ]]
then
# Bring up the network dhcp client. Use this for running in foreground
dhclient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE
# If you intend to run this script in the background you use this line insetead
# it will surpress output from dhclient3
# dhclient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE >/dev/null 2>/dev/null
fi
##### We should probably output an error message here
;; ###### END WPA
X)
# xsupplicant was chosen so
# use iwconfig to clear the key on the INTERFACE
iwconfig $INTERFACE key 0000000000
# set the encoding to open
iwconfig $INTERFACE enc open
# take down dhclient3
killall dhclient3 # Needed to let xsupplicant restart
# restart xsupplicant
/etc/init.d/xsupplicant/restart
;; ####### END XSUPPLICANT
WEP)
# For WEP we've just got to bring the card online.
dhlient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE
# Use the following line to run in background. All output from dhclient3 will be surpressed
# dhclient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE >/dev/null 2>/dev/null
esac
exit 0
Of course this script can also be started in the background to speed up booting. If you do this you'll want to uncomment the lines with dhcient and /dev/null on them and
CONFIGURING
After installing the WPA supplicant, you need to configure it. This is done by copying the sample wpa_supplicant.conf to /etc and editing it. The sample configuration file is well documented, so configuration should be easy.
A sample configuration for a WPA-PSK network is as follows:
network={
ssid="Network"
proto=WPA
scan_ssid=1
key_mgmt=WPA-PSK
psk="secretkey"
}
It is best to comment out all examples in the example configuration file before using it.
How to get WPA working under Ubuntu (method B, V1 added 2005-05-29)
Preparation (B)
Install the wpasupplicant package (its in the universe repository).
Disable the wpasupplicant init script. We don't want it to start automatically.
% sudo update-rc.d -f wpasupplicant remove
Save the following script as /etc/network/if-pre-up.d/wpasupplicant
#!/bin/sh
WPA_INIT_SCRIPT=/etc/init.d/wpasupplicant
WPA_CLI=/usr/sbin/wpa_cli
if [ ! -x $WPA_INIT_SCRIPT ]; then
exit 0
fi
if [ -n "$INTERFACE_WIRELESS_WPA" ]; then
$WPA_INIT_SCRIPT start
# this part can be left out but its prevents a potentially longer DHCP timeout
# from occurring while wpa supplicant is still starting its search.
TIMEOUT=10
INTERVAL=1
STATUS=1
# Try to authenticate for $TIMEOUT secs
sleep $INTERVAL
while [[ $STATUS == 1 && $TIME -lt $TIMEOUT ]]
do
$WPA_CLI status | grep AUTHENTICATED > /dev/null
STATUS=$?
TIME=$(($TIME + $INTERVAL))
sleep $INTERVAL
done
fi
Save the following script as /etc/network/if-post-down.d/wpasupplicant:
#!/bin/sh
WPA_INIT_SCRIPT=/etc/init.d/wpasupplicant
if [ ! -x $WPA_INIT_SCRIPT ]; then
exit 0
fi
if [ -n "$INTERFACE_WIRELESS_WPA" ]; then
$WPA_INIT_SCRIPT stop
fi
Configuration (B)
WPA supplicant must be told its command line arguments in the /etc/default/wpasupplicant file. An example for someone using a intel ipw driver is:
OPTIONS="-w -D ipw -i eth0 -c /etc/wpa_supplicant.conf"
All wireless network configuration (WPA, WEP, etc) will now be managed by wpasupplicant through its /etc/wpa_supplicant.conf file. See its manpage for more info. Here is an example WPA-PSK TKIP configuration for the wpa_supplicant.conf file:
network={
ssid="your-sekur3-network"
# proto=WPA
# key_mgmt=WPA-PSK
# auth_alg=OPEN
# pairwise=TKIP
# group=TKIP
psk="your key string goes here, don't use a sentance!"
priority=100
}
Finally, edit your /etc/network/interfaces file and for your wireless card's network interface add a "wireless-wpa foo" line like so:
# laptop built in mini-pci wireless interface:
iface eth0 inet dhcp
# this launches wpasupplicant for us from the if-pre-up.d/wpasupplicant script
# wireless WPA or WEP setup is configured in /etc/wpa_supplicant.conf
wireless-wpa foo
# bring it up on boot. warning: this is annoying if no valid wireless
# network is present when you boot. maybe you don't want this on.
auto eth0
The 'foo' is necessary as a value is required for all options in the interfaces file. we never use the value in our if-pre-up.d script. this method could be expanded to pass values thru wpa_cli to wpa_supplicant if someone found a use for that.
Known caveat: this assumes only a single wireless interface in the machine. The wpasupplicant package and startup scripts already assume this as it is. A better design would be to have the pre/post scripts launch wpa_supplicant based on the given interface name and type itself and kill the appropriate one later.
Comments (note the date or method type mentioned in the comment):
From unknown Tue Feb 15 15:01:20 +0000 2005 From: Date: Tue, 15 Feb 2005 15:01:20 +0000 Subject: hotplug vs pcmcia Message-ID: <20050215150120+0000@ https://www.ubuntulinux.org>
Great how-to, thanks!
Just one sugestion: why not to use hotplug instead of pcmcia? Hotplug scripts superseed the pcmcia one's to carbus devices at least I think... I can post my mod's to the hotplug scripts if you want to take a look at them --- From DaveBauer Thu Feb 24 16:22:16 +0000 2005 From: Dave Bauer Date: Thu, 24 Feb 2005 16:22:16 +0000 Subject: hotplus scripts for wpa-supplicant Message-ID: < 20050224162216+0000@www.ubuntulinux.org>
I definitely would appreciate an example of setting up wpa-supplicant with hotplug.
--- From KoreyRenner Sat Apr 16 03:27:57 +0100 2005 From: Korey Renner Date: Sat, 16 Apr 2005 03:27:57 +0100 Subject: Works for me! Message-ID: <20050416032757+0100@ https://www.ubuntulinux.org>
This worked for me! A word of warning, the text blocks above are not supposed to have any markup, but the wiki is still treating [[ ]] as markup, so if you copy and paste the lines above, be sure to delete the question marks added by the wiki. --- From GeneCaldwell Sun Apr 17 00:40:55 +0100 2005 From: Gene Caldwell Date: Sun, 17 Apr 2005 00:40:55 +0100 Subject: Works for me! Message-ID: <20050417004055+0100@ https://www.ubuntulinux.org> In-Reply-To: <20050416032757+0100@ https://www.ubuntulinux.org>
guys, I am just way too new at linux to understand what is going on here, this is not simple enough for me. like the sample WPA-PSK block above, what am I susposed to do what that ? I have absolutelt no clue. I am a win32 user looking to convert to linux, but if I can't do some of the basics like secure my computer using WPA instead of WEP and being able to browse various wi-fi networks when I am roaming using the package I found here http://www.bitbuilder.com/wifi_radar/ and maybe have a firewall and antivirus program then I may have to go back to win32. is there not a way for someone who is trying to learn to get a basic secure setup so that they can take thier time learning to operate linux ? I lookedat the script above that includes both static and DHCP but had no clue what to do with that text...I assume I create a file, a script file, but where ? where do I put it, what do I call the script file and how do I run a script file ? sorry for what you may see as very basic questions, but I have not been able to find a single place to answe any of the questions I just asked and really don't know how people are expected to learn. --- From PeterDedecker Sun Apr 17 16:03:57 +0100 2005 From: Peter Dedecker Date: Sun, 17 Apr 2005 16:03:57 +0100 Subject: Don't shoot the pianist Message-ID: < 20050417160357+0100@www.ubuntulinux.org>
As you can see, this page is just a draft and needs some more modification to make it a good howto. The author knows it, don't shoot him please. You can also read the manual at the wpa_supplicant website if you want to make it work now, instead of waiting for the completion of this howto. I also don't know where this file needs to be put. --- From ManuelValdés Sun Apr 17 22:13:06 +0100 2005 From: Manuel Valdés Date: Sun, 17 Apr 2005 22:13:06 +0100 Subject: a newbie that made it Message-ID: <20050417221306+0100@ https://www.ubuntulinux.org>
Trying to automatically load wpa_supplicant during login, and not really knowing what i was doing, i added the following lines to /etc/network/interfaces, and they're both working fine. The first one starts wpa_supplicant when the interface goes up and the second one kills the process when the interfaces goes down: up wpa_supplicant -wB -iwlan0 -c/etc/wpa_supplicant.conf -Dndiswrapper down killall wpa_supplicant --- From TomasVilda Mon Apr 18 10:11:41 +0100 2005 From: Tomas Vilda Date: Mon, 18 Apr 2005 10:11:41 +0100 Subject: Don't shoot the pianist Message-ID: <20050418101141+0100@ https://www.ubuntulinux.org> In-Reply-To: < 20050417160357+0100@www.ubuntulinux.org>
WPA Howto made for Intel Pro Wireless 2200BG can be found at http://tvilda.tigbis.lt/dokuwiki/doku.p ... i-howto_en , it's done according to this draft, if you want to use it for non Intel Pro Wireless, just change argument for wpa_supplicant on the script and skip intel drivers upgrade section.
From GregoryPSmith Mon May 30 00:42:18 +0100 2005 From: Gregory P Smith Date: Mon, 30 May 2005 00:42:18 +0100 Subject: Just added "Method B", give it a whirl Message-ID: < 20050530004218+0100@www.ubuntulinux.org>
I just added the Method B documentation. Hopefully its helpful to someone. It works well for me and avoids the headache of wpasupplicant and network configuration being seperate startup scripts. I just wish ubuntu could be told to always do network interface bringup in the background so this wouldn't hurt boot time.
From DennisKaarsemaker Mon May 30 08:01:06 +0100 2005 From: Dennis Kaarsemaker Date: Mon, 30 May 2005 08:01:06 +0100 Subject: Bringing up in the background Message-ID: <20050530080106+0100@ https://www.ubuntulinux.org>
You could change line 86/88 in /etc/network/interfaces from ifup -a to ifup -a &
From unknown Wed Jun 1 20:05:42 +0100 2005 From: Date: Wed, 01 Jun 2005 20:05:42 +0100 Subject: Some remarks (for newbies) Message-ID: < 20050601200542+0100@www.ubuntulinux.org>
As a newbie to Linux (ok, not completely) I can recommend method B to other newbies. However, i have some remarks: 1) if you're using ndiswrapper change this line [OPTIONS="-w -D ipw -i eth0 -c /etc/wpa_supplicant.conf"] to [OPTIONS="-w -D ndiswrapper -i wlan0 -c /etc/wpa_supplicant.conf"]
2) To generate a PSK key string for your wpa_supplicant.conf file, use this: [wpa_passphrase <ssid> <passphrase>]. Example: [wpa_passphrase MyHomeWireless SuperSecretPassphrase] ..which gives you an output something like:
network={ ssid="MyHomeWireless" # psk="SuperSecretPassphrase" psk=e42ac2538ef03f906d37332a0df4446150e04cdcdd392e309486075065a70a1f }
(this is were i get this info from: http://ubuntuforums.org/archive/index.php/t-31418.html)
3) Also for people using ndiswrapper, in the part about the "wireless-wpa foo" line change [interface eth0 inet dhcp] to [interface wlan0 inet dhcp] and change [auto eth0] to [auto wlan0]. So if you're using ndiswrapper, wherever you see eth0 just change it to wlan0
And last but not least, a note for the author of this wiki: it helped me a lot but maybe it can be improved a bit. Maybe my remarks are useful and i think its also useful to place a link to the SetupNdiswrapperHowto.
I have a question in regards to the wpa_passphrase tool to create the PSK value. When you have in the pre-shared key (PSK) a character like "!" how can you make it return the value? Currently our pre-shared key is something like this "mypre$hared!k3y" and the system chokes on the ! character and says that there is no event !k3y found. I have tried with quotes and everything. Does anybody either have a fix for a situation like this or another method to create the value? Thank you for your help. Great doc!
CategoryDocumentation
WPAHowto
I installed Ubuntu and stumbled upon this HOWTO when I tried to configure WPA. Unfortunately, the state of the entry was so rough that it hindered my progress and let air out of my sails. My intent is to finish this entry so there is a complete and correct guide to setting up WPA in Ubuntu. I couldn't have written this without the excellent post that luca_linux wrote in the forums detailing how to [http://ubuntuforums.org/showthread.php?t=26623 "Setup IPW2x00 and WPA"].
By no means is this HowTo finished. It is still a work in progress and should be treated as such.
-FishFoot 2005-09-27 13:56 GMT
Brief WPA Introduction
WPA (Wireless Protected Access) is a method of encryption used when connecting to a wireless router. It is based on the same encryption technology that is used in WEP (Wireless Equivilancy Protection) but provides additional security. For more information on the subject you can see the WPA entry on WikiPedia.
Their are 2 methods of connecting to a WPA enabled router.
wpa_supplicant - a client for WPA version 1.0.
xsupplicant - a client for WPA2 (802.11X)
You will need to determine which client is appropriate for connection to your network. Please see the documentation for your router.
Regardless of which client you use, you'll need to bring the client up before you bring your wireless adapter online. Once the WPA connection is in place, you will be able to bring up dhcp and connect to your router.
Method 1: wpa_supplicant
Installation of wpa_supplicant
wpa_supplicant is not included in the default installation of Hoary. It is available as a deb package though from the universe repository. If you haven't already enabled the universe repositories you can do so in a few quick steps:
fishfoot@lappy:~$ sudo nano /etc/apt/sources.list
add (or uncomment) the following line in your /etc/apt/sources.list file
deb http://us.archive.ubuntu.com/ubuntu hoary universe
this will enable the universe repositories. Once done, exit nano and save your changes. Then run:
fishfoot@lappy:~$ sudo apt-get update
fishfoot@lappy:~$ sudo apt-get install wpasupplicant
If all goes well, wpa_supplicant is now installed.
Setting Up Your Network
Generating the WPA Pre-Shared Key
To connect to the WPA enabled network you'll need a an encryption key can be generated from the ESSID of your network and the WPA Pre-Shared Key that you have setup on your router. Assuming that your network name is MyWireless and your Pre-Shared Key is MyPreSharedKey You'll need to run the following command to generate the key:
fishfoot@lappy:~$ wpa_passphrase MyWireless MyPreSharedKey
wpa_passphrase will give you output that you can place into your /etc/wpa_supplicant.conf file. It should look something like this:
network={
ssid="MyWireless"
#psk="MyPreSharedKey"
psk=2955339317cb276c0c0f7b921bd3eaf30727597109366003124e70a5fa0b1abe
}
Editing the wpa_supplicant.conf Config File
You'll need to edit a config file, but don't worry, there isn't much to it. Run:
fishfoot@lappy:~$ sudo nano /etc/wpa_supplicant.conf
and enter the following:
ctrl_interface=/var/run/wpa_supplicant
network={
ssid="MyWireless"
scan_ssid=1
proto=WPA
key_mgmt=WPA-PSK
#You may want to remove this line for security reasons: psk="MyPreSharedKey"
psk=2955339317cb276c0c0f7b921bd3eaf30727597109366003124e70a5fa0b1abe
}
Save your changes and quit.
Testing wpa_supplicant
Next we want to bring wpa_supplicant online and make sure everything is running correctly. To do this, we'll issue a call to wpa_supplicant and check the output to make sure everything is okay. Run:
fishfoot@lappy:~$ sudo wpa_supplicant -i eth1 -c /etc/wpa_supplicant.conf -D ipw
(note: We assume that your wireless card is eth1 and that the driver you're using is ipw for an ipw2x00 based wifi card) You should see output similar to this: (only with the MAC Address of your wireless router)
Trying to associate with 00:ff:00:1e:a7:7d (SSID='MyWireless' freq=0 MHz)
Associated with 00:ff:00:1e:a7:7d
WPA: Key negotiation completed with 00:ff:00:1e:a7:7d [PTK=TKIP GTK=TKIP]
If you don't see a message like this, something may be wrong. You can run wpa_supplicant with the -d or -dd. These will produce debug and extended debug output which you can use to help isolate the problem.
Assuming that everything worked you can quit out of wpa_supplicant by pressing cntrl-c.
Connecting to the Network
At this point, we know that wpa_supplicant is correctly configured to connect to our router with the ESSID: "MyWireless". To connect to our network we're going to need to bring wpa_supplicant online and then we'll need to use ifup to complete the connection. This will grab us an IP Address from DHCP and setup the appropriate entries in the routing tables. (Can somebody please give a better description of what ifup actually does. How does this compare to using dhclient3 as in the scripts below?)
Run the following to start wpa_supplicant in the background
fishfoot@lappy:~$ sudo wpa_supplicant -B -w -i eth1 -c /etc/wpa_supplicant.conf -D ipw
fishfoot@lappy:~$ sudo ifup eth1
(note: We assume that your wireless card is eth1) You should see output that looks like:
Internet Systems Consortium DHCP Client V3.0.1
Copyright 2004 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/products/DHCP
sit0: unknown hardware address type 776
sit0: unknown hardware address type 776
Listening on LPF/eth1/00:0e:35:7b:cf:14
Sending on LPF/eth1/00:0e:35:7b:cf:14
Sending on Socket/fallback
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPOFFER from 192.168.0.1
DHCPREQUEST on eth1 to 255.255.255.255 port 67
DHCPACK from 192.168.0.1
bound to 192.168.0.100 -- renewal in 34748 seconds.
And there you have it... you are now running a WPA-PSK protected network.
Configuring Startup Options
wpa_supplicant will now be set to load on system startup but it's config file: /etc/default/wpasupplicant hasn't been setup to launch the daemon on start. To set it up to launch on start you'll need to edit /etc/default/wpasupplicant:
fishfoot@lappy:~$ sudo nano /etc/default/wpasupplicant
Here's my config file:
# /etc/default/wpasupplicant
# WARNING! Make sure you have a configuration file!
ENABLED=1
# Useful flags:
# -D <driver> Wireless Driver
# -i <ifname> Interface (required, unless specified in config)
# -c <config file> Configuration file
# -d Debugging (-dd for more)
# -w Wait for interface to come up
OPTIONS="-i eth1 -c /etc/wpa_supplicant.conf -D ipw -w"
Basically we make sure ENABLED=1 so that wpa_supplicant is enabled. Then we pass OPTIONS to wpa_supplicant that correspond to our setup. (note: We assume that your wireless card is eth1 and that the driver you're using is ipw for an ipw2x00 based wifi card)
That's pretty much it. You can now restart your system and it should come online ready to connect to your network.
For further information on wpa_supplicant, read the the wpa_supplicant website (really handy, because there is a documentation of the wpa_supplicant.conf file)
Coming Soon
Method 2: xsupplicant
Final Notes
I intend to process what is found below and digest it to be a little more readable. I don't want to delete it yet because there may be some quality information. Hopefully what is above will at least help to get you started with WPA-PSK. Good Luck.
= Original WPAHowTo Entry =
Note that there are multiple methods to do this. Listed in order of appearrance, pick the one you prefer after reading the entire document.
For more information see the comments on the bottom of this page and [ wpa].
How to get WPA working under Ubuntu (method A, V2)
This small howto describes how to get wpa_supplicant running under linux. I assume that your wireless card already is working without WPA, i.e. the driver is installed properly, if not have a look at the WiFiHowto.
UPDATE
wpa_supplicant is available as a deb package - it's in the universe repository.
$ sudo apt-get install wpasupplicant
After installing wpa supplicant, you need to setup the interface correctly, here are two ways to do that. The first one is for a static IP, the second for DHCP
TODO
iface wlan0 inet manual
pre-up ifconfig wlan0 up
up /root/ssidselect wlan0
post-down ifconfig wlan0 down
post-down killall -q wpa_supplicant
The ssidselect script is a more general script that enables you to perform more authetication tricks, such as selecting proper authentication based on the ssid found (xsupplicant, wpa, wep, none) What follows is an example of such a script combining xsupplicant, wpa_supplicant and a wep connection
# I believe the original author intended this script to be run on
# startup but I'm not entirely sure.
##### VARIABLE DEFINITIONS ##############
## WIFI DRIVER ###
# Choose the driver that your wifi card uses
# drivers:
# hostap = Host AP driver (Intersil Prism2/2.5/3)
# prism54 = Prism54.org driver (Intersil Prism GT/Duette/Indigo)
# madwifi = MADWIFI 802.11 support (Atheros, etc.)
# atmel = ATMEL AT76C5XXx (USB, PCMCIA)
# wext = Linux wireless extensions (generic)
# ndiswrapper = Linux ndiswrapper
# ipw = Intel ipw2100/2200 driver
# My Laptop is a Centrino, this works for me. You'll want to see
# this luca_linux's guide to using this card with Ubuntu.
# Basically you'll need to manually get the latest version of the drivers.
DRIVER=ipw
## INTERFACE ###
# the interface will be automatically taken from the commandline's first parameter
# ie: eth1
# (You shouldn't need to change this)
INTERFACE=$1
# Set AUTH to a default value
AUTH=NONE
##### WPA OPTIONS ######
# If you are using WPA you will need to make sure these
# variables are setup correctly.
# The path to the config file that will be used with wpa_supplicant
CONFIG_FILE=/etc/wpa_supplicant.conf
# Set timeout values that will be used when wpa_supplicant is brought online
# (you shouldn't need to change theses)
TIMEOUT=25
INTERVAL=5
STATUS=1
TIME=0
#################### BRING THE NETWORK ONLINE ################################
#### SETUP the interface INTERFACE to connect to the network that is listed
# note: each call to iwconfig sets a value on the specified interface
#
# grab the ESSID from INTERFACE and save it in NET
for NET in `iwlist $INTERFACE scan 2>/dev/null | grep ESSID | cut -d '"' -f 2`
do
# Check NET and see which network matches
case $NET in
"Apple")
#"Apple" uses wpa_supplicant so flag it
AUTH=WPA
# Set "Apple" as the network we're going to connect to using INTERFACE
iwconfig $INTERFACE essid $NET
;;
"Red"|"Yellow"|"Green")
# these ESSID's use xsupplicant
AUTH=X
# load the ESSID that was matched
iwconfig $INTERFACE essid $NET
;;
"Beer")
#"Beer" uses WEP so...
AUTH=WEP
# Set "Beer" as the network to connect to using INTERFACE
iwconfig $INTERFACE essid $NET
# Set the WEP key to be used on INTERFACE
iwconfig $INTERFACE key 0123-4567-89
# Set the encoding to not require encryption?
# (This seems incorrect)
# shouldn't it be iwconfig $INTERFACE enc restricted
iwconfig $INTERFACE enc open
;;
########
## Somebody needs to make a case for open networks
########
esac
done
# Choose the proper form of encryption for the network
case $AUTH in
WPA)
# WPA means we're using wpa_supplicant so
# we'll need to stop any running wpa_supplicants
killall wpa_supplicant
# Start wpa_supplicant
# -w = wait for interface to be added, if needed
# -B = run the wpa_supplicant process in the background
# wpa_supplicant -w -B -i $INTERFACE -c $CONFIG_FILE -D $DRIVER_NAME
/etc/init.d/wpa_supplicant start
# Try to authenticate for $TIMEOUT secs
# while status is on and there is time left before the timeout
while [[ $STATUS == 1 && $TIME -lt $TIMEOUT ]]
do
# check the status of wpa_supplicant and see if it is AUTHENTICATED
wpa_cli status | grep AUTHENTICATED > /dev/null
# save the return value from grep into STATUS. Will be 0 if matches were found, else 1.
STATUS=$?
# Incriment our time counter
TIME=$(($TIME + $INTERVAL))
# wait INTERVAL seconds
sleep $INTERVAL
done
# If authenticated, start dhclient
if [[ $STATUS -ne 1 ]]
then
# Bring up the network dhcp client. Use this for running in foreground
dhclient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE
# If you intend to run this script in the background you use this line insetead
# it will surpress output from dhclient3
# dhclient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE >/dev/null 2>/dev/null
fi
##### We should probably output an error message here
;; ###### END WPA
X)
# xsupplicant was chosen so
# use iwconfig to clear the key on the INTERFACE
iwconfig $INTERFACE key 0000000000
# set the encoding to open
iwconfig $INTERFACE enc open
# take down dhclient3
killall dhclient3 # Needed to let xsupplicant restart
# restart xsupplicant
/etc/init.d/xsupplicant/restart
;; ####### END XSUPPLICANT
WEP)
# For WEP we've just got to bring the card online.
dhlient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE
# Use the following line to run in background. All output from dhclient3 will be surpressed
# dhclient3 -pf /var/run/dhclient.$INTERFACE.pid -lf /var/run/dhclient.$INTERFACE.leases $INTERFACE >/dev/null 2>/dev/null
esac
exit 0
Of course this script can also be started in the background to speed up booting. If you do this you'll want to uncomment the lines with dhcient and /dev/null on them and
CONFIGURING
After installing the WPA supplicant, you need to configure it. This is done by copying the sample wpa_supplicant.conf to /etc and editing it. The sample configuration file is well documented, so configuration should be easy.
A sample configuration for a WPA-PSK network is as follows:
network={
ssid="Network"
proto=WPA
scan_ssid=1
key_mgmt=WPA-PSK
psk="secretkey"
}
It is best to comment out all examples in the example configuration file before using it.
How to get WPA working under Ubuntu (method B, V1 added 2005-05-29)
Preparation (B)
Install the wpasupplicant package (its in the universe repository).
Disable the wpasupplicant init script. We don't want it to start automatically.
% sudo update-rc.d -f wpasupplicant remove
Save the following script as /etc/network/if-pre-up.d/wpasupplicant
#!/bin/sh
WPA_INIT_SCRIPT=/etc/init.d/wpasupplicant
WPA_CLI=/usr/sbin/wpa_cli
if [ ! -x $WPA_INIT_SCRIPT ]; then
exit 0
fi
if [ -n "$INTERFACE_WIRELESS_WPA" ]; then
$WPA_INIT_SCRIPT start
# this part can be left out but its prevents a potentially longer DHCP timeout
# from occurring while wpa supplicant is still starting its search.
TIMEOUT=10
INTERVAL=1
STATUS=1
# Try to authenticate for $TIMEOUT secs
sleep $INTERVAL
while [[ $STATUS == 1 && $TIME -lt $TIMEOUT ]]
do
$WPA_CLI status | grep AUTHENTICATED > /dev/null
STATUS=$?
TIME=$(($TIME + $INTERVAL))
sleep $INTERVAL
done
fi
Save the following script as /etc/network/if-post-down.d/wpasupplicant:
#!/bin/sh
WPA_INIT_SCRIPT=/etc/init.d/wpasupplicant
if [ ! -x $WPA_INIT_SCRIPT ]; then
exit 0
fi
if [ -n "$INTERFACE_WIRELESS_WPA" ]; then
$WPA_INIT_SCRIPT stop
fi
Configuration (B)
WPA supplicant must be told its command line arguments in the /etc/default/wpasupplicant file. An example for someone using a intel ipw driver is:
OPTIONS="-w -D ipw -i eth0 -c /etc/wpa_supplicant.conf"
All wireless network configuration (WPA, WEP, etc) will now be managed by wpasupplicant through its /etc/wpa_supplicant.conf file. See its manpage for more info. Here is an example WPA-PSK TKIP configuration for the wpa_supplicant.conf file:
network={
ssid="your-sekur3-network"
# proto=WPA
# key_mgmt=WPA-PSK
# auth_alg=OPEN
# pairwise=TKIP
# group=TKIP
psk="your key string goes here, don't use a sentance!"
priority=100
}
Finally, edit your /etc/network/interfaces file and for your wireless card's network interface add a "wireless-wpa foo" line like so:
# laptop built in mini-pci wireless interface:
iface eth0 inet dhcp
# this launches wpasupplicant for us from the if-pre-up.d/wpasupplicant script
# wireless WPA or WEP setup is configured in /etc/wpa_supplicant.conf
wireless-wpa foo
# bring it up on boot. warning: this is annoying if no valid wireless
# network is present when you boot. maybe you don't want this on.
auto eth0
The 'foo' is necessary as a value is required for all options in the interfaces file. we never use the value in our if-pre-up.d script. this method could be expanded to pass values thru wpa_cli to wpa_supplicant if someone found a use for that.
Known caveat: this assumes only a single wireless interface in the machine. The wpasupplicant package and startup scripts already assume this as it is. A better design would be to have the pre/post scripts launch wpa_supplicant based on the given interface name and type itself and kill the appropriate one later.
Comments (note the date or method type mentioned in the comment):
From unknown Tue Feb 15 15:01:20 +0000 2005 From: Date: Tue, 15 Feb 2005 15:01:20 +0000 Subject: hotplug vs pcmcia Message-ID: <20050215150120+0000@ https://www.ubuntulinux.org>
Great how-to, thanks!
Just one sugestion: why not to use hotplug instead of pcmcia? Hotplug scripts superseed the pcmcia one's to carbus devices at least I think... I can post my mod's to the hotplug scripts if you want to take a look at them --- From DaveBauer Thu Feb 24 16:22:16 +0000 2005 From: Dave Bauer Date: Thu, 24 Feb 2005 16:22:16 +0000 Subject: hotplus scripts for wpa-supplicant Message-ID: < 20050224162216+0000@www.ubuntulinux.org>
I definitely would appreciate an example of setting up wpa-supplicant with hotplug.
--- From KoreyRenner Sat Apr 16 03:27:57 +0100 2005 From: Korey Renner Date: Sat, 16 Apr 2005 03:27:57 +0100 Subject: Works for me! Message-ID: <20050416032757+0100@ https://www.ubuntulinux.org>
This worked for me! A word of warning, the text blocks above are not supposed to have any markup, but the wiki is still treating [[ ]] as markup, so if you copy and paste the lines above, be sure to delete the question marks added by the wiki. --- From GeneCaldwell Sun Apr 17 00:40:55 +0100 2005 From: Gene Caldwell Date: Sun, 17 Apr 2005 00:40:55 +0100 Subject: Works for me! Message-ID: <20050417004055+0100@ https://www.ubuntulinux.org> In-Reply-To: <20050416032757+0100@ https://www.ubuntulinux.org>
guys, I am just way too new at linux to understand what is going on here, this is not simple enough for me. like the sample WPA-PSK block above, what am I susposed to do what that ? I have absolutelt no clue. I am a win32 user looking to convert to linux, but if I can't do some of the basics like secure my computer using WPA instead of WEP and being able to browse various wi-fi networks when I am roaming using the package I found here http://www.bitbuilder.com/wifi_radar/ and maybe have a firewall and antivirus program then I may have to go back to win32. is there not a way for someone who is trying to learn to get a basic secure setup so that they can take thier time learning to operate linux ? I lookedat the script above that includes both static and DHCP but had no clue what to do with that text...I assume I create a file, a script file, but where ? where do I put it, what do I call the script file and how do I run a script file ? sorry for what you may see as very basic questions, but I have not been able to find a single place to answe any of the questions I just asked and really don't know how people are expected to learn. --- From PeterDedecker Sun Apr 17 16:03:57 +0100 2005 From: Peter Dedecker Date: Sun, 17 Apr 2005 16:03:57 +0100 Subject: Don't shoot the pianist Message-ID: < 20050417160357+0100@www.ubuntulinux.org>
As you can see, this page is just a draft and needs some more modification to make it a good howto. The author knows it, don't shoot him please. You can also read the manual at the wpa_supplicant website if you want to make it work now, instead of waiting for the completion of this howto. I also don't know where this file needs to be put. --- From ManuelValdés Sun Apr 17 22:13:06 +0100 2005 From: Manuel Valdés Date: Sun, 17 Apr 2005 22:13:06 +0100 Subject: a newbie that made it Message-ID: <20050417221306+0100@ https://www.ubuntulinux.org>
Trying to automatically load wpa_supplicant during login, and not really knowing what i was doing, i added the following lines to /etc/network/interfaces, and they're both working fine. The first one starts wpa_supplicant when the interface goes up and the second one kills the process when the interfaces goes down: up wpa_supplicant -wB -iwlan0 -c/etc/wpa_supplicant.conf -Dndiswrapper down killall wpa_supplicant --- From TomasVilda Mon Apr 18 10:11:41 +0100 2005 From: Tomas Vilda Date: Mon, 18 Apr 2005 10:11:41 +0100 Subject: Don't shoot the pianist Message-ID: <20050418101141+0100@ https://www.ubuntulinux.org> In-Reply-To: < 20050417160357+0100@www.ubuntulinux.org>
WPA Howto made for Intel Pro Wireless 2200BG can be found at http://tvilda.tigbis.lt/dokuwiki/doku.p ... i-howto_en , it's done according to this draft, if you want to use it for non Intel Pro Wireless, just change argument for wpa_supplicant on the script and skip intel drivers upgrade section.
From GregoryPSmith Mon May 30 00:42:18 +0100 2005 From: Gregory P Smith Date: Mon, 30 May 2005 00:42:18 +0100 Subject: Just added "Method B", give it a whirl Message-ID: < 20050530004218+0100@www.ubuntulinux.org>
I just added the Method B documentation. Hopefully its helpful to someone. It works well for me and avoids the headache of wpasupplicant and network configuration being seperate startup scripts. I just wish ubuntu could be told to always do network interface bringup in the background so this wouldn't hurt boot time.
From DennisKaarsemaker Mon May 30 08:01:06 +0100 2005 From: Dennis Kaarsemaker Date: Mon, 30 May 2005 08:01:06 +0100 Subject: Bringing up in the background Message-ID: <20050530080106+0100@ https://www.ubuntulinux.org>
You could change line 86/88 in /etc/network/interfaces from ifup -a to ifup -a &
From unknown Wed Jun 1 20:05:42 +0100 2005 From: Date: Wed, 01 Jun 2005 20:05:42 +0100 Subject: Some remarks (for newbies) Message-ID: < 20050601200542+0100@www.ubuntulinux.org>
As a newbie to Linux (ok, not completely) I can recommend method B to other newbies. However, i have some remarks: 1) if you're using ndiswrapper change this line [OPTIONS="-w -D ipw -i eth0 -c /etc/wpa_supplicant.conf"] to [OPTIONS="-w -D ndiswrapper -i wlan0 -c /etc/wpa_supplicant.conf"]
2) To generate a PSK key string for your wpa_supplicant.conf file, use this: [wpa_passphrase <ssid> <passphrase>]. Example: [wpa_passphrase MyHomeWireless SuperSecretPassphrase] ..which gives you an output something like:
network={ ssid="MyHomeWireless" # psk="SuperSecretPassphrase" psk=e42ac2538ef03f906d37332a0df4446150e04cdcdd392e309486075065a70a1f }
(this is were i get this info from: http://ubuntuforums.org/archive/index.php/t-31418.html)
3) Also for people using ndiswrapper, in the part about the "wireless-wpa foo" line change [interface eth0 inet dhcp] to [interface wlan0 inet dhcp] and change [auto eth0] to [auto wlan0]. So if you're using ndiswrapper, wherever you see eth0 just change it to wlan0
And last but not least, a note for the author of this wiki: it helped me a lot but maybe it can be improved a bit. Maybe my remarks are useful and i think its also useful to place a link to the SetupNdiswrapperHowto.
I have a question in regards to the wpa_passphrase tool to create the PSK value. When you have in the pre-shared key (PSK) a character like "!" how can you make it return the value? Currently our pre-shared key is something like this "mypre$hared!k3y" and the system chokes on the ! character and says that there is no event !k3y found. I have tried with quotes and everything. Does anybody either have a fix for a situation like this or another method to create the value? Thank you for your help. Great doc!
CategoryDocumentation
-
marsteel
- 帖子： 555
- 注册时间： 2005-11-28 12:09
- 联系：