wpa_supplicant
wpa_supplicant 是跨平台的 WPA 请求者程序(supplicant),支持 WEP、WPA 和 WPA2(IEEE 802.11i).。可以在桌面、笔记本甚至嵌入式系统中使用。
wpa_supplicant 是在客户端使用的 IEEE 802.1X/WPA 组件,支持与 WPA Authenticator 的交互,控制漫游和无线驱动的IEEE 802.11 验证和关联。
安装[编辑 | 编辑源代码]
安装 wpa_supplicant包 软件包。此软件包提供了主程序 wpa_supplicant,密码工具 wpa_passphrase 和文字界面前端 wpa_cli.
此外软件包 wpa_supplicant_guiAUR 提供了图形界面 wpa_gui。 wpa-cuteAUR 是 wpa_gui 的一个分支,提供了额外的修正和改进。
概览[编辑 | 编辑源代码]
连接到加密无线网络的第一步是让 wpa_supplicant 获取 WPA 认证者的认证。为此, wpa_supplicant 必须进行配置以使其能够向认证者提交认证信息。
完成认证后需要分配 IP 地址,请参考:网络配置#IP addresses。
用 wpa_cli 连接[编辑 | 编辑源代码]
这种方法使用了 wpa_cli 命令行工具,可以用其扫描可用网络,并配置 wpa_supplicant 。详细信息可以参考 wpa_cli(8) 。
使用 wpa_cli 前,需要先为 wpa_supplicant 指定一个控制接口,且它需要获得更新配置的权限。先创建一个最小配置:
/etc/wpa_supplicant/wpa_supplicant.conf
ctrl_interface=/run/wpa_supplicant update_config=1
接下来启动 wpa_supplicant :
# wpa_supplicant -B -i interface -c /etc/wpa_supplicant/wpa_supplicant.conf
ip link
命令查看你的无线网卡名称。完成后,执行:
# wpa_cli
这一步完成后会显示一个交互提示符 (>
),同时带有 tab 补全及命令描述功能。
/var/run/wpa_supplicant/
,可以使用 -p
选项手动指定位置,以与wpa_supplicant 的配置相符。另外,可以使用 -i
选项指定需配置的接口,否则将使用由 wpa_supplicant 管理的第一个网络接口。使用 scan
和 scan_results
命令查看可用网络:
> scan OK <3>CTRL-EVENT-SCAN-RESULTS > scan_results bssid / frequency / signal level / flags / ssid 00:00:00:00:00:00 2462 -49 [WPA2-PSK-CCMP][ESS] MYSSID 11:11:11:11:11:11 2437 -64 [WPA2-PSK-CCMP][ESS] ANOTHERSSID
要将网络与 MYSSID
进行关联,先添加网络,配置凭证并启用:
> add_network 0 > set_network 0 ssid "MYSSID" > set_network 0 psk "passphrase" > enable_network 0 <2>CTRL-EVENT-CONNECTED - Connection to 00:00:00:00:00:00 completed (reauth) [id=0 id_str=]
如果对应的 SSID 无需密码验证,则需要将命令 set_network 0 psk "passphrase"
替换为 set_network 0 key_mgmt NONE
,以将网络指定为无密码。
- 每个网络都按照数字顺序进行排列,所以第一个网络的索引为 0。
- PSK 是由 引号 括起的 "passphrase" 字符串计算而来,同时也在 wpa_passphrase 命令中显示。尽管如此,你也可以直接 不使用引号 向
psk
传入 PSK 。
最后,将网络保存到配置文件中:
> save_config OK
完成后,你需要获取一个 IP 地址,例如使用 dhcpcd 。
带 wpa 通行字的连接[编辑 | 编辑源代码]
用命令行工具 wpa_passphrase 生成 wpa_supplicant 所需的最小配置,可以快速连接到已知 SSID 的无线网络。例如:
$ wpa_passphrase MYSSID passphrase
network={ ssid="MYSSID" #psk="passphrase" psk=59e0d07fa4c7741797a4e394f38a5c321e3bed51d54ad5fcbd3f84bc7415d73d }
上例表明,wpa_supplicant 可以与 wpa_passphrase 协同工作,只需简单地这样做即可:
# wpa_supplicant -B -i interface -c <(wpa_passphrase MYSSID passphrase)
Successfully initialized wpa_supplicant Failed to open config file '/dev/fd/63', error: No such file or directory Failed to read or parse configuration '/dev/fd/63'参阅:Help:Reading#一般用户还是 root 用户。
- 如果输入内容包含空格请使用引号。例如:
"secret passphrase"
。 - 要找出无线网卡的名字,使用
ip link
命令。 - 某些不常用的复杂通行字要求从文件输入,例如:
wpa_passphrase MYSSID < passphrase.txt
;或者从命令行输入,例如:wpa_passphrase MYSSID <<< "passphrase"
。
连接后需要获取 IP 地址,可以使用 dhcpcd.
高级用法[编辑 | 编辑源代码]
对于各种纷繁复杂的网络,更常见的场景是使用 EAP 管理配置文件。各种配置及其范例可参阅手册页wpa_supplicant.conf(5);所有可支持的配置参数可参考范例文件 /etc/wpa_supplicant/wpa_supplicant.conf
。
配置[编辑 | 编辑源代码]
如上文中#带 wpa 通行字的连接一节所述,一个基本的配置文件可以这样生成:
# wpa_passphrase MYSSID passphrase > /etc/wpa_supplicant/example.conf
这样仅仅是创建了一个网络配置节段。包含更多通用配置项的配置文件类似下面这样:
/etc/wpa_supplicant/example.conf
ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel update_config=1 fast_reauth=1 ap_scan=1 network={ ssid="MYSSID" psk=59e0d07fa4c7741797a4e394f38a5c321e3bed51d54ad5fcbd3f84bc7415d73d }
如果可以不顾及安全问题,其中的通行字可以换成由引号包围的纯文本:
network={ ssid="MYSSID" psk="passphrase" }
如果某一网络没有设置通行字,比如一个公共无线网络,就是这样:
network={ ssid="MYSSID" key_mgmt=NONE }
Further network
blocks may be added manually, or using wpa_cli as illustrated in #用 wpa_cli 连接. In order to use wpa_cli, a control interface must be set with the ctrl_interface
option. Setting ctrl_interface_group=wheel
allows users belonging to such group to execute wpa_cli. This setting can be used to enable users without root access (or equivalent via sudo etc) to connect to wireless networks. Also add update_config=1
so that changes made with wpa_cli to example.conf
can be saved. Note that any user that is a member of the ctrl_interface_group
group will be able to make changes to the file if this is turned on.
fast_reauth=1
and ap_scan=1
are the wpa_supplicant options active globally at the time of writing. Whether you need them, or other global options too for that matter, depends on the type of network to connect to. If you need other global options, simply copy them over to the file from /etc/wpa_supplicant/wpa_supplicant.conf
.
Alternatively, wpa_cli set
can be used to see options' status or set new ones. Multiple network blocks may be appended to this configuration: the supplicant will handle association to and roaming between all of them. The strongest signal defined with a network block usually is connected to by default, one may define priority=
to influence behaviour.
An advantage to be mentioned in using a customized configuration file at /etc/wpa_supplicant/wpa_supplicant.conf
is that it is used by default by dhcpcd. If you do so, you might want to make a backup of the original and delete the extensive network block examples in it. Otherwise, do not be surprised if your device suddenly connects to networks defined in them. In any case, changes to new versions of the configuration file should of course be merged.
scan_ssid=1
has to be defined in the network block.连接[编辑 | 编辑源代码]
手动连接[编辑 | 编辑源代码]
首先启动 wpa_supplicant 命令,其最常用的参数为:
-B
- 在后台运行。-c filename
- 配置文件的路径。-i interface
- 要监听的设备。-D driver
- (可选)使用的驱动。运行wpa_supplicant -h
以查看所支持的驱动列表。nl80211
是目前的标准,但是不是所有无线网卡都支持。wext
目前已经弃用,但是仍被广泛支持。
见 wpa_supplicant(8) 获取全部参数的列表。例如:
# wpa_supplicant -B -i interface -c /etc/wpa_supplicant/example.conf
接着是手动获取IP的方法,正如在#概览中提到的,例如:
# dhcpcd interface
引导时连接(systemd)[编辑 | 编辑源代码]
wpa_supplicant 软件包中提供了多个 systemd 服务文件:
wpa_supplicant.service
- 使用 D-Bus ,建议 NetworkManager 用户使用。wpa_supplicant@.service
- 接受网口名作为参数,启动服务于该网口的 wpa_supplicant 守护进程。这个服务将读取/etc/wpa_supplicant/wpa_supplicant-interface.conf
这个配置文件。wpa_supplicant-nl80211@.service
- 同样接受网口名作为参数,但明确限定使用nl80211
驱动(详阅下文)。它的配置文件是/etc/wpa_supplicant/wpa_supplicant-nl80211-interface.conf
。wpa_supplicant-wired@.service
- 同样接受网口名作为参数,使用wired
(有线网络)驱动。它的配置文件是/etc/wpa_supplicant/wpa_supplicant-wired-interface.conf
。
在引导时激活无线网络,就是激活服务于某个无线网络接口的上述服务单元之一。
现在就可以像概览一节所述,可以选定某个网络接口并激活其服务单元的一个实例,从而获取一个 IP 地址。
802.1x/radius[编辑 | 编辑源代码]
To connect a wired adapter using 802.1x/radius you will need to specify some configurations and enable the necessary service for the adapter. This is useful for headless servers using networkd.
Replace adapter
with the wired adapter you wish to connect, and adapt the settings to match your 802.1x/radius requirements.
/etc/wpa_supplicant/wpa_supplicant-wired-adapter.conf
ctrl_interface=/var/run/wpa_supplicant ap_scan=0 network={ key_mgmt=IEEE8021X eap=PEAP identity="user_name" password="user_password" phase2="autheap=MSCHAPV2" }
IEEE8021X
to WPA-EAP
and removing the ap_scan=0
lineSince this file is storing a plaintext password, chown it to root:root
and chmod it to 600
.
Before running the wpa_supplicant-wired@adapter.service
service, make sure to set the device down:
# ip link set adapter down
dhcpcd@adapter.service
to solicit an address.wpa_cli 操作脚本[编辑 | 编辑源代码]
wpa_cli can run in daemon mode and execute a specified script based on events from wpa_supplicant. Two events are supported: CONNECTED
and DISCONNECTED
. Some environment variables are available to the script, see wpa_cli(8) for details.
The following example will use desktop notifications to notify the user about the events:
#!/bin/sh case "$2" in CONNECTED) notify-send "WPA supplicant: connection established"; ;; DISCONNECTED) notify-send "WPA supplicant: connection lost"; ;; esac
Remember to make the script executable, then use the -a
flag to pass the script path to wpa_cli:
$ wpa_cli -a /path/to/script
排错[编辑 | 编辑源代码]
/etc/wpa_supplicant/wpa_supplicant.conf
, which is filled with uncommented examples that will lead to lots of random errors in practice. This is a known packaging bug of the wpa_supplicant包 package: FS#40661.某些硬件上 nl80211 驱动不支持[编辑 | 编辑源代码]
On some (especially old) hardware, wpa_supplicant may fail with the following error:
Successfully initialized wpa_supplicant nl80211: Driver does not support authentication/association or connect commands wlan0: Failed to initialize driver interface
This indicates that the standard nl80211
driver does not support the given hardware. The deprecated wext
driver might still support the device:
# wpa_supplicant -B -i wlan0 -D wext -c /etc/wpa_supplicant/example.conf
If the command works to connect, and the user wishes to use systemd to manage the wireless connection, it is necessary to edit the wpa_supplicant@.service
unit provided by the package and modify the ExecStart
line accordingly:
/etc/systemd/system/wpa_supplicant@.service.d/wext.conf
[Service] ExecStart= ExecStart=/usr/bin/wpa_supplicant -c/etc/wpa_supplicant/wpa_supplicant-%I.conf -i%I -Dnl80211,wext
-Dnl80211,wext
makes wpa_supplicant use the first driver wrapper that is able to initialize the interface (see wpa_supplicant(8)). This is useful when using mutiple or removable (e.g. USB) wireless devices which use different drivers.挂载了网络共享(CIFS)时的关机问题[编辑 | 编辑源代码]
When you use wireless to connect to network shares you might have the problem that the shutdown takes a very long time. That is because systemd runs against a 3 minute timeout. The reason is that WPA supplicant is shut down too early, i.e. before systemd tries to unmount the share(s). A bug report suggests a work-around by editing the wpa_supplicant@.service
as follows:
/etc/systemd/system/wpa_supplicant.service.d/override.conf
[Unit] After=dbus.service
口令相关的问题[编辑 | 编辑源代码]
wpa_supplicant包 may not work properly if directly passed via stdin particularly long or complex passphrases which include special characters. This may lead to errors such as failed 4-way WPA handshake, PSK may be wrong
when launching wpa_supplicant包.
In order to solve this try using here strings wpa_passphrase <MYSSID> <<< "<passphrase>"
or passing a file to the -c
flag instead:
$ wpa_supplicant -i <interface> -c /etc/wpa_supplicant/wpa_supplicant.conf
In some instances it was found that storing the passphrase cleartext in the psk
key of the wpa_supplicant.conf
network
block gave positive results (see [1]). However, this approach is rather insecure. Using wpa_cli
to create this file instead of manually writing it gives the best results most of the time and therefore is the recommended way to proceed.