From owner-svn-doc-head@freebsd.org Thu Jul 2 00:14:32 2015 Return-Path: Delivered-To: svn-doc-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 25AC7992CD6; Thu, 2 Jul 2015 00:14:32 +0000 (UTC) (envelope-from wblock@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 154911092; Thu, 2 Jul 2015 00:14:32 +0000 (UTC) (envelope-from wblock@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.70]) by repo.freebsd.org (8.14.9/8.14.9) with ESMTP id t620EVak054675; Thu, 2 Jul 2015 00:14:31 GMT (envelope-from wblock@FreeBSD.org) Received: (from wblock@localhost) by repo.freebsd.org (8.14.9/8.14.9/Submit) id t620EVCF054674; Thu, 2 Jul 2015 00:14:31 GMT (envelope-from wblock@FreeBSD.org) Message-Id: <201507020014.t620EVCF054674@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: wblock set sender to wblock@FreeBSD.org using -f From: Warren Block Date: Thu, 2 Jul 2015 00:14:31 +0000 (UTC) To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r46911 - head/en_US.ISO8859-1/books/handbook/advanced-networking X-SVN-Group: doc-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-doc-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the doc tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2015 00:14:32 -0000 Author: wblock Date: Thu Jul 2 00:14:31 2015 New Revision: 46911 URL: https://svnweb.freebsd.org/changeset/doc/46911 Log: Update the WPA-PSK access point section at Mark Felder's request, who supplied the ifconfig output. Also update some of the defaults and suggestions for the current era: WPA2 and CCMP/AES. Submitted by: Mark Felder Reviewed by: adrian Differential Revision: Modified: head/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.xml Modified: head/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.xml ============================================================================== --- head/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.xml Wed Jul 1 13:35:19 2015 (r46910) +++ head/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.xml Thu Jul 2 00:14:31 2015 (r46911) @@ -1935,11 +1935,11 @@ freebsdap 00:11:95:c3:0d:ac 1 roam:rate 5 protmode CTS wme burst - - <acronym>WPA</acronym> Host-based Access Point + + <acronym>WPA2</acronym> Host-based Access Point This section focuses on setting up a &os; - AP using the WPA + access point using the WPA2 security protocol. More details regarding WPA and the configuration of WPA-based wireless clients can be found @@ -1947,13 +1947,13 @@ freebsdap 00:11:95:c3:0d:ac 1 The &man.hostapd.8; daemon is used to deal with client authentication and key management on the - WPA-enabled AP. + WPA2-enabled AP. The following configuration operations are performed on the &os; machine acting as the AP. Once the AP is correctly working, - &man.hostapd.8; should be automatically enabled at boot - with the following line in + &man.hostapd.8; can be automatically started at boot + with this line in /etc/rc.conf: hostapd_enable="YES" @@ -1963,95 +1963,95 @@ freebsdap 00:11:95:c3:0d:ac 1 linkend="network-wireless-ap-basic"/>. - <acronym>WPA-PSK</acronym> + <acronym>WPA2-PSK</acronym> - WPA-PSK is intended for small + WPA2-PSK is intended for small networks where the use of a backend authentication server is not possible or desired. The configuration is done in /etc/hostapd.conf: - interface=wlan0 -debug=1 -ctrl_interface=/var/run/hostapd -ctrl_interface_group=wheel -ssid=freebsdap -wpa=1 -wpa_passphrase=freebsdmall -wpa_key_mgmt=WPA-PSK -wpa_pairwise=CCMP TKIP + interface=wlan0 +debug=1 +ctrl_interface=/var/run/hostapd +ctrl_interface_group=wheel +ssid=freebsdap +wpa=2 +wpa_passphrase=freebsdmall +wpa_key_mgmt=WPA-PSK +wpa_pairwise=CCMP - This field indicates the wireless interface used - for the AP. + Wireless interface used + for the access point. - This field sets the level of verbosity during the + Level of verbosity used during the execution of &man.hostapd.8;. A value of 1 represents the minimal level. - The ctrl_interface field gives - the pathname of the directory used by &man.hostapd.8; - to store its domain socket files for the communication + Pathname of the directory used by &man.hostapd.8; + to store domain socket files for communication with external programs such as &man.hostapd.cli.8;. The default value is used in this example. - The ctrl_interface_group line - sets the group which is allowed to access the control + The group allowed to access the control interface files. - This field sets the network name. + The wireless network name, or + SSID, that will appear in wireless + scans. - The wpa field enables - WPA and specifies which + Enable + WPA and specify which WPA authentication protocol will - be required. A value of 1 + be required. A value of 2 configures the AP for - WPA-PSK. + WPA2 and is recommended. + Set to 1 only if the obsolete + WPA is required. - The wpa_passphrase field - contains the ASCII passphrase for + ASCII passphrase for WPA authentication. - Always use strong passwords that are - sufficiently long and made from a rich alphabet so + Always use strong passwords that are at least + 8 characters long and made from a rich alphabet so that they will not be easily guessed or attacked. - The wpa_key_mgmt line refers - to the key management protocol to use. This example + The + key management protocol to use. This example sets WPA-PSK. - The wpa_pairwise field - indicates the set of accepted encryption algorithms by - the AP. In this example, both - TKIP (WPA) and - CCMP (WPA2) - ciphers are accepted. The CCMP - cipher is an alternative to TKIP + Encryption algorithms accepted by + the access point. In this example, only + the + CCMP (AES) + cipher is accepted. CCMP + is an alternative to TKIP and is strongly preferred when possible. - TKIP should be used solely for - stations incapable of doing + TKIP should be allowed only when + there are stations incapable of using CCMP. @@ -2061,14 +2061,18 @@ wpa_pairwise=CCMP TKIP