os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Sand off some rough edges in the wireless section of advanced-networking.

Browse source 
Approved by:	gjb (mentor)
This commit is contained in:
Warren Block 2011-12-04 20:54:59 +00:00
parent a62f9e130b
commit 80faaef434
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=38000
1 changed files with 61 additions and 58 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

119
en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml
View file

@ -1168,7 +1168,7 @@ ifconfig_wlan0="authmode shared wepmode on weptxkey <replaceable>1</replaceable>
authentication parameters, you will have to get an IP authentication parameters, you will have to get an IP
address to communicate. Most of time you will obtain address to communicate. Most of time you will obtain
your wireless IP address via DHCP. To achieve that, your wireless IP address via DHCP. To achieve that,
simply edit <filename>/etc/rc.conf</filename> and add edit <filename>/etc/rc.conf</filename> and add
<literal>DHCP</literal> to the configuration for your <literal>DHCP</literal> to the configuration for your
device as shown in various examples above:</para> device as shown in various examples above:</para>
@ -1229,7 +1229,7 @@ ifconfig_wlan0="inet <replaceable>192.168.1.100</replaceable> netmask <replaceab
the 802.1X authentication protocol and uses one of several the 802.1X authentication protocol and uses one of several
ciphers instead of WEP for data integrity. The only ciphers instead of WEP for data integrity. The only
cipher required by WPA is TKIP (Temporary Key Integrity cipher required by WPA is TKIP (Temporary Key Integrity
Protocol) which is a cipher that extends the basic RC4 Protocol). TKIP is a cipher that extends the basic RC4
cipher used by WEP by adding integrity checking, tamper cipher used by WEP by adding integrity checking, tamper
detection, and measures for responding to any detected detection, and measures for responding to any detected
intrusions. TKIP is designed to work on legacy hardware intrusions. TKIP is designed to work on legacy hardware
@ -1247,7 +1247,7 @@ ifconfig_wlan0="inet <replaceable>192.168.1.100</replaceable> netmask <replaceab
station and the access point using a pre-shared secret. station and the access point using a pre-shared secret.
The former is commonly termed WPA Enterprise with the The former is commonly termed WPA Enterprise with the
latter known as WPA Personal. Since most people will not latter known as WPA Personal. Since most people will not
set up a RADIUS backend server for wireless network, set up a RADIUS backend server for their wireless network,
WPA-PSK is by far the most commonly encountered WPA-PSK is by far the most commonly encountered
configuration for WPA.</para> configuration for WPA.</para>
@ -1262,7 +1262,7 @@ ifconfig_wlan0="inet <replaceable>192.168.1.100</replaceable> netmask <replaceab
<sect5 id="network-wireless-wpa-wpa-psk"> <sect5 id="network-wireless-wpa-wpa-psk">
<title>WPA-PSK</title> <title>WPA-PSK</title>
<para>WPA-PSK also known as WPA-Personal is based on a <para>WPA-PSK, also known as WPA-Personal, is based on a
pre-shared key (PSK) generated from a given password and pre-shared key (PSK) generated from a given password and
that will be used as the master key in the wireless that will be used as the master key in the wireless
network. This means every wireless user will share the network. This means every wireless user will share the
@ -1293,7 +1293,7 @@ ifconfig_wlan0="inet <replaceable>192.168.1.100</replaceable> netmask <replaceab
<programlisting>wlans_ath0="wlan0" <programlisting>wlans_ath0="wlan0"
ifconfig_wlan0="WPA DHCP"</programlisting> ifconfig_wlan0="WPA DHCP"</programlisting>
<para>Then, we can bring up the interface:</para> <para>Then we can bring up the interface:</para>
<screen>&prompt.root; <userinput><filename>/etc/rc.d/netif</filename> start</userinput> <screen>&prompt.root; <userinput><filename>/etc/rc.d/netif</filename> start</userinput>
Starting wpa_supplicant. Starting wpa_supplicant.
@ -1346,16 +1346,16 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
wme burst roaming MANUAL</screen> wme burst roaming MANUAL</screen>
<note> <note>
<para>If the <filename>/etc/rc.conf</filename> is set up <para>If <filename>/etc/rc.conf</filename> has an
with the line <literal>ifconfig_wlan0="DHCP"</literal> <literal>ifconfig_wlan0</literal> entry with the
then it is no need to run the <literal>DHCP</literal> string (like
<command>dhclient</command> command manually, <literal>ifconfig_wlan0="DHCP"</literal>),
<command>dhclient</command> will be launched after <command>dhclient</command> will be launched
<command>wpa_supplicant</command> plumbs the automatically after <command>wpa_supplicant</command>
keys.</para> associates with the access point.</para>
</note> </note>
<para>In the case where the use of DHCP is not possible, <para>If DHCP is not possible or desired,
you can set a static IP address after you can set a static IP address after
<command>wpa_supplicant</command> has authenticated the <command>wpa_supplicant</command> has authenticated the
station:</para> station:</para>
@ -1374,7 +1374,7 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
wme burst roaming MANUAL</screen> wme burst roaming MANUAL</screen>
<para>When DHCP is not used, you also have to manually set <para>When DHCP is not used, you also have to manually set
up the default gateway and the nameserver:</para> the default gateway and the nameserver:</para>
<screen>&prompt.root; <userinput>route add default <replaceable>your_default_router</replaceable></userinput> <screen>&prompt.root; <userinput>route add default <replaceable>your_default_router</replaceable></userinput>
&prompt.root; <userinput>echo "nameserver <replaceable>your_DNS_server</replaceable>" &gt;&gt; /etc/resolv.conf</userinput></screen> &prompt.root; <userinput>echo "nameserver <replaceable>your_DNS_server</replaceable>" &gt;&gt; /etc/resolv.conf</userinput></screen>
@ -1384,17 +1384,17 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
<title>WPA with EAP-TLS</title> <title>WPA with EAP-TLS</title>
<para>The second way to use WPA is with an 802.1X backend <para>The second way to use WPA is with an 802.1X backend
authentication server, in this case WPA is called authentication server. In this case WPA is called
WPA-Enterprise to make difference with the less secure WPA-Enterprise to differentiate it from the less secure
WPA-Personal with its pre-shared key. The WPA-Personal with its pre-shared key.
authentication in WPA-Enterprise is based on EAP Authentication in WPA-Enterprise is based on the
(Extensible Authentication Protocol).</para> Extensible Authentication Protocol (EAP).</para>
<para>EAP does not come with an encryption method, it was <para>EAP does not come with an encryption method.
decided to embed EAP inside an encrypted tunnel. Many Instead, it was decided to embed EAP inside an encrypted
types of EAP authentication methods have been designed, tunnel. There are many EAP authentication methods, but
the most common methods are EAP-TLS, EAP-TTLS and EAP-TLS, EAP-TTLS, and EAP-PEAP are the most
EAP-PEAP.</para> common.</para>
<para>EAP-TLS (EAP with Transport Layer Security) is a <para>EAP-TLS (EAP with Transport Layer Security) is a
very well-supported authentication protocol in the very well-supported authentication protocol in the
@ -1559,7 +1559,7 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
<callout arearefs="co-ttls-cacert"> <callout arearefs="co-ttls-cacert">
<para>The <literal>ca_cert</literal> field indicates <para>The <literal>ca_cert</literal> field indicates
the pathname of the CA certificate file. This file the pathname of the CA certificate file. This file
is needed to verify the server certificat.</para> is needed to verify the server certificate.</para>
</callout> </callout>
<callout arearefs="co-ttls-pha2"> <callout arearefs="co-ttls-pha2">
@ -1601,23 +1601,26 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
<sect5 id="network-wireless-wpa-eap-peap"> <sect5 id="network-wireless-wpa-eap-peap">
<title>WPA with EAP-PEAP</title> <title>WPA with EAP-PEAP</title>
<note>
<para>PEAPv0/EAP-MSCHAPv2 is the most common PEAP method.
In the rest of this document, we will use the PEAP term
to refer to that method.</para>
</note>
<para>PEAP (Protected EAP) has been designed as an <para>PEAP (Protected EAP) has been designed as an
alternative to EAP-TTLS. There are two types of PEAP alternative to EAP-TTLS, and is the most used EAP
methods, the most common one is PEAPv0/EAP-MSCHAPv2. In standard after EAP-TLS. In other words, if you have a
the rest of this document, we will use the PEAP term to network with mixed OSes, PEAP should be the
refer to that EAP method. PEAP is the most used EAP most supported standard after EAP-TLS.</para>
standard after EAP-TLS, in other words if you have a
network with mixed OSes, PEAP should be the most
supported standard after EAP-TLS.</para>
<para>PEAP is similar to EAP-TTLS: it uses a server-side <para>PEAP is similar to EAP-TTLS: it uses a server-side
certificate to authenticate clients by creating an certificate to authenticate clients by creating an
encrypted TLS tunnel between the client and the encrypted TLS tunnel between the client and the
authentication server, which protects the ensuing authentication server, which protects the ensuing
exchange of authentication information. In term of exchange of authentication information. In terms of
security the difference between EAP-TTLS and PEAP is security, the difference between EAP-TTLS and PEAP is
that PEAP authentication broadcasts the username in that PEAP authentication broadcasts the username in the
clear, only the password is sent in the encrypted TLS clear, with only the password sent in the encrypted TLS
tunnel. EAP-TTLS will use the TLS tunnel for both tunnel. EAP-TTLS will use the TLS tunnel for both
username and password.</para> username and password.</para>
@ -1662,10 +1665,10 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
<callout arearefs="co-peap-pha1"> <callout arearefs="co-peap-pha1">
<para>This field contains the parameters for the <para>This field contains the parameters for the
first phase of the authentication (the TLS first phase of authentication (the TLS
tunnel). According to the authentication server tunnel). According to the authentication server
used, you will have to specify a specific label used, you will have to specify a specific label
for the authentication. Most of time, the label for authentication. Most of the time, the label
will be <quote>client EAP encryption</quote> which will be <quote>client EAP encryption</quote> which
is set by using <literal>peaplabel=0</literal>. is set by using <literal>peaplabel=0</literal>.
More information can be found in the More information can be found in the
@ -1686,7 +1689,7 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
<programlisting>wlans_ath0="wlan0" <programlisting>wlans_ath0="wlan0"
ifconfig_wlan0="WPA DHCP"</programlisting> ifconfig_wlan0="WPA DHCP"</programlisting>
<para>Then, we can bring up the interface:</para> <para>Then we can bring up the interface:</para>
<screen>&prompt.root; <userinput>/etc/rc.d/netif start</userinput> <screen>&prompt.root; <userinput>/etc/rc.d/netif start</userinput>
Starting wpa_supplicant. Starting wpa_supplicant.
@ -1713,7 +1716,7 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
<para>WEP (Wired Equivalent Privacy) is part of the original <para>WEP (Wired Equivalent Privacy) is part of the original
802.11 standard. There is no authentication mechanism, 802.11 standard. There is no authentication mechanism,
only a weak form of access control, and it is easily to be only a weak form of access control, and it is easily
cracked.</para> cracked.</para>
<para>WEP can be set up with <para>WEP can be set up with
@ -1728,18 +1731,18 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
<para>The <literal>weptxkey</literal> means which WEP <para>The <literal>weptxkey</literal> means which WEP
key will be used in the transmission. Here we used the key will be used in the transmission. Here we used the
third key. This must match the setting in the access third key. This must match the setting in the access
point. If you do not have any idea of what is the key point. If you do not have any idea of which key is
used by the access point, you should try to use used by the access point, try
<literal>1</literal> (i.e., the first key) for this <literal>1</literal> (i.e., the first key) for this
value.</para> value.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>The <literal>wepkey</literal> means setting the <para>The <literal>wepkey</literal> selects one of the
selected WEP key. It should in the format WEP keys. It should be in the format
<replaceable>index:key</replaceable>, if the index is <replaceable>index:key</replaceable>. Key
not given, key <literal>1</literal> is set. That is <literal>1</literal> is used by default; the index
to say we need to set the index if we use keys other only needs to be set if we use a key other
than the first key.</para> than the first key.</para>
<note> <note>
@ -1750,7 +1753,7 @@ wlan0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
</listitem> </listitem>
</itemizedlist> </itemizedlist>
<para>You are encouraged to read &man.ifconfig.8; manual <para>You are encouraged to read the &man.ifconfig.8; manual
page for further information.</para> page for further information.</para>
<para>The <command>wpa_supplicant</command> facility also <para>The <command>wpa_supplicant</command> facility also
@ -1781,7 +1784,7 @@ Associated with 00:13:46:49:41:76</screen>
<para>IBSS mode, also called ad-hoc mode, is designed for point <para>IBSS mode, also called ad-hoc mode, is designed for point
to point connections. For example, to establish an ad-hoc to point connections. For example, to establish an ad-hoc
network between the machine <hostid>A</hostid> and the machine network between the machine <hostid>A</hostid> and the machine
<hostid>B</hostid> we will just need to choose two IP addresses <hostid>B</hostid>, we will just need to choose two IP addresses
and a SSID.</para> and a SSID.</para>
<para>On the box <hostid>A</hostid>:</para> <para>On the box <hostid>A</hostid>:</para>
@ -1826,7 +1829,7 @@ Associated with 00:13:46:49:41:76</screen>
protmode CTS wme burst</screen> protmode CTS wme burst</screen>
<para>Both <hostid>A</hostid> and <hostid>B</hostid> are now <para>Both <hostid>A</hostid> and <hostid>B</hostid> are now
ready to exchange informations.</para> ready to exchange information.</para>
</sect2> </sect2>
<sect2 id="network-wireless-ap"> <sect2 id="network-wireless-ap">
@ -1843,19 +1846,19 @@ Associated with 00:13:46:49:41:76</screen>
<para>Before configuring your &os; machine as an AP, the <para>Before configuring your &os; machine as an AP, the
kernel must be configured with the appropriate wireless kernel must be configured with the appropriate wireless
networking support for your wireless card. You also have to networking support for your wireless card. You also have to
add the support for the security protocols you intend to add support for the security protocols you intend to
use. For more details, see <xref use. For more details, see <xref
linkend="network-wireless-basic">.</para> linkend="network-wireless-basic">.</para>
<note> <note>
<para>The use of the NDIS driver wrapper and the &windows; <para>The use of the NDIS driver wrapper and the &windows;
drivers do not allow currently the AP operation. Only drivers do not currently allow AP operation. Only
native &os; wireless drivers support AP mode.</para> native &os; wireless drivers support AP mode.</para>
</note> </note>
<para>Once the wireless networking support is loaded, you can <para>Once wireless networking support is loaded, you can
check if your wireless device supports the host-based access check if your wireless device supports the host-based access
point mode (also know as hostap mode):</para> point mode (also known as hostap mode):</para>
<screen>&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> create wlandev <replaceable>ath0</replaceable></userinput> <screen>&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> create wlandev <replaceable>ath0</replaceable></userinput>
&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> list caps</userinput> &prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> list caps</userinput>
@ -1865,8 +1868,8 @@ cryptocaps=1f&lt;WEP,TKIP,AES,AES_CCM,TKIPMIC&gt;</screen>
<para>This output displays the card capabilities; the <para>This output displays the card capabilities; the
<literal>HOSTAP</literal> word confirms this wireless card <literal>HOSTAP</literal> word confirms this wireless card
can act as an Access Point. Various supported ciphers are can act as an Access Point. Various supported ciphers are
also mentioned: WEP, TKIP, AES, etc., these informations also mentioned: WEP, TKIP, AES, etc. This information
are important to know what security protocols could be set is important to know what security protocols can be used
on the Access Point.</para> on the Access Point.</para>
<para>The wireless device can only be put into hostap mode <para>The wireless device can only be put into hostap mode
@ -1881,7 +1884,7 @@ cryptocaps=1f&lt;WEP,TKIP,AES,AES_CCM,TKIPMIC&gt;</screen>
<screen>&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> create wlandev <replaceable>ath0</replaceable> wlanmode hostap</userinput> <screen>&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> create wlandev <replaceable>ath0</replaceable> wlanmode hostap</userinput>
&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> inet <replaceable>192.168.0.1</replaceable> netmask <replaceable>255.255.255.0</replaceable> ssid <replaceable>freebsdap</replaceable> mode 11g channel 1</userinput></screen> &prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable> inet <replaceable>192.168.0.1</replaceable> netmask <replaceable>255.255.255.0</replaceable> ssid <replaceable>freebsdap</replaceable> mode 11g channel 1</userinput></screen>
<para>Use again <command>ifconfig</command> to see the status <para>Use <command>ifconfig</command> again to see the status
of the <devicename>wlan0</devicename> interface:</para> of the <devicename>wlan0</devicename> interface:</para>
<screen>&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable></userinput> <screen>&prompt.root; <userinput>ifconfig <replaceable>wlan0</replaceable></userinput>
@ -2154,7 +2157,7 @@ freebsdap 00:11:95:c3:0d:ac 1 54M 22:1 100 EPS</screen>
<para>On &os;, it is possible to combine two or even more network <para>On &os;, it is possible to combine two or even more network
interfaces together in a <quote>failover</quote> fashion, that interfaces together in a <quote>failover</quote> fashion, that
is, to use the most preferred and available connection from a is, to use the most preferred and available connection from a
group of network interfaces, and have the operating system to group of network interfaces, and have the operating system
switch automatically when the link state changes.</para> switch automatically when the link state changes.</para>
<para>We will cover link aggregation and failover in <xref linkend="network-aggregation"> <para>We will cover link aggregation and failover in <xref linkend="network-aggregation">