Linux Networking Cookbook

4.7. Making WPA2-Personal Almost As Good As WPA-Enterprise

Problem

You're nervous about sitting there with an unsecured wireless access point, and you really want to lock it up before you do anything else. You've made sure that all of your wireless network interfaces support WPA2, so you're ready to go. You don't want to run a RADIUS authentication server, but using the same shared key for all clients doesn't seem very secure. Isn't there some kind of in-between option?

Solution

Yes, there is. Pyramid Linux comes with hostapd, which is a user space daemon for access point and authentication servers. This recipe will show you how to assign different pre-shared keys to your clients, instead of everyone using the same one. And, we'll use a nice strong AES-CCMP encryption, instead of the weaker RC4-based ciphers that WPA and WEP use.

First, run /sbin/rw to make the Pyramid filesystem writeable, then create or edit the /etc/hostapd.conf file:

	##/etc/hostapd.conf
	interface=ath0
	bridge=br0
	driver=madwifi
	debug=0
	ssid=alrac-net
	macaddr_acl=0
	auth_algs=3
	wpa=1
	wpa_psk_file=/etc/hostapd_wpa_psk
	wpa_key_mgmt=WPA-PSK
	wpa_pairwise=CCMP

Next, create /etc/hostapd_wpa_psk, which holds the shared plaintext passphrase:

	00:00:00:00:00:00 waylongpassword

Then, edit /etc/network/interfaces so that hostapd starts when the br0 interface comes up. Add these lines to the end of your br0 entry:

	up hostapd -B /etc/hostapd.conf
	post-down killall hostapd

Run /sbin/ro, then restart networking:

 pyramid:~# /etc/init.d/networking ...