Adding dot1x support

2026-06-22 20:50:48 +00:00
parent 1f62e5ab17
commit dea7ca451a
13 changed files with 592 additions and 0 deletions
@@ -0,0 +1,33 @@
+# hostapd wired 802.1X authenticator + MACsec, ONE per supplicant-facing link.
+# Copy per link and set `interface=` to that link's NIC (e.g. eth1 for vmbr-secA).
+# Run: hostapd -dd authenticator/hostapd-wired-<link>.conf
+#
+# BENCH-VERIFY: wired+MACsec authenticator directives vary by hostapd build/version
+# (CONFIG_MACSEC + CONFIG_DRIVER_WIRED must be compiled in). Confirm your hostapd
+# was built with MACsec; `hostapd -v` / package notes. This is the half most
+# likely to need tweaking on first bring-up.
+
+interface=eth1
+driver=wired
+
+# --- 802.1X (external RADIUS = FreeRADIUS on the serving host) ---------------
+ieee8021x=1
+eap_server=0
+eapol_version=2
+use_pae_group_addr=1                  # listen on 01:80:c2:00:00:03 (PAE)
+
+auth_server_addr=192.168.50.10        # serving host (FreeRADIUS)
+auth_server_port=1812
+auth_server_shared_secret=testing123  # MUST match freeradius/clients.conf + .env RADIUS_SECRET
+
+# --- MACsec / MKA -----------------------------------------------------------
+# macsec_policy=1 requires MACsec; the CAK is derived from the EAP MSK and MKA
+# negotiates the SAK. This hostapd is the MKA key server for the link.
+macsec_policy=1
+macsec_integ_only=0                   # confidentiality (encrypt), matches the supplicant
+macsec_replay_protect=1
+macsec_replay_window=0
+mka_priority=128                      # lower than the supplicant's default => we're key server
+
+# After MKA succeeds the kernel creates a macsec iface on top of `interface`.
+# setup-link.sh bridges that to the serving uplink so DHCP/NVMe flow through.