34 lines
1.5 KiB
Plaintext
34 lines
1.5 KiB
Plaintext
# hostapd wired 802.1X authenticator + MACsec, ONE per supplicant-facing link.
|
|
# Copy per link and set `interface=` to that link's NIC (e.g. eth1 for vmbr-secA).
|
|
# Run: hostapd -dd authenticator/hostapd-wired-<link>.conf
|
|
#
|
|
# BENCH-VERIFY: wired+MACsec authenticator directives vary by hostapd build/version
|
|
# (CONFIG_MACSEC + CONFIG_DRIVER_WIRED must be compiled in). Confirm your hostapd
|
|
# was built with MACsec; `hostapd -v` / package notes. This is the half most
|
|
# likely to need tweaking on first bring-up.
|
|
|
|
interface=eth1
|
|
driver=wired
|
|
|
|
# --- 802.1X (external RADIUS = FreeRADIUS on the serving host) ---------------
|
|
ieee8021x=1
|
|
eap_server=0
|
|
eapol_version=2
|
|
use_pae_group_addr=1 # listen on 01:80:c2:00:00:03 (PAE)
|
|
|
|
auth_server_addr=192.168.50.10 # serving host (FreeRADIUS)
|
|
auth_server_port=1812
|
|
auth_server_shared_secret=testing123 # MUST match freeradius/clients.conf + .env RADIUS_SECRET
|
|
|
|
# --- MACsec / MKA -----------------------------------------------------------
|
|
# macsec_policy=1 requires MACsec; the CAK is derived from the EAP MSK and MKA
|
|
# negotiates the SAK. This hostapd is the MKA key server for the link.
|
|
macsec_policy=1
|
|
macsec_integ_only=0 # confidentiality (encrypt), matches the supplicant
|
|
macsec_replay_protect=1
|
|
macsec_replay_window=0
|
|
mka_priority=128 # lower than the supplicant's default => we're key server
|
|
|
|
# After MKA succeeds the kernel creates a macsec iface on top of `interface`.
|
|
# setup-link.sh bridges that to the serving uplink so DHCP/NVMe flow through.
|