wpa_supplicant

On a wired card, wpa_supplicant -D wired sends EAPOL-Start and answers the switch's EAP requests with the method and account in its settings file (key_mgmt=IEEE8021X, eap=PEAP, identity, password, and ca_cert to check the server). wpa_cli status shows how far it got: Supplicant PAE state (CONNECTING, AUTHENTICATING, AUTHENTICATED, HELD after a failure), suppPortStatus and the EAP method chosen. logoff sends EAPOL-Logoff and the switch closes the port.

On a Wi-Fi card the same program is the ordinary wireless client: the settings file holds a network={ … } block naming the SSID and the key management — key_mgmt=WPA-PSK with a psk for WPA2, or key_mgmt=SAE with an sae_password and ieee80211w=2 for WPA3. wpa_cli status then reads wpa_state=COMPLETED once associated, with key_mgmt and pmf (2 when 802.11w is on). After editing the settings file, wpa_cli reconfigure makes the running client re-read it and roam to the new network with no restart.

wpa_supplicant command usage

wpa_supplicant -B [-D wired] -i CARD -c FILE
wpa_cli -i CARD status|logoff|logon|reauthenticate|reconfigure|terminate

Options

-B

run in the background

-D wired

the wired Ethernet driver (nl80211, the default, for Wi-Fi)

-i CARD -c FILE

the card to log in on, and the settings

status

wpa_cli: the state, and for Wi-Fi the key_mgmt and pmf

reconfigure

wpa_cli: re-read the settings file and reassociate

logoff / logon

wpa_cli: send EAPOL-Logoff, or log in again

wpa_supplicant examples

wpa_supplicant -B -D wired -i eth0 -c /etc/wpa_supplicant/office.conf

Starts 802.1X on eth0 with the office settings.

wpa_supplicant -B -i wlan0 -c /etc/wpa.conf

Joins the Wi-Fi network named in the settings file on wlan0.

wpa_cli -i wlan0 status

Shows whether the card is associated, and with which key management and PMF.

wpa_cli -i wlan0 reconfigure

Re-reads the settings file and roams to the network it now names.

wpa_cli -i eth0 logoff

Logs off: the switch locks the port again.

Pitfalls

• PEAP or TTLS without ca_cert accepts any server: a fake access point or switch with its own RADIUS collects the inner login.
• terminate stops the supplicant without logging off, so the port stays open until the switch reauthenticates or the link drops.
• -f LOGFILE is a hostapd flag, not a wpa_supplicant one: passing it makes wpa_supplicant print its usage and exit.

Run it on real machines