1WPA_CLI(8)                                                          WPA_CLI(8)
2
3
4

NAME

6       wpa_cli - WPA command line client
7

SYNOPSIS

9       wpa_cli  [ -p path to ctrl sockets ] [ -i ifname ] [ -hvB ] [ -a action
10       file ] [ -P pid file ] [ command ... ]
11
12

OVERVIEW

14       wpa_cli is a text-based frontend program for interacting with  wpa_sup‐
15       plicant.  It  is  used  to  query current status, change configuration,
16       trigger events, and request interactive user input.
17
18       wpa_cli can show the current authentication status,  selected  security
19       mode,  dot11  and  dot1x  MIBs, etc. In addition, it can configure some
20       variables like EAPOL state machine parameters and trigger  events  like
21       reassociation  and  IEEE  802.1X  logoff/logon. wpa_cli provides a user
22       interface to request  authentication  information,  like  username  and
23       password,  if  these are not included in the configuration. This can be
24       used to implement,  e.g.,  one-time-passwords  or  generic  token  card
25       authentication  where  the  authentication  is  based  on  a challenge-
26       response that uses an external device for generating the response.
27
28       The control interface of wpa_supplicant can be configured to allow non-
29       root  user access (ctrl_interface GROUP= parameter in the configuration
30       file). This makes it  possible  to  run  wpa_cli  with  a  normal  user
31       account.
32
33       wpa_cli  supports  two  modes: interactive and command line. Both modes
34       share the same command set and the main difference  is  in  interactive
35       mode  providing  access  to unsolicited messages (event messages, user‐
36       name/password requests).
37
38       Interactive mode is started when wpa_cli is executed without  including
39       the  command  as a command line parameter. Commands are then entered on
40       the wpa_cli prompt. In command line mode, the same commands are entered
41       as command line arguments for wpa_cli.
42

INTERACTIVE AUTHENTICATION PARAMETERS REQUEST

44       When  wpa_supplicant  need authentication parameters, like username and
45       password, which are not present in the configuration file, it  sends  a
46       request  message  to  all  attached frontend programs, e.g., wpa_cli in
47       interactive  mode.   wpa_cli   shows   these   requests   with   "CTRL-
48       REQ-<type>-<id>:<text>"  prefix.  <type>  is IDENTITY, PASSWORD, or OTP
49       (one-time-password). <id> is a unique identifier for the  current  net‐
50       work.  <text> is description of the request. In case of OTP request, it
51       includes the challenge from the authentication server.
52
53       The reply to these requests can be given with identity,  password,  and
54       otp  commands. <id> needs to be copied from the matching request. pass‐
55       word and otp commands can be used regardless of whether the request was
56       for  PASSWORD or OTP. The main difference between these two commands is
57       that values given with password are remembered as long  as  wpa_suppli‐
58       cant  is  running  whereas values given with otp are used only once and
59       then forgotten, i.e., wpa_supplicant will ask frontend for a new  value
60       for  every  use.  This can be used to implement one-time-password lists
61       and generic token card -based authentication.
62
63       Example request for password and a matching reply:
64
65
66              CTRL-REQ-PASSWORD-1:Password needed for SSID foobar
67              > password 1 mysecretpassword
68
69       Example request for generic token card challenge-response:
70
71
72              CTRL-REQ-OTP-2:Challenge 1235663 needed for SSID foobar
73              > otp 2 9876
74

COMMAND ARGUMENTS

76       -p path
77              Change the path where control sockets should be found.
78
79       -i ifname
80              Specify the interface that is  being  configured.   By  default,
81              choose  the  first  interface found with a control socket in the
82              socket path.
83
84       -h     Help.  Show a usage message.
85
86       -v     Show version information.
87
88       -B     Run as a daemon in the background.
89
90       -a file
91              Run in daemon mode executing the action  file  based  on  events
92              from  wpa_supplicant.   The specified file will be executed with
93              the first argument set to interface name  and  second  to  "CON‐
94              NECTED"  or  "DISCONNECTED" depending on the event.  This can be
95              used to execute  networking  tools  required  to  configure  the
96              interface.
97
98              Additionally, three environmental variables are available to the
99              file: WPA_CTRL_DIR, WPA_ID, and  WPA_ID_STR.  WPA_CTRL_DIR  con‐
100              tains  the  absolute  path  to the ctrl_interface socket. WPA_ID
101              contains the unique network_id identifier assigned to the active
102              network,  and  WPA_ID_STR  contains  the  content  of the id_str
103              option.
104
105       -P file
106              Set the location of the PID file.
107
108       command
109              Run a command.  The available commands are listed  in  the  next
110              section.
111

COMMANDS

113       The following commands are available:
114
115       status get current WPA/EAPOL/EAP status
116
117       mib    get MIB variables (dot1x, dot11)
118
119       help   show this usage help
120
121       interface [ifname]
122              show interfaces/select interface
123
124       level <debug level>
125              change debug level
126
127       license
128              show full wpa_cli license
129
130       logoff IEEE 802.1X EAPOL state machine logoff
131
132       logon  IEEE 802.1X EAPOL state machine logon
133
134       set    set  variables  (shows  list of variables when run without argu‐
135              ments)
136
137       pmksa  show PMKSA cache
138
139       reassociate
140              force reassociation
141
142       reconfigure
143              force wpa_supplicant to re-read its configuration file
144
145       preauthenticate <BSSID>
146              force preauthentication
147
148       identity <network id> <identity>
149              configure identity for an SSID
150
151       password <network id> <password>
152              configure password for an SSID
153
154       pin <network id> <pin>
155              configure pin for an SSID
156
157       otp <network id> <password>
158              configure one-time-password for an SSID
159
160       bssid <network id> <BSSID>
161              set preferred BSSID for an SSID
162
163       list_networks
164              list configured networks
165
166       terminate
167              terminate wpa_supplicant
168
169       quit   exit wpa_cli
170

SEE ALSO

172       wpa_supplicant(8)
173
175       wpa_supplicant is copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>  and
176       contributors.  All Rights Reserved.
177
178       This  program  is  dual-licensed  under  both the GPL version 2 and BSD
179       license. Either license may be used at your option.
180
181
182
183                               15 February 2009                     WPA_CLI(8)
Impressum