hw_mode=g
channel=1
ssid=TestFT
utf8_ssid=1
ctrl_interface=/var/run/hostapd
r1_key_holder=000000000001
nas_identifier=dummy1

wpa=2
# Can support WPA-EAP and FT-EAP (space separated list) at the same
# time but we want to force FT
wpa_key_mgmt=FT-EAP FILS-SHA256 FT-FILS-SHA256
wpa_pairwise=CCMP
ieee8021x=1
eap_server=0
eap_server_erp=1
erp_domain=example.com
fils_realm=example.com
#eap_user_file=/tmp/certs/eap-user-tls.text
eap_user_file=/tmp/pwd.eap_user
pwd_group=19
#ca_cert=/tmp/certs/cert-ca.pem
#server_cert=/tmp/certs/cert-server.pem
#private_key=/tmp/certs/cert-server-key.pem
wpa_ptk_rekey=30
wpa_group_rekey=80
ieee80211w=1
rsn_preauth=1
disable_pmksa_caching=1
# Allow PMK cache to be shared opportunistically among configured interfaces
# and BSSes (i.e., all configurations within a single hostapd process).
okc=1
mobility_domain=1234
reassociation_deadline=60000
r0kh=12:00:00:00:00:01 nas1.w1.fi 000102030405060708090a0b0c0d0e0f
r0kh=12:00:00:00:00:02 nas2.w1.fi 000102030405060708090a0b0c0d0e0f
r1kh=12:00:00:00:00:01 00:00:00:00:00:01 000102030405060708090a0b0c0d0e0f
r1kh=12:00:00:00:00:02 00:00:00:00:00:02 000102030405060708090a0b0c0d0e0f
# Push mode only needed for 8021x, not PSK mode since msk already known
pmk_r1_push=1
ft_over_ds=0
ap_table_expiration_time=36000
ap_table_max_size=10
rrm_neighbor_report=1

radius_server_clients=/tmp/certs/radius-clients.text
radius_server_auth_port=1812

auth_server_addr=127.0.0.1
auth_server_port=1812
auth_server_shared_secret=secret
nas_identifier=nas1.w1.fi