Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

passwordSecuritywpawpa-supplicant

My wpa_supplicant.conf looks like this:

network={
  ssid="Some name"
  scan_ssid=1
  key_mgmt=WPA-EAP
  eap=PEAP
  identity="my-user-id"
  password="(clear text password here)"
  ca_cert="/usr/share/ca-certificates/mozilla/GeoTrust_Global_CA.crt"
  phase2="auth=MSCHAPV2"
}

With this specific combination of WPA-EAP and MSCHAP-v2, is there a way to not include my password in clear in this configuration file?

The ChangeLog seems to claim that this is feasible (since 2005!):

* added support for storing EAP user password as NtPasswordHash instead
  of plaintext password when using MSCHAP or MSCHAPv2 for
  authentication (hash:<16-octet hex value>); added nt_password_hash
  tool for hashing password to generate NtPasswordHash

Some notes:

1 That anser claims that using a hashed password means that the hash becomes the password. This is technically true, but at least the hash is a wifi-only password, which is significant progress over leaking a shared password granting access to multiple services.

Best Answer

Open terminal and type :

wpa_passphrase YOUR_SSID YOUR_PASSWORD

Sample output:

network={
    ssid="YOUR_SSID"
    #psk="YOUR_PASSWORD"
    psk=6a24edf1592aec4465271b7dcd204601b6e78df3186ce1a62a31f40ae9630702
}

Open the wpa_supplicant.conf file and add the following line:

psk=6a24edf1592aec4465271b7dcd204601b6e78df3186ce1a62a31f40ae9630702
Related Question