📶 Configuring Wireless Security (WPA/WPA2): Simple Guide

Let’s configure wireless security on your Alpine Linux system! 🔒 This guide uses easy steps and simple words. We’ll connect to WiFi networks securely! 😊

🤔 What is Wireless Security?

Wireless security is like having a secure lock and key system for your WiFi connection!

Think of wireless security like:

• 📝 A private club that requires a password to enter and keeps conversations secret
• 🔧 A secure envelope that protects your mail from being read by others
• 💡 A secret code that only you and your friends know to access a hidden room

🎯 What You Need

Before we start, you need:

• ✅ Alpine Linux system running
• ✅ Wireless network adapter
• ✅ Root access or sudo permissions
• ✅ WiFi network credentials (SSID and password)

📋 Step 1: Check Wireless Hardware

Identify Wireless Adapter

First, let’s make sure your wireless adapter is working! 😊

What we’re doing: Detecting and configuring your wireless network adapter to ensure it’s ready for secure connections.

# Update package lists and install wireless tools
apk update
apk add wireless-tools wpa_supplicant iw

# Check for wireless interfaces
iwconfig 2>/dev/null || echo "iwconfig not available, using ip command"
ip link show | grep -E "(wlan|wifi|wireless)"

# List all network interfaces
ip addr show

# Check wireless adapter details
lspci | grep -i wireless
lsusb | grep -i wireless

# Check kernel modules for wireless
lsmod | grep -E "(cfg80211|mac80211|iwl|ath|rt)"

# Check if wireless interface is up
iw dev

# Get wireless adapter information
for interface in $(iw dev | grep Interface | awk '{print $2}'); do
    echo "=== Wireless Interface: $interface ==="
    iw dev "$interface" info
    echo
done

# Check wireless regulatory domain
iw reg get

# Scan for available networks (if interface exists)
wireless_interface=$(iw dev | grep Interface | awk '{print $2}' | head -1)
if [ -n "$wireless_interface" ]; then
    echo "Scanning for networks with $wireless_interface..."
    ip link set "$wireless_interface" up
    iw dev "$wireless_interface" scan | grep -E "(SSID|signal|WPA|WEP)" | head -20
else
    echo "No wireless interface found"
fi

What this does: 📖 Identifies your wireless hardware and shows available networks.

Example output:

Interface wlan0
	ifindex 3
	wdev 0x1
	addr 02:11:22:33:44:55
	type managed
	txpower 20.00 dBm

BSS 00:1a:2b:3c:4d:5e (on wlan0)
	SSID: MyHomeWiFi
	signal: -45.00 dBm
	WPA:	 * Version 1
	RSN:	 * Version 1
		 * Group cipher: CCMP
		 * Pairwise ciphers: CCMP
		 * Authentication suites: PSK

What this means: Your wireless adapter is detected and can see networks! ✅

💡 Important Tips

Tip: Write down your WiFi network name (SSID) and password before starting! 💡

Warning: Always use WPA2 or newer security protocols, never WEP! ⚠️

🛠️ Step 2: Configure WPA Supplicant

Set Up Wireless Security

Now let’s configure secure wireless connections! 😊

What we’re doing: Setting up wpa_supplicant, which handles WPA/WPA2 wireless security protocols and manages secure connections to WiFi networks.

# Create wpa_supplicant configuration directory
mkdir -p /etc/wpa_supplicant

# Generate network configuration with wpa_passphrase
read -p "Enter your WiFi network name (SSID): " wifi_ssid
read -s -p "Enter your WiFi password: " wifi_password
echo

# Generate basic configuration
wpa_passphrase "$wifi_ssid" "$wifi_password" > /etc/wpa_supplicant/wpa_supplicant.conf

# Create comprehensive wpa_supplicant configuration
cat > /etc/wpa_supplicant/wpa_supplicant.conf << EOF
# WPA Supplicant Configuration for Secure Wireless

# Control interface settings
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
update_config=1

# Global configuration
country=US
ap_scan=1
fast_reauth=1

# Security settings
pmf=1

# Network configuration - Primary WiFi
network={
    ssid="$wifi_ssid"
    psk="$wifi_password"
    
    # Security protocol preferences (strongest first)
    proto=RSN WPA
    key_mgmt=WPA-PSK
    pairwise=CCMP TKIP
    group=CCMP TKIP
    
    # Connection priority (higher = preferred)
    priority=1
    
    # Automatically connect
    scan_ssid=1
    
    # Security enhancements
    proactive_key_caching=1
}

# Example: Guest network configuration
#network={
#    ssid="GuestNetwork"
#    psk="guestpassword"
#    proto=RSN
#    key_mgmt=WPA-PSK
#    pairwise=CCMP
#    priority=0
#}

# Example: Open network (not recommended)
#network={
#    ssid="OpenWiFi"
#    key_mgmt=NONE
#    priority=-1
#}

# Example: Enterprise WPA2 (802.1X)
#network={
#    ssid="CorpNetwork"
#    key_mgmt=WPA-EAP
#    eap=PEAP
#    identity="username"
#    password="password"
#    phase2="auth=MSCHAPV2"
#    priority=2
#}
EOF

# Secure the configuration file
chmod 600 /etc/wpa_supplicant/wpa_supplicant.conf
chown root:root /etc/wpa_supplicant/wpa_supplicant.conf

# Find wireless interface
wireless_interface=$(iw dev | grep Interface | awk '{print $2}' | head -1)

if [ -z "$wireless_interface" ]; then
    echo "No wireless interface found!"
    exit 1
fi

echo "Using wireless interface: $wireless_interface"

# Start wpa_supplicant
wpa_supplicant -B -i "$wireless_interface" -c /etc/wpa_supplicant/wpa_supplicant.conf -D nl80211

# Wait for connection
sleep 10

# Request IP address via DHCP
dhcpcd "$wireless_interface"

# Check connection status
wpa_cli -i "$wireless_interface" status

# Test connectivity
ping -c 3 8.8.8.8 && echo "✅ Wireless connection successful!" || echo "❌ Connection failed"

Security protocols configured:

• WPA2 (RSN) with CCMP encryption
• WPA fallback with TKIP encryption
• Pre-shared key (PSK) authentication
• Proactive key caching for faster reconnection

What this means: Your wireless connection is secured with strong encryption! 🎉

🎮 Step 3: Advanced Wireless Security

Implement Enterprise-Grade Security

Let’s add advanced wireless security features! 🎯

What we’re doing: Configuring advanced wireless security features including enterprise authentication, MAC filtering, and connection monitoring.

# Create advanced wireless security configuration
cat > /etc/wpa_supplicant/wpa_supplicant-advanced.conf << 'EOF'
# Advanced WPA Supplicant Configuration

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
update_config=1

# Global security settings
country=US
ap_scan=1
fast_reauth=1

# Enhanced security options
pmf=2  # Protected Management Frames required
sae_groups=19 20 21  # SAE (WPA3) groups

# Certificate validation for enterprise networks
ca_cert="/etc/ssl/certs/ca-certificates.crt"

# High-security home network (WPA3 if supported)
network={
    ssid="SecureHome"
    sae_password="very_strong_password_123!"
    key_mgmt=SAE
    ieee80211w=2
    priority=3
}

# WPA2 Personal with enhanced security
network={
    ssid="HomeWiFi"
    psk="strong_wifi_password_456!"
    proto=RSN
    key_mgmt=WPA-PSK
    pairwise=CCMP
    group=CCMP
    ieee80211w=2
    priority=2
    
    # Additional security options
    proactive_key_caching=1
    okc=1  # Opportunistic Key Caching
}

# Enterprise WPA2 with certificate validation
network={
    ssid="CorporateWiFi"
    key_mgmt=WPA-EAP
    eap=TLS
    identity="[email protected]"
    client_cert="/etc/ssl/certs/client.pem"
    private_key="/etc/ssl/private/client.key"
    ca_cert="/etc/ssl/certs/ca.pem"
    phase2="auth=MSCHAPV2"
    priority=5
    
    # Enterprise security options
    domain_suffix_match="company.com"
    altsubject_match="DNS:radius.company.com"
}

# PEAP with MSCHAPv2 (common enterprise setup)
network={
    ssid="OfficeWiFi"
    key_mgmt=WPA-EAP
    eap=PEAP
    identity="username"
    password="password"
    phase2="auth=MSCHAPV2"
    ca_cert="/etc/ssl/certs/ca-certificates.crt"
    priority=4
    
    # PEAP-specific options
    phase1="peaplabel=0"
    domain_suffix_match="office.local"
}

# Fallback network with lower security (if needed)
network={
    ssid="BackupWiFi"
    psk="backup_password"
    proto=RSN WPA
    key_mgmt=WPA-PSK
    pairwise=CCMP TKIP
    group=CCMP TKIP
    priority=1
}
EOF

# Create wireless security management script
cat > /usr/local/bin/wireless-security.sh << 'EOF'
#!/bin/bash
# Wireless Security Management Script

INTERFACE=""
CONFIG_FILE="/etc/wpa_supplicant/wpa_supplicant.conf"

# Find wireless interface
find_wireless_interface() {
    INTERFACE=$(iw dev | grep Interface | awk '{print $2}' | head -1)
    if [ -z "$INTERFACE" ]; then
        echo "❌ No wireless interface found"
        exit 1
    fi
    echo "📶 Using wireless interface: $INTERFACE"
}

# Scan for networks
scan_networks() {
    echo "🔍 Scanning for wireless networks..."
    
    # Bring interface up
    ip link set "$INTERFACE" up
    sleep 2
    
    # Perform scan
    iw dev "$INTERFACE" scan | awk '
    /^BSS/ { 
        mac = $2
        gsub(/\(.*\)/, "", mac)
    }
    /SSID:/ { 
        ssid = $2
        for(i=3; i<=NF; i++) ssid = ssid " " $i
    }
    /signal:/ { 
        signal = $2 " " $3
    }
    /WPA:/ { 
        security = "WPA"
    }
    /RSN:/ { 
        security = security " WPA2"
    }
    /Privacy/ { 
        if(security == "") security = "WEP"
    }
    /capability:/ {
        if(security == "") security = "Open"
        printf "%-20s %-17s %-12s %s\n", ssid, mac, signal, security
        ssid = ""; mac = ""; signal = ""; security = ""
    }' | sort -k3 -nr
}

# Check connection status
check_status() {
    echo "📊 Wireless Connection Status"
    echo "============================="
    
    # Interface status
    if ip addr show "$INTERFACE" | grep -q "state UP"; then
        echo "Interface: ✅ UP"
    else
        echo "Interface: ❌ DOWN"
        return 1
    fi
    
    # IP address
    local ip=$(ip addr show "$INTERFACE" | grep "inet " | awk '{print $2}')
    if [ -n "$ip" ]; then
        echo "IP Address: $ip"
    else
        echo "IP Address: ❌ Not assigned"
    fi
    
    # Connection info
    if pgrep wpa_supplicant >/dev/null; then
        echo "WPA Supplicant: ✅ Running"
        
        # Get connection details
        local status=$(wpa_cli -i "$INTERFACE" status 2>/dev/null)
        if echo "$status" | grep -q "wpa_state=COMPLETED"; then
            local ssid=$(echo "$status" | grep "ssid=" | cut -d'=' -f2)
            local bssid=$(echo "$status" | grep "bssid=" | cut -d'=' -f2)
            local freq=$(echo "$status" | grep "freq=" | cut -d'=' -f2)
            
            echo "Connected to: $ssid"
            echo "BSSID: $bssid"
            echo "Frequency: $freq MHz"
            
            # Signal strength
            local signal=$(iw dev "$INTERFACE" link | grep signal | awk '{print $2, $3}')
            echo "Signal: $signal"
        else
            echo "Connection: ❌ Not connected"
        fi
    else
        echo "WPA Supplicant: ❌ Not running"
    fi
    
    # Test connectivity
    if ping -c 1 -W 3 8.8.8.8 >/dev/null 2>&1; then
        echo "Internet: ✅ Connected"
    else
        echo "Internet: ❌ No connectivity"
    fi
}

# Connect to network
connect_network() {
    local ssid="$1"
    
    if [ -z "$ssid" ]; then
        echo "Usage: $0 connect <SSID>"
        return 1
    fi
    
    echo "🔗 Connecting to network: $ssid"
    
    # Start wpa_supplicant if not running
    if ! pgrep wpa_supplicant >/dev/null; then
        echo "Starting wpa_supplicant..."
        wpa_supplicant -B -i "$INTERFACE" -c "$CONFIG_FILE" -D nl80211
        sleep 3
    fi
    
    # Select network
    local network_id=$(wpa_cli -i "$INTERFACE" list_networks | grep "$ssid" | awk '{print $1}')
    
    if [ -n "$network_id" ]; then
        echo "Selecting configured network (ID: $network_id)..."
        wpa_cli -i "$INTERFACE" select_network "$network_id"
    else
        echo "❌ Network '$ssid' not found in configuration"
        return 1
    fi
    
    # Wait for connection
    echo "Waiting for connection..."
    for i in {1..30}; do
        if wpa_cli -i "$INTERFACE" status | grep -q "wpa_state=COMPLETED"; then
            echo "✅ Connected to $ssid"
            
            # Get IP via DHCP
            echo "Requesting IP address..."
            dhcpcd "$INTERFACE"
            return 0
        fi
        sleep 1
    done
    
    echo "❌ Connection timeout"
    return 1
}

# Disconnect from network
disconnect_network() {
    echo "🔌 Disconnecting from wireless network..."
    
    # Disconnect from current network
    wpa_cli -i "$INTERFACE" disconnect 2>/dev/null
    
    # Release DHCP lease
    dhcpcd -k "$INTERFACE" 2>/dev/null
    
    # Stop wpa_supplicant
    pkill wpa_supplicant
    
    echo "✅ Disconnected"
}

# Add new network
add_network() {
    local ssid="$1"
    local password="$2"
    local security="${3:-WPA2}"
    
    if [ -z "$ssid" ] || [ -z "$password" ]; then
        echo "Usage: $0 add <SSID> <PASSWORD> [WPA2|WPA|WEP]"
        return 1
    fi
    
    echo "➕ Adding network: $ssid"
    
    # Generate configuration
    local config_block=""
    case "$security" in
        "WPA2"|"WPA")
            config_block=$(cat << EOL

network={
    ssid="$ssid"
    psk="$password"
    proto=RSN WPA
    key_mgmt=WPA-PSK
    pairwise=CCMP TKIP
    group=CCMP TKIP
    priority=1
    scan_ssid=1
}
EOL
)
            ;;
        "WEP")
            config_block=$(cat << EOL

network={
    ssid="$ssid"
    wep_key0="$password"
    key_mgmt=NONE
    wep_tx_keyidx=0
    priority=0
    scan_ssid=1
}
EOL
)
            ;;
        *)
            echo "❌ Unsupported security type: $security"
            return 1
            ;;
    esac
    
    # Add to configuration file
    echo "$config_block" >> "$CONFIG_FILE"
    
    echo "✅ Network added to configuration"
    echo "💡 Use '$0 connect $ssid' to connect"
}

# Main menu
show_usage() {
    echo "📶 Wireless Security Management Tool"
    echo "Usage: $0 <command> [options]"
    echo
    echo "Commands:"
    echo "  scan                     - Scan for available networks"
    echo "  status                   - Show connection status"
    echo "  connect <SSID>          - Connect to configured network"
    echo "  disconnect              - Disconnect from current network"
    echo "  add <SSID> <PASS> [SEC] - Add new network configuration"
    echo
    echo "Examples:"
    echo "  $0 scan"
    echo "  $0 connect MyWiFi"
    echo "  $0 add GuestWiFi password123 WPA2"
}

# Main execution
find_wireless_interface

case "$1" in
    "scan")
        scan_networks
        ;;
    "status")
        check_status
        ;;
    "connect")
        connect_network "$2"
        ;;
    "disconnect")
        disconnect_network
        ;;
    "add")
        add_network "$2" "$3" "$4"
        ;;
    *)
        show_usage
        ;;
esac
EOF

chmod +x /usr/local/bin/wireless-security.sh

# Create wireless monitoring script
cat > /usr/local/bin/wireless-monitor.sh << 'EOF'
#!/bin/bash
# Wireless Connection Monitor

INTERFACE=$(iw dev | grep Interface | awk '{print $2}' | head -1)
LOG_FILE="/var/log/wireless-monitor.log"

monitor_connection() {
    while true; do
        clear
        echo "📶 WIRELESS SECURITY MONITOR - $(date)"
        echo "======================================="
        echo
        
        # Interface status
        if [ -n "$INTERFACE" ]; then
            echo "📡 Interface: $INTERFACE"
            
            if ip addr show "$INTERFACE" | grep -q "state UP"; then
                echo "Status: ✅ UP"
                
                # Connection details
                if wpa_cli -i "$INTERFACE" status 2>/dev/null | grep -q "wpa_state=COMPLETED"; then
                    local ssid=$(wpa_cli -i "$INTERFACE" status | grep "ssid=" | cut -d'=' -f2)
                    local bssid=$(wpa_cli -i "$INTERFACE" status | grep "bssid=" | cut -d'=' -f2)
                    local signal=$(iw dev "$INTERFACE" link | grep signal | awk '{print $2, $3}')
                    local freq=$(iw dev "$INTERFACE" link | grep freq | awk '{print $2}')
                    
                    echo "Connected: ✅ $ssid"
                    echo "BSSID: $bssid"
                    echo "Signal: $signal"
                    echo "Frequency: $freq MHz"
                    
                    # IP information
                    local ip=$(ip addr show "$INTERFACE" | grep "inet " | awk '{print $2}')
                    echo "IP: $ip"
                else
                    echo "Connected: ❌ Not connected"
                fi
            else
                echo "Status: ❌ DOWN"
            fi
        else
            echo "❌ No wireless interface found"
        fi
        
        echo
        echo "🔒 Security Information:"
        if wpa_cli -i "$INTERFACE" status 2>/dev/null | grep -q "wpa_state=COMPLETED"; then
            local key_mgmt=$(wpa_cli -i "$INTERFACE" status | grep "key_mgmt=" | cut -d'=' -f2)
            local pairwise=$(wpa_cli -i "$INTERFACE" status | grep "pairwise_cipher=" | cut -d'=' -f2)
            local group=$(wpa_cli -i "$INTERFACE" status | grep "group_cipher=" | cut -d'=' -f2)
            
            echo "Authentication: $key_mgmt"
            echo "Pairwise Cipher: $pairwise"
            echo "Group Cipher: $group"
        else
            echo "No security information (not connected)"
        fi
        
        echo
        echo "🌐 Connectivity Test:"
        if ping -c 1 -W 2 8.8.8.8 >/dev/null 2>&1; then
            echo "Internet: ✅ Connected"
        else
            echo "Internet: ❌ No connection"
        fi
        
        echo
        echo "Press Ctrl+C to exit, refreshing in 5 seconds..."
        sleep 5
    done
}

# Log connection events
log_event() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOG_FILE"
}

# Start monitoring
if [ "$1" = "daemon" ]; then
    # Background monitoring
    while true; do
        if wpa_cli -i "$INTERFACE" status 2>/dev/null | grep -q "wpa_state=COMPLETED"; then
            ssid=$(wpa_cli -i "$INTERFACE" status | grep "ssid=" | cut -d'=' -f2)
            signal=$(iw dev "$INTERFACE" link | grep signal | awk '{print $2, $3}' 2>/dev/null)
            log_event "Connected to $ssid, Signal: $signal"
        else
            log_event "Disconnected"
        fi
        sleep 60
    done
else
    # Interactive monitoring
    monitor_connection
fi
EOF

chmod +x /usr/local/bin/wireless-monitor.sh

echo "Advanced wireless security configuration completed!"
echo "Use '/usr/local/bin/wireless-security.sh' to manage connections"

Advanced security features:

• WPA3 (SAE) support for next-generation security
• Enterprise authentication with certificates
• Protected Management Frames (PMF)
• Signal monitoring and connection quality tracking

What this creates:

Wireless management: Complete command-line tools
Security protocols:   WPA, WPA2, WPA3, Enterprise
Monitoring system:    Real-time connection tracking
Configuration:        Multiple network profiles

Great job! Advanced wireless security is configured! 🌟

📊 Step 4: Wireless Security Testing

Verify Security Configuration

Now let’s test our wireless security setup! 😊

What we’re doing: Testing the wireless security configuration to ensure it’s working correctly and providing strong protection.

# Create wireless security test script
cat > /usr/local/bin/wireless-security-test.sh << 'EOF'
#!/bin/bash
# Wireless Security Testing Suite

INTERFACE=$(iw dev | grep Interface | awk '{print $2}' | head -1)
TEST_LOG="/var/log/wireless-security-test-$(date +%Y%m%d-%H%M%S).log"

echo "🔒 WIRELESS SECURITY TEST SUITE - $(date)" | tee "$TEST_LOG"
echo "===========================================" | tee -a "$TEST_LOG"
echo | tee -a "$TEST_LOG"

test_interface() {
    echo "📶 Testing Wireless Interface" | tee -a "$TEST_LOG"
    echo "=============================" | tee -a "$TEST_LOG"
    
    if [ -z "$INTERFACE" ]; then
        echo "❌ No wireless interface found" | tee -a "$TEST_LOG"
        return 1
    fi
    
    echo "✅ Wireless interface: $INTERFACE" | tee -a "$TEST_LOG"
    
    # Check interface capabilities
    iw dev "$INTERFACE" info | tee -a "$TEST_LOG"
    echo | tee -a "$TEST_LOG"
    
    # Check supported security protocols
    echo "🔐 Supported Security Protocols:" | tee -a "$TEST_LOG"
    iw phy | grep -A 10 "Supported Ciphers" | tee -a "$TEST_LOG"
    echo | tee -a "$TEST_LOG"
}

test_wpa_supplicant() {
    echo "🛡️  Testing WPA Supplicant" | tee -a "$TEST_LOG"
    echo "=========================" | tee -a "$TEST_LOG"
    
    # Check if wpa_supplicant is running
    if pgrep wpa_supplicant >/dev/null; then
        echo "✅ WPA Supplicant is running" | tee -a "$TEST_LOG"
        echo "PID: $(pgrep wpa_supplicant)" | tee -a "$TEST_LOG"
    else
        echo "❌ WPA Supplicant is not running" | tee -a "$TEST_LOG"
    fi
    
    # Check configuration file
    if [ -f /etc/wpa_supplicant/wpa_supplicant.conf ]; then
        echo "✅ Configuration file exists" | tee -a "$TEST_LOG"
        
        # Check file permissions
        local perms=$(stat -c %a /etc/wpa_supplicant/wpa_supplicant.conf)
        if [ "$perms" = "600" ]; then
            echo "✅ Configuration file permissions secure (600)" | tee -a "$TEST_LOG"
        else
            echo "⚠️  Configuration file permissions: $perms (should be 600)" | tee -a "$TEST_LOG"
        fi
        
        # Count configured networks
        local network_count=$(grep -c "^network=" /etc/wpa_supplicant/wpa_supplicant.conf)
        echo "📊 Configured networks: $network_count" | tee -a "$TEST_LOG"
    else
        echo "❌ Configuration file not found" | tee -a "$TEST_LOG"
    fi
    
    echo | tee -a "$TEST_LOG"
}

test_connection_security() {
    echo "🔒 Testing Connection Security" | tee -a "$TEST_LOG"
    echo "=============================" | tee -a "$TEST_LOG"
    
    if wpa_cli -i "$INTERFACE" status 2>/dev/null | grep -q "wpa_state=COMPLETED"; then
        echo "✅ Connected to wireless network" | tee -a "$TEST_LOG"
        
        # Get connection details
        local ssid=$(wpa_cli -i "$INTERFACE" status | grep "ssid=" | cut -d'=' -f2)
        local key_mgmt=$(wpa_cli -i "$INTERFACE" status | grep "key_mgmt=" | cut -d'=' -f2)
        local pairwise=$(wpa_cli -i "$INTERFACE" status | grep "pairwise_cipher=" | cut -d'=' -f2)
        local group=$(wpa_cli -i "$INTERFACE" status | grep "group_cipher=" | cut -d'=' -f2)
        
        echo "📡 SSID: $ssid" | tee -a "$TEST_LOG"
        echo "🔐 Key Management: $key_mgmt" | tee -a "$TEST_LOG"
        echo "🔒 Pairwise Cipher: $pairwise" | tee -a "$TEST_LOG"
        echo "🔒 Group Cipher: $group" | tee -a "$TEST_LOG"
        
        # Evaluate security level
        case "$key_mgmt" in
            "WPA2-PSK"|"SAE")
                echo "✅ Strong security protocol in use" | tee -a "$TEST_LOG"
                ;;
            "WPA-PSK")
                echo "⚠️  Moderate security protocol (consider upgrading to WPA2)" | tee -a "$TEST_LOG"
                ;;
            "NONE")
                echo "❌ No encryption (open network - very insecure!)" | tee -a "$TEST_LOG"
                ;;
            *)
                echo "❓ Unknown security protocol: $key_mgmt" | tee -a "$TEST_LOG"
                ;;
        esac
        
        case "$pairwise" in
            "CCMP")
                echo "✅ Strong encryption cipher (AES-CCMP)" | tee -a "$TEST_LOG"
                ;;
            "TKIP")
                echo "⚠️  Weak encryption cipher (TKIP - consider upgrading)" | tee -a "$TEST_LOG"
                ;;
            "WEP")
                echo "❌ Very weak encryption (WEP - highly insecure!)" | tee -a "$TEST_LOG"
                ;;
        esac
        
    else
        echo "❌ Not connected to any wireless network" | tee -a "$TEST_LOG"
    fi
    
    echo | tee -a "$TEST_LOG"
}

test_signal_quality() {
    echo "📶 Testing Signal Quality" | tee -a "$TEST_LOG"
    echo "========================" | tee -a "$TEST_LOG"
    
    if wpa_cli -i "$INTERFACE" status 2>/dev/null | grep -q "wpa_state=COMPLETED"; then
        # Get signal information
        local signal_info=$(iw dev "$INTERFACE" link 2>/dev/null | grep signal)
        if [ -n "$signal_info" ]; then
            echo "📊 $signal_info" | tee -a "$TEST_LOG"
            
            local signal_dbm=$(echo "$signal_info" | awk '{print $2}')
            local signal_num=$(echo "$signal_dbm" | tr -d '-')
            
            # Evaluate signal strength
            if [ "$signal_num" -le 50 ]; then
                echo "✅ Excellent signal strength" | tee -a "$TEST_LOG"
            elif [ "$signal_num" -le 60 ]; then
                echo "✅ Good signal strength" | tee -a "$TEST_LOG"
            elif [ "$signal_num" -le 70 ]; then
                echo "⚠️  Fair signal strength" | tee -a "$TEST_LOG"
            else
                echo "❌ Poor signal strength" | tee -a "$TEST_LOG"
            fi
        else
            echo "❓ Signal information not available" | tee -a "$TEST_LOG"
        fi
    else
        echo "❌ Not connected - cannot test signal quality" | tee -a "$TEST_LOG"
    fi
    
    echo | tee -a "$TEST_LOG"
}

test_connectivity() {
    echo "🌐 Testing Network Connectivity" | tee -a "$TEST_LOG"
    echo "==============================" | tee -a "$TEST_LOG"
    
    # Test local network connectivity
    local gateway=$(ip route | grep default | awk '{print $3}' | head -1)
    if [ -n "$gateway" ]; then
        if ping -c 3 -W 3 "$gateway" >/dev/null 2>&1; then
            echo "✅ Gateway connectivity: $gateway" | tee -a "$TEST_LOG"
        else
            echo "❌ Gateway unreachable: $gateway" | tee -a "$TEST_LOG"
        fi
    else
        echo "❌ No default gateway configured" | tee -a "$TEST_LOG"
    fi
    
    # Test internet connectivity
    if ping -c 3 -W 5 8.8.8.8 >/dev/null 2>&1; then
        echo "✅ Internet connectivity working" | tee -a "$TEST_LOG"
    else
        echo "❌ No internet connectivity" | tee -a "$TEST_LOG"
    fi
    
    # Test DNS resolution
    if nslookup google.com >/dev/null 2>&1; then
        echo "✅ DNS resolution working" | tee -a "$TEST_LOG"
    else
        echo "❌ DNS resolution failed" | tee -a "$TEST_LOG"
    fi
    
    # Test HTTPS connectivity
    if curl -s --connect-timeout 5 https://www.google.com >/dev/null 2>&1; then
        echo "✅ HTTPS connectivity working" | tee -a "$TEST_LOG"
    else
        echo "❌ HTTPS connectivity failed" | tee -a "$TEST_LOG"
    fi
    
    echo | tee -a "$TEST_LOG"
}

security_recommendations() {
    echo "💡 Security Recommendations" | tee -a "$TEST_LOG"
    echo "===========================" | tee -a "$TEST_LOG"
    
    # Check for security improvements
    if wpa_cli -i "$INTERFACE" status 2>/dev/null | grep -q "wpa_state=COMPLETED"; then
        local key_mgmt=$(wpa_cli -i "$INTERFACE" status | grep "key_mgmt=" | cut -d'=' -f2)
        local pairwise=$(wpa_cli -i "$INTERFACE" status | grep "pairwise_cipher=" | cut -d'=' -f2)
        
        case "$key_mgmt" in
            "WPA-PSK")
                echo "🔧 Consider upgrading to WPA2-PSK for better security" | tee -a "$TEST_LOG"
                ;;
            "NONE")
                echo "⚠️  Using open network - enable WPA2 security immediately!" | tee -a "$TEST_LOG"
                ;;
        esac
        
        case "$pairwise" in
            "TKIP")
                echo "🔧 Consider using CCMP (AES) encryption instead of TKIP" | tee -a "$TEST_LOG"
                ;;
            "WEP")
                echo "⚠️  WEP encryption is extremely insecure - upgrade to WPA2!" | tee -a "$TEST_LOG"
                ;;
        esac
        
        # Check if WPA3 is supported
        if iw phy | grep -q "SAE"; then
            echo "💡 Your hardware supports WPA3 (SAE) - consider upgrading for maximum security" | tee -a "$TEST_LOG"
        fi
    fi
    
    # General recommendations
    echo "📋 General Security Best Practices:" | tee -a "$TEST_LOG"
    echo "   • Use strong, unique passwords for WiFi networks" | tee -a "$TEST_LOG"
    echo "   • Prefer WPA3 > WPA2 > WPA (never use WEP or open networks)" | tee -a "$TEST_LOG"
    echo "   • Regularly update wireless drivers and firmware" | tee -a "$TEST_LOG"
    echo "   • Monitor for unauthorized connections" | tee -a "$TEST_LOG"
    echo "   • Use VPN for additional security on public networks" | tee -a "$TEST_LOG"
    
    echo | tee -a "$TEST_LOG"
}

# Run all tests
main() {
    test_interface
    test_wpa_supplicant
    test_connection_security
    test_signal_quality
    test_connectivity
    security_recommendations
    
    echo "✅ Wireless security testing completed" | tee -a "$TEST_LOG"
    echo "📊 Full report saved to: $TEST_LOG" | tee -a "$TEST_LOG"
}

main
EOF

chmod +x /usr/local/bin/wireless-security-test.sh

# Run initial security test
echo "Running wireless security test..."
/usr/local/bin/wireless-security-test.sh

What this does: Provides comprehensive wireless security testing and validation! 📚

📊 Quick Summary Table

🌐 Step 5: Troubleshooting Wireless Issues

Debug Common Wireless Problems

Let’s set up comprehensive wireless troubleshooting! 🌐

What we’re doing: Creating debugging tools and solutions for common wireless security and connectivity issues.

# Create wireless troubleshooting script
cat > /usr/local/bin/wireless-troubleshoot.sh << 'EOF'
#!/bin/bash
# Wireless Troubleshooting Tool

INTERFACE=$(iw dev | grep Interface | awk '{print $2}' | head -1)
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

print_status() {
    local status="$1"
    local message="$2"
    
    case "$status" in
        "OK")
            echo -e "${GREEN}✅ $message${NC}"
            ;;
        "WARN")
            echo -e "${YELLOW}⚠️  $message${NC}"
            ;;
        "ERROR")
            echo -e "${RED}❌ $message${NC}"
            ;;
    esac
}

check_hardware() {
    echo "🔍 Checking Wireless Hardware"
    echo "=============================="
    
    # Check for wireless interface
    if [ -n "$INTERFACE" ]; then
        print_status "OK" "Wireless interface found: $INTERFACE"
    else
        print_status "ERROR" "No wireless interface detected"
        echo "Possible solutions:"
        echo "  • Check if wireless adapter is connected"
        echo "  • Load wireless drivers: modprobe <driver_name>"
        echo "  • Check dmesg for hardware errors: dmesg | grep -i wireless"
        return 1
    fi
    
    # Check interface status
    if ip link show "$INTERFACE" | grep -q "state UP"; then
        print_status "OK" "Interface is UP"
    else
        print_status "WARN" "Interface is DOWN"
        echo "Attempting to bring up interface..."
        ip link set "$INTERFACE" up
        sleep 2
        if ip link show "$INTERFACE" | grep -q "state UP"; then
            print_status "OK" "Interface brought up successfully"
        else
            print_status "ERROR" "Failed to bring up interface"
        fi
    fi
    
    # Check for regulatory domain
    local regdomain=$(iw reg get | grep country | awk '{print $2}' | head -1)
    if [ -n "$regdomain" ]; then
        print_status "OK" "Regulatory domain set: $regdomain"
    else
        print_status "WARN" "No regulatory domain set"
        echo "Set regulatory domain: iw reg set US"
    fi
    
    echo
}

check_drivers() {
    echo "🔧 Checking Wireless Drivers"
    echo "============================"
    
    # Check loaded wireless modules
    local wireless_modules=$(lsmod | grep -E "(cfg80211|mac80211|iwl|ath|rt)" | wc -l)
    if [ "$wireless_modules" -gt 0 ]; then
        print_status "OK" "Wireless drivers loaded ($wireless_modules modules)"
        lsmod | grep -E "(cfg80211|mac80211|iwl|ath|rt)" | awk '{print "  " $1}'
    else
        print_status "ERROR" "No wireless drivers loaded"
        echo "Load appropriate driver for your hardware"
    fi
    
    # Check for firmware
    if dmesg | grep -q "firmware"; then
        local firmware_errors=$(dmesg | grep -i "firmware.*error\|firmware.*fail" | wc -l)
        if [ "$firmware_errors" -eq 0 ]; then
            print_status "OK" "Firmware loaded successfully"
        else
            print_status "ERROR" "Firmware loading errors detected"
            echo "Check dmesg for firmware issues: dmesg | grep -i firmware"
        fi
    fi
    
    echo
}

check_configuration() {
    echo "⚙️  Checking Configuration"
    echo "========================="
    
    # Check wpa_supplicant configuration
    if [ -f /etc/wpa_supplicant/wpa_supplicant.conf ]; then
        print_status "OK" "WPA supplicant config exists"
        
        # Check file permissions
        local perms=$(stat -c %a /etc/wpa_supplicant/wpa_supplicant.conf)
        if [ "$perms" = "600" ]; then
            print_status "OK" "Config file permissions secure"
        else
            print_status "WARN" "Config file permissions: $perms (should be 600)"
            echo "Fix with: chmod 600 /etc/wpa_supplicant/wpa_supplicant.conf"
        fi
        
        # Check for networks
        local networks=$(grep -c "^network=" /etc/wpa_supplicant/wpa_supplicant.conf)
        if [ "$networks" -gt 0 ]; then
            print_status "OK" "Networks configured: $networks"
        else
            print_status "WARN" "No networks configured"
        fi
    else
        print_status "ERROR" "WPA supplicant config not found"
        echo "Create config: /etc/wpa_supplicant/wpa_supplicant.conf"
    fi
    
    # Check wpa_supplicant process
    if pgrep wpa_supplicant >/dev/null; then
        print_status "OK" "WPA supplicant running"
    else
        print_status "ERROR" "WPA supplicant not running"
        echo "Start with: wpa_supplicant -B -i $INTERFACE -c /etc/wpa_supplicant/wpa_supplicant.conf"
    fi
    
    echo
}

check_connection() {
    echo "🌐 Checking Connection"
    echo "====================="
    
    # Check connection status
    if wpa_cli -i "$INTERFACE" status 2>/dev/null | grep -q "wpa_state=COMPLETED"; then
        print_status "OK" "Connected to wireless network"
        
        local ssid=$(wpa_cli -i "$INTERFACE" status | grep "ssid=" | cut -d'=' -f2)
        local signal=$(iw dev "$INTERFACE" link | grep signal | awk '{print $2, $3}' 2>/dev/null)
        print_status "OK" "Network: $ssid"
        print_status "OK" "Signal: $signal"
    else
        print_status "ERROR" "Not connected to wireless network"
    fi
    
    # Check IP address
    local ip=$(ip addr show "$INTERFACE" | grep "inet " | awk '{print $2}')
    if [ -n "$ip" ]; then
        print_status "OK" "IP address: $ip"
    else
        print_status "ERROR" "No IP address assigned"
        echo "Try: dhcpcd $INTERFACE"
    fi
    
    # Check connectivity
    if ping -c 1 -W 3 8.8.8.8 >/dev/null 2>&1; then
        print_status "OK" "Internet connectivity working"
    else
        print_status "ERROR" "No internet connectivity"
    fi
    
    echo
}

fix_common_issues() {
    echo "🔧 Applying Common Fixes"
    echo "======================="
    
    print_status "OK" "Restarting network interface..."
    ip link set "$INTERFACE" down
    sleep 2
    ip link set "$INTERFACE" up
    sleep 3
    
    print_status "OK" "Restarting wpa_supplicant..."
    pkill wpa_supplicant
    sleep 2
    wpa_supplicant -B -i "$INTERFACE" -c /etc/wpa_supplicant/wpa_supplicant.conf -D nl80211
    sleep 5
    
    print_status "OK" "Requesting new IP address..."
    dhcpcd -k "$INTERFACE" 2>/dev/null
    sleep 2
    dhcpcd "$INTERFACE"
    sleep 5
    
    print_status "OK" "Testing connectivity..."
    if ping -c 3 8.8.8.8 >/dev/null 2>&1; then
        print_status "OK" "✅ Connection restored!"
    else
        print_status "ERROR" "❌ Connection still not working"
        echo
        echo "Additional troubleshooting:"
        echo "  • Check if network password is correct"
        echo "  • Verify network is in range and working"
        echo "  • Check router/access point settings"
        echo "  • Try connecting to a different network"
    fi
    
    echo
}

run_diagnostic() {
    echo "🩺 Running Wireless Diagnostic"
    echo "=============================="
    
    echo "System Information:"
    echo "  Kernel: $(uname -r)"
    echo "  Distribution: Alpine Linux"
    echo
    
    echo "Hardware Information:"
    lspci | grep -i network
    lsusb | grep -i wireless
    echo
    
    echo "Driver Information:"
    lsmod | grep -E "(cfg80211|mac80211)" | head -5
    echo
    
    echo "Interface Information:"
    iw dev "$INTERFACE" info 2>/dev/null || echo "Interface info not available"
    echo
    
    echo "Scan Results (last 5 networks):"
    iw dev "$INTERFACE" scan 2>/dev/null | grep -E "(SSID|signal|WPA|WEP)" | head -10 || echo "Scan failed"
    echo
    
    echo "Connection Logs:"
    tail -10 /var/log/messages | grep -E "(wpa_supplicant|dhcpcd)" || echo "No recent logs"
    echo
}

# Main menu
show_menu() {
    echo "🔧 WIRELESS TROUBLESHOOTING TOOL"
    echo "================================="
    echo
    echo "1) Check hardware and drivers"
    echo "2) Check configuration"
    echo "3) Check connection status"
    echo "4) Apply common fixes"
    echo "5) Run full diagnostic"
    echo "6) Show network scan"
    echo "7) Exit"
    echo
    read -p "Select option (1-7): " choice
    
    case "$choice" in
        1)
            check_hardware
            check_drivers
            ;;
        2)
            check_configuration
            ;;
        3)
            check_connection
            ;;
        4)
            fix_common_issues
            ;;
        5)
            check_hardware
            check_drivers
            check_configuration
            check_connection
            run_diagnostic
            ;;
        6)
            echo "Scanning for networks..."
            /usr/local/bin/wireless-security.sh scan
            ;;
        7)
            echo "Exiting troubleshooter"
            exit 0
            ;;
        *)
            echo "Invalid option"
            ;;
    esac
    
    echo
    read -p "Press Enter to continue..."
    show_menu
}

# Start troubleshooter
if [ "$1" = "auto" ]; then
    # Auto mode - run all checks
    check_hardware
    check_drivers
    check_configuration
    check_connection
else
    # Interactive mode
    show_menu
fi
EOF

chmod +x /usr/local/bin/wireless-troubleshoot.sh

echo "Wireless troubleshooting tools installed!"
echo "Run '/usr/local/bin/wireless-troubleshoot.sh' for interactive troubleshooting"
echo "Run '/usr/local/bin/wireless-troubleshoot.sh auto' for automatic checks"

What this does: Provides comprehensive wireless troubleshooting and problem resolution! 🌟

🚨 Fix Common Problems

Problem 1: Cannot connect to WPA2 network ❌

What happened: Authentication fails when connecting to secure networks. How to fix it: Check credentials and security settings!

# Verify network credentials
wpa_passphrase "NetworkName" "password" | grep psk=

# Check configuration syntax
wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -i wlan0 -d

# Reset and reconfigure
pkill wpa_supplicant
wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf

Problem 2: Weak signal or frequent disconnections ❌

What happened: Connection drops or signal is poor. How to fix it: Check signal strength and positioning!

# Check signal strength
iw dev wlan0 link | grep signal

# Monitor signal quality
watch -n 1 'iw dev wlan0 link | grep signal'

# Scan for best access point
iw dev wlan0 scan | grep -E "(SSID|signal)" | grep -A1 "YourNetwork"

Problem 3: DNS not working on wireless ❌

What happened: Connected but no internet due to DNS issues. How to fix it: Configure DNS manually!

# Set DNS servers manually
echo "nameserver 8.8.8.8" > /etc/resolv.conf
echo "nameserver 1.1.1.1" >> /etc/resolv.conf

# Test DNS resolution
nslookup google.com

# Restart networking to regenerate resolv.conf
rc-service networking restart

Don’t worry! These problems happen to everyone. You’re doing great! 💪

💡 Simple Tips

1. Use strong passwords 📅 - Complex passwords provide better security
2. Choose WPA2 or newer 🌱 - Avoid WEP and open networks
3. Monitor signal strength 🤝 - Position for best reception
4. Keep drivers updated 💪 - Updated drivers improve compatibility

✅ Check Everything Works

Let’s make sure everything is working:

# Check wireless interface
iw dev

# Verify wpa_supplicant is running
pgrep wpa_supplicant && echo "✅ WPA supplicant running"

# Check connection status
/usr/local/bin/wireless-security.sh status

# Test internet connectivity
ping -c 3 8.8.8.8 && echo "✅ Internet working"

# Test DNS resolution
nslookup google.com && echo "✅ DNS working"

# Run security test
/usr/local/bin/wireless-security-test.sh

# Monitor connection
/usr/local/bin/wireless-monitor.sh &
sleep 10
pkill -f wireless-monitor

# You should see this
echo "Wireless security is configured and working perfectly! ✅"

Good output:

Interface wlan0
	ifindex 3
	wdev 0x1
	addr 02:11:22:33:44:55
	type managed

✅ WPA supplicant running

📶 Using wireless interface: wlan0
📊 Wireless Connection Status
=============================
Interface: ✅ UP
IP Address: 192.168.1.105/24
WPA Supplicant: ✅ Running
Connected to: HomeWiFi
BSSID: 00:1a:2b:3c:4d:5e
Signal: -42 dBm

PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=116 time=15.123 ms

✅ Internet working
✅ DNS working
✅ Strong security protocol in use
✅ Strong encryption cipher (AES-CCMP)

✅ Success! Wireless security is properly configured and connection is secure.

🏆 What You Learned

Great job! Now you can:

• ✅ Configure WPA/WPA2 wireless security protocols
• ✅ Set up wpa_supplicant for secure wireless connections
• ✅ Implement advanced wireless security features
• ✅ Test and validate wireless security configurations
• ✅ Troubleshoot common wireless connectivity issues

🎯 What’s Next?

Now you can try:

• 📚 Setting up WPA3 (SAE) for next-generation security
• 🛠️ Configuring enterprise wireless with RADIUS authentication
• 🤝 Creating wireless access point with hostapd
• 🌟 Building wireless mesh networks for extended coverage!

Remember: Every expert was once a beginner. You’re doing amazing! 🎉

Keep practicing and you’ll become a wireless security expert too! 💫