I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one hashed in SHA256 without salt and the last one hashed in SHA256 and salted.

I used this script to create the salted hash : https://gist.github.com/bestrocker221/f506eee8ccadc60cab71d5f633b7cc07

When I am testing the connexion to the radius server (with the command radtest and with another computer running ubuntu), all of the accounts can be accessed.

Here is the database content : (Each user have the same password, "passroot")

mysql> select * from radcheck;
| id | username | attribute         | op | value
|  1 |   user1  |Cleartext-Password | := | passroot
|  2 |   user2  |SHA2-Password      | := | ef653cafdcaf5b3733c7c5aa24b781c5c952618642efd2abc04b9c6efccac8258bc84a881850d9ffa8e6c91953c8ca7613f49dea007ae6437ccf26b8f10fadfb
|  4 |   toto   |SSHA2-256-Password | := | /F8Bymi/qgL4rQHP9C+8jDciSLmr/PZEc5JJNoCwRelzZWxkZW1lcg==

The authentication with the account using the salt method is working :

root@Principale:"/share# radtest toto passroot 1812 passroot
Sent Access-Request Id 117 from to length 74
User-Name = "toto"
User-Password = "passroot"
NAS-IP-Address =
NAS-Port = 1812
Message-Authenticator = 0x00
Cleartext-Password = "passroot"
Received Access-Accept Id 117 from to   length 20

root@Principale:"/share# tail /var/log/freeradius/radius.log
Tue May 4 16:32:07 2021 : Info: Need 7 more connections to reach 10 spares
Tue May 4 16:32:07 2021 : Info: rlm_sql (sql): Opening additional connection (42), 1 of 29 pending _slots used
Tue May 4 16:32:07 2021 : Auth: (164) Login OK: [toto/passroot] (from client test port 1812)

I don't understand how freeradius can match the password provided by the user to the salted hash stored in the database when he doesn't know the salt I used.

  • 1
    I'm just going to chime in here: do not use SHA-anything for password storage. There are significantly more appropriate algorithms out there.
    – Nzall
    Commented May 5, 2021 at 6:52
  • Can you give me some name you think about ? I found this list of compatible hash with freeradius for EAP-GTC authentication : Clear-text, NT hash, MD5, Salted MD5, SHA1 & 2, Salted SHA1 & 2, Unix Crypt.
    – molik
    Commented May 5, 2021 at 7:06
  • 6
    @molik It appears that FreeRadius does not support anything more secure than SHA-2 unfortunately. Ideally it should support something more modern like bcrypt, Argon2id, scrypt or PBKDF2, which are the current standards for password security.
    – Nzall
    Commented May 5, 2021 at 11:11
  • FreeRADIUS supports PBKDF2 in both master branch and v3.0.x - github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/… github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/… Commented May 6, 2021 at 19:17
  • 1
    In master it also supports SSHA3. Commented May 6, 2021 at 19:18

1 Answer 1


The hash and salt are both in the value column. After Base64 decoding, the first 32 bytes are the hash, and the rest is the salt (in your case, it's the ASCII string seldemer).

  • 9
    seldemer (sel de mer) translates as "sea salt" in french btw Commented May 6, 2021 at 14:46
  • 1
    Is that salt always used, or only in test? Because a salt is supposed to be different for each user, a fixed salt is almost as bad as no salt. Commented May 6, 2021 at 16:27
  • 1
    @JosephSible-ReinstateMonica I am not CodesInChaos, but I would assume it is because 'seldemer' doesn't seem all too random.
    – cjnash
    Commented May 6, 2021 at 17:20
  • 3
    @cjnash The OP did manually pick that salt, but it was just for that one user's password. If another user had a salted password, it would have its own salt. They wouldn't have to be the same. Commented May 6, 2021 at 17:21
  • 3
    @JosephSible-ReinstateMonica It's clearly not random, and not part of the code the OP showed. And I wouldn't be surprised if somebody competent enough to choose SHA-256 as password hash, would choose a hardcoded "salt". Commented May 6, 2021 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .