60
votes
Accepted
How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt
The hash and salt are both in the value column. After Base64 decoding, the first 32 bytes are the hash, and the rest is the salt (in your case, it's the ASCII string seldemer).
5
votes
What can I do with a radius shared secret?
The RADIUS client and server use the shared secret to encrypt the password. If you know the shared secret, and you can capture RADIUS packets with encrypted passwords, you can decrypt them and get ...
- 72.7k
3
votes
How to protect against MAC spoofing in WiFi network?
You cannot prevent the user from changing their MAC address. The MAC address is provided by the client and can be changed at any time assuming their hardware allows them to do so. If you are relying ...
- 9,294
2
votes
Break into WPA2-Enterprise RADIUS wifi network by stealing credentials
It is possible, and you cannot prevent it.
Most devices will allow administrators to backup or extract certificates, including the private key. Your perception of security is not in line with the ...
- 3,942
1
vote
Accepted
WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks
As ysdx mentioned in their excellent answer, hostapd has a feature that allows one to specify different PSKs based on the station MAC address. This can be achieved either by using the wpa_psk_file or ...
- 61
1
vote
WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks
The options you listed are part of WPA Entreprise. They are not suitable for a station which only supports WPA personal (i.e. WPA1-PSK, WPA2-PSK, WPA3-SAE).
If your device can only do WPA2-PSK, your ...
- 1,382
1
vote
Are there other types of NT Password (NTLM Hash) besides raw MD4?
No, the protocol is specifically defined to use MD4. (It's called "NT hash" because it is in fact the exact same hash format that was used by Windows NT to store user passwords – and MS-CHAP ...
- 1,141
1
vote
Accepted
Freeradius eap-tls - unknown CA
The issue was linked to a field called "identity" with the supplicant
I had chosen a different name than that specified in the FreeRADIUS clients.conf file
- 21
1
vote
Accepted
How are RADIUS packets encrypted?
RADIUS by itself provides no encryption of all traffic. It protects only a small part of the traffic, notably the passwords. To cite from Wikipedia: Radius - Security:
The RADIUS protocol ...
- 198k
1
vote
OpenVPN using google authenticator
There is an extention made for OpenVPN for OTP (One Time Password).
This extention includes Google Authenticator software tokens.
https://github.com/evgeny-gridasov/openvpn-otp
- 111
1
vote
Accepted
Security concerns of RADIUS based server/workstation auth
If it helps you feel better, 99% of our encrypted communication uses symmetric cryptography (Like PSKs). We only use asymmetric cryptography (Certificates) to transfer symmetric keys and sign hashes.
...
- 184
Only top scored, non community-wiki answers of a minimum length are eligible