Skip to main content
60 votes
Accepted

How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt

The hash and salt are both in the value column. After Base64 decoding, the first 32 bytes are the hash, and the rest is the salt (in your case, it's the ASCII string seldemer).
Joseph Sible-Reinstate Monica's user avatar
5 votes

What can I do with a radius shared secret?

The RADIUS client and server use the shared secret to encrypt the password. If you know the shared secret, and you can capture RADIUS packets with encrypted passwords, you can decrypt them and get ...
gowenfawr's user avatar
  • 73k
3 votes

How to protect against MAC spoofing in WiFi network?

You cannot prevent the user from changing their MAC address. The MAC address is provided by the client and can be changed at any time assuming their hardware allows them to do so. If you are relying ...
bk2204's user avatar
  • 9,544
2 votes

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

It is possible, and you cannot prevent it. Most devices will allow administrators to backup or extract certificates, including the private key. Your perception of security is not in line with the ...
DoubleD's user avatar
  • 3,952
1 vote
Accepted

WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks

As ysdx mentioned in their excellent answer, hostapd has a feature that allows one to specify different PSKs based on the station MAC address. This can be achieved either by using the wpa_psk_file or ...
Facundo's user avatar
  • 71
1 vote

WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks

The options you listed are part of WPA Entreprise. They are not suitable for a station which only supports WPA personal (i.e. WPA1-PSK, WPA2-PSK, WPA3-SAE). If your device can only do WPA2-PSK, your ...
ysdx's user avatar
  • 1,775
1 vote

Are there other types of NT Password (NTLM Hash) besides raw MD4?

No, the protocol is specifically defined to use MD4. (It's called "NT hash" because it is in fact the exact same hash format that was used by Windows NT to store user passwords – and MS-CHAP ...
grawity's user avatar
  • 1,716
1 vote
Accepted

Freeradius eap-tls - unknown CA

The issue was linked to a field called "identity" with the supplicant I had chosen a different name than that specified in the FreeRADIUS clients.conf file
azurtem's user avatar
  • 21
1 vote
Accepted

How are RADIUS packets encrypted?

RADIUS by itself provides no encryption of all traffic. It protects only a small part of the traffic, notably the passwords. To cite from Wikipedia: Radius - Security: The RADIUS protocol ...
Steffen Ullrich's user avatar
1 vote

OpenVPN using google authenticator

There is an extention made for OpenVPN for OTP (One Time Password). This extention includes Google Authenticator software tokens. https://github.com/evgeny-gridasov/openvpn-otp
Inferno IV's user avatar
1 vote
Accepted

Security concerns of RADIUS based server/workstation auth

If it helps you feel better, 99% of our encrypted communication uses symmetric cryptography (Like PSKs). We only use asymmetric cryptography (Certificates) to transfer symmetric keys and sign hashes. ...
Andrew Hendrix's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible