Troubleshooting FreeRADIUS

Recently I was working with FreeRADIUS to do PEAP authentication. I went under a lot of trouble from installing to configuring the FreeRADIUS. Thankfully, I noted down the problems I encountered and the solution I followed. This is not a complete guide for FreeRADIUS installation but provides you with possible solution to a few errors.

1.

While executing radiusd -X, it may throw the following error:

radiusd: error while loading shared libraries:

libfreeradius-radius-2.1.10.so:

cannot open shared object file: No such file or directory

The reason for this error is that the libraries have been installed in a place where dynamic linker cannot find it. To solve this problem use this command:

sudo /sbin/ldconfig -v

2.

While running in debug mode the RADIUS server may give the following error:

Ignoring EAP-Type/tls because we do not have OpenSSL support.

[eap] Request found, released from the list

[eap] EAP NAK

[eap] NAK asked for unsupported type PEAP

[eap] No common EAP types found.

[eap] Failed in EAP select

++[eap] returns invalid

Failed to authenticate the user.

The reason for this error is that open ssl dev library “libssl-dev” is not installed. Install the library (sudo apt-get install libssl-dev) and re-configure (by running configure, make and make install) FreeRADIUS server.

3.

Running the RADIUS server may also result in the following error:

Error: Failed binding to authentication address * port 1812: Address already in use /usr/local/etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812

The reason for this error is that another instance of radius is running and has occupied the port.

See which radius process is running:

ps aux | grep radius

And then kill that process:

sudo kill -9 process_id

4.

While running the RADIUS sever it may also throw an error: “no soh-server”. To solve it, copy “soh” file in /usr/local/etc/raddb/sites-available to /usr/local/etc/raddb/sites-enabled.

I hope it helped you. Questions and suggestions are welcomed. Enjoy :)


Troubleshoot: NAP capable clients are evaluated as Non NAP capable

I had real hard time in troubleshooting the problem where NAP capable clients were evaluated as Non NAP capable by the NPS server. 802.1x authentication was perfectly successful but there were no information about the client’s health. It seemed NPS server was working as a plain RADIUS server.

There are few points which must be checked for a successful implementation of Microsoft NAP. Check all of these:

  1. NAP agent must be running: To check use “netsh nap client show state” in command prompt. If not running, go to services and start the service and put it to automatic.
  2. Enforcement client 79623 is enabled and initialized on the client: This can also be checked with the previous command.
  3. Quarantine checks are enabled in PEAP properties on the client: See the authentication tab in network properties.
  4. 802.1X with PEAP is configured (rather than 802.1X with EAP) on the client: See the authentication tab in network properties.
  5. NAP agent is running before 802.1x authentication. Put the dependency on NAP agent with wired auto config.
  6. Override network policy authentication settings is enabled in connection request policy on the server.

Hope it will help you in troubleshooting your NAP setup. Questions and suggestions are welcomed. Enjoy :)

Sources: Microsoft, Greg Lindsay