Virtual Private Networks - Revision history

Andreasdittrich: /* Poptop - The PPTP Server for Linux */

2005-09-14T13:49:50Z

Poptop - The PPTP Server for Linux

← Older revision		Revision as of 13:49, 14 September 2005
Line 52:		Line 52:

	/etc/modules.conf		/etc/modules.conf

	/etc/pptpd.conf		/etc/pptpd.conf

	/etc/ppp/options.pptpd		/etc/ppp/options.pptpd

	/etc/ppp/chap-secrets		/etc/ppp/chap-secrets

Andreasdittrich: /* Servers */

2005-09-14T13:49:34Z

Servers

← Older revision		Revision as of 13:49, 14 September 2005
Line 27:		Line 27:

	===Servers===		===Servers===

			There are quite a few implementations of PPTP out in the wild since it's easy to implement and was pushed to market strongly by Microsoft. Most of the broadband hardware-routers support it besides PPPoE etc. We will focus on to servers here: The standard Microsoft-way on Windows 2003 Server and poptop, a userspace daemon for Linux.

	===Implementation Windows===		===Implementation Windows===

Andreasdittrich: /* Preface */

2005-09-14T13:46:50Z

Preface

← Older revision		Revision as of 13:46, 14 September 2005
Line 19:		Line 19:

	===Preface===		===Preface===

	How does it work?

	PPTP is best described in RFC 2637. In short, PPTP is used to tunnel the PPP-protocol over IP-networks. It is realized with a Client-Server architecture and works on two logically seperated channels: One control-channel that ist used to control the PPTP-connection. It runs on TCP Port 1723. Second the data-channel on wich the actuall PPP-data is exchanged, encapsulated in GRE-packets.		PPTP is best described in RFC 2637. In short, PPTP is used to tunnel the PPP-protocol over IP-networks. It is realized with a Client-Server architecture and works on two logically seperated channels: One control-channel that ist used to control the PPTP-connection. It runs on TCP Port 1723. Second the data-channel on wich the actuall PPP-data is exchanged, encapsulated in GRE-packets.

	Authentication

	Authentication is done by PPP and the underlying MSCHAPv2 which is broken. Unfortunately there is no way NOT to use Login/Passwords but more secure certificates. That is the reason Microsoft doesn't encourage the use of PPTP anymore.		Authentication is done by PPP and the underlying MSCHAPv2 which is broken. Unfortunately there is no way NOT to use Login/Passwords but more secure certificates. That is the reason Microsoft doesn't encourage the use of PPTP anymore.

	Encryption

	Only the data-tunnel is optionally encrypted with MPPE with a maximum keylength of 128bit which makes it a good goal for attacks. The lack of rekeying makes attacks obviously easier.		Only the data-tunnel is optionally encrypted with MPPE with a maximum keylength of 128bit which makes it a good goal for attacks. The lack of rekeying makes attacks obviously easier.

Andreasdittrich: /* Preface */

2005-09-14T13:45:45Z

Preface

← Older revision		Revision as of 13:45, 14 September 2005
Line 21:		Line 21:

	How does it work?		How does it work?

			PPTP is best described in RFC 2637. In short, PPTP is used to tunnel the PPP-protocol over IP-networks. It is realized with a Client-Server architecture and works on two logically seperated channels: One control-channel that ist used to control the PPTP-connection. It runs on TCP Port 1723. Second the data-channel on wich the actuall PPP-data is exchanged, encapsulated in GRE-packets.

	Authentication		Authentication

			Authentication is done by PPP and the underlying MSCHAPv2 which is broken. Unfortunately there is no way NOT to use Login/Passwords but more secure certificates. That is the reason Microsoft doesn't encourage the use of PPTP anymore.

	Encryption		Encryption

			Only the data-tunnel is optionally encrypted with MPPE with a maximum keylength of 128bit which makes it a good goal for attacks. The lack of rekeying makes attacks obviously easier.

	===Servers===		===Servers===

Andreasdittrich: /* Poptop - The PPTP Server for Linux */

2005-09-14T13:40:17Z

Poptop - The PPTP Server for Linux

← Older revision		Revision as of 13:40, 14 September 2005
Line 58:		Line 58:
	[http://poptop.sourceforge.net/dox/ poptop Documentation]		[http://poptop.sourceforge.net/dox/ poptop Documentation]

	''modules.conf'' and ''chap-secrets'' don't need to be explained here and also ''options.pptpd'' needs only a few adjustments for your personal setup. Check that the name of the service is correctly referenced in both ''options.pptpd' and ''chap-secrets''. The most interesting file is ''pptpd.conf''. The options you should have a closer look at are		''modules.conf'' and ''chap-secrets'' don't need to be explained here and also ''options.pptpd'' needs only a few adjustments for your personal setup. Check that the name of the service is correctly referenced in both ''options.pptpd'' and ''chap-secrets''. The most interesting file is ''pptpd.conf''. The options you should have a closer look at are

	bcrelay <if>		bcrelay <if>

Andreasdittrich: /* Poptop - The PPTP Server for Linux */

2005-09-14T13:39:43Z

Poptop - The PPTP Server for Linux

@@ Line 46: / Line 46: @@
 I can confirm this to be perfectly working on the current sarge-kernel (2.6.8-2).
 You might want to make a menuconfig oder oldconfig to ensure that MPPE-support is being built.
 ===Clients===

Andreasdittrich: /* Poptop - The PPTP Server for Linux */

2005-09-14T13:27:49Z

Poptop - The PPTP Server for Linux

← Older revision		Revision as of 13:27, 14 September 2005
Line 38:		Line 38:
	I used Debian Sarge as a base system. Your mileage may vary on different platforms, the Setup on a Debian-machine is pretty straight forward. This Howto explains everything step by step:		I used Debian Sarge as a base system. Your mileage may vary on different platforms, the Setup on a Debian-machine is pretty straight forward. This Howto explains everything step by step:

	[http://poptop.sourceforge.net/dox/debian-howto.phtml Debian-~~Howto Debian~~-Howto]		[http://poptop.sourceforge.net/dox/debian-howto.phtml Debian-poptop-Howto]

	For the mppe-patch you might wanna use this howto:		For the mppe-patch you might wanna use this howto:

	[http://pptpclient.sourceforge.net/howto-debian-build.phtml ~~Debian-MPPE-Howto~~ Debian-MPPE-Howto]		[http://pptpclient.sourceforge.net/howto-debian-build.phtml Debian-MPPE-Howto]

	I can confirm this to be perfectly working on the current sarge-kernel (2.6.8-2).		I can confirm this to be perfectly working on the current sarge-kernel (2.6.8-2).

Andreasdittrich: /* Linux */

2005-09-14T13:26:55Z

Linux

← Older revision		Revision as of 13:26, 14 September 2005
Line 52:		Line 52:

	====Linux====		====Linux====

			pptclient

	====MacOS====		====MacOS====

Andreasdittrich: /* Implementation Linux */

2005-09-14T13:26:40Z

Implementation Linux

← Older revision		Revision as of 13:26, 14 September 2005
Line 31:		Line 31:

	===Implementation Linux===		===Implementation Linux===

			The implementation basically consists of three parts: First of all the PPTP-daemon that ist needed to handle the PPTP-connections. Second a PPP-daemon that is needed to dial into the network from the remote site. Last but not least you might want to encrypt your PPTP-Datatunnel. This is accomplished on PPP-Level with mppe. Since it isn't secure and announced obsolete by Microsoft there is no strong will to implement support into the Linuxkernel itself, so you have to patch your kernel to get the module.

	====Poptop - The PPTP Server for Linux====		====Poptop - The PPTP Server for Linux====

			I used Debian Sarge as a base system. Your mileage may vary on different platforms, the Setup on a Debian-machine is pretty straight forward. This Howto explains everything step by step:
	mppe-patch

	pptpd
			[http://poptop.sourceforge.net/dox/debian-howto.phtml Debian-Howto Debian-Howto]

			For the mppe-patch you might wanna use this howto:

			[http://pptpclient.sourceforge.net/howto-debian-build.phtml Debian-MPPE-Howto Debian-MPPE-Howto]

			I can confirm this to be perfectly working on the current sarge-kernel (2.6.8-2).
			You might want to make a menuconfig oder oldconfig to ensure that MPPE-support is being built.

	===Clients===		===Clients===

Deni at 12:32, 12 September 2005

2005-09-12T12:32:11Z

← Older revision		Revision as of 12:32, 12 September 2005
Line 55:		Line 55:

	===Openswan===		===Openswan===

			==L2TP/IPSec==