PPTP + MPPE + RADIUS + MySQL

[doramon]

PPTP + MPPE + RADIUS + MySQL
Requirements:
kernel sources. (2.4.18 or later prefered.) www.kernel.org
ppp sources from cvs or recent snapshot. www.samba.org/ppp
Freeradius 0.7.1 or later. www.freeradius.org
PoPToP 1.1.3 www.sourceforge.net/projects/poptop


Should be present in most distributions these days:
MySQL www.mysql.com
openssl 0.9.6b or later. www.openssl.org


Caveats: MPPE encryption seems to be available with MS-CHAP authentication only. Not PAP and CHAP. This document assumes only MS-CHAP v2 is used. (As version 1 is totally broken securitywise.)

PPP and kernel:

Patch your kernel sources with the mppeinstall.sh script in linux/mppe/
Configure your kernel source for mppe support (make menuconfig or your prefered way.) The patch makes a new choice for a MPPE module under Network devices - PPP.

Compile and install your kernel and modules. I take it everybody knows how to do this and update their lilo/grub/whatever bootloader.

Doublecheck /etc/modules.conf for aliases to ppp_mppe and so on.
alias char-major-108 ppp_generic
alias tty-ldisc-3 ppp_async
alias tty-ldisc-14 ppp_synctty
alias ppp-compress-18 ppp_mppe
alias ppp-comress-21 bsd_comp
alias ppp-compress-24 ppp_deflate
alias ppp-compress-26 ppp_deflate


Now is as good a time as any to reboot with your MPPE enabled kernel. (Some docs tells you to install ppp before reboot. Reason unknown, it shouldn't matter.)

Compile and install ppp. MPPE and ms-chapv2 support is compiled in by default.

PoPToP:

Compile and install. Nothing fancy needed, as it's pppd that does the magic.

PoPToP and pppd Configuration:

In my /etc/pptpd.conf I have
localip some.ip.add.ress
option /etc/options.pptpd


This is just for clarity, the default is off course /etc/ppp/options The clients get remoteip from radius, so we don't need it here as they will be overridden, but you could have them for clarity/confusion/easy testing without radius...

I only use mschap-v2, so my /etc/ppp/options.pptpd file is:
#-----------start----------
lock
#uncomment when testing:
#debug
name pptpd
proxyarp
asyncmap 0
-chap
-mschap
+mschap-v2
require-mppe
lcp-echo-failure 30
lcp-echo-interval 5
ipcp-accept-local
ipcp-accept-remote
ms-wins wins.server.ip.address
ms-dns dns.server.ip.address
plugin radius.so
#-----------end----------


Note: It might be "chapms" and not "mschap" as changes might be happening in the cvs.

The radius.so plugin uses the settings from radiusclient, so make sure:

/etc/radiusclient/servers contains the secret for your radius server(s)
Like:
localhost testing123


If the radius is on localhost using the default freeradius secret (bad idea off course...)

I think you must have the dictionary.microsoft file in /etc/radiusclient if you use ms-chap 1 or 2.

It should be there by default.

Set authserver and acctserver in /etc/radiusclient/radiusclient.conf if your radius server is not on the same machine as your poptop.

This file sure makes splitting authentication and accounting between two radius servers very easy.

Make sure both servers(if different) are listed in /etc/radiusclient/servers

Freeradius:

Compile and install. Also has all we need by default.

Freeradius configuration:

/etc/raddb/clients.conf: Should contain entries corresponding to the servers in /etc/radiusclient/servers for the client/NAS

(our pptp server):

client 127.0.0.1 {
secret = testing123
shortname = localhost
}


/etc/raddb/radiusd.conf: This is the relevant parts of my radiusd.conf for authentication and accounting in MySQL. Thanks to Charles J. Boening (charlieb@cot.net) for this. Just remove the sql parts if you don't want them, and add files or unix module or something.

Modules {
# You might have more here
# this is just the relevant part
mschap {
authtype = MS-CHAP
use_mppe = yes
#force 128bit:
require_strong = yes
}
}
authorize {
preprocess
suffix
sql
mschap
}
authenticate {
mschap
}
preacct {
preprocess
suffix
files
}
accounting {
acct_unique
detail
sql
# radutmp
}
session {
sql
# radutmp
}
#-----------end----------


set the correct server, user and pass in /etc/raddb/sql.conf

MySQL:

Mysql configuration should be trival, and basically consists of:

Create a database called for example "radius" in mysql. Fill it with the tables from the schema found in /src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql:

mysql radius < /path/to/db_mysql.sql

Populate your tables with usernames, passwords, reply items and so on. Consult the radius docs for more info.

Windows Clients: Remember, you need 128 bit encryption support. Win98/95 users needs dun14 update.

VPN connection properties: require encryption and allow ms-chap v2 protocol

Good luck.