[pptp-server] help
Edith LEVY
not_work at hotmail.com
Fri Jun 23 22:01:03 CDT 2000
>From: pptp-server-request at lists.schulte.org
>Reply-To: pptp-server at lists.schulte.org
>To: pptp-server at lists.schulte.org
>Subject: pptp-server digest, Vol 1 #442 - 9 msgs
>Date: Fri, 23 Jun 2000 12:00:13 -0500
>
>Send pptp-server mailing list submissions to
> pptp-server at lists.schulte.org
>
>To subscribe or unsubscribe via the World Wide Web, visit
> http://lists.schulte.org/mailman/listinfo/pptp-server
>or, via email, send a message with subject or body 'help' to
> pptp-server-request at lists.schulte.org
>
>You can reach the person managing the list at
> pptp-server-admin at lists.schulte.org
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of pptp-server digest..."
>
>
>Today's Topics:
>
> 1. PTY read or GRE write failure (Daniel Slatford)
> 2. Re: PTY read or GRE write failure (Neale Banks)
> 3. *fixed* Unresolved symbol RC4_set_key (Iain Cox)
> 4. Re: *fixed* Unresolved symbol RC4_set_key (Charles Duffy)
> 5. mppe error (=?koi8-r?B?4czFy9PFyiDtwcDLz9c=?=)
> 6. RE: *fixed* Unresolved symbol RC4_set_key (Jean-Paul Chavant)
> 7. Re: *fixed* Unresolved symbol RC4_set_key (Giulio Orsero)
> 8. remote administration (keywords: ADSL,PPTP through PPTP,Telnet,FTP)
>(Ivo Truxa)
> 9. Re: remote administration (keywords: ADSL,PPTP through
>PPTP,Telnet,FTP) (Charles Duffy)
>
>--__--__--
>
>Message: 1
>From: "Daniel Slatford" <daniel at unity.f9.co.uk>
>To: <pptp-server at lists.schulte.org>
>Date: Thu, 22 Jun 2000 20:33:42 +0100
>charset="iso-8859-1"
>Subject: [pptp-server] PTY read or GRE write failure
>
>Greetings all,
>
>Anybody able to shed any light on whats going on here? Trying to get a
>basic
>pptp server running for doze 98SE client, running pptpd 1.0.0, pppd 2.3.11
>and kernel 2.2.16, SuSE 6.4 box. The box it's running on is a masq box for
>my home LAN.
>
>Can establish a connection momentarially from windows, but it immediately
>disconnects. Logfile thus:
>
>pptpd[1144]: MGR: Launching /usr/local/sbin/pptpctrl to handle client
>pptpd[1144]: CTRL: local address = 192.168.1.100
>pptpd[1144]: CTRL: remote address = 192.168.1.234
>pptpd[1144]: CTRL: pppd speed = 115200
>pptpd[1144]: CTRL: pppd options file = /etc/ppp/options.pptp
>pptpd[1144]: CTRL: Client 213.48.114.184 control connection started
>pptpd[1144]: CTRL: Received PPTP Control Message (type: 1)
>pptpd[1144]: CTRL: Made a START CTRL CONN RPLY packet
>pptpd[1144]: CTRL: I wrote 156 bytes to the client.
>pptpd[1144]: CTRL: Sent packet to client
>pptpd[1144]: CTRL: Received PPTP Control Message (type: 7)
>pptpd[1144]: CTRL: Set parameters to 0 maxbps, 16 window size
>pptpd[1144]: CTRL: Made a OUT CALL RPLY packet
>pptpd[1144]: CTRL: Starting call (launching pppd, opening GRE)
>pptpd[1144]: CTRL: pty_fd = 5
>pptpd[1144]: CTRL: tty_fd = 6
>pptpd[1145]: CTRL (PPPD Launcher): Connection speed = 115200
>pptpd[1145]: CTRL (PPPD Launcher): local address = 192.168.1.100
>pptpd[1145]: CTRL (PPPD Launcher): remote address = 192.168.1.234
>pptpd[1144]: CTRL: I wrote 32 bytes to the client.
>pptpd[1144]: CTRL: Sent packet to client
>pptpd[1144]: GRE: read(fd=5,buffer=804dac0,len=8196) from PTY failed:
>status
>= -1 error = Input/output error
>pptpd[1144]: CTRL: PTY read or GRE write failed (pty,gre)=(5,6)
>pptpd[1144]: CTRL: Client 213.48.114.184 control connection finished
>pptpd[1144]: CTRL: Exiting now
>pptpd[1099]: MGR: Reaped child 1144
>
>As I can't even seem to get this bit working I've not tried recompiling
>pppd
>with appropiate encryption patches yet.
>
>The seperate pppd options file /etc/ppp/options.pptp is necessary because I
>also have to use pppd to dial into my ISP, the two configurations conflict.
>Even tho there's a seperate instance of pppd running each with its own
>config file, would that cause a problem for pptpd?
>
>I'm not 100% sure either if the localip should be any free IP address on
>the
>subnet (which it is in the above example) or the address of an existing
>interface, ie eth0. I always thought it was the former reading the pptpd
>docs, however I've been playing with seawall firewall script lately and
>that
>tells me the latter. (either way, it doesn't work, and using my old (basic)
>ipchains script still produced the same problem).
>
>**
>
>Also, assuming I manage to clear up this problem - what, in the opinion of
>people far more experianced with pptpd than I, is the feasability of using
>poptop on a corporate LAN? In our office (A job I've just started - they're
>all NT based, eurgh) we plan to have a leased line installed, and need a
>firewall/VPN solution. Currently we have neither, just an MS proxy server,
>*gulp*. As my experiance with poptop is so far less than impressive (but I
>still have faith in it!) is it up to the task of serving, say, up to a
>dozen
>concurrent connections reliably? (it's this requirement that introduced me
>to poptop to begin with, then I realised as sometimes travel about a bit
>how
>cool it'd be to have a VPN link to my home lan :)
>
>
>
>--
>Dan Slatford
>-------------------------------------------------
>Email: daniel at unity.f9.co.uk Mobile: 07787 778186
>URL : http://www.unity.f9.co.uk ICQ: 12576446
>-------------------------------------------------
>
>
>--__--__--
>
>Message: 2
>Date: Fri, 23 Jun 2000 07:25:29 +1000 (EST)
>From: Neale Banks <neale at lowendale.com.au>
>To: Daniel Slatford <daniel at unity.f9.co.uk>
>cc: pptp-server at lists.schulte.org
>Subject: Re: [pptp-server] PTY read or GRE write failure
>
>On Thu, 22 Jun 2000, Daniel Slatford wrote:
>
> > Greetings all,
> >
> > Anybody able to shed any light on whats going on here? Trying to get a
>basic
> > pptp server running for doze 98SE client, running pptpd 1.0.0, pppd
>2.3.11
> > and kernel 2.2.16, SuSE 6.4 box. The box it's running on is a masq box
>for
> > my home LAN.
> >
> > Can establish a connection momentarially from windows, but it
>immediately
> > disconnects. Logfile thus:
>[snip]
> >
> > As I can't even seem to get this bit working I've not tried recompiling
>pppd
> > with appropiate encryption patches yet.
> >
> > The seperate pppd options file /etc/ppp/options.pptp is necessary
>because I
> > also have to use pppd to dial into my ISP, the two configurations
>conflict.
> > Even tho there's a seperate instance of pppd running each with its own
> > config file, would that cause a problem for pptpd?
>
>"should" be OK. You might coax some useful information from ppp if you
>include "debug" in the pppd options (e.g. maybe the caller is using the
>MS-style DOMAIN\\user?).
>
>[...]
> > Also, assuming I manage to clear up this problem - what, in the opinion
>of
> > people far more experianced with pptpd than I, is the feasability of
>using
> > poptop on a corporate LAN? In our office (A job I've just started -
>they're
> > all NT based, eurgh) we plan to have a leased line installed, and need a
> > firewall/VPN solution. Currently we have neither, just an MS proxy
>server,
> > *gulp*. As my experiance with poptop is so far less than impressive (but
>I
> > still have faith in it!) is it up to the task of serving, say, up to a
>dozen
> > concurrent connections reliably?
>
>IIRC, others here reported success with these kinds of numbers and there
>has been the occasional speculation on how to run many more than this.
>
> > (it's this requirement that introduced me
> > to poptop to begin with, then I realised as sometimes travel about a bit
>how
> > cool it'd be to have a VPN link to my home lan :)
>
>PoPToP has its place, but if you have *n*x at each end then there are
>other, arguably more appropriate, solutions available (e.g. vpnd).
>
>HTH,
>Neale.
>
>
>--__--__--
>
>Message: 3
>Date: Thu, 22 Jun 2000 19:39:12 -0700
>From: Iain Cox <icox at pinc.com>
>To: "'pptp-server at lists.schulte.org'" <pptp-server at lists.schulte.org>
>Subject: [pptp-server] *fixed* Unresolved symbol RC4_set_key
>
>Hi all,
>
>I got around the unresolved symbol error (from my post yesterday- check
>it out for the details) that I was getting in ppp_mppe when trying to
>connect clients using encryption. I ditched ppp-2.3.10 and SSLeay-0.9.0b
>and grabbed the ppp2.3.11 tarball and applied the
>ppp-2.3.11-openssl-0.9.5-mppe.patch available from
>ftp.binarix.com/pub/ppp-mppe/
>pptp stays untouched...it was working fine!
>
>It went something like this...you may need to adjust.
>
>tar xvzf ppp-2.3.11.tar.gz
>cd ppp-2.3.11
>patch -p1 < ppp-2.3.11-openssl-0.9.5-mppe.patch
>./configure
>make
>make kernel
>make install
>
>cd /usr/src/linux/
>make modules SUBDIRS=drivers/net
>make modules_install
>
>Make sure your /etc/ppp/options file is setup correctly to use
>encryption, check the client to make sure it is configured properly,
>then try the connection again.
>
>
>--__--__--
>
>Message: 4
>Date: Thu, 22 Jun 2000 20:03:32 -0700
>From: Charles Duffy <cduffy at mvista.com>
>To: "'pptp-server at lists.schulte.org'" <pptp-server at lists.schulte.org>
>Subject: Re: [pptp-server] *fixed* Unresolved symbol RC4_set_key
>"'pptp-server at lists.schulte.org'" <pptp-server at lists.schulte.org>
>protocol="application/pgp-signature"; boundary="cHMo6Wbp1wrKhbfi"
>
>
>--cHMo6Wbp1wrKhbfi
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>
>On Thu, Jun 22, 2000 at 07:39:12PM -0700, Iain Cox wrote:
> > make kernel
>
>I'm pretty sure this is the key step.
>
>Any changes made to the files that are installed into the kernel have
>to be done before 'make kernel', or be done directly to the copies in
>the kernel source.
>
>Someone mentioned having changed some files in his ppp directory --
>but without running make kernel, it becomes easy to see why thy could
>fail to have any effect.
>
>--cHMo6Wbp1wrKhbfi
>Content-Type: application/pgp-signature
>Content-Disposition: inline
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.0.1 (GNU/Linux)
>Comment: For info see http://www.gnupg.org
>
>iD8DBQE5UtOEr/O29KUQmJURAvKTAJ9AQKPMpilMhEPBfNfs2rzYvn6MlACgszG5
>X5nDaMG9eV9ds3DZ5BG+PXc=
>=0EZg
>-----END PGP SIGNATURE-----
>
>--cHMo6Wbp1wrKhbfi--
>
>--__--__--
>
>Message: 5
>From: =?koi8-r?B?4czFy9PFyiDtwcDLz9c=?= <alexm at sirena.khv.ru>
>To: <pptp-server at lists.schulte.org>
>Date: Fri, 23 Jun 2000 14:33:54 +1100
>boundary="----=_NextPart_000_0015_01BFDD20.0ECF1E90"
>Subject: [pptp-server] mppe error
>
>This is a multi-part message in MIME format.
>
>------=_NextPart_000_0015_01BFDD20.0ECF1E90
>Content-Type: text/plain;
> charset="koi8-r"
>Content-Transfer-Encoding: quoted-printable
>
>Hi, all !
>I'm having a some problems during the installation of "PPP with =
>MSCHAPv2/MPPE". Then the all make-ing procedures are completed and I =
>typing the ' insmod ppp_mppe ', I receiving the next message :=20
>"insmod : /lib/modules/2.0.36/net/ppp_mppe.o : unresolved symbol =
>RC4_set_key".
>What's wrong in my actions ?
>With best regards, Alex Mayukoff, Russia.
>p.s. sorry for my poor English
>
>
>------=_NextPart_000_0015_01BFDD20.0ECF1E90
>Content-Type: text/html;
> charset="koi8-r"
>Content-Transfer-Encoding: quoted-printable
>
><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
><HTML><HEAD>
><META content=3D"text/html; charset=3Dkoi8-r" http-equiv=3DContent-Type>
><META content=3D"MSHTML 5.00.2614.3401" name=3DGENERATOR>
><STYLE></STYLE>
></HEAD>
><BODY bgColor=3D#ffffff>
><DIV><FONT face=3D"Arial Cyr" size=3D2>Hi, all !</FONT></DIV>
><DIV><FONT face=3D"ARIAL CYR" size=3D2>I'm having a some problems during =
>the=20
>installation of "PPP with MSCHAPv2/MPPE". Then the all make-ing =
>procedures=20
>are completed and I typing the ' insmod ppp_mppe ', I receiving the next =
>message=20
>: </FONT></DIV>
><DIV><FONT face=3D"ARIAL CYR" size=3D2>"insmod : =
>/lib/modules/2.0.36/net/ppp_mppe.o=20
>: unresolved symbol RC4_set_key".</FONT></DIV>
><DIV><FONT face=3D"ARIAL CYR" size=3D2>What's wrong in my actions =
>?</FONT></DIV>
><DIV><FONT face=3D"ARIAL CYR" size=3D2>With best regards, Alex Mayukoff, =
>
>Russia.</FONT></DIV>
><DIV><FONT face=3D"ARIAL CYR" size=3D2>p.s. sorry for my poor =
>English</FONT></DIV>
><DIV> </DIV></BODY></HTML>
>
>------=_NextPart_000_0015_01BFDD20.0ECF1E90--
>
>
>--__--__--
>
>Message: 6
>From: "Jean-Paul Chavant" <jp.chavant at geosys.fr>
>To: "Pptp" <pptp-server at lists.schulte.org>
>Cc: "Iain Cox" <icox at pinc.com>
>Subject: RE: [pptp-server] *fixed* Unresolved symbol RC4_set_key
>Date: Fri, 23 Jun 2000 12:37:13 +0200
>charset="iso-8859-1"
>
>hello,
>
>i resolve my problem using ppp2.3.11 tarball with
>ppp-2.3.11-openssl-0.9.5-mppe.patch and openssl-0.9.5a.
>
>It works with no encryption !!!
>
>BUT :(
>
>I want to use encryption ! And it doesn't work ...
>
>if i use encryption with my /etc/ppp/options file :
>
>lock
>debug
>auth
>+chap
>proxyarp
>+chapms
>+chapms-v2
>mppe-40
>mppe-128
>mppe-stateless
>
>i ve an error on my client (629)
>and in the pptp.log file this one :
>
>/usr/sbin/pppd: In file /etc/ppp/options: unrecognized option '+chapms'
>
>whereis my problem ? i m not able to find it ... :(
>
>JP
>
> >
> >
> > Hi all,
> >
> > I got around the unresolved symbol error (from my post yesterday-
>check
> > it out for the details) that I was getting in ppp_mppe when trying to
> > connect clients using encryption. I ditched ppp-2.3.10 and
> > SSLeay-0.9.0b
> > and grabbed the ppp2.3.11 tarball and applied the
> > ppp-2.3.11-openssl-0.9.5-mppe.patch available from
> > ftp.binarix.com/pub/ppp-mppe/
> > pptp stays untouched...it was working fine!
> >
> > It went something like this...you may need to adjust.
> >
> > tar xvzf ppp-2.3.11.tar.gz
> > cd ppp-2.3.11
> > patch -p1 < ppp-2.3.11-openssl-0.9.5-mppe.patch
> > ./configure
> > make
> > make kernel
> > make install
> >
> > cd /usr/src/linux/
> > make modules SUBDIRS=drivers/net
> > make modules_install
> >
> > Make sure your /etc/ppp/options file is setup correctly to use
> > encryption, check the client to make sure it is configured properly,
> > then try the connection again.
> >
> > _______________________________________________
> > pptp-server maillist - pptp-server at lists.schulte.org
> > http://lists.schulte.org/mailman/listinfo/pptp-server
> > List services provided by www.schulteconsulting.com!
> >
>
>
>--__--__--
>
>Message: 7
>From: Giulio Orsero <giulioo at pobox.com>
>To: "Pptp" <pptp-server at lists.schulte.org>
>Subject: Re: [pptp-server] *fixed* Unresolved symbol RC4_set_key
>Date: Fri, 23 Jun 2000 13:21:22 +0200
>Organization: nowhere
>
>On Fri, 23 Jun 2000 12:37:13 +0200, you wrote:
>
> >/usr/sbin/pppd: In file /etc/ppp/options: unrecognized option '+chapms'
> >whereis my problem ? i m not able to find it ... :(
>Are you sure you have installed the new (patched) pppd?
>
>--
>giulioo at pobox.com
>
>--__--__--
>
>Message: 8
>From: "Ivo Truxa" <truxa at truxoft.com>
>To: <pptp-server at lists.schulte.org>
>Date: Fri, 23 Jun 2000 15:21:57 +0200
>charset="iso-8859-1"
>Subject: [pptp-server] remote administration (keywords: ADSL,PPTP through
>PPTP,Telnet,FTP)
>
>Please excuse if my questions are lame, it was not my intension. I studied
>the FAQ, HOWTO, mail-list-archives, made a research on SE, but I am still
>not sure about the right replies.
>
>A remark to the list-moderator: a searchable web-interface to the archives
>would be VERY helpful and could save the list subscribers from many lamers
>like me!
>
>I want to use PPTP to securely administrate a dedicated Linux web server
>from my NT machine over the Internet. My questions:
>
>1. I hope I understood well that once I build the tunnel between the remote
>machine and me, all the communication runs encrypted (presuming MPPE having
>installed on both ends). Is that correct, or is there any way some
>connections to the remote machine could escape from the tunnel?
>
>2. Strangely I have not seen using Telnet through PPTP mentioned anywhere
>as
>a secure alternative to SSLTelnet, SSH and other secure shells. Is there
>any
>problem in using Telnet trough a PPTP or is there some better alternative?
>
>3. Same for FTP. Well, I understand that installing Samba would be probably
>better alternative, but would FTP through PPTP still work fine (and
>secure)?
>I suppose there should be no problem, but would like to have it confirmed.
>
>4. I am connected to the Internet through a VPN (also PPTP). I use ADSL
>modem that connects me to the network of my national telecom. Through a
>tunnel (PPTP) in their network I am connected to my ISP. How the connection
>to my remote web server would be made? (My remote web server is outside of
>the national telecom network). It seems to me that I would need to build a
>second tunnel (to my server) inside of the tunnel to my ISP (and to the
>Internet). Is it possible at all?
>
>5. Has anybody experience with a remote installation of PoPToP incl.
>MSCHAPv2/MPPE? Are there any risks I should be especially aware of, or
>things to check before I start? Or can it be done only locally and I should
>ask my IHP to install it for me?
>
>Many thanks in advance for any hints,
>Ivo Truxa
>
>PS: I am trying to send this message to the list without subscribing. I am
>not sure if it works. If replying to the list, please attach a CC to my
>address too: pptp at truxoft.com
>
>Thanks
>
>
>
>--__--__--
>
>Message: 9
>Date: Fri, 23 Jun 2000 09:52:14 -0700
>From: Charles Duffy <cduffy at mvista.com>
>To: pptp-server at lists.schulte.org
>Cc: pptp at truxoft.com
>Subject: Re: [pptp-server] remote administration (keywords: ADSL,PPTP
>through PPTP,Telnet,FTP)
>pptp-server at lists.schulte.org, pptp at truxoft.com
>protocol="application/pgp-signature"; boundary="wRRV7LY7NUeQGEoC"
>
>
>--wRRV7LY7NUeQGEoC
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>Content-Transfer-Encoding: quoted-printable
>
>On Fri, Jun 23, 2000 at 03:21:57PM +0200, Ivo Truxa wrote:
> > I want to use PPTP to securely administrate a dedicated Linux web server
> > from my NT machine over the Internet. My questions:
> >=20
> > 1. I hope I understood well that once I build the tunnel between the
>remo=
>te
> > machine and me, all the communication runs encrypted (presuming MPPE
>havi=
>ng
> > installed on both ends). Is that correct, or is there any way some
> > connections to the remote machine could escape from the tunnel?
>
>Barring any bugs (and none are known and likely to be causing this),
>everything should be encrypted unless MPPE fails.
>
>It is advisable that you install the MPPE-only patch to prevent this
>from happening; my understanding is that it will terminate a session
>rather than allow it to go unencrypted.
>
> > 2. Strangely I have not seen using Telnet through PPTP mentioned
>anywhere=
> as
> > a secure alternative to SSLTelnet, SSH and other secure shells. Is there
>=
>any
> > problem in using Telnet trough a PPTP or is there some better
>alternative?
>
>The only "problem" is that it's not as versitile -- with SSH, your
>connection is encrypted as far as wherever you're connecting to. With
>telnet over PPTP, it's only encrypted as far as the PPTP server.
>
>Also, SSH has (particularly in RSA key mode) far better crypto than
>MPPE provides (see Counterpane's analysis).
>
> > 3. Same for FTP. Well, I understand that installing Samba would be
>probab=
>ly
> > better alternative, but would FTP through PPTP still work fine (and
>secur=
>e)?
> > I suppose there should be no problem, but would like to have it
>confirmed.
>
>Yes, it would work -- but MPPE's security still leaves something to
>be desired. I strongly reccomend SCP (the file-copying counterpart to
>SSH).
>
> > 4. I am connected to the Internet through a VPN (also PPTP). I use ADSL
> > modem that connects me to the network of my national telecom. Through a
> > tunnel (PPTP) in their network I am connected to my ISP. How the
>connecti=
>on
> > to my remote web server would be made? (My remote web server is outside
>of
> > the national telecom network). It seems to me that I would need to build
>a
> > second tunnel (to my server) inside of the tunnel to my ISP (and to the
> > Internet). Is it possible at all?
>
>Yes, you can nest tunnels. As long as your routing to the target of
>the second target goes through the first (ie. your first tunnel is
>correctly configured), the second one should go through it without any
>special configuration.
>
> > 5. Has anybody experience with a remote installation of PoPToP incl.
> > MSCHAPv2/MPPE? Are there any risks I should be especially aware of, or
> > things to check before I start? Or can it be done only locally and I
>shou=
>ld
> > ask my IHP to install it for me?
>
>Any time you're loading kernel modules, you're putting the system at a
>slight risk. As long as you compile against the same kernel version as
>is on the remote machine, though, or compile on the remote machine,
>you should be fine.
>
>Really, though, it's probably better security-wise to use SSH/SCP if
>you have the choice. PuTTY/PSCP are a pair of high quality, free SSH
>and SCP clients for Windows; you might want to consider giving them a
>try. (Also, if you have a low-bandwidth connection and turn on SSH's
>compression, you may get better performance).
>
>--wRRV7LY7NUeQGEoC
>Content-Type: application/pgp-signature
>Content-Disposition: inline
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.0.1 (GNU/Linux)
>Comment: For info see http://www.gnupg.org
>
>iD8DBQE5U5W+r/O29KUQmJURArWDAKC2cZkb4qJZglWA+s+rw8SF7H4PIACcD9T0
>Am/Y1tlQ4IvkCcNM5OdU4ms=
>=A7+M
>-----END PGP SIGNATURE-----
>
>--wRRV7LY7NUeQGEoC--
>
>
>--__--__--
>
>_______________________________________________
>pptp-server maillist - pptp-server at lists.schulte.org
>http://lists.schulte.org/mailman/listinfo/pptp-server
>List services provided by www.schulteconsulting.com!
>
>End of pptp-server Digest_______________________________________________
>pptp-server maillist - pptp-server at lists.schulte.org
>http://lists.schulte.org/mailman/listinfo/pptp-server
>List services provided by www.schulteconsulting.com!
________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com
More information about the pptp-server
mailing list