[pptp-server] SMBpasswd security breach patch

[Gill, Vern]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

By no means did your patch cause ME any trouble. I was just alarmed
by the discovery, and wanted to disseminate the information as
quickly as possible to prevent any "would-be'ers" who might monitor
this or other lists from utilizing the information.

As far as whether or not it is useful, let me assure you that it is
indeed. It keeps me from having plain text passwords laying around my
system. Although I cannot use a single-entry in my smbpasswd file as
of yet, it is still better than the default...

Thank you for taking the time to create the patch in the first place,
and for taking the time to investigate this situation. I for one
appreciate it, as I am sure many others on this list do as well.

P.S.
Justin,
I again tried your pap/smbpasswd patch, and had no success. It
compiled no problems, (after converting it to ppp-2.4.x) but when
trying to use it with pppoe, it fails to transmit the password, or
the correct password. I have not actually tried tcpdumping to see
what's happening, but I thought you might like to know...

P.S.S.
Justin has made a patch for using smbpasswd with pap. I have "ported"
that patch to ppp-2.4.x. If anyone would like it, let me know. I
intend to put it up on my site, just haven't had time yet.

P.S.S.S.
Just in case anyone hasn't heard, I have a site up for PPP with
instructions on how to make it ppp-2.4.x work with various patches.
If you are interested, please go to http://linus.yi.org, and click
the PPP tab at the top... The information will be expanded soon to
include more patches for ppp and accompanying howtos, pptpd and pptp
client information, as well as linux-2.4.x, and how to make it all
work together. You can check out the Masq page also, to see where my
system is at as far as what software is being used for ip filtering.
I am successfully running kernel 2.4.2 and ppp-2.4.0 with pptpd
1.1.2. I am also using iptables, which is the "future" of ip
filtering/forwarding/masquerading/mangling/blah/blah/blah... Please
check out the site...

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBOqgr8xeamMdwy9TXEQIUjgCgzuL9WB2OKBigDicThIsHW5HcX8QAoLRA
UM6rcHiwj8pvCqsF8UgPyU1A
=yShP
-----END PGP SIGNATURE-----