[Samba] Re: Authenticating PPTP users against Samba/LDAP - Patch
doesn't seem to be working
Alex Brown
alexjrb at bellsouth.net
Mon Jan 3 15:41:26 GMT 2005
Andrew Bartlett wrote:
>On Fri, 2004-12-31 at 08:48 -0500, Alex Brown wrote:
>
>
>>Andrew Bartlett wrote:
>>
>>
>>>On Wed, 2004-10-20 at 00:44, Mike Brodbelt wrote:
>>>
>>>
>>>
>>>>Hi,
>>>>
>>>>I have a few remote user who use a PPTP based VPN. The server is running
>>>>PoPToP (http://www.poptop.org/), and a pppd patched to support MPPE/MPPC
>>>>for (some) added security. Currently, users authentication information
>>>>is stored in plaintext in /etc/ppp/chap-secrets. I'd like to be able to
>>>>put users into LDAP, and have ppp authenticate either directly against
>>>>LDAP, or against Samba (with an LDAP backend). Any ideas on how I might
>>>>go about this? Most of the docs I've seen suggest that you can't use PAM
>>>>for authentication with CHAP, so it seems not to be as simple as I might
>>>>have hoped.
>>>>
>>>>Disclaimer - I haven't actually tried any of this yet, I'm just trying
>>>>to get it clear in my head before I start...
>>>>
>>>>
>>>The pppd patch (one for 2.4.2, one for current CVS) is here:
>>>http://download.samba.org/ftp/unpacked/lorikeet/trunk/pppd
>>>
>>>The documentation is:
>>>http://hawkerc.net/staff/abartlet/comp3700/final-report.pdf
>>>
>>>Note that the patch changed a little since the report was written, use
>>>the instructions in the README for configuration.
>>>
>>>Andrew Bartlett
>>>
>>>
>>>
>>>
>>Hi Andrew,
>>
>>Thanks for creating the "final-report" document. It is very
>>informative. I'm trying to set up a PoPToP server that authenticates to
>>our Windows NT Domain (with a Windows NT 4.0 PDC) via Samba/Winbind.
>>When I follow the instructions in your document, after changing to the
>>ppp directory to apply the ntlm_auth patch, I get the following output.
>>
>>
>
>Current ppp has everything you need already - I finally got it merged
>upstream. All you need now is the configuration (which has changed
>since the report was written):
>
>Configuration (pppd config file):
>
>plugin winbind.so
>ntlm_auth-helper "/usr/local/bin/ntlm_auth --helper-protocol=ntlm-
>server-1"
>
>The --required-membership-of option is also available, to implement a
>'dialin users' or 'vpn users' group.
>
>Andrew Bartlett
>
>
>
Thanks Andrew,
I followed your instructions without applying the patch and I modified
the /etc/ppp/options.pptpd file to include the changes in your reply.
I'm having what I'm sure is a small problem so please forgive my ignorance.
When I try to authenticate to the poptop server with my Windows XP
client, I see the following messages in my log...
Jan 3 08:31:37 papcom pptpd[2603]: MGR: Launching /usr/sbin/pptpctrl to
handle client
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: local address = 192.168.0.1
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: remote address = 192.168.0.3
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: pppd options file =
/etc/ppp/options.pptpd
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Client 66.156.10.36 control
connection started
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Received PPTP Control Message
(type: 1)
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Made a START CTRL CONN RPLY packet
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: I wrote 156 bytes to the client.
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Sent packet to client
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Received PPTP Control Message
(type: 7)
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Set parameters to 1525 maxbps,
64 window size
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Made a OUT CALL RPLY packet
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: Starting call (launching pppd,
opening GRE)
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: pty_fd = 5
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: tty_fd = 6
Jan 3 08:31:37 papcom pptpd[2604]: CTRL (PPPD Launcher): Connection
speed = 115200
Jan 3 08:31:37 papcom pptpd[2603]: CTRL: I wrote 32 bytes to the client.
Jan 3 08:31:38 papcom pptpd[2604]: CTRL (PPPD Launcher): local address
= 192.168.0.1
Jan 3 08:31:38 papcom pptpd[2603]: CTRL: Sent packet to client
Jan 3 08:31:38 papcom pptpd[2604]: CTRL (PPPD Launcher): remote address
= 192.168.0.3
Jan 3 08:31:38 papcom pptpd[2603]: CTRL: Received PPTP Control Message
(type: 15)
Jan 3 08:31:38 papcom pppd[2604]: Plugin
/usr/local/lib/pppd/2.4.3/winbind.so loaded.
Jan 3 08:31:38 papcom pptpd[2603]: CTRL: Got a SET LINK INFO packet
with standard ACCMs
Jan 3 08:31:38 papcom pppd[2604]: WINBIND plugin initialized.
Jan 3 08:31:38 papcom pptpd[2603]: GRE: Discarding duplicate packet
Jan 3 08:31:38 papcom pppd[2604]: pppd 2.4.3 started by root, uid 0
Jan 3 08:31:38 papcom pppd[2604]: using channel 23
Jan 3 08:31:38 papcom kernel: divert: not allocating divert_blk for
non-ethernet device ppp0
Jan 3 08:31:38 papcom pppd[2604]: Using interface ppp0
Jan 3 08:31:38 papcom pppd[2604]: Connect: ppp0 <--> /dev/pts/2
Jan 3 08:31:38 papcom pppd[2604]: sent [LCP ConfReq id=0x1 <asyncmap
0x0> <auth chap MS-v2> <magic 0x57d0a938> <pcomp> <accomp>]
Jan 3 08:31:38 papcom pptpd[2603]: GRE: Bad checksum from pppd.
Jan 3 08:31:38 papcom pppd[2604]: rcvd [LCP ConfAck id=0x1 <asyncmap
0x0> <auth chap MS-v2> <magic 0x57d0a938> <pcomp> <accomp>]
Jan 3 08:31:40 papcom pppd[2604]: rcvd [LCP ConfReq id=0x1 <mru 1400>
<magic 0x7b6b79b5> <pcomp> <accomp> <callback CBCP>]
Jan 3 08:31:40 papcom pppd[2604]: sent [LCP ConfRej id=0x1 <callback CBCP>]
Jan 3 08:31:40 papcom pppd[2604]: rcvd [LCP ConfReq id=0x2 <mru 1400>
<magic 0x7b6b79b5> <pcomp> <accomp>]
Jan 3 08:31:40 papcom pppd[2604]: sent [LCP ConfAck id=0x2 <mru 1400>
<magic 0x7b6b79b5> <pcomp> <accomp>]
Jan 3 08:31:40 papcom pppd[2604]: sent [LCP EchoReq id=0x0
magic=0x57d0a938]
Jan 3 08:31:40 papcom pppd[2604]: sent [CHAP Challenge id=0xb4
<5d8f7b72df4bb4a4003ddc0a3d7a4644>, name = "papcom"]
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Received PPTP Control Message
(type: 15)
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Ignored a SET LINK INFO packet
with real ACCMs!
Jan 3 08:31:40 papcom pppd[2604]: rcvd [LCP Ident id=0x3
magic=0x7b6b79b5 "MSRASV5.10"]
Jan 3 08:31:40 papcom pppd[2604]: rcvd [LCP Ident id=0x4
magic=0x7b6b79b5 "MSRAS-1-INFG450ROG-1234"]
Jan 3 08:31:40 papcom pppd[2604]: rcvd [LCP EchoRep id=0x0
magic=0x7b6b79b5]
Jan 3 08:31:40 papcom pppd[2604]: rcvd [CHAP Response id=0xb4
<ec918ac4e0cd14ab96a16047e9417f4f00000000000000008a747cd2cfdf8dbd4e993df5b34cf15ac6b65c94e3b1721c00>,
name = "PAP\\abrown"]
Jan 3 08:31:40 papcom pppd[2604]: Peer PAP\\abrown failed CHAP
authentication
Jan 3 08:31:40 papcom pppd[2604]: sent [CHAP Failure id=0xb4 "E=691 R=1
C=5d8f7b72df4bb4a4003ddc0a3d7a4644 V=0 M=Access denied"]
Jan 3 08:31:40 papcom pppd[2604]: sent [LCP TermReq id=0x2
"Authentication failed"]
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Received PPTP Control Message
(type: 15)
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Got a SET LINK INFO packet
with standard ACCMs
Jan 3 08:31:40 papcom pppd[2604]: rcvd [LCP TermAck id=0x2
"Authentication failed"]
Jan 3 08:31:40 papcom pppd[2604]: Connection terminated.
Jan 3 08:31:40 papcom kernel: divert: no divert_blk to free, ppp0 not
ethernet
Jan 3 08:31:40 papcom pppd[2604]: Exit.
Jan 3 08:31:40 papcom pptpd[2603]: GRE:
read(fd=5,buffer=804d5a0,len=8196) from PTY failed: status = -1 error =
Input/output error
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: PTY read or GRE write failed
(pty,gre)=(5,6)
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Closing child BCrelay with pid 0
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Closing child ppp with pid 2604
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Client 66.156.10.36 control
connection finished
Jan 3 08:31:40 papcom pptpd[2603]: CTRL: Exiting now
Jan 3 08:31:40 papcom pptpd[2564]: MGR: Reaped child 2603
I know this section of the log . .
<ec918ac4e0cd14ab96a16047e9417f4f00000000000000008a747cd2cfdf8dbd4e993df5b34cf15ac6b65c94e3b1721c00>,
name = "PAP\\abrown"]
Jan 3 08:31:40 papcom pppd[2604]: Peer PAP\\abrown failed CHAP
authentication
Jan 3 08:31:40 papcom pppd[2604]: sent [CHAP Failure id=0xb4 "E=691 R=1
C=5d8f7b72df4bb4a4003ddc0a3d7a4644 V=0 M=Access denied"]
Jan 3 08:31:40 papcom pppd[2604]: sent [LCP TermReq id=0x2
"Authentication failed"]
is the cause of the problem but I don't know how to fix it.
It appears that the pppd is expecting something to be in the
chap-secrets file. I don't have anything in it. Should I have
something in it that will cause it to talk to the Windows PDC for
authentication?
Here is a copy of my /etc/ppp/options.pptpd file.
## CHANGE TO SUIT YOUR SYSTEM
lock
debug
name papcom
noauth
#proxyarp
nobsdcomp
#chapms-strip-domain
lcp-echo-failure 30
lcp-echo-interval 5
ipcp-accept-local
ipcp-accept-remote
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-wins 10.1.100.13
ms-dns 10.1.100.127
plugin /usr/local/lib/pppd/2.4.3/winbind.so
ntlm_auth-helper "/usr/local/bin/ntlm_auth --helper-protocol=ntlm-server-1"
Thanks again for any help you can give. I'm learning a lot. I hope to
be like you when I grow up!
Alex
More information about the samba
mailing list