PPTPD with PAM authentication

pampptpdvpn

I need a VPN solution for my company. One requirement is to be able to use the built-in windows VPN client. We are running a Debian Etch server.

I've managed to set up PPTPD but the authentication is based on the chap-secrets file. We already have all the user accounts set up on the server, so it'd be nice to use PAM authentication to get user/pass directly from the unix login.

Is this possible to achieve and how? If not, is there any other VPN solution that can do this? Don't tell me OpenVPN, it needs additional software to be installed on the Windows machines. 🙂

Best Answer

It's been a while, but I believe PopTop will do this for *nix environments. Way back in the day you had to throw a RADIUS setup in between PopTop and PAM, but I think it supports it natively now.

And of course Routing and Remote Access does this for Windows Servers.

Related Solutions

Ubuntu – Restricting account logins using LDAP and PAM

PAM has the ability to restrict access based on an access control list (at least on Ubuntu) which, like kubanskamac's answer (+1) regards the groups as posix groups, whether they're stored in LDAP, /etc/group or NIS.

/etc/security/access.conf is the access list file. In my file, I put at the end:

-:ALL EXCEPT root sysadmin (ssh-users):ALL

This denies everyone except root, sysadmin and in the group ssh-users (which is in LDAP) wherever they login from (the second ALL).

Then in my PAM account file (this IS an account module), I add at the very end:

account required pam_access.so

which tells PAM to use this file. It works a treat :-)

Debian server + PPTP VPN – connection not working

It's not entirely clear to me how you got PPTP working to the Windows XP server when you have forwarded all port 1723 traffic to the Debian Squeeze server. You likely can only "VPN" to the WinXP server from within your local LAN, which seems to be of limited usefulness.

Regardless, PPTP requires not only TCP port 1723 traffic, but also GRE protocol. Is your router capable of handling GRE tunnels correctly? If it's an ordinary consumer-grade router, then I suspect not. And even if it is, GRE is esoteric enough that finding help may be difficult.

In your case I recommend trying a VPN solution that uses only TCP and/or UDP transports, since those protocols are ubiquitous and well-known. OpenVPN is one such VPN solution, and it is available for all the major OSes (Win, Mac, Linux, *BSD).

Depending on what you're trying to accomplish, another possibility is to run sshd on the Debian server, e.g.:

apt-get install openssh-server

All the major OSes have free ssh clients capable of creating tunnels over an ssh connection.

Best Answer

Related Solutions

Ubuntu – Restricting account logins using LDAP and PAM

Debian server + PPTP VPN – connection not working

Related Topic