5

Should we migrate our VPN from MSCHAP V2 to something else?

view full story
linux-howto

http://serverfault.com – We bought a new Firewall a couple months back, a Netgear UTM9S, and one of the features we enabled is the PPTP VPN to enable access to SQL, Web and File servers for remote users. But now, after reading this Ars Technica article on MSCHAP V2 being broken I am wondering should we worry about this and turn off PPTP and enable one of the other VPN options? SSL and IPSEC options are available, and reading the Manual will be required to move to them, plus configuring each users machine, so should we spend time on this? or is this just FUD? (HowTos)

xskl's picture
Submitted by xskl on 08/07/2012 – Made popular on 08/07/2012

Stories similar to Should we migrate our VPN from MSCHAP V2 to something else?

I tried to setup the pptp vpn in ubuntu i.e

/etc/ppp/peers/myvpn

Its contents are

pty "pptp <host> --nolaunchpppd" name myusername remotename myvpn linkname myvpn ipparam myvpn usepeerdns require-mppe file /etc/ppp/options.pptp

But using this settings i can establish the tunnel and I even get the private IP of the VPN network , but I cannot ssh into any machine or not even ping to a

Hello.

I have 2 Ubuntu servers, one is acting as a firewall/proxy/pptp server, with 3 network interfaces. One WAN and 2 LAN interfaces.

The other server acts primarily as a SAMBA server.

I have the PPTP server configured on the firewall, and I can connect and browse the internet without issue.

Long uptime to everyone!

OS FreeBSD 9.0-RELEASE, pptpd-1.3.4.

Network:

em0 1.2.3.4 - external interface and ip tun0 10.18.1.0/24 - network for openvpn clients tun1 10.18.2.0/24 - network for pptp clients

Configuration.

/etc/ppp.conf:

default: set timeout 0 set log Phase Chat LCP IPCP CCP TUN Command Connect disable vjcomp deflate pred1

pptp: set device localhost:pptp set ifaddr 10.18.

I have a Samba server running on an OpenVZ VPS with a public IP. I also have a PPTP server running on the same server. I connect to it from a remote Windows PPTP client. I have everything working except network browsing. I can connect and see file shares on the Samba server using explorer and typing \\10.10.0.1.

I'm setting up a VPN test server, on Windows 2008 R2.

The company I work for has a client that has a Cisco PIX 506e firewall running v6.3. The PIX is currently set up to manage PPTP VPN connections using the local Windows domain controller as a RADIUS server.

I plan on setting up some ClearOS boxes at several sites, and would like to set up site-to-site VPN between the remote sites and a main site (all running ClearOS enterprise 5.2sp1 / latest version).

I have found references for how to set up ClearOS to VPN in to devices such as cisco for IPSEC, and others with PPTP.

Suppose I have a lot of PPTP VPN servers and I want a good way of authenticating users. Each user must be able to create a maximum of 2 concomitant connections to any given server.

I'm using a virtual Ubuntu Server (on Amazon EC2) and I want to connect to a PPTP VPN server to route outgoing traffic through this connection. To do this, I specify the following two options:

defaultroute replacedefaultroute

This works - but the moment the tunnel to route the traffic is established, my SSH connection to the server is broken and I can't reconnect.