poptop_ads_howto_1.htm 11 KB

  1. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
  2. "http://www.w3.org/TR/html4/loose.dtd">
  3. <html>
  4. <head>
  5. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
  6. <title>Poptop MSCHAP2 ADS Howto</title>
  7. </head>
  8. <body>
  9. <h3>PopTop + MSCHAPv2 + Samba + Radius + Microsoft Active Directory + Fedora Howto</h3>
  10. <p align="left">Copyright &copy; 2005-2009 Wing S Kwok </p>
  11. <p align="right">by: Wing S Kwok<br>
  12. email: wskwok18 (at) gmail.com</p>
  13. <p align="left"><strong>Revision History</strong>:</p>
  14. <dl>
  15. <dt>Release 1.5 - 22 March 2009</dt>
  16. <dd>- Added a section on how to retrict one connection per user</dd>
  17. <br>
  18. <dt>Release 1.4 - 30 September 2008</dt>
  19. <dd>- Updated information of the Howto to focus on Fedora 8</dd>
  20. <dd>- Moved FC5/FC6 specific information to Appendix</dd>
  21. <br>
  22. <dt>Release 1.3 - 19 May 2007</dt>
  23. <dd>- Added info on potential problem of selinux on pptpd </dd>
  24. <dd>- Added info to build rpm from pptpd tar ball</dd>
  25. <dd>- Updated version information of software</dd>
  26. <br>
  27. <dt>Release 1.21 - 23 February 2007</dt>
  28. <dd>- Fixed up typo in dictionary.microsoft</dd>
  29. <br>
  30. <dt>Release 1.2 - 15 January 2007</dt>
  31. <dd>- Added Fedora Core 6 information</dd>
  32. <br>
  33. <dt>Release 1.1 - 25 September 2006</dt>
  34. <dd>- Updated version information on kernel, samba and pptpd</dd>
  35. <br>
  36. <dt>Release 1.0 - 7 May 2006</dt>
  37. <dd>- Updated the Howto to focus on Fedora Core 5</dd>
  38. <dd>- Rearranged the order of steps to make the walkthrough more logical</dd>
  39. <dd>- Moved Fedora Core 4 specific info to Appendix</dd>
  40. <br>
  41. <dt>Release 0.8 - 5 March 2006</dt>
  42. <dd>- Updated information on pptpd, samba version</dd>
  43. <dd>- Updated information on FC4 kernel version</dd>
  44. <dd>- Added info on changing MTU size</dd>
  45. <br>
  46. <dt>Release 0.71 - 3 February 2006</dt>
  47. <dd>- Problem with kernel 2.6.15 and ppp-2.4.3-5 is Gentoo specific. Corrected the document.</dd>
  48. <br>
  49. <dt>Release 0.7 -- 1 February 2006</dt>
  50. <dd>- Section 12.2 has been rewritten.</dd>
  51. <dd>- Updated information on Samba version.</dd>
  52. <dd>- Provided a link to information on problem with kernel 2.6.15 and ppp-2.4.3-5</dd>
  53. <br>
  54. <dt>Release 0.6 -- 5 January 2006</dt>
  55. <dd>- Added a new section on pptp server administration.</dd>
  56. <dd>- Updated information on Samba version. </dd>
  57. <br>
  58. <dt>Release 0.5 -- 17 November 2005</dt>
  59. <dd>- Included info on kernel 2.6.15-rc1 and MPPE support</dd><br>
  60. <dt>Release 0.4 -- 30 October 2005</dt>
  61. <dd>- Updated kernel-ppp-mppe version number</dd><br>
  62. <dt>Release 0.3 -- 23 October 2005</dt>
  63. <dd>- added the Acknowledgements section</dd>
  64. <dd>- added information on problem with FC4 2.6.13 kernel and mppe kernel module </dd>
  65. <dd>- added information on kernel upgrade and dkms_autoinstaller</dd>
  66. <dd>- added information on pptp access control</dd>
  67. <dd>- updated the software version info to reflect the latest available version</dd><br>
  68. <dt>Release 0.2 -- 23 September 2005</dt>
  69. <dd>- Rewrote part of the pptp client configuration section and included split tunneling information.</dd><br>
  70. <dt>Release 0.1 -- 12 September 2005</dt>
  71. <dd>- added Kerberos version information</dd>
  72. <dd>- added the full path of winbindd_privileged directory</dd>
  73. <dd>- fixed the VBScript which had a few lines missing</dd>
  74. <dd>- corrected a few typos </dd>
  75. </dl>
  76. <dl>
  77. <dt>First Release -- 5 September 2005</dt>
  78. </dl>
  79. <p align="left">This document covers how to integrate Poptop with Microsoft Active Directory on Fedora 8. Two different implementations are described: a) winbind; and b) freeradius.</p>
  80. <hr>
  81. <a name="toc"></a>Table of Contents
  82. <dl><dt>1. <a href="#introduction">Introduction</a></dt>
  83. <dt>2. <a href="#disclaimer">Disclaimer</a></dt>
  84. <dt>3. <a href="#acknowledgement">Acknowledgements</a></dt>
  85. <dt>4. <a href="poptop_ads_howto_2.htm">The Test Environment</a></dt>
  86. <dt>5. <a href="poptop_ads_howto_3.htm#selinux">Fedora and SELINUX</a></dt>
  87. <dt>6. <a href="poptop_ads_howto_3.htm#network">Network Configuration</a></dt>
  88. <dd>6.1 <a href="poptop_ads_howto_3.htm#defaultroute">Default Route and Static Routes</a></dd>
  89. <dd>6.2 <a href="poptop_ads_howto_3.htm#pforward">Enable Packet Forwarding</a></dd>
  90. <dt>7. <a href="poptop_ads_howto_4.htm#mppe">Install MPPE Kernel Module</a></dt>
  91. <dt>8. <a href="poptop_ads_howto_4.htm#pppd_pptpd">pppd and pptpd</a></dt>
  92. <dd>8.1 <a href="poptop_ads_howto_4.htm#pppd">pppd</a></dd>
  93. <dd>8.2 <a href="poptop_ads_howto_4.htm#pptpd">Install pptpd</a></dd>
  94. <dt>9. <a href="poptop_ads_howto_5.htm">Samba</a></dt>
  95. <dd>9.1 <a href="poptop_ads_howto_5.htm#smbconf">Configure Samba</a></dd>
  96. <dt>10. <a href="poptop_ads_howto_6.htm">Kerberos</a></dt>
  97. <dd>10.1 <a href="poptop_ads_howto_6.htm#krbconf">Configure Kerberos</a></dd>
  98. <dd>10.2 <a href="poptop_ads_howto_6.htm#krbtest">Test Kerberos</a></dd>
  99. <dt>11. <a href="poptop_ads_howto_6a.htm#smbjoin">Join the AD Domain</a></dt>
  100. <dt>12. <a href="poptop_ads_howto_7.htm">pptpd and winbindd</a></dt>
  101. <dd>12.1 <a href="poptop_ads_howto_7.htm#wbtest">Enable and Test winbindd</a></dd>
  102. <dd>12.2 <a href="poptop_ads_howto_7.htm#pptpconf">Configure pptpd</a></dd>
  103. <dd>12.3 <a href="poptop_ads_howto_7.htm#access">PPTP Access Control</a></dd>
  104. <dt>13. <a href="poptop_ads_howto_8.htm">Software for Radius Setup</a></dt>
  105. <dt>14. <a href="poptop_ads_howto_8.htm#rclient">Radiusclient</a></dt>
  106. <dd>14.1 <a href="poptop_ads_howto_8.htm#rclientconf">radiusclient.conf</a></dd>
  107. <dd>14.2 <a href="poptop_ads_howto_8.htm#dict">dictionary.microsoft</a></dd>
  108. <dt>15. <a href="poptop_ads_howto_9.htm">Freeradius</a></dt>
  109. <dd>15.1 <a href="poptop_ads_howto_9.htm#mschap2">Configure Freeradius for MSCHAPv2</a></dd>
  110. <dd>15.2 <a href="poptop_ads_howto_9.htm#access">PPTP Access Control</a></dd>
  111. <dt>16. <a href="poptop_ads_howto_10.htm">pptpd and freeradius</a></dt>
  112. <dd>16.1 <a href="poptop_ads_howto_10.htm#radiusd">Enable freeradius</a></dd>
  113. <dd>16.2 <a href="poptop_ads_howto_10.htm#pptpdradius">Configure pptpd</a></dd>
  114. <dt>17. <a href="poptop_ads_howto_11.htm">pptp Client Installation</a></dt>
  115. <dd>17.1 <a href="poptop_ads_howto_11.htm#splittunnel">Split Tunneling</a></dd>
  116. <dt>18. <a href="poptop_ads_howto_12.htm">pptp Server Administration </a></dt>
  117. <dd>18.1 <a href="poptop_ads_howto_12.htm#whoisonline">Who is Online?</a></dd>
  118. <dd>18.2 <a href="poptop_ads_howto_12.htm#accounting">Accounting</a></dd>
  119. <dd>18.3 <a href="poptop_ads_howto_12.htm#disconnect">Disconnect a User</a></dd>
  120. <dd>18.4 <a href="poptop_ads_howto_12.htm#oneconnection">Allow One Connection per User </a></dd>
  121. <dt>A1. <a href="poptop_ads_howto_a1.htm#mppe">Install MPPE Module on Fedora Core 4 / 5 / 6 </a></dt>
  122. <dd>A1.1 <a href="poptop_ads_howto_a1.htm#a11_fc56">Fedora Core 5 / 6</a></dd>
  123. <dd>A1.2 <a href="poptop_ads_howto_a1.htm#a12_fc4">Fedora Core 4</a></dd>
  124. <dd>A1.3 <a href="poptop_ads_howto_a1.htm#autoinstaller">Kernel Upgrade and dkms_autoinstaller</a></dd>
  125. <dt>A2. <a href="poptop_ads_howto_a2.htm#pppd">Update pppd on Fedora Core 4 / 5 / 6 </a></dt>
  126. <dd>A2.1 <a href="poptop_ads_howto_a2.htm#fc56_pppd">Fedora Core 5 / 6</a></dd>
  127. <dd>A2.2 <a href="ppptop_ads_howto_a2.htm#f4_pppd">Fedora Core 4</a></dd>
  128. <dt>A3. <a href="poptop_ads_howto_a3.htm#samba">Samba for Fedora Core 4 / 5 / 6</a></dt>
  129. <dd>A3.1 <a href="poptop_ads_howto_a3.htm#fc56_samba">Fedora Core 5 / 6</a></dd>
  130. <dd>A3.2 <a href="poptop_ads_howto_a3.htm#fc4_samba">Fedora Core 4</a></dd>
  131. <dt>A4. <a href="poptop_ads_howto_a4.htm#a4freeradius">Software for Radius Setup on Fedora Core 4 / 5 / 6</a></dt>
  132. <dd>A4.1 <a href="poptop_ads_howto_a4.htm#fc56_freeradius">Fedora Core 5 / 6</a></dd>
  133. <dd>A4.2 <a href="poptop_ads_howto_a4.htm#fc4_freeradius">Fedora Core 4</a></dd>
  134. <dt>A5. <a href="poptop_ads_howto_a5.htm">Radiusclient Configuration for Fedora 4 / 5 / 6</a></dt>
  135. <dd>A5.1 <a href="poptop_ads_howto_a5.htm#rclientconf">radiusclient.conf</a></dd>
  136. <dd>A5.2 <a href="poptop_ads_howto_a5.htm#dict">dicitonary.microsoft</a></dd>
  137. <dt>A6. <a href="poptop_ads_howto_a6.htm">Configure Freeradius for MSCHAP2 on Fedora 4 / 5 / 6</a></dt>
  138. </dl>
  139. <hr>
  140. <strong><a name="introduction"></a>1. Introduction</strong>
  141. <p>This document descibes how to build a Linux PPTP server with Poptop and use Microsoft Active Directory to authenticate users. There are a few howtos on this topic, such as the <a href="http://poptop.sourceforge.net/dox/replacing-windows-pptp-with-linux-howto.phtml">Replacing a Windows PPTP Server with Linux Howto</a> created by Matt Alexander and maintained by James Cameron. Most of them, however, concentrate on Samba and winbind. I followed them and got it working in the test environment. Unfortunately, winbind does not scale very well in a AD setup which has thousands of objects. The AD in my work is a big tree. It spans across all continents and has thousands of users and groups. Winbind simply times out before it can harvest a complete list of users/groups.</p>
  142. <p align="left">The other way of doing it is with radius. Information on how to setup pptpd with radius against Active Directory is scarce. I can only find bits and pieces information from forums but never find any comprehensive documents. I spent days to try to get it configured properly. After countless frustrations and tears, I eventually got a working setup. I therefore decided to make this howto to document it. Hopefully, you will find it useful.</p>
  143. <p align="left">To make this howto complete, I include the winbind configuration as well although it may duplicate Matt's work.</p>
  144. <dt align="left"><strong>Note</strong>:</dt>
  145. <dd>- this howto is based on Fedora 8 and use pre-packaged RPMs whenever possible. If you are using other distributions or like to compile software, you will have to make the necessary adjustments.</dt>
  146. <dd>- Information for Fedora Core 4/5/6 has been moved to Appendix and will not be updated anymore. </dd>
  147. <br>
  148. <hr>
  149. <strong><a name="disclaimer"></a>2. Disclaimer</strong>
  150. <p>This document is provided as is. I have tried my best to make it as accurate as I can but it may contain wrong information. Use it at your own risk. </dd>
  151. <p>Any comments on this document will be greatly appreciated.. </p>
  152. <hr>
  153. <a name="acknowledgement"></a><strong>3. Acknowledgements
  154. </strong>
  155. <p>Thanks to the following individuals who provided feedback and suggestions to make this document better.</p>
  156. <blockquote>
  157. <p>Peter Mueller - suggested to add information on Kerberos version (R0.1) <br>
  158. Francis Lessard - provided details on implementing pptp access control (R0.3)<br>
  159. James Cameron - provided info on MPPE support on kernel v2.6.15-rc1 (R0.5) <br>
  160. Phil Oester - pointed out the kernel-2.6.15/ppp-2.4.3-5 problem is Gentoo specific (R0.71)<br>
  161. Nicolas Ross - pointed out typo in dictionary.microsoft (R1.21)<br>
  162. Frederick Chapleau - info on the potential problem of SELINUX on PPTPD (R1.3) </p>
  163. </blockquote>
  164. <hr>
  165. <a href="poptop_ads_howto_2.htm">Next</a>
  166. &nbsp;&nbsp;<a href="#toc">Content</a>
  167. </body>
  168. </html>