[Poptop-server] MPPE keys not available?

[John Horne]

Hello,

I am suddenly getting errors on our vpn servers which show:

Jan 29 11:31:52 barney pppd[1386]: pppd 2.4.2b1 started by root, uid 0
Jan 29 11:31:52 barney pppd[1386]: Connect: ppp0 <--> /dev/pts/1
Jan 29 11:31:52 barney pptpd[1385]: GRE: Bad checksum from pppd.
Jan 29 11:31:54 barney pptpd[1385]: CTRL: Ignored a SET LINK INFO packet
with real ACCMs!
Jan 29 11:31:54 barney pppd[1386]: rc_get_seqnbr: fscanf failure:
/var/run/radius.seq
Jan 29 11:31:55 barney pppd[1386]: MPPE required, but keys are not
available. Possible plugin problem?
Jan 29 11:31:55 barney pppd[1386]: CHAP peer authentication succeeded for
Jan 29 11:31:55 barney pppd[1386]: Modem hangup
Jan 29 11:31:55 barney pppd[1386]: Connection terminated.
Jan 29 11:31:55 barney pptpd[721]: MGR: No free connection slots or IPs -
no more clients can connect!
Jan 29 11:31:55 barney pppd[1390]: pppd 2.4.2b1 started by root, uid 0
Jan 29 11:31:55 barney pppd[1390]: Connect: ppp0 <--> /dev/pts/1
Jan 29 11:31:55 barney pptpd[1389]: GRE: Bad checksum from pppd.
Jan 29 11:31:55 barney pptpd[1389]: GRE: Discarding duplicate packet
Jan 29 11:31:58 barney pptpd[1389]: CTRL: Ignored a SET LINK INFO packet
with real ACCMs!
Jan 29 11:31:58 barney pppd[1390]: MPPE required, but keys are not
available. Possible plugin problem?
Jan 29 11:31:58 barney pppd[1390]: CHAP peer authentication succeeded for
Jan 29 11:31:58 barney pppd[1390]: Modem hangup
Jan 29 11:31:58 barney pppd[1390]: Connection terminated.

I tried rebooting the server but it made no difference. The important bits
seem to be that MPPE states that the keys are not available; MGR then states
that there are no free connection slots. I then repeats the process - I
assume this was the Windows 2K client either restarting the connection?

The servers worked fine the night before - see my previous message about GRE
problems. However, the only change is that for these connection atempts we
are using the pppd radius plugin, which talks to an MS IAS server. However,
I can see the radius request being handled and accepted. As indicated above
the authentication succeeds. If I use an account name/password from the
chap-secrets file then all goes okay and no 'MPPE' errors. The IAS server
shows the radius request arriving and the reply being sent back - so I don't
think that is in itself part of the problem.


Anyone any ideas about this? I'll investigate further - obviously since we
need this to authenticate our users! - but I'm a bit confused as to the
connection between using radius and the MPPE keys!? Also the radius server
seems to send the authentication request of to the IAS server twice - no
idea why.


Thanks,

John.

------------------------------------------------------------------------
John Horne, University of Plymouth, UK Tel: [phone]
E-mail: ***@plymouth.ac.uk
PGP key available from public key servers

[James Cameron]

Post by John Horne
/var/run/radius.seq
Jan 29 11:31:55 barney pppd[1386]: MPPE required, but keys are not
available. Possible plugin problem?

The /var/run/radius.seq file is present, but may not contain a sequence
number.

Source ppp/pppd/plugins/radius/radiusclient/lib/buildreq.c

[John Horne]

Post by James Cameron

Post by John Horne
/var/run/radius.seq
Jan 29 11:31:55 barney pppd[1386]: MPPE required, but keys are not
available. Possible plugin problem?

The /var/run/radius.seq file is present, but may not contain a sequence
number.

Small bug here it seems. When the system is rebooted /var/run is cleaned
out. When ppp tries to first authenticate using the radius plugin the code
says:

if ((sf = fopen(seqfile, "a+")) == NULL)

so the file is created (a+). Later we then get:

if (fscanf(sf, "%d", &seq_nbr) != 1) {

The file is opened and locked okay because it exists, but with nothing in
it. So the fscanf will fail after reboots since it has no number (%d) in it.
Subsequent uses of radius.seq, until the next reboot, are okay because a
random number is put into the file after the fscanf failure.

Does that seem correct? I'll see if I can find who to report this to.


John.

------------------------------------------------------------------------
John Horne, University of Plymouth, UK Tel: [phone]
E-mail: ***@plymouth.ac.uk
PGP key available from public key servers

[John Horne]

Post by John Horne
/var/run/radius.seq

I've submitted this as a bug to the ppp people.

Post by John Horne
Jan 29 11:31:55 barney pppd[1386]: MPPE required, but keys are not
available. Possible plugin problem?

The cvs version of pppd I'm using on the old test server is older than the
one I'm using on the new servers. One of the changes was that the radius
plugin when using MPPE must have seen both the MPPE send and receive keys as
part of the RADIUS reply *and* the MPPE encryption policy. This latter part
isn't being sent back by the MS IAS server. Hence it denies the connection
saying that the keys are not available. Previously there was no such check
which is why my previous tests all worked.

I'll talk to our IAS guy when he returns (out on campus at the moment) to
see if he can set the pairs returned. Failing that I'll simply have to
modify the code to revert back to the former behaviour. I have already
tested this out and it all works fine, but I'm sure the change was done for
a good reason.



John.

------------------------------------------------------------------------
John Horne, University of Plymouth, UK Tel: [phone]
E-mail: ***@plymouth.ac.uk
PGP key available from public key servers