PPTP: Use LDAP or PAM as authentication backend

Question

I'm using pptpd and pppd on a Debian linux host to provide VPN capabilities to mobile phones. I would like to use my OpenLDAP server for authentication and authorization purposes (instead of keeping users and cleartext passwords in /etc/ppp/chap-secrets). Is that possible?

I have normal unix login working via libpam-ldap, does that help?

I've read some stuff about using FreeRADIUS in between pppd and OpenLDAP, but it sounds to me like overkill.

Solution

The MSCHAPv2 authentication requires the server to have cleartext passwords. I dont't think you can get around that if your clients are mobile phones - you need certificates for the other strong authentication methods.

I had once a setup pptpd->FreeRADIUS->MySQL running. The pppd has no direct ldap plugin AFAIK, so you absolutely need to employ RADIUS in between. And you need cleartext passwords somewhere - I would not feel that good storing them in LDAP, but it should be possible.

Comments

[Hank]

Thanks, that clarifies it! I might look into L2TP instead then.