winxp 手動設置ip登陸pptpd所出現的問題

winxp 手動設置ip登陸pptpd所出現的問題

服務端：pptpd + radius +ldap
           centos 5.2

現象：見附件圖片
說明：如果用chap-secrets 來保存帳戶，登陸是沒有問題的。

日誌：

Plugin /usr/lib/pppd/2.4.4/radius.so loaded.
RADIUS plugin initialized.
pppd options in effect:
debug           # (from /etc/ppp/options.pptpd)
logfile /var/log/pptpd.log              # (from /etc/ppp/options.pptpd)
dump            # (from /etc/ppp/options.pptpd)
plugin /usr/lib/pppd/2.4.4/radius.so            # (from /etc/ppp/options.pptpd)
require-mschap-v2               # (from /etc/ppp/options.pptpd)
name pptpd              # (from /etc/ppp/options.pptpd)
115200          # (from command line)
lock            # (from /etc/ppp/options)
local           # (from command line)
ipparam 192.168.0.88            # (from command line)
ms-dns xxx #             # (from /etc/ppp/options.pptpd)
ms-wins xxx #            # (from /etc/ppp/options.pptpd)
proxyarp                # (from /etc/ppp/options.pptpd)
require-mppe-128                # (from /etc/ppp/options.pptpd)
using channel 17
Using interface ppp0
Connect: ppp0 <--> /dev/pts/2
sent
rcvd
sent
rcvd
sent
sent
rcvd
sent
rcvd
rcvd
sent
sent
rcvd
sent
rcvd
sent
rcvd
rcvd
sent
MPPE 128-bit stateless compression enabled
sent
rcvd
sent
rcvd
rcvd
sent
rcvd
sent
Peer is not authorized to use remote address 192.168.10.1
Connect time 0.1 minutes.
Sent 122 bytes, received 152 bytes.
sent
rcvd
MPPE disabled
sent
sent
Modem hangup
Connection terminated.
Connect time 0.1 minutes.
Sent 156 bytes, received 514 bytes.


[ 本帖最後由 diyself 於 2009-4-21 17:23 編輯 ]

如果用chap-secrets 來保存帳戶，成功登陸的log。



rcvd
rcvd
sent
rcvd
sent
Cannot determine ethernet address for proxy ARP
local  IP address 59.37.71.85
remote IP address 192.168.10.1
Script /etc/ppp/ip-up started (pid 3211)
Script /etc/ppp/ip-up finished (pid 3211), status = 0x0



但奇怪的是，那個伺服器ip地址哪裡來的呢？請看附件！

[ 本帖最後由 diyself 於 2009-4-21 17:19 編輯 ]

補充配置文件

/etc/pptpd.conf

###############################################################################
# $Id: pptpd.conf,v 1.10 2006/09/04 23:30:57 quozl Exp $
#
# Sample Poptop configuration file /etc/pptpd.conf
#
# Changes are effective when pptpd is restarted.
###############################################################################

# TAG: ppp
#       Path to the pppd program, default '/usr/sbin/pppd' on Linux
#
ppp /usr/sbin/pppd

# TAG: option
#       Specifies the location of the PPP options file.
#       By default PPP looks in '/etc/ppp/options'
#
option /etc/ppp/options.pptpd

# TAG: debug
#       Turns on (more) debugging to syslog
#
#debug

# TAG: stimeout
#       Specifies timeout (in seconds) on starting ctrl connection
#
# stimeout 10

# TAG: noipparam
#       Suppress the passing of the client's IP address to PPP, which is
#       done by default otherwise.
#
#noipparam

# TAG: logwtmp
#       Use wtmp(5) to record client connections and disconnections.
#
#logwtmp

# TAG: bcrelay <if>
#       Turns on broadcast relay to clients from interface <if>
#
#bcrelay eth0

# TAG: delegate
#       Delegates the allocation of client IP addresses to pppd.
#
#       Without this option, which is the default, pptpd manages the list of
#       IP addresses for clients and passes the next free address to pppd.
#       With this option, pptpd does not pass an address, and so pppd may use
#       radius or chap-secrets to allocate an address.
#
delegate

# TAG: connections
#       Limits the number of client connections that may be accepted.
#
#       If pptpd is allocating IP addresses (e.g. delegate is not
#       used) then the number of connections is also limited by the
#       remoteip option.  The default is 100.
connections 100

# TAG: localip
# TAG: remoteip
#       Specifies the local and remote IP address ranges.
#
#       These options are ignored if delegate option is set.
#
#       Any addresses work as long as the local machine takes care of the
#       routing.  But if you want to use MS-Windows networking, you should
#       use IP addresses out of the LAN address space and use the proxyarp
#       option in the pppd options file, or run bcrelay.
#
#       You can specify single IP addresses seperated by commas or you can
#       specify ranges, or both. For example:
#
#               192.168.0.234,192.168.0.245-249,192.168.0.254
#
#       IMPORTANT RESTRICTIONS:
#
#       1. No spaces are permitted between commas or within addresses.
#
#       2. If you give more IP addresses than the value of connections,
#          it will start at the beginning of the list and go until it
#          gets connections IPs.  Others will be ignored.
#
#       3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238,
#          you must type 234-238 if you mean this.
#
#       4. If you give a single localIP, that's ok - all local IPs will
#          be set to the given one. You MUST still give at least one remote
#          IP for each simultaneous client.
#
# (Recommended)

localip 192.168.10.111
remoteip 192.168.10.234-238,192.168.10.245
# or
#localip 192.168.0.234-238,192.168.0.245
#remoteip 192.168.1.234-238,192.168.1.245


/etc/ppp/options.pptpd

###############################################################################
# $Id: options.pptpd,v 1.11 2005/12/29 01:21:09 quozl Exp $
#
# Sample Poptop PPP options file /etc/ppp/options.pptpd
# Options used by PPP when a connection arrives from a client.
# This file is pointed to by /etc/pptpd.conf option keyword.
# Changes are effective on the next connection.  See "man pppd".
#
# You are expected to change this file to suit your system.  As
# packaged, it requires PPP 2.4.2 and the kernel MPPE module.
###############################################################################


# Authentication

# Name of the local system for authentication purposes
# (must match the second field in /etc/ppp/chap-secrets entries)
name pptpd

# Strip the domain prefix from the username before authentication.
# (applies if you use pppd with chapms-strip-domain patch)
#chapms-strip-domain


# Encryption
# (There have been multiple versions of PPP with encryption support,
# choose with of the following sections you will use.)


# BSD licensed ppp-2.4.2 upstream with MPPE only, kernel module ppp_mppe.o
# {{{
#refuse-pap
#refuse-chap
#refuse-mschap
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
require-mschap-v2
# Require MPPE 128-bit encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
require-mppe-128
# }}}


# OpenSSL licensed ppp-2.4.1 fork with MPPE only, kernel module mppe.o
# {{{
#-chap
#-chapms
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
#+chapms-v2
# Require MPPE encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
#mppe-40        # enable either 40-bit or 128-bit, not both
#mppe-128
#mppe-stateless
# }}}


# Network and Routing

# If pppd is acting as a server for Microsoft Windows clients, this
# option allows pppd to supply one or two DNS (Domain Name Server)
# addresses to the clients.  The first instance of this option
# specifies the primary DNS address; the second instance (if given)
# specifies the secondary DNS address.
#ms-dns 10.0.0.1
#ms-dns 10.0.0.2
ms-dns 202.96.128.86

# If pppd is acting as a server for Microsoft Windows or "Samba"
# clients, this option allows pppd to supply one or two WINS (Windows
# Internet Name Services) server addresses to the clients.  The first
# instance of this option specifies the primary WINS address; the
# second instance (if given) specifies the secondary WINS address.
#ms-wins 10.0.0.3
ms-wins 202.96.128.86

# Add an entry to this system's ARP
# table with the IP address of the peer and the Ethernet address of this
# system.  This will have the effect of making the peer appear to other
# systems to be on the local ethernet.
# (you do not need this if your PPTP server is responsible for routing
# packets to the clients -- James Cameron)
proxyarp

# Normally pptpd passes the IP address to pppd, but if pptpd has been
# given the delegate option in pptpd.conf or the --delegate command line
# option, then pppd will use chap-secrets or radius to allocate the
# client IP address.  The default local IP address used at the server
# end is often the same as the address of the server.  To override this,
# specify the local IP address here.
# (you must not use this unless you have used the delegate option)
#10.8.0.100


# Logging

# Enable connection debugging facilities.
# (see your syslog configuration for where pppd sends to)
debug

# Print out all the option values which have been set.
# (often requested by mailing list to verify options)
dump
logfile /var/log/pptpd.log

# Miscellaneous

# Create a UUCP-style lock file for the pseudo-tty to ensure exclusive
# access.
#lock

# Disable BSD-Compress compression
#nobsdcomp

# Disable Van Jacobson compression
# (needed on some networks with Windows 9x/ME/XP clients, see posting to
# poptop-server on 14th April 2005 by Pawel Pokrywka and followups,
# http://marc.theaimsgroup.com/?t=111343175400006&r=1&w=2 )
#novj
#novjccomp

# turn off logging to stderr, since this may be redirected to pptpd,
# which may trigger a loopback
#nologfd

# put plugins here
#plugin /usr/lib/pppd/2.4.4/radius.so
# (putting them higher up may cause them to sent messages to the pty)


[ 本帖最後由 diyself 於 2009-4-21 17:23 編輯 ]

回復 #1 diyself 的帖子

呵呵
看來沒有理解那個參數的設置含義呀

原帖由 kns1024wh 於 2009-4-21 17:40 發表 http://bbs2.chinaunix.net/images/common/back.gif
呵呵
看來沒有理解那個參數的設置含義呀


對，應該是理解錯了。

Delegates the allocation of client IP addresses to pppd.

這個英語的意思應該是」給pptpd伺服器分配ip「，而不是給客戶端分配ip。這個可以從2樓的截圖可以證實！:mrgreen:

回復 #5 diyself 的帖子

應該如此的
不過這個探討是很好的過程呀

Tags: