Re: [Poptop-server] PPTP traffic should be considered unencrypted

James Cameron wrote:
> On Tue, Jul 31, 2012 at 04:40:03PM -0700, Tim Gustafson wrote:
>   
>>> The user's password.  That is to say, the attack would have to be
>>> repeated if the user changed their PPTP password.
>>>       
>> Actually, it occurs to me that I haven't seen this question asked or
>> answered so far either:
>>
>> The vulnerability described does not seem to be related to EAP,
>> correct?  Is using EAP as an authentication method still viable?
>>     
>
> I agree, the vulnerability is specific to MSCHAP-v2.  I know nothing
> useful about EAP, sorry.  I don't know if anybody has it working with
> PPTP.  Yes, MPPE depends on MSCHAP-v2, I don't think it can be made to
> depend on anything else, but that's a matter for the pppd guys, in
> pptpd land we just ask pppd to do it.
>
>   
FWIW: a long time ago I wrote a patch for pppd to do just this:
  http://www.nikhef.nl/~janjust/ppp/
it adds EAP-TLS support (including MPPE+MPPC) to pppd, which in turn can 
be used to secure a PPTP VPN using X509 certs. The patch has not made it 
into the pppd mainstream code yet (mostly due to me) but the patch has 
been adopted by RedHat, Suse and Debian.

HTH,

JJK

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
pptpclient-devel mailing list
pptpclient-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/pptpclient-devel