Learn PPTP - RADIUS Integration & User Management

#Introduction

Managing users one by one in /etc/ppp/chap-secrets is fine for a small lab, but becomes a nightmare when users number in the hundreds. This is where RADIUS comes in: a single point of authentication, authorization, and accounting for all dial-up services.

Episode 11 covers connecting pppd to RADIUS through the radius.so plugin, setting up FreeRADIUS as a backend, integrating LDAP for centralized authentication, and using accounting to monitor sessions.

#Why RADIUS

#One Database for All Services

With RADIUS, user data no longer needs to be scattered across every server's chap-secrets. Authentication is handled by the RADIUS server, which becomes the single source of truth. This makes adding, disabling, and auditing users easy.

RADIUS also provides accounting: every session start and end is recorded, so you can calculate usage and detect anomalies.

#The radius.so Plugin in pppd

#Loading the RADIUS Plugin

pppd supports a RADIUS plugin compiled as a shared library. On Debian/Ubuntu, the ppp package provides this plugin:

find /usr/lib -name "radius.so"

If find /usr/lib -name "radius.so" finds the file, add it to the PPP options file:

plugin radius.so
radius-config-file /etc/ppp/radius.conf

The plugin radius.so line makes pppd load the plugin, and radius-config-file points to the RADIUS server configuration file.

#The radius.conf Configuration File

The plugin configuration in /etc/ppp/radius.conf defines the server address and the shared secret:

auth-server 192.168.1.100:1812
acct-server 192.168.1.100:1813
secret 3k1Ra45lAnDSecreto
nas-identifier pptp-server

auth-server points to FreeRADIUS on port 1812 (authentication), acct-server on port 1813 (accounting). The secret must match exactly what is configured on the RADIUS server side.

#FreeRADIUS as a Backend

#Adding Users in FreeRADIUS

On the FreeRADIUS server, users are stored in /etc/freeradius/3.0/users:

budi    Cleartext-Password := "password-rahasia"

For VPN sessions, add the relevant attributes:

budi    Cleartext-Password := "password-rahasia",
        Framed-Protocol = PPP,
        Framed-IP-Address = 10.0.0.100

Every attribute returned by the RADIUS server is passed to pppd as an option. Framed-IP-Address, for example, forces the client to get a specific IP address.

#Restart and Test

sudo systemctl restart freeradius
sudo radtest budi "password-rahasia" 127.0.0.1 0 3k1Ra45lAnDSecreto

radtest sends a test authentication request to the RADIUS server. If the reply is Access-Accept, the server configuration is correct and ready to serve pppd.

#LDAP Integration

#Centralized Authentication via LDAP

Instead of storing passwords in FreeRADIUS, authentication can be delegated to LDAP such as Active Directory or OpenLDAP. In FreeRADIUS, the rlm_ldap module connects the two.

The rlm_ldap configuration is usually set in the LDAP module file, then invoked from the virtual server during authentication. The common pattern: FreeRADIUS receives an Access-Request from pppd, queries LDAP for the credentials, then returns the result to pppd.

ldapsearch -x -H ldap://ldap.example.com -b "ou=people,dc=example,dc=com" uid=budi

ldapsearch -x -H ldap://ldap.example.com -b "ou=people,dc=example,dc=com" uid=budi tests the connection and user lookup. Make sure the bind works before wiring it into FreeRADIUS.

#Accounting and Monitoring

#Monitoring Sessions from RADIUS Logs

Every PPTP session using the radius plugin produces accounting start and stop records. The information includes the user, IP address, session duration, and bytes transferred.

sudo tail -f /var/log/freeradius/radacct/*/* | grep -E "Acct-Status-Type|Acct-Session-Time"

tail -f /var/log/freeradius/radacct/*/* displays accounting entries live. From here, you can build a usage dashboard or detect users with abnormal sessions.

#Closing

Episode 11 connected PPTP to the enterprise world: loading the radius.so plugin, configuring radius.conf, adding users in FreeRADIUS, integrating LDAP, and monitoring sessions through accounting.

Key takeaways:

• RADIUS provides centralized authentication, authorization, and accounting.
• plugin radius.so and radius-config-file enable RADIUS in pppd.
• radius.conf needs the server address, shared secret, and nas-identifier.
• Framed attributes returned by FreeRADIUS are passed as pppd options.
• LDAP is integrated through the rlm_ldap module in FreeRADIUS.
• RADIUS accounting records start, stop, duration, and bytes for every session.

In the next episode, episode 12, we will discuss automation and deployment — shell scripts for one-shot setup, bulk user creation, the role of Ansible, and the discussion of running PPTP inside a Docker container.