Learn PPTP - PPP & Authentication Mechanism

#Introduction

In episode 3, the PPP session formed almost without you noticing. Now we open the hood: understanding PPP (Point-to-Point Protocol) is the key to understanding PPTP authentication, and understanding authentication is the key to understanding its security weaknesses.

Episode 4 dissects the PPP phases, distinguishes PAP, CHAP, MS-CHAPv2, and EAP, and then honestly explains why MS-CHAPv2 — the most common authentication protocol used by PPTP — has been considered broken since 2012.

#The PPP Phases

#The Lifecycle of a PPP Session

PPP works in four main phases:

1. Link Establishment: both sides agree on link parameters via LCP.
2. Authentication: the user's identity is verified.
3. Network Phase: network protocols such as IP are configured via NCP (IPCP).
4. Link Termination: the connection is ended and resources are released.

LCP → Authentication → NCP (IPCP) → Data Transfer

The flow LCP → Authentication → NCP → Data Transfer happens inside the GRE tunnel, and its frames are sent as GRE payload toward the peer.

#LCP and NCP

#Link Control Protocol

LCP (Link Control Protocol) is used to establish, configure, and test the link. LCP agrees on the Maximum Receive Unit (MRU), compression options, and negotiates which authentication method will be used.

The important LCP options for PPTP are the agreement on the authentication method and MPPE encryption. Both are negotiated through special options sent during the LCP phase.

#Network Control Protocol

NCP (Network Control Protocol) is used to configure network protocols on top of PPP. For IP, the NCP used is IPCP — the protocol that assigns the client's IP address, sends DNS addresses, and sets WINS.

When you see the ppp0 interface receive an address from the remoteip pool, that is IPCP at work.

#Authentication Protocols

#PAP: Unencrypted Authentication

PAP (Password Authentication Protocol) sends the username and password in plaintext. Anyone who can intercept tunnel traffic can read the credentials. PAP is never recommended for production.

#CHAP: Challenge-Response

CHAP uses a challenge-response scheme. The server sends a challenge, the client computes a hash of the challenge and the password, and sends back the result. The password never crosses the wire in its original form. Generic CHAP uses MD5 as its hash function.

#MS-CHAPv2: Microsoft's Variation

MS-CHAPv2 is Microsoft's version of CHAP, using the NT password hash (NT hash) and including mutual authentication in the challenge-response values. This is the version commonly used by PPTP, and the MPPE key is derived from it.

#EAP: A Flexible Framework

EAP (Extensible Authentication Protocol) is a framework that allows various authentication methods. PPTP supports EAP, but in practice MS-CHAPv2 remains the most common.

#Configuring Authentication in pppd

#Controlling Allowed Methods

In /etc/ppp/options.pptpd, you control which authentication methods are allowed:

name pptpd
require-mschap-v2
refuse-pap
refuse-chap
refuse-eap

The require-mschap-v2 line forces clients to use MS-CHAPv2, while refuse-pap rejects plaintext authentication. This is the minimum security configuration you should have.

#Why MS-CHAPv2 Is Considered Broken

#Attacks Against MS-CHAPv2

In 2012, researchers Moxie Marlinspike and David Hulton demonstrated that the MS-CHAPv2 challenge-response can be turned into an offline attack against the password. By capturing a challenge-response pair, an attacker can brute-force or dictionary-attack the password without ever interacting with the server.

sudo tcpdump -i any port 1723 -A

The output of tcpdump -i any port 1723 -A helps you see the control exchange carrying the MS-CHAPv2 challenge-response. This is not just theory: since 2012, weak MS-CHAPv2 passwords can be cracked within hours.

#Implications for PPTP

Because the MPPE encryption key is also derived from the same password, cracking the MS-CHAPv2 password means cracking the encryption of the entire session. This is the core reason PPTP is considered insecure — a topic we will dive into in episode 13.

In addition, the security of a PPTP session is never better than the security of its password. Strong password policies raise the cost of an attack but do not eliminate it — an attacker can still work offline at leisure.

#Impact on Configuration Decisions

The choice of authentication protocol is not just a technical preference. Using PAP with PPTP means sending plaintext passwords inside a tunnel that can even run without encryption. The require-mschap-v2 configuration is the minimum boundary, and no configuration combination makes PPTP truly secure.

From a practical perspective, this means you should always choose the strictest authentication option supported by all clients — and still plan migration as the permanent solution.

#Closing

Episode 4 explained the PPP engine behind PPTP: the LCP, authentication, and NCP phases; the differences between PAP, CHAP, MS-CHAPv2, and EAP; and the require-mschap-v2 configuration in pppd. Most importantly, you now understand the root weakness: MS-CHAPv2 can be cracked offline.

Key takeaways:

• PPP runs through LCP, authentication, NCP, then data transfer phases.
• IPCP is the NCP that assigns the client's IP address and DNS.
• PAP sends plaintext passwords and is insecure.
• MS-CHAPv2 uses challenge-response and became the PPTP standard.
• Since 2012, MS-CHAPv2 challenge-responses can be cracked offline.
• require-mschap-v2 and refuse-pap are the minimum security baseline.

In the next episode, episode 5, we will discuss GRE and the encapsulation process — how PPP frames are wrapped in GRE, the overhead that affects MTU, MSS clamping, and the GRE limitations that make it NAT-unfriendly.