Bart's SSH1/PPPD Secure VPN Solution

NOTE: this work was converted to a nice MiniHOWTO by Scott Bronson. You may want to read his document as this is showing it's age. You can find a copy of it here: VPN PPP-SSH Mini-HOWTO.

I cannot take the credit... this work is heavily based on The VPN HOWTO by Arpad Magosanyi . I just RedHat-ized it and made it work with my setup (RedHat 6.1 with ssh-1.2.26).

I assume that you have a masquerading firewall. I didn't cover the setup of you here but you will need to have one already working. See the Linux IP Masquerade HOWTO for more details on that.

Also, I used ssh-1.2.26 but ssh2 may also work... I just don't know.



How to make your very own SSH/PPPD secure VPN

As in the original HOWTO (see above) I refer to the originator of the connection as the master and the recepiant the slave. If you need any help understanding how the VPN works or how ssh or pppd work please consult the above mentioned HOWTO. I just made the setup a bit easier for RedHat users.
  1. Get pty-redir-0.1-bart.tar.gz (slight modification to the original: ftp://ftp.vein.hu/ssa/contrib/mag/pty-redir-0.1.tar.gz) compile it and install it in /usr/local/bin/pty-redir on the master.

  2. Make sure you have installed ssh on both machines and sudo on the slave.

  3. Login in as root on the master and run ssh-keygen (if you don't have ~root/.ssh/identity.pub).

  4. Make an account for user vpn on the slave computer (or whatever you want this user to be called). Login as this slave and execute ssh-keygen to initialize the ssh engine for this user. Now copy over the ~root/.ssh/identity.pub from the master to ~vpn/.ssh/authorized_keys on the slave). Test the ssh keys by running ssh vpn@slave ls on the master.

  5. On the slave computer give the vpn account access to route and pppd. The eazy way of doing it is with sudo. Sudo grants super user access to normal users if given permissions listed in the /etc/pseudoers file. The proper way to edit this file is with visudo. So add these lines:

    		 Cmnd_Alias VPN=/usr/sbin/pppd,/sbin/route
    		 vpn ALL=NOPASSWD: VPN
    		 
    NOTE: This is not a very good solution since anybody that gains access to the account vpn can mess up your routes.

  6. Copy my vpn init.d script (vpn) to /etc/rc.d/init.d/vpn on your master and edit the top portion to indicate your network configuration.

  7. Now execute the script /etc/rc.d/init.d/vpn start ... if you configured everything properly it should work. If not email me.



Bart Trojanowski
http://www.jukie.net/~bart
bart@jukie.net