10.6. Adding Your Poptop Server to Active Directory

Problem

You have an Active Directory domain under your care, and you want your Linux pptp server to be an Active Directory member, so you want to manage it just like any other AD object. Your DNS house is in order, and you already have a Kerberos Key Distribution Center (KDC).

Solution

Use Samba, Winbind, and Kerberos on your Linux Poptop server to become a full Active Domain member. See Recipe 11.6 to learn how to do this.

Then, configure your Poptop server according to the previous recipes, and add these lines to /etc/ppp/options.pptpd:

	##/etc/ppp/options.pptpd
	[...]
	#if you are using MS-DNS, enter the server IP address
	ms-dns 1.2.3.5
	#if you use a WINS server, enter the IP address
	ms-wins 1.2.3.4
	plugin winbind.so
	ntlm_auth-helper "/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1"

Start it up, and make sure it's running with netstat or ps:

	# /etc/init.d/pptpd stop
	# /etc/init.d/pptpd start
	# netstat -untap | grep pptpd
	tcp    0   0 0.0.0.0:1723   0.0.0.0:*   LISTEN    4167/pptpd
	$ ps ax | grep pptpd
	 4167 ?    Ss     0:00 /usr/sbin/pptpd

Now, connect some Windows clients, and life should be good. Windows 2000 clients and up can use Active Directory authentication, and don't need entries in /etc/ ppp/chap-secrets.

Discussion

Put your plug-ins at the end of the /etc/ppp/options.pptpd file; this helps to avoid any possible conflicts.

/usr/bin/ntlm_auth is part of Winbind.

See Also