I would strongly suggest that you abandon using PPTP altogether.  I'm
not kidding.  If a VPN protocol is unable to provide you with meaningful
security, then what's the point of using it?  Bruce Schneier with Mudge
of L0pht showed a while ago how worthless MS-PPTP is as a VPN protocol:

http://www.schneier.com/pptp.html

As they put it:

  3. How bad is it?
  Very. Microsoft PPTP is very broken, and there's no real way to fix it
  without taking the whole thing down and starting over. This isn't just
  one problem, but six different problems, any one of which breaks the
  protocol.

  4. Doesn't Microsoft know better?
  You'd think they would. The mistakes they made are not subtle; they're
  "kindergarten cryptographer" mistakes. The encryption is used in a way
  that completely negates its effectiveness. The documentation claims
  128-bit keys, even though nothing remotely close to that key length is
  actually used. Passwords are protected by hash functions so badly that
  most can be easily recovered. And the control channel is so sloppily
  designed that anyone can cause a Microsoft PPTP server to go belly up. 

There is full support for IPsec in all modern versions of Windows, and
in particular the versions of Windows that you are using, and I
personally believe that it is the best thing that ever happened to you
that you're having trouble getting it to work!  Get FreeS/WAN or
OpenSWAN or the inherent 2.6.x IPsec implementation for IPsec on Linux.
FreeS/WAN to Microsoft IPsec interoperability is fairly well documented
as well.

As of now, it seems that for VPN's it's either IPsec or nothing.  IPsec
seems to be too complicated, but it's a fair sight better than any of
the many, horribly broken protocols out there.

--
Philippine Linux Users' Group (PLUG) Mailing List
[EMAIL PROTECTED] (#PLUG @ irc.free.net.ph)
Official Website: http://plug.linux.org.ph
Searchable Archives: http://marc.free.net.ph
.
To leave, go to http://lists.q-linux.com/mailman/listinfo/plug
.
Are you a Linux newbie? To join the newbie list, go to
http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie

Reply via email to