Re: npppd pptp hangs

[Stuart Longland]

On 23/3/20 10:26 pm, Marko Cupać wrote:
> Anything I can do to avoid future hangs?

Whilst probably not the answer you're looking for: moving away from PPTP
would be a good start.

The MSCHAPv2 authentication used in PPTP is vulnerable to dictionary
attacks and the RC4 cipher used in MPPE (the security layer of PPTP) is
laughably weak in today's security context.  Whilst MSCHAPv2 can be
replaced with EAP-TLS, there's no fix for MPPE.

IPSec (which is built into OpenBSD) or OpenVPN (in ports) would be
vastly superior options.
-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

npppd pptp hangs

[Marko Cupać]

Hi,

my npppd pptp server has recently got increase from ~20 to >200
concurrent users. So far it worked flawlessly for years, but before few
minutes it become unresponsive.

It stopped logging at one point (I have log redirected to its own file,
/var/log/npppd). npppctl also hanged, returning nothing. I couldn't
restart it with rcctl, or kill it with HUP. I had to resort to `kill
-9', and it started fine afterwards.

It appears that already established sessions worked, but with poor
performance.

I have lots of these in log (I saw them earlier as well but they
weren't causing problems AFAIK):

Mar 23 12:03:26 nat1 /bsd: pipex: ppp=1869 iface=tun1 protocol=PPTP id=45012 
Received bad data packet: out of sequence: seq=1266880(1266946-1267010) 
ack=1915237(1915368-1915471)
Mar 23 12:03:26 nat1 /bsd: pipex: ppp=1869 iface=tun1 protocol=PPTP id=45012 
Received bad data packet: out of sequence: seq=1266881(1266946-1267010) 
ack=1915239(1915368-1915472)
Mar 23 12:03:26 nat1 /bsd: pipex: ppp=1869 iface=tun1 protocol=PPTP id=45012 
Workaround the out-of-sequence PPP framing problem: 1215 => 1151
Mar 23 12:06:59 nat1 /bsd: pipex: ppp=1847 iface=tun1 protocol=PPTP id=45439 
received packet caused window overflow. seq=218469(218273-218337)may lost 196 
packets.

Also, at the time before killing it there's:

Mar 23 13:13:37 nat1 /bsd: splassert: pipex_destroy_session: want 2 have 0
Mar 23 13:13:37 nat1 last message repeated 95 times


Anything I can do to avoid future hangs?

Thank you in advance,

-- 
Before enlightenment - chop wood, draw water.
After  enlightenment - chop wood, draw water.

Marko Cupać
https://www.mimar.rs/