1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
|
.. _sstp_server:
###########
SSTP Server
###########
:abbr:`SSTP (Secure Socket Tunneling Protocol)` is a form of :abbr:`VPN
(Virtual Private Network)` tunnel that provides a mechanism to transport PPP
traffic through an SSL/TLS channel. SSL/TLS provides transport-level security
with key negotiation, encryption and traffic integrity checking. The use of
SSL/TLS over TCP port 443 allows SSTP to pass through virtually all firewalls
and proxy servers except for authenticated web proxies.
SSTP is available for Linux, BSD, and Windows.
VyOS utilizes accel-ppp_ to provide SSTP server functionality. We support both
local and RADIUS authentication.
As SSTP provides PPP via a SSL/TLS channel the use of either publically signed
certificates as well as a private PKI is required.
.. note:: All certificates should be stored on VyOS under
``/config/user-data/sstp``. If certificates are not stored unt ``/config``
they will not be migrated during a software update.
Self Signed CA and Certificates
===============================
To generate the CA, the server private key and certificates the following
commands can be used.
.. code-block:: none
vyos@vyos:~$ mkdir -p /config/user-data/sstp
vyos@vyos:~$ openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/user-data/sstp/server.key -out /config/user-data/sstp/server.crt
Generating a 4096 bit RSA private key
.........................++
...............................................................++
writing new private key to 'server.key'
[...]
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
vyos@vyos:~$ openssl req -new -x509 -key /config/user-data/sstp/server.key -out /config/user-data/sstp/ca.crt
[...]
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
Configuration
=============
.. cfgcmd:: set vpn sstp authentication local-users username <user> password <pass>
Create `<user>` for local authentication on this system. The users password
will be set to `<pass>`.
.. cfgcmd:: set vpn sstp authentication local-users username <user> disable
Disable `<user>` account.
.. cfgcmd:: set vpn sstp authentication local-users username <user> static-ip <address>
Assign static IP address to `<user>` account.
.. cfgcmd:: set vpn sstp authentication local-users username <user> rate-limit download <bandwidth>
Download bandwidth limit in kbit/s for `<user>`.
.. cfgcmd:: set vpn sstp authentication local-users username <user> rate-limit upload <bandwidth>
Upload bandwidth limit in kbit/s for `<user>`.
.. cfgcmd:: set vpn sstp authentication protocols <pap | chap | mschap | mschap-v2>
Require the peer to authenticate itself using one of the following protocols:
pap, chap, mschap, mschap-v2.
.. cfgcmd:: set vpn sstp authentication mode <local | radius>
Set authentication backend. The configured authentication backend is used
for all queries.
* **radius**: All authentication queries are handled by a configured RADIUS
server.
* **local**: All authentication queries are handled locally.
.. cfgcmd:: set vpn sstp network-settings client-ip-settings gateway-address <gateway>
Specifies single `<gateway>` IP address to be used as local address of PPP
interfaces.
.. cfgcmd:: set vpn sstp network-settings client-ip-settings subnet <subnet>
Use `<subnet>` as the IP pool for all connecting clients.
.. cfgcmd:: set vpn sstp network-settings name-server <address>
Connected client should use `<address>` as their DNS server. Up to two IPv4
nameservers can be configured.
SSL Certificates
----------------
.. cfgcmd:: set vpn sstp ssl ca-cert-file <file>
Path to `<file>` pointing to the certificate authority certificate.
.. cfgcmd:: set vpn sstp ssl cert-file <file>
Path to `<file>` pointing to the servers certificate (public portion).
.. cfgcmd:: set vpn sstp ssl key-file <file>
Path to `<file>` pointing to the servers certificate (private portion).
PPP Settings
------------
.. cfgcmd:: set vpn sstp ppp-settings lcp-echo-failure <number>
Defines the maximum `<number>` of unanswered echo requests. Upon reaching the
value `<number>`, the session will be reset.
.. cfgcmd:: set vpn sstp ppp-settings lcp-echo-interval <interval>
If this option is specified and is greater than 0, then the PPP module will
send LCP pings of the echo request every `<interval>` seconds.
.. cfgcmd:: set vpn sstp ppp-settings lcp-echo-timeout
Specifies timeout in seconds to wait for any peer activity. If this option
specified it turns on adaptive lcp echo functionality and "lcp-echo-failure"
is not used.
.. cfgcmd:: set vpn sstp ppp-settings mppe <require | prefer | deny>
Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotioation
preference.
* **require** - ask client for mppe, if it rejects drop connection
* **prefer** - ask client for mppe, if it rejects don't fail
* **deny** - deny mppe
Default behavior - don't ask client for mppe, but allow it if client wants.
Please note that RADIUS may override this option by MS-MPPE-Encryption-Policy
attribute.
RADIUS
------
Server
^^^^^^
.. cfgcmd:: set vpn sstp authentication radius server <server> port <port>
Configure RADIUS `<server>` and its required port for authentication requests.
.. cfgcmd:: set vpn sstp authentication radius server <server> key <secret>
Configure RADIUS `<server>` and its required shared `<secret>` for
communicating with the RADIUS server.
.. cfgcmd:: set vpn sstp authentication radius server <server> fail-time <time>
Mark RADIUS server as offline for this given `<time>` in seconds.
.. cfgcmd:: set vpn sstp authentication radius server <server> disable
Temporary disable this RADIUS server.
Options
^^^^^^^
.. cfgcmd:: set vpn sstp authentication radius acct-timeout <timeout>
Timeout to wait reply for Interim-Update packets. (default 3 seconds)
.. cfgcmd:: set vpn sstp authentication radius dynamic-author server <address>
Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
.. cfgcmd:: set vpn sstp authentication radius dynamic-author port <port>
Port for Dynamic Authorization Extension server (DM/CoA)
.. cfgcmd:: set vpn sstp authentication radius dynamic-author key <secret>
Secret for Dynamic Authorization Extension server (DM/CoA)
.. cfgcmd:: set vpn sstp authentication radius max-try <number>
Maximum number of tries to send Access-Request/Accounting-Request queries
.. cfgcmd:: set vpn sstp authentication radius timeout <timeout>
Timeout to wait response from server (seconds)
.. cfgcmd:: set vpn sstp authentication radius nas-identifier <identifier>
Value to send to RADIUS server in NAS-Identifier attribute and to be matched
in DM/CoA requests.
.. cfgcmd:: set vpn sstp authentication radius nas-ip-address <address>
Value to send to RADIUS server in NAS-IP-Address attribute and to be matched
in DM/CoA requests. Also DM/CoA server will bind to that address.
.. cfgcmd:: set vpn sstp authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.
.. cfgcmd:: set vpn sstp authentication radius rate-limit attribute <attribute>
Specifies which RADIUS server attribute contains the rate limit information.
The default attribute is `Filter-Id`.
.. cfgcmd:: set vpn sstp authentication radius rate-limit enable
Enables bandwidth shaping via RADIUS.
.. cfgcmd:: set vpn sstp authentication radius rate-limit vendor
Specifies the vendor dictionary, dictionary needs to be in
/usr/share/accel-ppp/radius.
Example
=======
* Use local user `foo` with password `bar`
* Client IP addresses will be provided from pool `192.0.2.0/25`
Use <tab> to setup the ``set ssl...``, it automatically
looks for all files and directories in ``/config/user-data/sstp``.
.. code-block:: none
set vpn sstp authentication local-users username foo password 'bar'
set vpn sstp authentication mode 'local'
set vpn sstp network-settings client-ip-settings gateway-address '192.0.2.254'
set vpn sstp network-settings client-ip-settings subnet '192.0.2.0/25'
set vpn sstp network-settings name-server '10.0.0.1'
set vpn sstp network-settings name-server '10.0.0.2'
set vpn sstp ssl ca-cert-file 'ca.crt'
set vpn sstp ssl cert-file 'server.crt'
set vpn sstp ssl key-file 'server.key'
.. include:: ../common-references.rst
|
