1

I am using pptpd on Debian 6. I know that last shows the list of connections as well as the source IP.

I am looking for the log of unsuccessful authentication, or any form of alert/ban for a source IP failing to authenticate.

Is there anything that works with pptpd? or wtmp? Or should I look at external authentication mechanism (radius?) to get the logs I need.

Thanks for your help

peyman
  • 13
  • 1
  • 1
  • 3

1 Answers1

1

if you enable logwtmp option on your pptpd.conf, you should see on /var/log/messages

pptpd.conf

# TAG: logwtmp
#       Use wtmp(5) to record client connections and disconnections.
#
logwtmp

/var/log/messages

Mar 13 19:45:23 pineapple pppd[25571]: No CHAP secret found for authenticating USERNAME
Mar 13 19:45:23 pineapple pppd[25571]: Peer riqa failed CHAP authentication
Mar 13 19:45:24 pineapple pptpd[25570]: CTRL: EOF or bad error reading ctrl packet length.
Mar 13 19:45:24 pineapple pptpd[25570]: CTRL: couldn't read packet header (exit)
Mar 13 19:45:24 pineapple pptpd[25570]: CTRL: CTRL read failed
Mar 13 19:45:24 pineapple pppd[25571]: Modem hangup
Mar 13 19:45:24 pineapple pppd[25571]: Connection terminated.
Mar 13 19:45:24 pineapple pppd[25571]: Exit.
Mar 13 19:45:24 pineapple pptpd[25570]: CTRL: Client w.x.y.z control connection finished
chocripple
  • 2,109
  • 14
  • 9