pppd "peer refused to authenticate"

Question

I have a working pptpd+pppd server configured which currently has two Windows 7 clients successfully connecting. However, when I try to connect a linux client I'm getting a really weird exchange that ends with "peer refused to authenticate" on both the server and client end.

This is the log from the server:

pppd[8205]: using channel 51
pppd[8205]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfRej id=0x1 <auth chap MS-v2>]
pppd[8205]: sent [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[8205]: sent [LCP ConfNak id=0x1 <auth pap>]
pppd[8205]: rcvd [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[8205]: sent [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[8205]: sent [LCP EchoReq id=0x0 magic=0x20b0750f]
pppd[8205]: sent [LCP TermReq id=0x3 "peer refused to authenticate"]
pppd[8205]: rcvd [LCP EchoReq id=0x0 magic=0x23d6bed3]
pppd[8205]: rcvd [LCP TermReq id=0x3 "peer refused to authenticate"]
pppd[8205]: sent [LCP TermAck id=0x3]
pppd[8205]: rcvd [LCP TermAck id=0x3]
pptpd[8204]: CTRL: Reaping child PPP[8205]

And this is the log from the client:

pppd[12077]: pppd options in effect:
pppd[12077]: debug               # (from command line)
pppd[12077]: holdoff 10          # (from /etc/ppp/peers/home1)
pppd[12077]: persist             # (from /etc/ppp/peers/home1)
pppd[12077]: dump                # (from command line)
pppd[12077]: require-mschap-v2           # (from /etc/ppp/peers/home1)
pppd[12077]: refuse-pap          # (from /etc/ppp/peers/home1)
pppd[12077]: refuse-mschap               # (from /etc/ppp/peers/home1)
pppd[12077]: name <redacted>          # (from /etc/ppp/peers/home1)
pppd[12077]: remotename <redacted>             # (from /etc/ppp/peers/home1)
pppd[12077]:             # (from /etc/ppp/options)
pppd[12077]: pty pptp <redacted> --nolaunchpppd                # (from /etc/ppp/peers/home1)
pppd[12077]: crtscts             # (from /etc/ppp/options)
pppd[12077]:             # (from /etc/ppp/options)
pppd[12077]: asyncmap 0          # (from /etc/ppp/options)
pppd[12077]: lcp-echo-failure 4          # (from /etc/ppp/options)
pppd[12077]: lcp-echo-interval 30                # (from /etc/ppp/options)
pppd[12077]: hide-password               # (from /etc/ppp/options)
pppd[12077]: proxyarp            # (from /etc/ppp/options)
pppd[12077]: nobsdcomp           # (from /etc/ppp/peers/home1)
pppd[12077]: nodeflate           # (from /etc/ppp/peers/home1)
pppd[12077]: nomppe              # (from /etc/ppp/peers/home1)
pppd[12077]: noipx               # (from /etc/ppp/options)
pppd[12078]: pppd 2.4.5 started by <redacted>, uid 0
pppd[12078]: using channel 12
pppd[12078]: Using interface ppp0
pppd[12078]: Connect: ppp0 <--> /dev/pts/14
pptp[12079]: anon log[main:pptp.c:314]: The synchronous pptp option is NOT activated
pptp[12086]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 1 'Start-Control-Connection-Request'
pptp[12086]: anon log[ctrlp_disp:pptp_ctrl.c:739]: Received Start Control Connection Reply
pptp[12086]: anon log[ctrlp_disp:pptp_ctrl.c:773]: Client connection established.
pppd[12078]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x23d6bed3> <pcomp> <accomp>]
pptp[12086]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 7 'Outgoing-Call-Request'
pptp[12086]: anon log[ctrlp_disp:pptp_ctrl.c:858]: Received Outgoing Call Reply.
pptp[12086]: anon log[ctrlp_disp:pptp_ctrl.c:897]: Outgoing call established (call ID 0, peer's call ID 1920).
pppd[12078]: rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[12078]: No auth is possible
pppd[12078]: sent [LCP ConfRej id=0x1 <auth chap MS-v2>]
pppd[12078]: rcvd [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[12078]: sent [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[12078]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[12078]: rcvd [LCP ConfNak id=0x1 <auth pap>]
pppd[12078]: sent [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[12078]: rcvd [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[12078]: sent [LCP EchoReq id=0x0 magic=0x23d6bed3]
pppd[12078]: peer refused to authenticate: terminating link
pppd[12078]: sent [LCP TermReq id=0x3 "peer refused to authenticate"]
pppd[12078]: rcvd [LCP EchoReq id=0x0 magic=0x20b0750f]
pppd[12078]: rcvd [LCP TermReq id=0x3 "peer refused to authenticate"]
pppd[12078]: sent [LCP TermAck id=0x3]
pppd[12078]: rcvd [LCP TermAck id=0x3]
pppd[12078]: Connection terminated.

I'm really puzzled by these lines (from the server log):

pppd[8205]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfRej id=0x1 <auth chap MS-v2>]
pppd[8205]: sent [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[8205]: sent [LCP ConfNak id=0x1 <auth pap>]
pppd[8205]: rcvd [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x23d6bed3> <pcomp> <accomp>]

If I'm reading right, server requests mschap-v2 auth, then the client rejects that (why?); after that the client requests mschap-v2 auth, then the server rejects pap (wtf?) leading to both peers settling on no auth and the connection failing.

Can someone shed some light on what's happening here?

Re 'wtf': [ConfRej](https://tools.ietf.org/html/rfc1661#section-5.4) states items that are unacceptable, but [ConfNak](https://tools.ietf.org/html/rfc1661#section-5.3) states those that *would be* acceptable. — dave_thompson_085, Feb 13 '16 at 18:21

score 3 · Answer 1 · answered Jan 09 '13 at 17:11

3

Figured it out.

The problem was giving the "auth" and "require-mschap-v2" options to pppd on the client end. Evidently only the server end must be configured to request authentication with the client configured to not request any kind of auth. What was happening was that the client asked the server to authenticate itself, which failed.

answered Jan 09 '13 at 17:11

Moshev

161
1
1
5

3

you explain the reason, how do you resolve this problem? – moioi May 12 '14 at 07:13

score 0 · Answer 2 · answered Feb 13 '16 at 15:10

I hope my experience would help others arriving here.
The most commom origin of the problem I have found when I get this kind of communication attemps:

pppd[8205]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfRej id=0x1 <auth chap MS-v2>]
pppd[8205]: sent [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0x20b0750f> <pcomp> <accomp>]
pppd[8205]: rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x23d6bed3> <pcomp> <accomp>]
pppd[8205]: sent [LCP ConfNak id=0x1 <auth pap>]
pppd[8205]: rcvd [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0x23d6bed3> <pcomp> <accomp>]

... is GRE packets not correctly arriving to destination.
Note the sent and rcvd lines in the log: there is some sort of communication, but not enough.

Many routers don't allow GRE packets (mandatory on PPTP) to travel across them, but most of them have some option to enable/disable it.

In my case (NetGear Genie CG3100D cable modem), you can solve it checking:

Advanced --> Advanced Configuration --> Services -> PPTP PassThrough

pppd "peer refused to authenticate"

2 Answers2