VPN server setup and vpnaddkeyagentuser

Question

Level 1

18 points

VPN server setup and vpnaddkeyagentuser

So I've tried a number of installs (and reinstalls) of Leopard Server and everytime I've failed to get the VPN working. So far as I've been able to determine, this is because I'm missing the vpn_xxxx user in the OD. For whatever reason it never gets created. So, looking at the documented solutions for Tiger, I tried using the vpnaddkeyagentuser /LDAPv3/127.0.0.1 command (run as root) but this seems to fail silently - it creates keys in the Keyring (com.apple.ras) but still doesnt create the vpn_xxx user. Looking at the logs I see the following line:

+Nov 9 14:30:11 webber sudo[22161]: admin : TTY=ttys000 ; PWD=/Users/tim ; USER=root ; COMMAND=/usr/sbin/vpnaddkeyagentuser /LDAPv3/127.0.0.1+
+Nov 9 14:30:16 webber vpnaddkeyagentuser[22161]: admin user '†$t†å^G' is not a password server user. Cannot access password server.+

I can't help but feel that the admin user '.....' isnt something I want to see.

This is running on a Core Solo Intel box (so 32-bit). I dont have access to a 64-bit Intel box or an older PowerPC box to see if it behaves the same.

Any thought on either why I see this behavior or just on fixing the VPN user in general, greatly appreciated.

Macbook Pro, Mac OS X (10.5)

Posted on Nov 9, 2007 2:35 PM

Reply

Answer 1

aanon4 Author

Level 1

18 points

Nov 15, 2007 4:58 PM in response to aanon4

Well, had hoped that 10.5.1 would have fixed this problem, but no - still can't create the vpn_xxx user.

Reply

Answer 2

aanon4 Author

Level 1

18 points

Nov 19, 2007 10:53 PM in response to aanon4

So, if anyone needs to fix this problem by hand (which I have now done), here's how to do it:

1. vpnaddkeyagentuser /LDAPv3/127.0.0.1 - this creates an entry in the system keychain called com.apple.ras - from this you can find the vpn_xxx username and password
2. Create an OpenDirectory user using the Workgroup Manager using the vpn_xxx name and password
3. Use the mkpassdb -dump command to get a list of the users credentials. Find the entry corresponding to the vpn_xxx user.
4. Run mkpassdb -setkeyagent 0x..... where the 0x... bit is the big hex number to the immediate left of the username from the previous dump command (mine mostly start 0x47...)

After this I can use MPPE with PPTP. I guess the addvpnkeyagentuser command is a bit broken since I assume this is what its suppose to do (but on my box, doesn't).

Reply

Answer 3

Nov 20, 2007 1:04 PM in response to aanon4

Thanks a lot for your effort! It finally works with my server too...
Though not being able to delete a vpn_* user I had created earlier, I had to give it an additional alias, instead of creating a new one.

Reply

Answer 4

aanon4 Author

Level 1

18 points

Nov 21, 2007 5:40 PM in response to bhelfmann

If it helps, to delete old VPN users you need to find the user using the 'dscl' tool and then delete the key called 'AuthenticationAuthority'. Once you've done that you can then delete the vpn_xxx user.

Reply