Testing the Connection Creating a VPN with PPP and SSH

140 Similarly, the route command should show you all of the routes that have been added to whatever system you run it on.

8.5 Troubleshooting Problems

Now let us assume that everything didnt go as smoothly as planned. There are several points of failure along the way, but fortunately there are some good ways to pinpoint the problem.

8.5.1 Errors from the VPN Script

The following are errors that might occur when you execute the VPN script. All of these errors should appear directly on the screen. When looking at these errors, its important to remember the essentials of what the VPN script does: it redirects a pseudo-terminal, launches the PPP daemon on the slave using SSH, launches the PPP daemon on the master, and sets up routing on both the master and slave. FAILED If you see this message, pty-redir failed to get a valid pseudo-terminal. You should check the contents of the tmpdevice file and see if its empty. If it exists but is empty, and you actually saw pty-redir spit out a device name when you ran it by hand earlier, STDERR output may not be redirected to that file. You will have to add a 2 as we showed under Section 8.4.2.7 . SIOCADDR: Network is unreachable This is a message from one of the route commands. It can mean there is a mistake either in one of the IP addresses or networks in the VPN script settings, or in the slaves route script. Or it could mean that a PPP connection was never successfully started, in which case youll need to check the logs see Section 8.5.2 . SIOCADDRT: Operation not permitted This is also a message from one of the route commands. It means that youre not allowed to execute the route command in order to add a route, and is probably taking place on the slave. You should double-check your sudoers file on the slave to make sure that your master account has permission to execute the route command as root.

8.5.2 Connection Problems

If you get the Network is unreachable error from the VPN script, you might want to look at a process list on the slave using the ps command to see if the PPP daemon is running. If it isnt, either the SSH connection wasnt completely successful, or the PPP daemon failed to start up. The best place to look for problems with both of these is in varadmmessages on the slave. A normal ssh and pppd startup on the slave should look like this in the logs: Jun 6 04:01:40 slave-lan sshd[18745]: log: Connection from 1.0.0.1 port 1 Jun 6 04:01:41 slave-lan sshd[18745]: log: RSA authentication for vpn1 accepted Jun 6 04:01:41 slave-lan sshd[18747]: log: executing remote command as user vpn1 141 Jun 6 04:01:41 slave-lan sudo: vpn1 : TTY=ttyp1 ; PWD=homevpn1 ; USER=root Jun 6 04:01:41 slave-lan pppd[18747]: pppd 2.2.0 started by vpn1, uid 0 Jun 6 04:01:41 slave-lan pppd[18747]: Using interface ppp0 Jun 6 04:01:41 slave-lan pppd[18747]: Connect: ppp0 -- devttyp1 Jun 6 04:01:53 slave-lan pppd[18747]: local IP address 192.168.1.2 Jun 6 04:01:53 slave-lan pppd[18747]: remote IP address 192.168.1.1 As you can see, the SSH daemon output says that authentication is accepted, and sudo successfully launches the PPP daemon as root for vpn1. The PPP daemon is started up on the slave, then its started up on the master communicating with ttyp1, which is the SSH connection, which also assigns IP addresses.

8.5.2.1 Debugging an SSH connection

A failed SSH connection will give you the following error in the messages log: fatal: Connection closed by remote host . If this log indicates problems with the SSH connection, try connecting to the master from the slave using ssh -l vpn1 -v . That will give you verbose output of whats going on when you attempt to connect. Here are some common errors: Server refused our key This means that the public key of the account on the master attempting to make the connection e.g., root doesnt exist in the authorized_keys file of the account on the slave e.g., vpn1. The solution is to copy the public key from roots identity.pub file into vpn1s authorized_keys file. Server refused our rhosts authentication or host key This means that the server isnt in the .rhosts file or found in a known_hosts file. Add the server to either one, or both. As we said earlier in Section 8.2 , some implementations of shadow passwords may not work with SSH. Although its compatible with most of the major methods, including those used by Solaris, Ultrix, SCO, Irix, and Linux, there may be some that it doesnt recognize or know how to handle. You may not notice any problems at compile time, and will only see them when you attempt to make a connection using password authentication and are denied login. At this point your two options are to attempt to add the appropriate code yourself found in the configure.in and auth-passwd.c files, or to send a query to the SSH mailing list or the programs author. See the upcoming Section 8.5.3 for more on this.

8.5.2.2 Debugging a PPP connection

If it looks like SSH has started successfully, but PPP never starts, there are two things you need to check: sudo and pppd. The first thing to do is see if sudo executed successfully in the messages file. If you need more information, check for failures in syslog, which will typically look like this: