Re: PPTP vs. SSL

>     jordi laforge wrote:
>      > I'm trying to provide a roadwarrior situation. Here is what I'm
>     looking at:
>      > Small 8-12 user lan.
>      > 4-5 of these users have home pc's(Windows) that they'd like to use to
>      > connect to the
>      > office and user the file server\ email\ databases.
>      > The windows file server has PPTP capabilities.
>      >
>      > I could either use the Windows PPTP or setup another server running
>      > Linux with openvpn. Or something else I haven't thought of....but
>     you
>      > guys suggest.
>      > Whaddya think?

>     Okay, it sounds like you're not all that familiar with VPNs in general,
>     based on your comments here and in later messages.  I *strongly* suggest
>     doing some quick reading on that topic first before getting into
>     specifics.  The 'howstuffworks' entry on VPNs is not half-bad and the
>     wikipedia page is excellent.

>     Here's the very very short summary: A VPN would allow your 'road
>     warriors' to connect to the home office while they are at home or on
>     the
>     road.  The user's remote laptop or desktop would get a special IP that
>     is specific to the VPN through which all traffic to work is 'tunneled'
>     in an encrypted manner.  Done properly, the remote worker would be able
>     to access ALL of the services that she could normally access while in
>     the office... but in a safe and secure manner over the public Internet.

>     Now PPTP has the advantage here of being very easy to setup and if you
>     have one of the Windows Servers, then you have half of it already nearly
>     setup.  You would need to get clients for any Linux users, but that's
>     not a problem as I'm fairly certain that there is now "native" support
>     in the kernel.

>     HOWEVER, PPTP is considered to be fundamentally broken by some respected
>     cryptographers.  A quote from Bruce Schneier: "Microsoft PPTP is very
>     broken, and there's no real way to fix it without taking the whole
>     thing
>     down and starting over."

>     http://www.schneier.com/pptp-faq.html

>     OpenVPN is a free solution that has so far been proven to be rock-solid.
>     It is, however, not as easy to setup as PPTP.  In fact, if you want to
>     do anything more than a peer-to-peer setup, you will likely have to do a
>     considerable bit of reading and some configuration file editing.

>     Mind you, while the reading is verbose, it's not hard to understand and
>     it shouldn't take more than a few hours to get everything setup.  I'm
>     told, too, that some of the GUIs available make it a lot easier (haven't
>     used any of them) and some of the specialized distros like Smoothwall
>     and IPCop should make it even easier yet.

>     Now this is a Linux group so we'll tend to lean towards using Linux
>     based solution for the "server" side.  I'm honor bound to tell you,
>     though, that you don't have to.  OpenVPN is fundamentally a
>     peer-to-peer
>     VPN (with some variances) and works just dandy on Windows.  So you
>     *could* run it as a service on your Windows Server and it would likely
>     chug away just fine.  There is even a handy GUI for it.

>     I recommend starting with some reading:

>     http://openvpn.net/howto.html
>     http://openvpn.net/INSTALL-win32.html
>     http://openvpn.se/ <http://openvpn.se/>
>     ---------------------------------------------------
>     PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>     <mailto:PLUG-discuss@lists.plug.phoenix.az.us>
>     To subscribe, unsubscribe, or to change  you mail settings:
>     http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss