m0n0wall's PPTP authentication method

I am working on an article about VPN and Remote Access right now but I thought I would post what I have so far and then I will combine this entry with the rest of the article when it is finished.

I have been setting up a VPN connection on a NET4090 router with m0n0wall v1.11 in order to allow users to access files on our server. Originally I was going to use a Windows 2008 server with Routing and Remote Access Services to facilitate the VPN, but there is an issue with the PPTP redirect and I eventually conceded to using the built in PPTP server. I set the encryption at 128-bit, but it was the authentication I was concerned about. The m0n0wall documentation makes no mention of the authentication protocol used. Neither does Google(at least not the first 4-5 pages of search results for several different search terms). So, in order to find out, I opened Wireshark and started capturing on my laptop's wireless interface. I then made the VPN connection. It seems that m0n0wall version 1.11 uses CHAP(Challenge Authentication Protocol), not PAP(Password Authentication Protocol). There are better authentication methods, but CHAP is far better than PAP. You can redirect authentication to a RADIUS server, but that's an overly complex solution for our network at this time.

A quick tip about Skype

If you have Skype running on your computer, you may have two very well-known ports open on your system. The default configuration on Skype is to have ports 80 and 443 open as alternate ports. This is extremely dangerous, especially if you are connected directly to the internet instead of behind a router or physical firewall. Port 80 is the port that is used by web servers for http traffic and port 443 is the port used for 443. Crackers know to port scan systems and look for ports such as these. Although they may eventually realize your system is not a web server, this may give you the opportunity to be targeted by criminals.

Don't forget about rootkits!

I have a multi-tiered combination of security software that I run on my own computer and suggest to others. These include Avira anti-virus, Spybot Search & Destroy, and Malwarebytes. These tend to block most malware that comes onto my system or remove it fairly easily. One of the most troublesome pieces of malware, however, is also the most difficult to detect: rootkits. Regular methods do not suffice. Although there are programs designed to deal with rootkit detection, in order for them to recognize their full potential, the system drive has to be scanned when the operating system on it has not been booted. A live CD or USB boot is the best way to achieve this. The Windows XP, Vista, and 7 installation disks all have a diagnostic mode that you can boot into, although it is a command-line mode. A useful freeware program which can be downloaded from CNET is Gmer. It has a graphical interface, however, so booting into the Windows Recovery Console will not work. You will have to boot from a second hard drive to use it. Also, the program is not available for Linux. Perhaps this post will get you thinking about your system security, because just because you have anti-virus and anti-spyware software, that does not mean your system is safe. There could be other problems that are going undetected.