Here is an example of an entry in /etc/network/interfaces:
iface work inet ppp
options pty "sstpc vpn.example.com --ca-cert /path/to/example.com.ca.crt --nolaunchpppd" \
plugin sstp-pppd-plugin.so sstp-sock /var/run/sstpc/sstpc-uds-sock \
lock nodefaultroute noipdefault noauth user myusername \
refuse-pap refuse-chap refuse-eap nobsdcomp nodeflate novj \
persist maxfail 0 \
debug logfd 2
pre-up touch /etc/ppp/peers/work
Then you just use
ifup work and
ifdown work to connect or disconnect.
You'll need to compile the sstp-client and install it. This can be used by following the instructions on http://sstp-client.sourceforge.net/ or building a deb package using these instructions:
apt-get install build-essential dpkg-dev debhelper ppp-dev libevent-dev libssl-dev
mkdir sstp-client.build && cd sstp-client.build
wget -o sstp-client-1.0.10.tar.gz http://sourceforge.net/projects/sstp-client/files/sstp-client/1.0.10/sstp-client-1.0.10.tar.gz/download
tar xzvf sstp-client-1.0.10
dpkg-buildpackage -b -us -uc
dpkg -i sstp-client_1.0.10-0ubuntu2_amd64.deb \
cd /usr/lib/pppd/2.4.5 && ln -s ../2.4.6/sstp-pppd-plugin.so .
The pppd lib dir is hard-coded to use 2.4.6, and not the installed version, which is why the symlink is required. This is a bug in the debian build description for sstp-client.
Typical connection timeout issue
If you use the pppd
pty option (which the example uses) it is vital that the parameters
plugin sstp-pppd-plugin.so sstp-sock /var/run/sstpc/sstpc-uds-sock are specified. If you don't specify these, you'll end up getting the famous Connection aborted, reason not known error after approximately 60 seconds, and the connection will not transmit packets.
CA certificate requirement
You also must have the CA certificate for the Active Directory domain the Microsoft SSTP VPN server is part of in the local file
/path/to/example.com.ca.crt. This can usually be found in the
CertEnroll SMB share on one of the Domain Controllers. Export it as a Base64-encoded X509 certificate and rename as appropriate. Use
certtool -i <example.com.ca.crt to verify you have the correct certificate with the correct information.