Subject: Re: Bob's questions on PPP
To: Bill Studenmund <wrstuden@loki.stanford.edu>
From: John P. Wittkoski <jpw@netscape.com>
List: port-mac68k
Date: 09/03/1996 14:23:29
> Anyway, the wrong answer (my answer) to how to get ppp working: delete all
> the fancy replace strings and code your username and password directly
> into ppp-chat. I think I also had to make sure the chat script did the
> proper ping-ponging, i.e. "<expect stuff>" "<sent stuff>"... Or is
> that "<sent stuff>" first? Check the man page. I think things were out of
> sync somewhere in ppp-chat.

I feel I should jump in here and comment on something.

Different service providers have different ways of "logging you in"
when you connect using PPP. They both need chat scripts to dial
the remote system. However, their way of "authenticating" you is 
different. The two common ways are:

1. The chat script, after dialing and connecting, waits for a 
   "login:" prompt, sends your name, waits for the "Password:" 
   prompt, then sends the password. This logs you into the remote 
   system, where the chat script runs pppd and exits (passing 
   control to the local pppd), OR (and this is more common) your 
   shell on the remote machine is actually pppd, so the chat 
   script ends and the two pppd's are connected and start 
   negotiating IP numbers and other fun stuff.
   THIS IS THE METHOD THAT THE ppp.setup.tar.gz SCRIPTS ARE 
   SET UP TO USE.

2. Your service provider uses PAP or CHAP to authenticate you.
   (PAP and CHAP authentication are built into the pppd program.)
   In this case, the chat script ends when the modems connect. 
   Instead of waiting for a login prompt, as above, control 
   immediately returns to the local pppd, which attempts to
   authenticate with the remote pppd. After authenticating,
   the pppd's get around to negotiating IPs and things.

With a few minor changes, the scripts that come with the
ppp.setup.tar.gz distribution will work with service providers
that user method #2. Right now I don't have changes to the 
actual scripts with me, but the main things that need to
be changed are:

1. Remove the portions of the chat script that waits for the
   the login and the password (and the part that runs pppd
   if you service provider has you run it explicidly)
2. In the /etc/ppp directory, create a pap-secrets or
   chap-secrets file. (Most service providers use PAP, 
   because CHAP requires each side of the ppp link to 
   authenticate to each other, whereas PAP authentication
   is one way only.)
3. If your dial in name is NOT the same as your machine's
   hostname, you must add the "name <username>" option to
   the /etc/ppp/options file or as an option to the pppd
   command line, where <username> is the name you use to 
   authenticate with (i.e. log into) the remote system.

For example, my pap-secrets file looks like this:

#
# pap-secrets file for daedalus
#
#user		server		password
jpw		*		SecRet

The "*" in the server line means accept ANY remote server.
This is important because most service providers have
multiple dial in servers. The password needs to be in
plain view, although I think that there is some way to
encrypt it if you want to slog through the pppd man 
pages and figure it out. Otherwise, just make sure the
file is readable only by root.

If there is heavy interest in this, as I suspect there is,
I could be persuaded to modify the existing ppp.setup.tar.gz
distribution to include these changes.

	--John