Subject: Re: Bob's questions on PPP
To: Bill Studenmund <wrstuden@loki.stanford.edu>
From: John P. Wittkoski <jpw@netscape.com>
List: port-mac68k
Date: 09/03/1996 14:23:29
> Anyway, the wrong answer (my answer) to how to get ppp working: delete all
> the fancy replace strings and code your username and password directly
> into ppp-chat. I think I also had to make sure the chat script did the
> proper ping-ponging, i.e. "<expect stuff>" "<sent stuff>"... Or is
> that "<sent stuff>" first? Check the man page. I think things were out of
> sync somewhere in ppp-chat.
I feel I should jump in here and comment on something.
Different service providers have different ways of "logging you in"
when you connect using PPP. They both need chat scripts to dial
the remote system. However, their way of "authenticating" you is
different. The two common ways are:
1. The chat script, after dialing and connecting, waits for a
"login:" prompt, sends your name, waits for the "Password:"
prompt, then sends the password. This logs you into the remote
system, where the chat script runs pppd and exits (passing
control to the local pppd), OR (and this is more common) your
shell on the remote machine is actually pppd, so the chat
script ends and the two pppd's are connected and start
negotiating IP numbers and other fun stuff.
THIS IS THE METHOD THAT THE ppp.setup.tar.gz SCRIPTS ARE
SET UP TO USE.
2. Your service provider uses PAP or CHAP to authenticate you.
(PAP and CHAP authentication are built into the pppd program.)
In this case, the chat script ends when the modems connect.
Instead of waiting for a login prompt, as above, control
immediately returns to the local pppd, which attempts to
authenticate with the remote pppd. After authenticating,
the pppd's get around to negotiating IPs and things.
With a few minor changes, the scripts that come with the
ppp.setup.tar.gz distribution will work with service providers
that user method #2. Right now I don't have changes to the
actual scripts with me, but the main things that need to
be changed are:
1. Remove the portions of the chat script that waits for the
the login and the password (and the part that runs pppd
if you service provider has you run it explicidly)
2. In the /etc/ppp directory, create a pap-secrets or
chap-secrets file. (Most service providers use PAP,
because CHAP requires each side of the ppp link to
authenticate to each other, whereas PAP authentication
is one way only.)
3. If your dial in name is NOT the same as your machine's
hostname, you must add the "name <username>" option to
the /etc/ppp/options file or as an option to the pppd
command line, where <username> is the name you use to
authenticate with (i.e. log into) the remote system.
For example, my pap-secrets file looks like this:
#
# pap-secrets file for daedalus
#
#user server password
jpw * SecRet
The "*" in the server line means accept ANY remote server.
This is important because most service providers have
multiple dial in servers. The password needs to be in
plain view, although I think that there is some way to
encrypt it if you want to slog through the pppd man
pages and figure it out. Otherwise, just make sure the
file is readable only by root.
If there is heavy interest in this, as I suspect there is,
I could be persuaded to modify the existing ppp.setup.tar.gz
distribution to include these changes.
--John