If the server to which you are connecting requires PAP or CHAP authentication, you have a little bit more work.
To the above options file, add the following lines
# # force pppd to use your ISP user name as your 'host name' during the # authentication process name <your ISP user name> # you need to edit this line # # If you are running a PPP *server* and need to force PAP or CHAP # uncomment the appropriate one of the following lines. Do NOT use # these is you are a client connecting to a PPP server (even if it uses PAP # or CHAP) as this tells the SERVER to authenticate itself to your # machine (which almost certainly can't do - and the link will fail). #+chap #+pap # # If you are using ENCRYPTED secrets in the /etc/ppp/pap-secrets # file, then uncomment the following line. # Note: this is NOT the same as using MS encrypted passwords as can be # set up in MS RAS on Windows NT. #+papcrypt
Microsoft Windows NT RAS can be set up to use a variation on CHAP (Challenge/Handshake Authentication Protocol). In your PPP sources tar ball, you will find a file called README.MSCHAP80 that discusses this.
You can determine if the server is requesting authentication using this protocol by enabling debugging for pppd. If the server is requesting MS CHAP authentication, you will see lines like
rcvd [LCP ConfReq id=0x2 <asyncmap 0x0> <auth chap 80> <magic 0x46a3>]
The critical information here is auth chap 80.
In order to use MS CHAP, you will need to recompile pppd to support this. Please see the instructions in the README.MSCHAP80 file in the PPP source file for instructions on how to compile and use this variation.
You should note that at present this code supports only Linux PPP clients connecting to an MS Windows NT server. It does NOT support setting up a Linux PPP server to use MSCHAP80 authentication from clients.
If you are using pap or chap authentication, then you also need to create the secrets file. These are:
/etc/ppp/pap-secrets /etc/ppp/chap-secrets
They must be owned by user root, group root and have file permissions 740 for security.
The first point to note about PAP and CHAP is that they are designed to authenticate computer systems not users.
"Huh? What's the difference?" I hear you ask.
Well now, once your computer has made its PPP connection to the server, ANY user on your system can use that connection - not just you. This is why you can set up a WAN (wide area network) link that joins two LANs (local area networks) using PPP.
PAP can (and for CHAP DOES) require bidirectional authentication - that is a valid name and secret is required on each computer for the other computer involved. However, this is NOT the way most PPP servers offering dial up PPP PAP-authenticated connections operate.
That being said, your ISP will probably have given you a user name and password to allow you to connect to their system and thence the Internet. Your ISP is not interested in your computer's name at all, so you will probably need to use the user name at your ISP as the name for your computer.
This is done using the name user name option to pppd. So, if you are
to use the user name given you by your ISP, add the line
name your_user name_at_your_ISP
to your /etc/ppp/options file.
Technically, you should really use user our_user name_at_your_ISP
for PAP, but pppd is sufficiently intelligent to interpret name as
user if it is required to use PAP. The advantage of using the name
option is that this is also valid for CHAP.
As PAP is for authenticating computers, technically you need also to specify a remote computer name. However, as most people only have one ISP, you can use a wild card (*) for the remote host name in the secrets file.
It is also worth noting that many ISPs operate multiple modem banks connected to different terminal servers - each with a different name, but ACCESSED from a single (rotary) dial in number. It can therefore be quite difficult in some circumstances to know ahead of time what the name of the remote computer is, as this depends on which terminal server you connect to!
The /etc/ppp/pap-secrets file looks like
# Secrets for authentication using PAP # client server secret acceptable_local_IP_addresses
The four fields are white space delimited and the last one can be blank (which is what you want for a dynamic and probably static IP allocation from your ISP).
Suppose your ISP gave you a user name of fred and a password of
flintstone you would set the name fred option in
/etc/ppp/options[.ttySx] and set up your
/etc/ppp/pap-secrets file as follows
# Secrets for authentication using PAP # client server secret acceptable local IP addresses fred * flintstone
This says for the local machine name fred (which we have told pppd
to use even though it is not our local machine name) and for ANY
server, use the password (secret) of flintstone.
Note that we do not need to specify a local IP address, unless we are required to FORCE a particular local, static IP address. Even if you try this, it is unlikely to work as most PPP servers (for security reasons) do not allow the remote system to set the IP number they are to be given.
This requires that you have mutual authentication methods - that is you must allow for both your machine to authenticate the remote server AND the remote server to authenticate your machine.
So, if your machine is fred and the remote is barney, your
machine would set name fred remotename barney and the remote
machine would set name barney remotename fred in their respective
/etc/ppp/options.ttySx files.
The /etc/chap-secrets file for fred would look like
# Secrets for authentication using CHAP # client server secret acceptable local IP addresses fred barney flintstone barney fred wilma
and for barney
# Secrets for authentication using CHAP # client server secret acceptable local IP addresses barney fred flintstone fred barney wilma
Note in particular that both machines must have entries for bidirectional authentication. This allows the local machine to authenticate itself to the remote AND the remote machine to authenticate itself to the local machine.
Some users have more than one server to which they connect that use PAP. Provided that your user name is different on each machine to which you want to connect, this is not a problem.
However, many users have the same user name on two (or more - even all)
systems to which they connect. This then presents a problem in correctly
selecting the appropriate line from /etc/ppp/pap-secrets.
As you might expect, PPP provides a mechanism for overcoming this. PPP allows you to set an 'assumed name' for the remote (server) end of the connection using the remotename option to pppd.
Let us suppose that you connect to two PPP servers using the username
fred. You set up your /etc/ppp/pap-secrets something like
fred pppserver1 barney fred pppserver2 wilma
Now, to set connect to pppserver1 you would use name fred remotename
pppserver1 in your ppp-options and for pppserver2 name fred
remotename pppserver2.
As you can select the ppp options file to use with pppd using the
file filename option, you can set up a script to connect to each of
your PPP servers, correctly picking the options file to use and hence
selecting the right remotename option.