[Appendix A] A.2 The PPP Daemon
Author: Craig Hunt
Date: 1999-02-04T01:42:33Z

#

| Appendix A PPP Tools |

## A.2 The PPP Daemon

The PPP Daemon (pppd) is a freely available implementation of the Point-to-Point Protocol (PPP) that runs on many UNIX systems. Examples of configuring and using pppd are covered in Chapter 6. The syntax of the pppd command is:

  pppd [`device`] [`speed`] [`options`]

`device` is the name of the serial port over which the PPP protocol operates and `speed` is the transmission speed of that port in bits per second. The complexity of this command comes not from these simple parameters but from the large number of `options` that it supports. There are so many options, in fact, that they are often stored in a file. There are three options files that can be used with pppd: the /etc/ppp/options file, which is used to set system-wide pppd options; the ~/.ppprc file, which is used by an individual to set personal pppd options, and the /etc/ppp/options.device file, which sets options for a serial device, e.g., /etc/ppp/options.cua0 sets options for cua0. The order of precedence for options is that those specified in the /etc/ppp/options.device file are the highest priority, followed by those defined on the command line, then those in the ~/.ppprc file, and, finally, those defined in the /etc/ppp/options file. Some options that relate to system security, once defined in the /etc/ppp/options file, cannot be overridden by the user through the command line or the ~/.ppprc file. The system administrator can override any option set by the user by setting the option in the /etc/ppp/options.device file.

The following list contains all of the pppd options except those that do not relate to TCP/IP:

`local_IP_address`:`remote_IP_address`

  Defines static local and remote IP addresses. Either address may be omitted. For example: 172.16.25.3: defines only the local address, while :172.16.25.12 defines only the remote address. The default local address is the IP address associated with the local system's hostname.

-ac

  Disables Address/Control compression negotiation.

-all

  Disables all LCP and IPCP negotiations.

-am

  Disables asyncmap negotiation. Sends all control characters as two-character escape sequences.

asyncmap `map`

  Defines the ASCII control characters that must be sent as two-character escape sequences. The first 32 ASCII characters are control characters. `map` is a 32-bit hex number with each bit representing a control character. Bit 0 (00000001) represents the character 0x00; bit 31 (80000000) represents the character 0x1f. If a bit is on in `map`, the character represented by that bit must be sent as an escape sequence. If no asyncmap option is specified, all control characters are sent as escape sequences. The asyncmap option can also be written in the form -as `map`.

auth

  Requires the use of an authentication protocol. See Chapter 6 for a discussion of the authentication protocols CHAP and PAP.

bsdcomp `receive`,`transmit`

  Enables the BSD-Compress scheme to compress packets. The maximum length code word used to compress packets accepted by this host is `receive` bits long. The maximum code word length used to compress packets sent by this host is `transmit` bits long. Acceptable code word length is 9 to 15 bits. Disable compression when receiving or transmitting by placing a 0 in `receive` or `transmit`, respectively.

-bsdcomp

  Disables BSD-Compress compression.

+chap

  Requires the use of the Challenge Handshake Authentication Protocol (CHAP).

-chap

  Disables the use of CHAP. This is a bad idea.

chap-interval

  Tells system to use CHAP to reauthenticate the remote system every `n` seconds.

chap-max-challenge `n`

  Tells system to send the CHAP challenge to the remote system a maximum of `n` times until the remote system responds. The default is 10.

chap-restart `n`

  Tells system to wait `n` seconds before retransmitting a CHAP challenges when the remote system fails to respond. The default is 3 seconds.

connect `script`

  Invokes a `script` to create the serial connection. Any scripting language can be used, but chat is the most common. See Chapter 6 for an example of using connect to invoke an inline chat script.

crtscts

  Enables hardware flow control (RTS/CTS).

-crtscts

  Disables hardware flow control (RTS/CTS).

debug

  Logs all control packets sent or received using syslogd with facility daemon and level debug. The debug option can also be written as -d.

defaultroute

  Defines the PPP link as the default route. The route is removed when the connection is closed.

-defaultroute

  Prevents users from creating a default route using the defaultroute option.

-detach

  Prevents pppd from running as a background process. See the example in Chapter 6.

disconnect `script`

  Invokes a `script` to gracefully shut down the serial connection. Any scripting language can be used, but chat is the most common.

domain `name`

  Defines the name of the local domain. Use this if hostname does not return a fully qualified name for the local system.

escape `x,x,...`

  Specifies characters that should be transmitted as two-character escape sequences. The characters are specified in a comma-separated list of hex numbers. Any character except 0x20 - 0x3f and 0x5e can be escaped.

file `file`

  Defines another options file, where `file` is the name of the new file. Options are normally read for /etc/ppp/options, ~/.ppprc, the command line, and /etc/ppp/options.device. See the description of these files earlier in this section.

-ip

  Disables IP address negotiation. When used, the remote IP address must be explicitly defined by a pppd option.

+ip-protocol

  Enables the IPCP and IP protocols, which is the default.

-ip-protocol

  Disables the IPCP and IP protocols. This should never be used on a TCP/IP network. It is for pure IPX networks.

ipcp-accept-local

  Tells system to use the local IP address provided by the remote server even if it is defined locally.

ipcp-accept-remote

  Tells system to use the remote IP address provided by the remote server even if it is defined locally.

ipcp-max-configure `n`

  Tells system to send the IPCP configure-request packet a maximum of `n` times. The default is 10.

ipcp-max-failure `n`

  Tells system to accept up to `n` IPCP configure-NAKs before sending a configure-reject. The default is 10.

ipcp-max-terminate `n`

  Tells system to send no more than `n` IPCP terminate-request packets without receiving an acknowledgment. The default is 3.

ipcp-restart `n`

  Tells system to wait `n` seconds before resending an IPCP configure-request packet. The default is 3.

ipparam `string`

  Passes `string` to the ip-up and ip-down scripts. /etc/ppp/ip-up is a shell script executed by pppd when the link comes up. /etc/ppp/ip-down is a shell script executed by pppd when the link is brought down.

kdebug `n`

  Enables kernel-level debugging. `n` is 1 to print general debugging messages, 2 to print received packets, and 4 to print transmitted packets.

lcp-echo-failure `n`

  Tells system to terminate the connection if no reply is received to `n` LCP echo-requests. Normally echo-requests are not used for this purpose because "link down" conditions are determined by the modem hardware.

lcp-echo-interval `n`

  Tells system to wait `n` seconds before sending another LCP echo-request when the remote system fails to reply.

lcp-max-configure `n`

  Tells system to send the LCP configure-request packet a maximum of `n` times. The default is 10.

lcp-max-failure `n`

  Tells system to accept up to `n` LCP configure-NAKs before sending a configure-reject. The default is 10.

lcp-max-terminate `n`

  Tells system to send no more than `n` LCP terminate-request transmissions without receiving an acknowledgment. The default is 3.

lcp-restart `n`

  Tells system to wait `n` seconds before resending a LCP configure-request packet. The default is 3.

local

  Tells system to ignore the DCD (Data Carrier Detect) and DTR (Data Terminal Ready) modem control lines.

lock

  Tells system to use a UUCP-style lock file to ensure that pppd has exclusive access to the serial device.

login

  Tells system to use the /etc/passwd file to authenticate PAP users. Records the login in the wtmp file.

modem

  Tells system to use the DCD (Data Carrier Detect) and DTR (Data Terminal Ready) modem control lines; wait for the DCD signal before opening the serial device; and drop the DTR signal when terminating a connection.

-mn

  Disables magic number negotiation.

mru `n`

  Sets the Maximum Receive Unit (MRU) to `n` bytes. MRU is used to tell the remote system the maximum packet size the local system can accept. The minimum is 128. The default is 1500.

-mru

  Disables Maximum Receive Unit (MRU) negotiation.

mtu `n`

  Sets the Maximum Transmission Unit (MTU) to `n` bytes. MTU defines the maximum length of a packet that can be sent. The smaller of the local MTU and the remote MRU is used to define the maximum packet length.

name `name`

  Tells system to use `name` as the name of the local system for authentication purposes.

netmask `mask`

  Defines the subnet mask.

noipdefault

  Instructs system not to use hostname to determine the local IP address. The address must be obtained from the remote system or explicitly set by an option.

+pap

  Requires the use of the Password Authentication Protocol (PAP).

-pap

  Disables the use of PAP.

papcrypt

  Instructs system not to accept passwords that are identical to those in the /etc/ppp/pap-secrets file because the ones in the file are encrypted. Therefore the transmitted password should not match an entry in the pap-secrets file until it is also encrypted.

pap-max-authreq `n`

  Tells system to transmit no more than `n` PAP authenticate-requests if the remote system does not respond. The default is 10.

pap-restart `n`

  Tells system to wait `n` seconds before retransmitting a PAP authenticate-request. The default is 3 seconds.

pap-timeout `n`

  Tells system to wait no more than `n` seconds for the remote system to authenticate itself. When `n` is 0, there is no time limit.

passive

  Tells system to wait for a Link Control Protocol (LCP) packet from the remote system even if that system does not reply to the initial LCP packet sent by the local system. Without this option the local system aborts the connection when it does not receive a reply. The passive option can also be written as -p.

-pc

  Disables protocol field compression negotiation. By default, protocol field compression is not used. Setting this option means that even if the remote end requests it, it will not be used.

persist

  Tells system to reopen the connection if it was terminated by a SIGHUP signal.

pred1comp

  Tells system to ask the remote system to use Predictor-1 compression.

-pred1comp

  Tells system not to use Predictor-1 compression.

proxyarp

  Tells system to enable proxy ARP. This adds a proxy ARP entry for the remote system to the local system's ARP table.

-proxyarp

  Disables the proxyarp option, preventing users from creating proxy ARP entries with pppd.

remotename `name`

  Tells system to use `name` as the remote system's name for authentication purposes.

silent

  Tells system to wait for an LCP packet from the remote system. Do not send the first LCP packet.

usehostname

  Disables the name option, forcing the local hostname to be used for authentication purposes.

user `username`

  Tells system to use `username` for PAP authentication when challenged by a remote host.

-vj

  Disables Van Jacobson header compression.

-vjccomp

  Disables the connection-ID compression option in Van Jacobson header compression.

vj-max-slots `n`

  Tells system to use `n` connection slots for Van Jacobson header compression. `n` must be a number from 2 to 16.

Several of the options listed above concern PPP security. One of the strengths of PPP is its security. The Challenge Handshake Authentication Protocol (CHAP) is the preferred PPP security protocol. The Password Authentication Protocol (PAP) is less secure and only provided for compatibility with less capable systems. The usernames, IP addresses, and secret keys used for these protocols are defined in the /etc/ppp/chap-secrets file and the /etc/ppp/pap-secrets file. Chapter 6 shows the format of these files and describes their use.

It is very important that the directory /etc/ppp and the files in that directory not be world- or group-writable. Modifications to the chap-secrets, pap-secrets, or options files could compromise system security. In addition, the script files /etc/ppp/ip-up and /etc/ppp/ip-down may run with root privilege. If pppd finds a file with the name ip-up in the /etc/ppp directory, it executes it as soon as the PPP connection is established. The ip-up script is used to modify the routing table, process the sendmail queue, or do other tasks that depend on the presences of the network connection. The ip-down script is executed by pppd after the PPP connection is closed and is used to terminate processes that depend on the link. Clearly these scripts and the /etc/ppp directory must be protected.

### A.2.1 Signal processing

pppd handles the following signals:

SIGUSR1

  This signal toggles debugging on or off. The first SIGUSR1 signal received by pppd turns on debugging and begins logging diagnostic messages through syslogd with facility set to daemon and level set to debug. The second SIGUSR1 signal turns off debugging and closes the log file. See the debug option described above.

SIGUSR2

  This signal causes pppd to renegotiate compression. It has limited applicability because it is only needed to restart compression after a fatal error has occurred. Most people close the PPP connection and open a new one after a fatal error.

SIGHUP

  This signal closes the PPP connection, returns the serial device to its normal operating mode, and terminates pppd. If the persist option is specified, pppd opens an new connection instead of terminating.

SIGINT

  This signal, or the SIGTERM signal, closes the PPP connection, returns the serial device to its normal operating mode, and terminates pppd. The persist option has no effect.

A.1 Dial-Up IP |  | A.3 chat