Debian PPP package notes ======================== Table of contents: + Modern usage of PPP + Provided user space scripts + Permissions + Unprivileged use of PPP + Outbound dialing setup + Inbound setup combined with mgetty + Syslog facility level + Logging of ip-up and ip-down + DSL connections + MSS clamping + Naming of PPPoE interfaces -- Christoph Lameter , 22 July 1997 Phil Hands Josip Rodin , 27 November 1999. Marco d'Itri Chris Boot Modern usage of PPP ~~~~~~~~~~~~~~~~~~~ The PPP protocol may date back from a time of dial-up modems but it is still in active use today. PPP is often used on modern FTTP and DSL networks to encapsulate packets and provide authentication, and PPP is also used in several kinds of VPN stack too. Most users who need to use PPP directly (e.g. for PPPoE) will want to do so using some kind of network management tool or process supervisor. For example, to configure a PPPoE connection one of the easiest ways is using NetworkManager which has a built-in "DSL/PPPoE" connection type. Simply start nm-connection-editor or nmtui and follow the instructions to add a new DSL/PPPoE connection, then manage it like any other connection. Another alternative is to use the ppp@.service template systemd unit. Place a peer/provider configuration file into /etc/ppp/peers/ and then enable and start the service. For example, if you create /etc/ppp/peers/myisp, you can enable and start pppd for that provider using: systemd enable --now ppp@myisp.service You can also use an entry in /etc/network/interfaces as described in "Outbound dialing setup" below. Provided user space scripts ~~~~~~~~~~~~~~~~~~~~~~~~~~~ The ppp package provides scripts to control PPP. Note that the scripts only work with the proper setup in /etc/ppp. Edit the configuration files and manage your connection using: pon Bring link up. Executes pppd (you may specify the ISP name on the command line), and will immediately return the command prompt while still dialing. plog Shows the last lines of the pppd log. Basically, does tail ppp.log. poff Bring link down. Terminates connection by killing pppd. Please read the manual page pon(1) for specific descriptions of these commands. Note that the unprivileged access that these commands once supported is no longer recommended. Please use a network supervisor such as NetworkManager, or a process supervisor such as systemd, to manage your PPP connections. Permissions ~~~~~~~~~~~ pppd should be run in a privileged context (e.g. as root). While unprivileged use of pppd using group memberhip of the "dip" group was supported in the past, this is no longer the case. Please see "Modern usage of PPP" above for current recommendations, or "Unprivileged use of PPP" below to restore the previous functionality. Unprivileged use of PPP ~~~~~~~~~~~~~~~~~~~~~~~ Use of ppp by unprivileged users is no longer supported, please use a network supervisor such as NetworkManager or a proess supervisor such as systemd to manage your PPP connections; see "Modern usage of PPP" above. If you rely on being able to run pppd as an unprivileged user, however, the functionality can be restored by the following steps: adduser your-user dip dpkg-statoverride --remove /etc/ppp/peers dpkg-statoverride --update --add root dip 2750 /etc/ppp/peers dpkg-statoverride --update --add root dip 2750 /etc/chatscripts dpkg-statoverride --update --add root dip 4754 /usr/sbin/pppd Note that future changes in ppp upstream are introduction additional restrictions on unprivileged use of pppd soon. The above is provided with no guarantees or support of any kind and may stop working in future. You have been warned! If you want to undo these changes: dpkg-statoverride --remove /etc/ppp/peers dpkg-statoverride --remove /etc/chatscripts dpkg-statoverride --remove /usr/sbin/pppd dpkg-statoverride --update --add root root 700 /etc/ppp/peers chown root:root /etc/chatscripts /usr/sbin/pppd chmod 700 /etc/chatscripts chmod 755 /usr/sbin/pppd Outbound dialing setup ~~~~~~~~~~~~~~~~~~~~~~ Edit the file /etc/ppp/peers/provider and put all options in it that you need to connect to your server. The most common options are already provided for you, and you should only need to set the login name and telephone number. Edit the file /etc/ppp/pap-secrets and put your password into the designated location. You should then be able to start the PPP connection with pon. You should never need to modify /etc/ppp/options. If you want to have PPP started at boot time then add something like this to /etc/network/interfaces: auto myisp iface myisp inet ppp provider dsl-provider Inbound setup combined with mgetty ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Note: for this to work you need to have mgetty version >= 0.99 with its AutoPPP feature turned on. Edit the /etc/ppp/options file and uncomment the nameserver lines. Provide the IP addresses that you want the users to use for their name services. To have one options file for each serial port you run mgetty on, use the files /etc/ppp/options.ttyXX. Give each serial port an IP address in those files. That way that port is locked into using that IP number. Think what consequences that assignment might have for outbound use... That should be enough for dial-up from a Win9x or NT Server. The username/password on those system is used for a PAP authentication. The /etc/ppp/pap-secrets is already set up for such a situation. Mgetty is preconfigured to call pppd with parameters so that the PAP verification will be done through the /etc/passwd file. All your users should now be able to establish PPP connections by just specifying phone number, username, and password from Win9x. Inbound dial-up using dial-up scripts: A PPP session can be established from the regular Linux prompt by executing /usr/sbin/pppd. The user is limited to use the assigned IP address in /etc/ppp/options.ttyname and will not be able to override it. Note: there is support for callback, it can be done through scripts (see /usr/share/doc/ppp/examples/scripts/*callback), and with mgetty's `callback' program (see callback(8) manual page). Syslog facility level ~~~~~~~~~~~~~~~~~~~~~ The default level of LOG_DAEMON has been overridden (as described in the pppd(8) man page), to be LOG_LOCAL2. The intent being that local2 be sent to /var/log/ppp.log for use by plog, if you add the following line to your /etc/syslog.conf file: local2.* -/var/log/ppp.log Logging of ip-up and ip-down ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If you want to enable logging of the ip-up and ip-down scripts output, then create the file /var/log/ppp-ipupdown.log . DSL connections ~~~~~~~~~~~~~~~ The files peers-pppoa, peers-pppoe and interfaces from /usr/share/doc/ppp/examples/ contain complete configuration examples for the protocols commonly used for DSL connections. Beware: the pppoatm kernel driver currently is not autoloaded, so PPPoA users probably want to add it to /proc/modules. The same applies to PPPoEoATM users who need the br2684 module. MSS clamping ~~~~~~~~~~~~ If the computer running pppd acts as a router for other machines, you may want to make it reduce the MSS field of outgoing packets, in order to avoid fragmentation and problems caused by broken path MTU discovery. You may add something like this to /etc/ppp/ip-up.d/local: iptables --insert FORWARD 1 --proto tcp --tcp-flags SYN,RST SYN \ --out-interface $PPP_IFACE --match tcpmss --mss 1400:1536 \ --jump TCPMSS --clamp-mss-to-pmtu You may prefer to use your firewall builder for this; search your tool's documentation for "MSS Clamping" to see how it's done there.