PPP & CHAP: Clarification
I would like to clarify how use PPPD with ISPs that require
CHAP authentication because most of the documentation on
the subject is misleading. (i.e. This applies to dialup connections.)
The most important thing to remember is you need to edit
both the CHAP secrets file--/etc/ppp/chap-secrets--and
the peer file--/etc/ppp/peers/peer_file_name, not just the
CHAP secrets file.
1) Two typical entries in the CHAP secrets file are as follows:
email@example.com * secret_password *
firstname.lastname@example.org isp_name secret_password *
The email@example.com entry is usually the login ID required
by the ISP that the standards describe as a system name
or identifier. In any case, this is the "name" field transmitted,
in a CHAP challenge/response packet. However, it will
NOT be transmitted unless the peer file is configured
correctly--which I will explain below !
The second field--whose value is isp_name and '*' in the above
examples--identifies the entity performing CHAP authentication.
For ISPs that have a static authenticator, specifying a value
is a good idea and necessary in some cases. For ISPs that
have multiple or dynamic authenticators--such as AT&T Worldnet,
you must use the wildcard '*' as the value. This corresponds
to the value of "name" field received in the CHAP challenge packet.
The third field--secret_password--is usually the password required
by the ISP but is logically the secret used in calculating the
"value" field of the CHAP challenge response packet--as
described by the standards.
The last field is an optional IP address which the documentation
describes accurately. (i.e. It is rarely used.)
2) There are three crucial entries in the peer file. Examples
of entries are as follows:
# ISP login ID or local system identifier.
# Corresponds to the first field in chap-secrets.
# Remote authentication system identifier.
# Corresponds to the third field in chap-secrets.
# The chat script for connecting to the ISP.
connect "/usr/sbin/chat -v -f/etc/chatscripts/isp.chat.script"
The "user" entry is mandatory for CHAP authentication
to work at all--which isn't clear in most of the documentation.
In addition the firstname.lastname@example.org in the example--must
correspond to the first field of an entry in the CHAP secrets file.
The value of the "name" entry should correspond to the
third field of an entry in the CHAP secrets file.
However, CHAP authentication may work if it is incorrect
Finally, the "connect" entry specifies the CHAT script
used to dial the ISP and insure that PPP begins executing.
3) An example of a typical chat script is as follows:
# Static modem response strings.
ABORT "NO CARRIER"
ABORT "NO DIALTONE"
# Send the modem training command and set the defaults.
# A slow response indicates a modem malfunction.
# Perform the dialup: Connecting may take some time.
# Wait for some indication that things are working
# from the ISP to insure PPP has enough time to begin execution.
# Note: "Sign-on:" is sent by AT&T Worldnet just before
# it begins PPP negotiations.
Note that it is important to wait for the remote system to start up PPP
before beginning PPP negotiations.
The CHAP authentication will occur during PPP negotiations.
RCOM Communications Software