Next: Dialing out with chat Up: The Point-to-Point Protocol Previous: Running pppd

Using Options Files

Before pppd parses its command line arguments, it scans several files for default options. These files may contain any valid command line arguments, spread out across an arbitrary number of lines. comments are introduced by has signs.

The first options file is /etc/ppp/options, which is always scanned when pppd starts up. Using it to set some global defaults is a good idea, because it allows you to keep your users from doing several things that may compromise security. For instance, to make pppd require some kind of authentication (either PAP or CHAP) from the peer, you would add the auth option to this file. This option cannot be overridden by the user, so that it becomes impossible to establish a PPP connection with any system that is not in our authentication databases.

The other option file, which is read after /etc/ppp/options, is .ppprc in the user's home directory. It allows each user to specify her own set of default options.

A sample /etc/ppp/options file might look like this:

           # Global options for pppd running on vlager.vbrew.com
           auth                 # require authentication
           usehostname          # use local hostname for CHAP
           lock                 # use UUCP-style device locking
           domain vbrew.com     # our domain name

The first two of these options apply to authentication and will be explained below. The lock keyword makes pppd comply to the standard UUCP method of device locking. With this convention, each process that accesses a serial device, say /dev/cua3, creates a lock file named LCK..cua3 in the UUCP spool directory to signal that the device is in use. This is necessary to prevent any other programs such as minicom or uucico to open the serial device while used by PPP.

The reason to provide these options in the global configuration file is that options such as those shown above cannot be overridden, and so provide for a reasonable level of security. Note however, that some options can be overridden later; one such an example is the connect string.

---

Next: Dialing out with chat Up: The Point-to-Point Protocol Previous: Running pppd

Andrew Anderson
Thu Mar 7 23:22:06 EST 1996