Provided by: ipppd_3.8.2005-12-06-2ubuntu4_i386 bug

NAME

       ipppd - (ISDN) Point to Point Protocol daemon

SYNOPSIS

       /usr/sbin/ipppd [ options ] [ device ]

DESCRIPTION

       The  Point-to-Point  Protocol  (PPP) provides a method for transmitting
       datagrams over serial point-to-point links.  PPP is composed  of  three
       parts:  a  method  for  encapsulating  datagrams  over serial links, an
       extensible Link Control Protocol (LCP), and a family of Network Control
       Protocols  (NCP)  for  establishing  and configuring different network-
       layer protocols.

       The encapsulation scheme is provided by  driver  code  in  the  kernel.
       ipppd  provides  the  basic LCP, authentication support, and an NCP for
       establishing and configuring the Internet Protocol (IP) (called the  IP
       Control Protocol, IPCP).

NOTES for (ISDN) IPPPD

       This  special  (ISDN)  PPP  daemon  is  a  modified version of pppd and
       provides synchronous PPP for ISDN connections.

       If you need asynchronous PPP over ISDN lines use pppd instead with  the
       ISDN character devices, see ttyI(4).

       The  ipppd  can  handle  multiple  devices.  This  is necessary to link
       several connections together to one bundle.  ipppd  should  be  started
       once.  It  opens  the  devices  and  waits  for  connections.   If  the
       connections is closed  ipppd  reopens  the  device  automatically  (the
       device,  that’s  it  ... not the link to the remote).  So you shouldn’t
       kill the ipppd to close a  link.  Instead,  trigger  a  hangup  on  the
       netdevice layer  by ’isdnctrl hangup <device>’.

       The     facility     to     configure     the     daemon    via    file
       /etc/ppp/ioptions.<devname> is disabled.   The  ’file’  option  or  the
       command line may be used for individual configuration.

       Do  not  set  the  permissions  of  the  program  to ’setuid to root on
       execution’. Call the daemon as root instead.   No  common  user  should
       have the need to call the daemon!

OPTIONS

       <device>
              Communicate  over  the  named  device.   The  string  "/dev/" is
              prepended if necessary.  If no device name is given, or  if  the
              name  of  the  controlling terminal is given, ipppd will use the
              controlling terminal, and will not fork to  put  itself  in  the
              background.

       <local_IP_address>:<remote_IP_address>
              Set  the local and/or remote interface IP addresses.  Either one
              may be omitted.  The IP addresses can be specified with  a  host
              name  or  in  decimal  dot  notation  (e.g. 150.234.56.78).  The
              default local address is the (first) IP address  of  the  system
              (unless  the  noipdefault  option is given).  The remote address
              will be obtained from the peer if not specified in  any  option.
              Thus,  in simple cases, this option is not required.  If a local
              and/or remote IP address is specified with  this  option,  ipppd
              will  not  accept  a  different  value from the peer in the IPCP
              negotiation, unless the  ipcp-accept-local  and/or  ipcp-accept-
              remote options are given, respectively.

       active-filter filter-expression
              Specifies  a  packet  filter  to  be  applied to data packets to
              determine which packets are to be regarded as link activity, and
              therefore  reset the idle timer, or cause the link to be brought
              up in demand-dialling mode. This option is useful in conjunction
              with the idle option if there are packets being sent or received
              regularly  over  the  link  (for  example,  routing  information
              packets)  which  would  otherwise  prevent  the  link  from ever
              appearing to  be  idle.   The  filter-expression  syntax  is  as
              described  for  tcpdump(1),  except  that  qualifiers  which are
              inappropriate for a PPP link, such as ether  and  arp,  are  not
              permitted. Generally the filter expression should be enclosed in
              single-quotes to prevent whitespace in the expression from being
              interpreted   by  the  shell.  This  option  is  currently  only
              available if both  the  kernel  and  ipppd  were  compiled  with
              IPPP_FILTER defined.

       -ac    Disable  Address/Control  compression  negotiation (use default,
              i.e.  address/control field compression disabled).

       -all   Don’t request or allow negotiation of any options  for  LCP  and
              IPCP (use default values).

       auth   Require  the peer to authenticate itself before allowing network
              packets to be sent or received.

       bsdcomp nr,nt
              Request that the peer compress packets that it sends, using  the
              BSD-Compress  scheme,  with  a maximum code size of nr bits, and
              agree to compress packets sent to the peer with a  maximum  code
              size  of  nt  bits.   If nt is not specified, it defaults to the
              value given for nr.  Values in the range 9 to 15 may be used for
              nr  and  nt;  larger  values give better compression but consume
              more kernel memory for compression dictionaries.  Alternatively,
              a  value  of  0  for  nr  or  nt  disables  compression  in  the
              corresponding direction.

       -bsdcomp
              Disables  compression;  ipppd  will  not  request  or  agree  to
              compress packets using the BSD-Compress scheme.

       callback <string>
              Request the peer to call back at the location given in <string>.
              Ususally this is a phone  number,  but  it  may  be  interpreted
              differently  (or ignored) depending on the callback-type option.
              If <string> is the empty string, ipppd  automatically  tries  to
              negotiate  a  callback  type that does not need a location to be
              specified.

       callback-delay <n>
              Callback delay for CBCP in seconds. If  callback  is  negotiated
              using  CBCP,  request  that  the peer waits at least <n> seconds
              before calling  back.  Ignored  if  callback  is  negotiated  as
              specified in RFC 1570. Legal range is 0..255, default is 5.

       callback-cbcp
              Enable callback negotiation via CBCB (default).

       -callback-cbcp
              Disable callback negotiation via CBCB.

       no-callback-cbcp
              Disable callback negotiation via CBCB.

       callback-cbcp-preferred
              If both CBCP and RFC 1570 style callback negotiation is enabled,
              CBCP is preferred (default)

       callback-rfc1570-preferred
              If both CBCP and RFC 1570 style callback negotiation is enabled,
              RFC 1570 style is preferred.

       callback-rfc1570
              Enable RFC 1570 style callback negotiation (default).

       -callback-rfc1570
              Disable RFC 1570 style callback negotiation.

       no-callback-rfc1570
              Disable RFC 1570 style callback negotiation (default).

       callback-type <n>
              Specifies  how  to  interpret  the  location identifier given as
              parameter of the callback option. Legal values are 0..4. A value
              of  0  means  that only callback types should be negotiated that
              need no extra location id. No location id is sent to the peer in
              this  case.  For RFC 1570 style callback negotiation, the values
              1..4  indicate  how  the  peer  should  interpret  the  location
              identifier:  1 - id is a system specific dial string,  2 - id is
              used for database lookup by the peer, 3 - id is a phone  number,
              and  4 id is a name. For CBCP callback negotiation, the location
              id is always interpreted as a phone number.

       -ccp   Necessary for a few netblazers on the remote side.

       noccp  same as -ccp

       +chap  Require   the   peer   to   authenticate   itself   using   CHAP
              [Cryptographic      Handshake      Authentication      Protocol]
              authentication.

       -chap  Don’t agree to authenticate using CHAP.

       chap-interval <n>
              If this option is given, ipppd will rechallenge the  peer  every
              <n> seconds.

       chap-max-challenge <n>
              Set  the  maximum  number of CHAP challenge transmissions to <n>
              (default 10).

       chap-restart <n>
              Set  the  CHAP  restart  interval  (retransmission  timeout  for
              challenges) to <n> seconds (default 3).

       debug  Increase debugging level (same as -d).  If this option is given,
              ipppd will log the contents  of  all  control  packets  sent  or
              received  in  a  readable  form.  The packets are logged through
              syslog with facility daemon and level debug.   This  information
              can  be  directed  to  a  file  by  setting  up /etc/syslog.conf
              appropriately (see syslog.conf(5)).

       -d     Increase debugging level (same as the debug option).

       defaultroute
              Add a default route to the system routing tables, using the peer
              as the gateway, when IPCP negotiation is successfully completed.
              This entry is removed when the PPP connection is broken.

       -defaultroute
              Disable the defaultroute option.  The system  administrator  who
              wishes  to prevent users from creating default routes with ipppd
              can do so by placing this option in the /etc/ppp/ioptions  file.

       deldefaultroute
              Replace  default  route  if it already exists. Together with the
              option defaultroute, this  will  replace  any  existing  default
              route  by a new one through this ipppd’s interface when it comes
              up.

       -detach
              Don’t fork to become a background process (otherwise ipppd  will
              do  so if a serial device other than its controlling terminal is
              specified).

       domain <d>
              Append  the  domain  name  <d>  to  the  local  host  name   for
              authentication  purposes.  For example, if gethostname() returns
              the name  porsche,  but  the  fully  qualified  domain  name  is
              porsche.Quotron.COM,  you would use the domain option to set the
              domain name to Quotron.COM.

       file <f>
              Read options from file <f> (the format is described below).

       -ip    Disable IP address negotiation.  If this  option  is  used,  the
              remote  IP  address  must  be  specified  with  an option on the
              command line or in an options file.

       +ip-protocol
              Enable the IPCP and IP protocols. This is the default condition.
              This  option  is  only  needed  if  the  default setting is -ip-
              protocol.

       -ip-protocol
              Disable the IPCP and IP protocols. This should only be  used  if
              you  know that you are using a client which only understands IPX
              and you don’t want to confuse the client with the IPCP protocol.

       +ipx-protocol
              Enable  the  IPXCP  and  IPX  protocols.  This  is  the  default
              condition if your kernel  supports  IPX.  This  option  is  only
              needed  if  the default setting is -ipx-protocol. If your kernel
              does not support IPX then this option will have no effect.

       -ipx-protocol
              Disable the IPXCP and IPX protocols. This should only be used if
              you  know  that you are using a client which only understands IP
              and you  don’t  want  to  confuse  the  client  with  the  IPXCP
              protocol.

       ipcp-accept-local
              With this option, ipppd will accept the peer’s idea of our local
              IP address, even if the local IP address  was  specified  in  an
              option.

       ipcp-accept-remote
              With  this  option,  ipppd  will  accept  the peer’s idea of its
              (remote) IP address, even if the remote IP address was specified
              in an option.

       ipcp-max-configure <n>
              Set  the  maximum number of IPCP configure-request transmissions
              to <n> (default 10).

       ipcp-max-failure <n>
              Set the maximum number of IPCP  configure-NAKs  returned  before
              starting  to send configure-Rejects instead to <n> (default 10).

       ipcp-max-terminate <n>
              Set the maximum number of IPCP  terminate-request  transmissions
              to <n> (default 3).

       ipcp-restart <n>
              Set  the  IPCP  restart interval (retransmission timeout) to <n>
              seconds (default 3).

       ipparam string
              Provides an extra parameter to the ip-up  and  ip-down  scripts.
              If this option is given, the string supplied is given as the 6th
              parameter to those scripts.

       ipx-network <n>
              Set the IPX network number in the IPXCP configure request  frame
              to  <n>.  There  is  no  valid  default.  If  this option is not
              specified then the network number is obtained from the peer.  If
              the peer does not have the network number, the IPX protocol will
              not be started. This is a  hexadecimal  number  and  is  entered
              without  any  leading  sequence such as 0x. It is related to the
              ipxcp-accept-network option.

       ipx-node <n>:<m>
              Set the IPX node numbers. The two  node  numbers  are  separated
              from  each other with a colon character. The first number <n> is
              the local node number. The second number <m> is the peer’s  node
              number. Each node number is a hexadecimal number, to the maximum
              of ten significant digits. The node numbers on  the  ipx-network
              must be unique. There is no valid default. If this option is not
              specified then the node number is obtained from the  peer.  This
              option  is a related to the ipxcp-accept-local and ipxcp-accept-
              remote options.

       ipx-router-name <string>
              Set the name of the router. This is a string and is sent to  the
              peer as information data.

       ipx-routing <n>
              Set  the  routing  protocol to be received by this option. Use a
              comma-serperated list if you  want  to  specify  more  than  one
              protocol.   The  ’none’  option (0) may be specified as the only
              instance of ipx-routing. The values may be 0  for  NONE,  2  for
              RIP/SAP, and 4 for NLSP.

       ipxcp-accept-local
              Accept  the peer’s NAK for the node number specified in the ipx-
              node option. If a node number was specified, and  non-zero,  the
              default is to insist that the value be used. If you include this
              option then you will permit the peer to override  the  entry  of
              the node number.

       ipxcp-accept-network
              Accept  the  peer’s  NAK for the network number specified in the
              ipx-network option. If a network number was specified, and  non-
              zero,  the  default  is to insist that the value be used. If you
              include this option then you will permit the  peer  to  override
              the entry of the node number.

       ipxcp-accept-remote
              Use the peer’s network number specified in the configure request
              frame. If a node number was specified  for  the  peer  and  this
              option  was  not  specified,  the peer will be forced to use the
              value which you have specified.

       ipxcp-max-configure <n>
              Set the maximum number of IPXCP configure request  frames  which
              the system will send to <n>. The default is 10.

       ipxcp-max-failure <n>
              Set  the  maximum  number  of  IPXCP  NAK frames which the local
              system will send before it  rejects  the  options.  The  default
              value is 3.

       ipxcp-max-terminate <n>
              Set  the  maximum nuber of IPXCP terminate request frames before
              the local system considers that the peer  is  not  listening  to
              them. The default value is 3.

       kdebug n
              Enable  debugging  code  in  the  kernel-level  PPP driver.  The
              argument n is a number which is the sum of the following values:
              1  to  enable  general  debug  messages,  2  to request that the
              contents of received packets be printed, and 4 to  request  that
              the contents of transmitted packets be printed.

       lcp-echo-failure <n>
              If  this option is given, ipppd will presume the peer to be dead
              if n LCP echo-requests are sent without receiving  a  valid  LCP
              echo-reply.    If   this   happens,  ipppd  will  terminate  the
              connection.  Use of this option requires a  non-zero  value  for
              the  lcp-echo-interval  parameter.   This  option can be used to
              enable ipppd to terminate after the physical connection has been
              broken  (e.g., the line hung up) in situations where no hardware
              modem control lines are available.

       lcp-echo-interval <n>
              If this option is given, ipppd will  send  an  LCP  echo-request
              frame to the peer every n seconds.  With Linux, the echo-request
              is sent when no packets have been received from the peer  for  n
              seconds.   Normally  the peer should respond to the echo-request
              by sending an echo-reply.  This option can be used with the lcp-
              echo-failure  option  to  detect  that  the  peer  is  no longer
              connected.

       lcp-max-configure <n>
              Set the maximum number of LCP configure-request transmissions to
              <n> (default 10).

       lcp-max-failure <n>
              Set  the  maximum  number  of LCP configure-NAKs returned before
              starting to send configure-Rejects instead to <n> (default  10).

       lcp-max-terminate <n>
              Set the maximum number of LCP terminate-request transmissions to
              <n> (default 3).

       lcp-restart <n>
              Set the LCP restart interval  (retransmission  timeout)  to  <n>
              seconds (default 3).

       lock   Specifies  that  ipppd  should create a UUCP-style lock file for
              the serial device to ensure exclusive access to the device.

       login  Use the system password database  for  authenticating  the  peer
              using PAP, and record the user in the system wtmp file.

       -mn    Disable  magic  number  negotiation.   With  this  option, ipppd
              cannot detect a looped-back line.

       +mp    enables MPPP negotiation

       mru <n>
              Set the MRU [Maximum Receive Unit] value to <n> for negotiation.
              ipppd  will  ask  the  peer  to send packets of no more than <n>
              bytes.  The minimum MRU value is 128.  The default MRU value  is
              1500.   A  value  of 296 is recommended for slow links (40 bytes
              for TCP/IP header + 256 bytes of data).

       -mru   Disable MRU  [Maximum  Receive  Unit]  negotiation.   With  this
              option, ipppd will use the default MRU value of 1500 bytes.

       ms-dns <n>
              This option sets the IP address or addresses for the Domain Name
              Server. It is used by Microsoft Windows clients. The primary DNS
              address is specified by the first instance of the ms-dns option.
              The secondary is specified by the second instance.

       ms-get-dns
              Implements the client side of RFC1877.  If ipppd is acting as  a
              client  to a server that implements RFC1877 such as one intended
              to be used with Microsoft Windows clients,  this  option  allows
              ipppd  to  obtain  one or two DNS (Domain Name Server) addresses
              from the server.  It does not do anything with  these  addresses
              except  put  them  in  the environment (MS_DNS1 MS_DNS2) that is
              passed to scripts.  For compatibility with the async pppd,  DNS1
              DNS2 environment variables are also set. A sample resolv.conf is
              created  in  /etc/ppp/resolv.conf.   The  /etc/ppp/ip-up  script
              should  use  this  information to perform whatever adjustment is
              necessary.   Note:  RFC1877  is  a  horrible  protocol  layering
              violation,  the  correct approach would be to use DHCP after the
              IPCP phase.

       ms-get-wins
              As ms-get-dns but for  WINS  (Windows  Internet  Name  Services)
              server   addresses.   Environment  variables  are  MS_WINS1  and
              MS_WINS2.

       mtu <n>
              Set the MTU [Maximum Transmit Unit] value to  <n>.   Unless  the
              peer  requests  a  smaller value via MRU negotiation, ipppd will
              request that the kernel networking code send data packets of  no
              more than n bytes through the PPP network interface.

       name <n>
              Set  the name of the local system for authentication purposes to
              <n>.

       netmask <n>
              Set the interface netmask to <n>, a 32 bit netmask  in  "decimal
              dot"  notation  (e.g.  255.255.255.0).  If this option is given,
              the value specified is  ORed  with  the  default  netmask.   The
              default  netmask  is  chosen  based  on the negotiated remote IP
              address; it is the appropriate network mask for the class of the
              remote  IP address, ORed with the netmasks for any non point-to-
              point network interfaces in the system which  are  on  the  same
              network.

       noipdefault
              Disables  the  default  behaviour  when  no  local IP address is
              specified, which is to determine  (if  possible)  the  local  IP
              address from the hostname.  With this option, the peer will have
              to supply the local IP address during IPCP  negotiation  (unless
              it  specified  explicitly  on  the command line or in an options
              file).

       passive
              Enables the "passive" option in  the  LCP.   With  this  option,
              ipppd  will  attempt  to  initiate  a connection; if no reply is
              received from the peer, ipppd will then just wait passively  for
              a valid LCP packet from the peer (instead of exiting, as it does
              without this option).

       -p     Same as the passive option.

       +pap   Require the peer to authenticate itself using PAP.

       -pap   Don’t agree to authenticate using PAP.

       papcrypt
              Indicates that all  secrets  in  the  /etc/ppp/pap-secrets  file
              which  are  used  for  checking  the  identity  of  the peer are
              encrypted, and thus ipppd should not  accept  a  password  which
              (before   encryption)  is  identical  to  the  secret  from  the
              /etc/ppp/pap-secrets file.

       pap-max-authreq <n>
              Set the maximum number of PAP authenticate-request transmissions
              to <n> (default 10).

       pap-restart <n>
              Set  the  PAP  restart  interval (retransmission timeout) to <n>
              seconds (default 3).

       pap-timeout <n>
              Set the maximum time that  ipppd  will  wait  for  the  peer  to
              authenticate  itself with PAP to <n> seconds (0 means no limit).

       pass-filter filter-expression
              Specifies a packet filter to applied to data packets being  sent
              or  received  to  determine  which  packets should be allowed to
              pass.  Packets which are rejected by  the  filter  are  silently
              discarded.  This  option can be used to prevent specific network
              daemons (such as routed) using up link bandwidth, or to  provide
              a basic firewall capability.  The filter-expression syntax is as
              described for  tcpdump(1),  except  that  qualifiers  which  are
              inappropriate  for  a  PPP  link, such as ether and arp, are not
              permitted. Generally the filter expression should be enclosed in
              single-quotes to prevent whitespace in the expression from being
              interpreted by the shell. Note that  it  is  possible  to  apply
              different constraints to incoming and outgoing packets using the
              inbound and outbound qualifiers. This option is  currently  only
              available  if  both  the  kernel  and  ipppd  were compiled with
              IPPP_FILTER defined.

       -pc    Disable protocol field  compression  negotiation  (use  default,
              i.e.  protocol field compression disabled).

       pidfile <filename>
              Use <filename> instead of /var/run/ipppd.pid

       pred1comp
              Attempt  to  request  that the peer send the local system frames
              which have been compressed by the Predictor-1  compression.  The
              compression  protocols  must  be  loaded  or this option will be
              ignored.

       -pred1comp
              Do not accept Predictor-1 comprssion, even if the peer wants  to
              send  this  type  of compression and support has been defined in
              the kernel.

       proxyarp
              Add an entry to this system’s ARP [Address Resolution  Protocol]
              table  with  the IP address of the peer and the Ethernet address
              of this system.

       -proxyarp
              Disable the  proxyarp  option.   The  system  administrator  who
              wishes  to  prevent  users  from creating proxy ARP entries with
              ipppd can do so by placing this option in the  /etc/ppp/ioptions
              file.

       remotename <n>
              Set  the  assumed  name  of the remote system for authentication
              purposes to <n>.

       set_userip
              You may define valid IPs in /etc/ppp/useriptab

       silent With this  option,  ipppd  will  not  transmit  LCP  packets  to
              initiate  a connection until a valid LCP packet is received from
              the peer (as for the ‘passive’ option with ancient  versions  of
              ipppd).

       +ua <p>
              Agree   to   authenticate  using  PAP  [Password  Authentication
              Protocol] if requested by the peer, and use the data in file <p>
              for the user and password to send to the peer. The file contains
              the remote user name, followed by a  newline,  followed  by  the
              remote   password,  followed  by  a  newline.   This  option  is
              obsolescent.

       usefirstip
              Gets the remote address from the first entry in  the  auth  file
              (if there is an IP address entry). This address should be a full
              IP address not an address  from  a  masked  area.   Ipppd  calls
              ’gethostbyname()’  and negotiates the result.  IP from auth file
              will overwrite the remote address  gotten  from  the  interface.
              ’usefirstip’ is UNTESTED!

       usehostname
              Enforce  the use of the hostname as the name of the local system
              for authentication purposes (overrides the name option).

       usepeerdns
              Same as ms-get-dns for compatibility with async pppd.

       user <u>
              Set the user name to use for authenticating  this  machine  with
              the peer using PAP to <u>.

       useifip
              will  get  (if  not  set  to  0.0.0.0)  the  IP  address for the
              negotiation from the attached network-interface.   (also:  ipppd
              will  try  to negotiate ’pointopoint’ IP as remote IP) interface
              address -> local IP pointopoint address -> remote IP

       -vj    Disable  negotiation  of  Van  Jacobson  style   TCP/IP   header
              compression (use default, i.e. no compression).

       -vjccomp
              Disable  the  connection-ID  compression  option in Van Jacobson
              style TCP/IP header compression.  With this option,  ipppd  will
              not  omit  the  connection-ID  byte from Van Jacobson compressed
              TCP/IP headers, nor ask the peer to do so.

       vj-max-slots n
              Sets the number of connection  slots  to  be  used  by  the  Van
              Jacobson  TCP/IP header compression and decompression code to n,
              which must be between 2 and 16 (inclusive).

OPTIONS FILES

       Options can be taken from files as well as  the  command  line.   ipppd
       reads  options  from  the  file /etc/ppp/ioptions before looking at the
       command line.  An options file  is  parsed  into  a  series  of  words,
       delimited  by  whitespace.   Whitespace  can  be  included in a word by
       enclosing the word in quotes (").  A backslash (\) quotes the following
       character.   A hash (#) starts a comment, which continues until the end
       of the line.

AUTHENTICATION

       ipppd provides system administrators  with  sufficient  access  control
       that PPP access to a server machine can be provided to legitimate users
       without fear of compromising the security of the server or the  network
       it’s on.  In part this is provided by the /etc/ppp/ioptions file, where
       the administrator can place options to require authentication  whenever
       ipppd  is run, and in part by the PAP and CHAP secrets files, where the
       administrator can restrict the set of  IP  addresses  which  individual
       users may use.

       The  default  behaviour  of  ipppd  is  to  agree  to  authenticate  if
       requested, and to not require authentication from the  peer.   However,
       ipppd  will not agree to authenticate itself with a particular protocol
       if it has no secrets which could be used to do so.

       Authentication is based on secrets, which  are  selected  from  secrets
       files  (/etc/ppp/pap-secrets  for PAP, /etc/ppp/chap-secrets for CHAP).
       Both secrets files have the same format, and both can store secrets for
       several  combinations  of server (authenticating peer) and client (peer
       being authenticated).  Note that ipppd can be both a server and client,
       and  that  different  protocols  can  be  used in the two directions if
       desired.

       A secrets file is parsed into words as for a options file.  A secret is
       specified  by  a  line containing at least 3 words, in the order client
       name, server name, secret.  Any following words on the  same  line  are
       taken  to  be  a  list  of acceptable IP addresses for that client.  If
       there are only 3 words on the line, it is assumed that any  IP  address
       is  OK;  to  disallow  all IP addresses, use "-".  If the secret starts
       with an ‘@’, what follows is assumed to be the  name  of  a  file  from
       which  to  read the secret.  A "*" as the client or server name matches
       any name.  When selecting a secret, ipppd takes the  best  match,  i.e.
       the match with the fewest wildcards.

       Thus  a  secrets  file  contains both secrets for use in authenticating
       other hosts, plus secrets which we use for authenticating ourselves  to
       others.   Which  secret to use is chosen based on the names of the host
       (the ‘local name’) and its peer (the ‘remote name’).  The local name is
       set as follows:

       if the usehostname option is given,
          then the local name is the hostname of this machine (with the domain
          appended, if given)

       else if the name option is given,
          then use the argument of the first name option seen

       else if the local IP address is specified with a hostname,
          then use that name

       else use the hostname of this machine (with  the  domain  appended,  if
       given)

       When authenticating ourselves using PAP, there  is  also  a  ‘username’
       which is the local name by default, but can be set with the user option
       or the +ua option.

       The remote name is set as follows:

       if the remotename option is given,
          then use the argument of the last remotename option seen

       else if the remote IP address is specified with a hostname,
          then use that host name

       else the remote name is the null string "".

       Secrets are selected from the PAP secrets file as follows:

       * For authenticating the  peer,  look  for  a  secret  with  client  ==
         username  specified  in  the  PAP authenticate-request, and server ==
         local name.

       * For authenticating ourselves to the peer,  look  for  a  secret  with
         client == our username, server == remote name.

       When  authenticating  the  peer  with  PAP,  a secret of "" matches any
       password supplied by the peer.   If  the  password  doesn’t  match  the
       secret, the password is encrypted using crypt() and checked against the
       secret again; thus secrets for authenticating the peer can be stored in
       encrypted   form.    If   the  papcrypt  option  is  given,  the  first
       (unencrypted) comparison is omitted, for better security.

       If the login option was specified, the username and password  are  also
       checked  against  the  system  password  database.   Thus,  the  system
       administrator can set up the pap-secrets file to allow PPP access  only
       to  certain  users,  and  to restrict the set of IP addresses that each
       user can use.  Typically, when using the login option,  the  secret  in
       /etc/ppp/pap-secrets  would  be  "", to avoid the need to have the same
       secret in two places.

       Secrets are selected from the CHAP secrets file as follows:

       * For authenticating the peer, look for a secret with  client  ==  name
         specified in the CHAP-Response message, and server == local name.

       * For  authenticating  ourselves  to  the  peer, look for a secret with
         client == local name, and server  ==  name  specified  in  the  CHAP-
         Challenge message.

       Authentication  must  be  satisfactorily  completed before IPCP (or any
       other Network Control Protocol)  can  be  started.   If  authentication
       fails,  ipppd  will  terminated  the  link  (by  closing LCP).  If IPCP
       negotiates an unacceptable IP address for the remote host, IPCP will be
       closed.  IP packets can only be sent or received when IPCP is open.

       In  some  cases  it  is  desirable  to  allow  some  hosts  which can’t
       authenticate themselves to connect and use one of a restricted  set  of
       IP   addresses,   even   when   the   local   host  generally  requires
       authentication.  If  the  peer  refuses  to  authenticate  itself  when
       requested,  ipppd  takes  that as equivalent to authenticating with PAP
       using the empty string for the username and password.  Thus, by  adding
       a line to the pap-secrets file which specifies the empty string for the
       client and password, it is possible to allow restricted access to hosts
       which refuse to authenticate themselves.

ROUTING

       When  IPCP negotiation is completed successfully, ipppd will inform the
       kernel of the local and remote IP  addresses  for  the  ppp  interface.
       This  is  sufficient  to  create  a host route to the remote end of the
       link,  which  will  enable  the   peers   to   exchange   IP   packets.
       Communication   with   other   machines   generally   requires  further
       modification to routing tables and/or ARP (Address Resolution Protocol)
       tables.   In  some  cases  this  will be done automatically through the
       actions of the routed or gated daemons, but in most cases some  further
       intervention is required.

       Sometimes  it  is  desirable  to add a default route through the remote
       host, as in the case of a machine whose only connection to the Internet
       is  through the ppp interface.  The defaultroute option causes ipppd to
       create such a default route when IPCP comes up, and delete it when  the
       link is terminated.

       In some cases it is desirable to use proxy ARP, for example on a server
       machine  connected  to  a  LAN,  in  order  to  allow  other  hosts  to
       communicate  with the remote host.  The proxyarp option causes ipppd to
       look for a network interface on the same subnet as the remote host  (an
       interface supporting broadcast and ARP, which is up and not a point-to-
       point or loopback interface).  If found,  ipppd  creates  a  permanent,
       published  ARP  entry  with  the  IP address of the remote host and the
       hardware address of the network interface found.

DIAGNOSTICS

       Messages are sent to  the  syslog  daemon  using  facility  LOG_DAEMON.
       (This  can  be  overriden  by  recompiling ipppd with the macro LOG_PPP
       defined as the desired facility.)  In order to see the error and  debug
       messages,  you  will  need to edit your /etc/syslog.conf file to direct
       the messages to the desired output device or file.

       The debug option causes the contents of all  control  packets  sent  or
       received  to  be  logged,  that is, all LCP, PAP, CHAP or IPCP packets.
       This can be useful  if  the  PPP  negotiation  does  not  succeed.   If
       debugging  is  enabled  at  compile  time, the debug option also causes
       other debugging messages to be logged.

       Debugging can also be enabled or disabled by sending a SIGUSR1  to  the
       ipppd process.  This signal acts as a toggle.

FILES

       /var/run/ipppd.pid
              Process-ID for ipppd process on ppp interface unit n.

       /etc/ppp/ip-up
              A program or script which is executed when the link is available
              for sending and receiving IP packets (that  is,  IPCP  has  come
              up).  It is executed with the parameters

              interface-name   tty-device  speed  local-IP-address  remote-IP-
              address

              and with its standard input, output and error streams redirected
              to /dev/null.

              This  program  or  script  is  executed  with  the same real and
              effective user-ID as ipppd, that  is,  at  least  the  effective
              user-ID  and possibly the real user-ID will be root.  This is so
              that it can be used to manipulate routes, run privileged daemons
              (e.g.   sendmail),  etc.   Be  careful  that the contents of the
              /etc/ppp/ip-up and /etc/ppp/ip-down scripts  do  not  compromise
              your system’s security.

       /etc/ppp/ip-down
              A program or script which is executed when the link is no longer
              available for sending and receiving IP packets.  This script can
              be  used  for  undoing the effects of the /etc/ppp/ip-up script.
              It is invoked with the same parameters as the ip-up script,  and
              the  same  security  considerations  apply, since it is executed
              with the same effective and real user-IDs as ipppd.

       /etc/ppp/ipx-up
              A program or script which is executed when the link is available
              for  sending  and receiving IPX packets (that is, IPXCP has come
              up).  It is executed with the parameters

              interface-name tty-device speed  network-number  local-IPX-node-
              address    remote-IPX-node-address    local-IPX-routing-protocol
              remote-IPX-routing-protocol  local-IPX-router-name   remote-IPX-
              router-name ipparam ipppd-pid

              and with its standard input, output and error streams redirected
              to /dev/null.

              The local-IPX-routing-protocol  and  remote-IPX-routing-protocol
              field may be one of the following:

              NONE      to indicate that there is no routing protocol
              RIP       to indicate that RIP/SAP should be used
              NLSP      to indicate that Novell NLSP should be used
              RIP NLSP  to indicate that both RIP/SAP and NLSP should be used

              This  program  or  script  is  executed  with  the same real and
              effective user-ID as ipppd, that  is,  at  least  the  effective
              user-ID  and possibly the real user-ID will be root.  This is so
              that it can be used to manipulate routes, run privileged daemons
              (e.g.   ripd),  etc.   Be  careful  that  the  contents  of  the
              /etc/ppp/ipx-up and /etc/ppp/ipx-down scripts do not  compromise
              your system’s security.

       /etc/ppp/ipx-down
              A program or script which is executed when the link is no longer
              available for sending and receiving IPX  packets.   This  script
              can  be  used  for  undoing  the  effects of the /etc/ppp/ipx-up
              script.  It is invoked with the same parameters  as  the  ipx-up
              script,  and the same security considerations apply, since it is
              executed with the same effective and real user-IDs as ipppd.

       /etc/ppp/auth-up
              This  program   or   script   is   executed   after   successful
              authentication  with  the  following parameters: interface name,
              authentication user name, username of ipppd, devicename,  speed,
              remote number

       /etc/ppp/auth-down
              This  program  or  script is executed after a disconnection with
              the following parameters: interface  name,  authentication  user
              name, username of ipppd, devicename, speed, remote number

       /etc/ppp/auth-fail
              This  program  or  script  is  executed  after  a authentication
              failure  with  the   following   parameters:   interface   name,
              authentication  user name, username of ipppd, devicename, speed,
              remote number, failure reason
               Valid reasons are:
                1 = Timeout during pap auth
                2 = pap protocol rejected
                3 = pap secrets invalid
                9 = Timeout during chap auth
               10 = chap protocol rejected
               11 = chap secrets invalid

       /etc/ppp/pap-secrets
              Usernames, passwords and IP addresses for PAP authentication.

       /etc/ppp/chap-secrets
              Names, secrets and IP addresses for CHAP authentication.

       /etc/ppp/ioptions
              System default options  for  ipppd,  read  before  user  default
              options or command-line options.

SEE ALSO

       ttyI(4), isdnctrl(8), ipppstats(8),

       RFC1144
              Jacobson,  V.   Compressing  TCP/IP headers for low-speed serial
              links.  1990 February.

       RFC1321
              Rivest, R.  The MD5 Message-Digest Algorithm.  1992 April.

       RFC1332
              McGregor, G.  PPP Internet  Protocol  Control  Protocol  (IPCP).
              1992 May.

       RFC1334
              Lloyd,  B.;  Simpson,  W.A.  PPP authentication protocols.  1992
              October.

       RFC1548
              Simpson,  W.A.   The  Point-to-Point   Protocol   (PPP).    1993
              December.

       RFC1549
              Simpson, W.A.  PPP in HDLC Framing.  1993 December

NOTES

       The  following signals have the specified effect when sent to the ipppd
       process.

       SIGINT, SIGTERM
              These signals cause ipppd to  terminate  the  link  (by  closing
              LCP), restore the serial device settings, and exit.

       SIGHUP This  signal  causes  ipppd  to  terminate the link, restore the
              serial device settings, and close the  serial  device.   If  the
              persist  option has been specified, ipppd will try to reopen the
              serial device and start  another  connection.   Otherwise  ipppd
              will exit.

       SIGUSR2
              This  signal  causes ipppd to renegotiate compression.  This can
              be useful to re-enable compression after it has been disabled as
              a  result of a fatal decompression error.  With the BSD Compress
              scheme, fatal decompression errors generally indicate a  bug  in
              one or other implementation.

AUTHORS

       Originally  written  by  Drew  Perkins,  Brad  Clements, Karl Fox, Greg
       Christy,  Brad  Parker,  Paul  Mackerras   <paulus@cs.anu.edu.au>   for
       (original) pppd.

       Changes  for  ipppd  by  Klaus  Franken  <kfr@suse.de> and Michael Hipp
       <Michael.Hipp@student.uni-tuebingen.de>.

       Removal  of  pppd  specific  options  and  polish   by   Frank   Elsner
       <Elsner@zrz.TU-Berlin.DE>.