لطفا منتظر باشید ...
Using a PPP Link
Most of this book assumes that the network to which the Linux
computer is connected is a dedicated one, such as an Ethernet network. In this environment,
it''s possible to run servers, as discussed in
configurations, though, use a less permanent type of network link. These
connections use a telephone modem and PPP to create a temporary connection to
the Internet, or at least to one other computer. Although you''re not likely to
run servers over a PPP link, they do have their place. For instance, you might
run a small office or home office network, and so use various local network
servers, as discussed in
network to the Internet on an as-needed basis. You can even share this
connection among all the computers on the network by setting up Network Address
Translation (NAT; also called IP masquerading), as discussed in
though, you''ll first have to establish the PPP connection. This section
describes how to do this.
PPP over Ethernet
Some low-end DSL connections use a variant of PPP, known as
PPPoE. The 2.4.
x Linux kernel includes PPPoE
support, but it''s considered experimental. The most common PPPoE tool for
Linux in 2002 is the Roaring Penguin PPPoE client (
package comes in source code form or as RPM packages for a variety of
platforms.
After you install Roaring Penguin, type adsl-setup or tkpppoe to configure the tool. (The
latter command requires installation of Roaring Penguin GUI tools; the former
is a text-based program.) You''ll be asked for information such as your username
and password, and the script will store all the information and create a
dialing script called adsl-start .
You can run this script to initiate a PPPoE connection.
It''s important to note that Roaring Penguin requires that
you have support for your network device. Linux works with all external
Ethernet-based DSL modems, provided you have a supported Ethernet card. If
your DSL modem is USB-based or internal, though, you''ll need to locate
drivers for it, and these are rare in 2002.
Using
a GUI Dialer
PPP can be a tricky tool to use; the protocol has many options
that, if set incorrectly, can disrupt the PPP connection or even prevent it
from coming up initially. For this reason, many people find it easier to use
PPP via a GUI dialer than through configuration scripts. In fact, many Linux
GUI PPP dialers closely resemble their counterparts in other OSs, such as
Windows, so if you''re familiar with PPP in another OS, you shouldn''t have too
much difficulty using a Linux GUI PPP dialer.
Different GUI dialers differ in some details, but they are
similar in broad outline. This section presents information on the popular KPPP
dialer, which is part of the K Desktop Environment (KDE). You can use KPPP even
if you don''t use KDE; or you can use GNOME PPP (part of the GNU Network Object
Model Environment, or GNOME) or a dialer that''s not part of any desktop
environment, such as X-ISP (http://xisp.hellug.gr ).
NOTE
align=left border=0> Before using KPPP, you must sign up for a dial-up account
and test your modem''s functionality in Linux. Check your telephone book for
ISPs to obtain an account, or consult an online resource such as The List (
if you''ve got access through some other computer. To test the modem, connect
it and (if it''s an external model) turn it on. You should be able to send
data to /dev/ttyS0 , /dev/ttyS1 , or some other port. If
you''re using the new devfs (
to automatically create device files, you''ll use /dev/tts/0 , /dev/tts/1 ,
and so on. You can most easily test this configuration by using a terminal
program like the text-based minicom
or the GUI Seyon, both of which ship with most Linux distributions. If you
can get an AT prompt from the
modem, you know that Linux can use the modem.
To start KPPP, you can select it from a menu on your desktop
environment, or you can type kppp
in an xterm. The result should resemble
launch KPPP, it probably won''t include any ISP names in the Connect To list,
nor a login ID or password. In order to set the program up to use an account,
follow these steps:
Click the Setup button. This action will produce the KPPP
Configuration dialog box shown in
account information for future connections.
The KPPP Configuration dialog box controls hardware features associated with a
PPP connection, such as what modem device to use, and lets you modify specific
accounts using other dialog boxes.
> 2.
Click New to create a new account. KPPP asks if you want to use a
wizard or set up via dialog boxes. Although the wizard is purported to be
easier, it begins by asking for your country, and there''s no entry for the
United States. I therefore present the dialog box procedure, which produces the
New Account dialog box shown in
The New Account dialog box lets you enter many important account details.
> 3.
Type the name of your ISP into the Connection Name field.
4.
Click Add. This action produces a small dialog box in which you may
enter a telephone number for your ISP. Be sure to include any digits you need
to dial an outside line, or the area code if you need to dial it. When you
click OK in this dialog box, the Phone Number field should reflect the
addition. You may repeat this step if you want to enter multiple numbers that
the dialer will attempt in sequence, should one number be busy.
5.
Most ISPs today use the Password Authentication Protocol (PAP) for
communicating the username and password, so you should probably leave the
Authentication selector in the New Account dialog box set to PAP. You can
change this to various other options if required, though. Of particular
interest is the Challenge Handshake Authentication Protocol (CHAP), which some
ISPs use.
6.
If your ISP gave you a list of DNS servers as part of your sign-up
process, click the DNS tab of the New Account information and enter each IP
address in the DNS IP Address field, clicking Add after entering each address.
7.
Click OK in the New Account dialog box. You should see the new entry
appear in the list in the KPPP Configuration dialog box (
8.
Click the Device tab in the KPPP Configuration dialog box. Set the
Modem Device to whatever device name your system uses for the modem. This is
often /dev/modem (the default),
but may be /dev/ttyS0 , / dev/ttyS1 , or something more exotic. You
may also want to adjust the Connection Speed option on this tab. The default is
57,600, but 115,200 provides better speed on most systems. (Higher values don''t
work on most hardware.) The speed you set here is for communication between
your computer and your modem. The connect speed between your modem and your ISP
is likely to be lower, but if your modem uses compression, a local connection
speed of about twice the modem-to-modem speed is optimal.
9.
Click OK in the KPPP Configuration dialog box. You should now be able
to select your new account in the main KPPP window (
Figure 2.4. GUI PPP dialers usually
provide some way of selecting an account, entering a username and password, and
initiating a connection.
NOTE align=left border=0> The KPPP Configuration and New Account dialog boxes both
include tabs and options I''ve not discussed here. In most cases, you won''t
need to adjust these values, but sometimes they''re vital. If you have
problems connecting or if you want to enable a feature you''ve heard about but
that''s not covered here, check these tabs for options that might help. The
PPP HOWTO document (target="_blank">http://www.linuxdoc.org/HOWTO/PPP-HOWTO/ )
includes additional information on PPP and debugging PPP connections.
Using a GUI PPP dialer is a fairly simple matter; after launching
the program, you need only click the Connect button (which may be called
something else in some programs). Some dialers will provide you with an
indication of their progress during the connection phase, and many modems will
echo the sounds of the modem negotiations. In KPPP, clicking the Show Log
Window button will provide added details. Some dialers, including KPPP, require
you to enter the username (in the Login ID field) and password before clicking
Connect. Others will ask for this information after you click Connect. Many let
you store your password on disk (the Store Password check box in the KPPP New
Account dialog box lets you set this option).
WARNING
align=left border=0> Storing your PPP dialup password on the computer is a
potential security risk. This risk may be small for an isolated computer that
you use to initiate connections, but if the computer has many users, some of
whom shouldn''t have access to the PPP account, the risk may be greater. At
the very least, you should not use your PPP dialup account password for any
other purpose, so that if the PPP password is stolen you need not change any
other passwords.
Once a connection is initiated, the Connect button changes
names so that you can break a connection. (Some dialers may use a different
button or present another dialog box to let you end a connection.) If your ISP
or telephone company charges by the minute, remember to do this or you''ll get
an unexpectedly large bill!
Adjusting
Configuration Scripts
GUI dialers are a convenient way to get started with PPP, but
they aren''t ideal for all situations. For instance, if you want to initiate a
PPP connection automatically, a GUI dialer won''t do the job, because it
requires manual intervention to begin the call. For this reason, PPP connection
scripts can also initiate connections. You may use these scripts manually or as
part of an auto-dialing scheme, as discussed in the next section, "
scripts requires setting authentication options and configuring the scripts
themselves.
Setting
PPP Authentication Options
As noted earlier, most ISPs use a protocol called PAP for
authenticating dial-in users. In order to use this protocol from a dialing
script, you need to edit the file /etc/ppp/pap-secrets .
(A similar file, called /etc/ppp/
chap-secrets , is used by another protocol that some ISPs use. Both
files use the same format, so you can edit both, if you like.) This file
consists of a series of lines, one for each PPP account you have. The format of
each line is as follows:
username server password IP_address
Each of these elements is separated by one or more spaces or
tabs. Their meanings are as follows:
username
This is the username to be used on the ISP''s system. This username is unrelated
to your Linux username; it''s the one your ISP gave you.
server
This is the name of the computer to which yours communicates. You don''t
normally know this name, so this field should contain a single asterisk ( * ), to denote that PPP will accept any
hostname.
password
As you might guess, this is the password on the remote system.
IP_address
This is the IP address your system expects to get. Most PPP systems don''t
guarantee you a specific IP address, so this field is empty (the line has only
three fields).
WARNING
align=left border=0> The pap-secrets
file must store the password in an unencrypted form. This fact means that the
file is extremely sensitive; if an unauthorized party obtains the file, that
individual will be able to use your PPP account without your authorization.
If possible, you shouldn''t use this password for anything other than basic
access; try to use a different password for e-mail retrieval or to log on to
any other computer or network, for instance. For security, most distributions
ship with pap-secrets set to root ownership, and only root has read access to the file. You
should leave it this way unless you have a good reason for changing it.
Most systems connect to just one ISP, so the pap-secrets file will have just one line.
This line might resemble the following:
penguin * w8terfow1
Configuring
Dialing Scripts
Once you''ve set up the PAP or CHAP authentication file, you
can begin adjusting the dialing scripts themselves. Because GUI dialers have
become so prevalent, most distributions now hide these scripts in a
documentation directory, such as /usr/share/doc/ppp-version/scripts ,
where version is the
version of PPP your distribution uses, such as 2.4.0 .
There are three scripts that are of interest:
ppp-on
This script sets important variables, such as your ISP''s telephone number, and
calls the Linux PPP utility ( pppd ).
ppp-on-dialer
ppp-on passes this script to pppd , which uses it to control the initial
stages of communication with the ISP''s system.
ppp-off
This script terminates a PPP session.
You''ll need to modify ppp-on ,
and possibly ppp-on-dialer , in
order to connect to an ISP. You''ll also probably want to move all three scripts
to a convenient location, like /usr/local/bin .
In ppp-on , set the following
items:
Locate the TELEPHONE
variable and set it to your ISP''s telephone number. For instance, the line
might read TELEPHONE=555-9876
when it''s set correctly.
Set the values for the ACCOUNT
and PASSWORD variables. If your
ISP uses PAP, these variables won''t actually be used, so you should set them to
some dummy values, such as the values they contain by default.
If your ISP provides you with a fixed IP address or if you know
the IP address of the system to which you''ll be connecting, you can set the LOCAL_IP and REMOTE_IP variables appropriately. Likewise, you can change
the NETMASK variable if you know
what your network mask should be. You can usually leave all three of these
variables alone.
Locate the DIALER_SCRIPT
variable and set it to point to the location of your ppp-on-dialer script. (Point to the copy
you intend to modify, not the original in the documentation directory.) The
default value is /etc/ppp/ppp-on-dialer ,
and you can put your script there if you like.
The end of the script is a call to pppd . This is Linux''s PPP tool, and it supports a large
number of options. You should not have to modify most of these, but there are
some exceptions. Specifically, you may need to set the device file used by your
modem (the default is usually /dev/ttyS0 ),
as well as the connection speed (the default is normally 38400 , but 115200 usually works better).
Once you''ve adjusted your ppp-on
script to your needs, you should examine the ppp-on-dialer
script. This script controls pppd ''s
interactions with your modem, including sending the commands that cause it to
dial, and any interactions required to log in if your ISP doesn''t use PAP or
CHAP. The script does this by calling a utility known as chat , which handles automated exchanges
with tools that expect text-based input. Most of this script is a series of
expect/reply strings, arranged in columns. The first column is the value for
which the script looks, and the second column is the response that chat sends in response. Some of these,
such as an expect value of ABORT ,
carry special meaning; for instance, ABORT
tells chat when to halt because
of an error. Most of the lines end in a backslash ( \ ), the common convention for a line continuation. (In
reality, chat expects a single
line with interspersed expect/reply pairs; they''re grouped in columns only for
the convenience of humans.) The final line lacks a backslash.
The main feature that may need adjustment is the final three
lines of the ppp-on-dialer
script. The default script is usually written with the expectation that the ISP
is not using PAP, so it concludes with two
lines that echo your username and password (as entered in the ACCOUNT and PASSWORD variables in ppp-on ).
You may need to delete these lines or comment them out (by preceding them with
pound signs, # ). If you do this,
you''ll also have to remove the backslash from the third-to-last line, which
normally begins with an expect string of CONNECT .
Removing these final two lines and adjusting the preceding one will cause chat
to terminate immediately after connection, whereupon pppd will try to use PAP or CHAP to
authenticate the connection. If your ISP does not
use PAP or CHAP, you may need to modify the expect portions of these lines to
match the prompts your ISP uses for your username and password, and possibly
add more prompts if you have to enter additional commands yourself, such as a
command to explicitly start PPP on the ISP''s system.
Using
PPP Dialing Scripts
Editing the script files is the most difficult part of initiating
a PPP connection via these scripts. When this task is done, you need only type ppp-on (preceded by a complete path to
the script, if you didn''t put it somewhere on your path) to initiate a
connection. If your modem is external, you should see its lights blink, and if
it''s configured to echo sounds to its speaker during dialing, you should hear
this process. If all goes well, after a few seconds you should be able to
access the Internet using Linux''s normal networking tools.
If you encounter problems, you should first check the log file
to which pppd logs its actions
(normally /var/log/messages ).
The end of this file should contain information on pppd ''s actions, including whatever caused it to faila
timeout waiting for PAP, a failure when running chat , or what have you. If this output is cryptic or
doesn''t provide you with the clues you need, try searching for keywords related
to your problem on http://groups.google.com . This site hosts
archives of recent posts to Usenet newsgroups, where discussions of problems
with PPP and other Linux networking tools frequently appear. Searching there
will quite possibly turn up an answer, or at least a lead you can follow. The
PPP HOWTO document, mentioned earlier, also has PPP debugging tips.
One drawback to connecting via scripts is that most
distributions are configured in such a way that only root may initiate a PPP connection. This
can be an important security measure on a multi-user system, because you may
not want unauthorized personnel making random PPP connections. It can be a
nuisance, though. The GUI dialers get around this problem by using the set user
ID (SUID) bit to have the GUI dialer run with root
privileges. Of course, this opens up the system to the security problems of
allowing random users access to the dialer. (You may restrict execute
privileges to the GUI dialer by creating a PPP users group, assigning the GUI
dialer to that group, and denying world execute privileges on the program.) Many ISPs communicate the IP addresses of DNS servers along
with other information as part of the PPP negotiation. Sometimes, though,
you''ll need to enter this information in /etc/resolv.conf
yourself, as described earlier in this chapter in "
set up your DNS servers permanently.
Configuring
Dial-on-Demand
When your computer is used primarily as a
single-user workstation, GUI dialers or manually launched scripts like ppp-on are
good methods of initiating PPP connections. In a multi-user environment,
though, these tools have their problems. Users could try to initiate
connections when they''re already up, terminate connections when other users are
using them, or accidentally leave connections active for long periods of time. For
this reason, Linux supports a procedure known as dial-on-demand,
which is implemented through a program called diald . This tool detects
outgoing network traffic, initiates a PPP connection in response to the
traffic, and terminates the connection after a specified period of time with no
network activity. The result is that users may use network tools almost as if
they were on an always-up network connection; they need take no explicit
actions to start or stop the PPP link. There will be a delay, however, between
the time when diald detects the outgoing traffic and the time the connection is
finished (after all, the system has to dial the modem, and the modem must
negotiate the connection). If you program the system to drop a connection too
soon after the cessation of network activity, this can result in annoying
delays during normal network usesay, a long pause when a user clicks on a link
in a Web page, because the connection timed out when the user was reading the
first page.
To use diald , you must have SLIP
support compiled in your kernel, as described in
because diald uses SLIP to set up a virtual connection, essentially linking your
computer to the diald program itself. Programs therefore see an always-up network
interface, and diald receives the network traffic so that it can control when to
initiate the real connection.
Unfortunately, most Linux distributions don''t
ship with diald . You can obtain the package from its home Web site,
or you can search for a prebuilt binary on
The diald program is
controlled through three configuration files:
/etc/diald.conf This file sets many of the configuration options that are normally
handled by ppp-on , including the modem device filename ( device ) and connect speed
( speed ). The local and remote options set the IP addresses used internally by diald . You
should set both addresses to ones on the same network segment, but neither
address should be used on the Internet or your own local network (if you have
one). Addresses in the 192.168.
x.x range are
typically good choices.
/etc/ppp/diald-dialer This file is essentially identical to the ppp-on-dialer script described earlier. You should adjust it just as you would ppp-on-dialer .
/usr/lib/diald/standard.filter This file defines the timeout periods that diald uses to
decide when to drop a connection. You can specify different types of
connections by the destination connection type, as shown in /etc/services .
In each case, you tell diald to remain up for a given number of seconds. The default file should
be a reasonable starting point, and you can modify it if you find that diald is
dropping connections too soon.
In addition to these configuration files, you
must edit your /etc/ppp/
pap-secrets or /etc/ppp/chap-secrets file if your ISP uses PAP or CHAP, just as for a regular script-based PPP
connection. You may also need to enter your ISP''s DNS server addresses in /etc/resolv.conf , as described earlier. To use diald , type /usr/sbin/diald as root to start the program. It should then detect outgoing network
activity and initiate a connection. Because of the connection delays, though, a
first attempt to use a tool may fail; for instance, a Web browser may time out
before it can display a page. The second attempt should work, though.
If you want your system to start diald automatically when it boots, you can create a SysV
startup script, or add an entry to a local startup script, such as /etc/rc.d/rc.local or /etc/rc.d/boot.local . Whether you start it
manually or automatically, diald
can detect network traffic that originates on a local network if you configure
your computer to function as a NAT router, as described in
network to the Internet via a Linux computer and modem, and configure your
local computers as if they were on the Internet at large, using the Linux
system as the local gateway.
