This is the command that calls pppd with the correct chat script, the correct options, and correct UID permission.
It allows a 'plain user' to bring a ppp link up or down without knowing the root password.
Some people prefer the scripts /usr/sbin/ppp-on and ppp-off. Many apps might try to use them, so you could rewrite them as
#!/bin/sh # ppp-on /etc/ppp/dial_ppp tdc and #!/bin/sh # ppp-off /etc/ppp/dial_ppp cut
This is still "secure", as only members of the "dial_ppp" group (or root) can run the dial_ppp command.
Add a new group, called dial_ppp. Members are allowed to start and stop pre-configured ppp links. Add the people to the line
dial_ppp::19:gps,fred,kt
You don't have to, but now is a good time to add a new group, called "phone". Members are allowed to use the modem at any time of the day for sesson type calls (eg minicom). the email ppp link, send faxes, make calls, etc.
dial_ppp and phone have nothing to do with each other. /etc/ppp/dial_ppp works by refusing non members of the dial_ppp group, who don't have permission to run the binary.
It then gives root uid and exec's a semi-safe script passing argv through untouched.
minicom and fax work by group permission on /dev/modem (or by a script such as this one!).
After editing /etc/group, those users will have to logout/login, for it to take effect.
Here is a program. Type it in. Compile it.
/* /etc/ppp/dial_ppp.c */ #include <unistd.h> #include <errno.h> #include <stdio.h> main( int argc, char ** argv, char ** envp ) { if( setgid(getegid()) ) perror( "setgid" ); if( setuid(geteuid()) ) perror( "setuid" ); execve( "/etc/ppp/dial_ppp.sh", argv, envp ); perror( argv[0] ); return errno; }
This is the only time the group permission is used, provided the chmod is done correctly.
The owner of the file will be the process UID.
It isn't 6755, because we only want members of the group to be able to run this command, and that zero stops them.
It can be 4750 or 6750, it makes no difference here.
The suid bit is fragile! If you chgrp or chown the file, you will have to chmod it again. Similarly recompiling needs a new chmod. If there is a Makefile, eg dial_ppp.mk, it should do that for you.
You might wish to allow the command to appear in ALL users space, so that they can run it by accident, when browsing for gif converters.
ln -s /etc/ppp/dial_ppp /usr/bin
This is the command that gets run. It is a suid shell script so be careful.
Edit the parts that have "tdc", that's the name of the isp. Put your details there.
#!/bin/sh # /etc/ppp/dial_ppp.sh # echo "Running: $0 $* (\$#=$#)" loc="tdc_me" rem="" speed=38400 modem=/dev/modem OPTIONS="debug lock crtscts modem defaultroute persist" PATH="/usr/sbin:$PATH" case "$1" in help) echo "$0" "$@" "# see /etc/ppp/." exit 1 ;; id) id ;; cut) killall pppd ;; ppp_tdc) exec /etc/ppp/ppp_tdc ;; tdc) rem="" chat_script=/etc/ppp/chat_tdc # rem="tdc_gw" # allow remote to supply ip_addr set -x pppd connect "chat -v -f $chat_script" \ "$modem" $speed $OPTIONS \ "$loc:$rem" ;; list) echo "tdc # PPP link to dircon" # used by menu ;; *) echo "BAD USAGE: $0 $*" exit 1 esac
chat does the actual modem initialisation and dialing. This script is alternating, expect '' send ATZ, expect 'OK' send AT Q0 ...,
I wish chat had a spectial line-string character such as @ that didn't echo the password into the trace files! You may need chmod 640 /var/log/messages to keep it's contents private.
ABORT BUSY ABORT 'NO CARRIER' ABORT 'NO DIAL TONE' REPORT CONNECT '' ATZ TIMEOUT 5 OK 'AT Q0 V1 E1 X4 L1 W1 S95=47 M1 I4' OK 'ATDT 0181 265 2211' TIMEOUT 45 CONNECT '' TIMEOUT 10 login: trix Password: password Protocol: ppp
This is another shell script that also gets run as root, as does /etc/ppp/ip-down. I don't have to fetch email, but running finger @mailhost sooner, wakes it's sendmail up, and tells me when it's finished. That's local.
#!/bin/sh mailq sleep 2 sendmail -q finger @felix # seems to leave one in queue finger @felix # you might use popclient - faster echo "$0 $* exit $?" >> /var/log/messages
Mine is blank, but you can put the modem baud rate and options in there. Much tidier if you do.
Your ISP's PPP setup may be different than Dircon's ("The Direct Connection"). You might have to negociate your secret key challenge, but your ISP should tell you what settings you need.
This option tells pppd, to redial if the connecton drops.
Note that if the chat script fails (eg BUSY), it won't redial again, if that is a problem, look at diald. Note that this is a new feature, and might not be in your pppd.
You have got to have "tdc_me" and tdc_gw in /etc/hosts. These are alias names for the IP addresses of the two ends of the ppp link.
If you don't specify them, you can't complain about what the other end thinks it's called, or request it to become what you want.
You need a menu to call your new command. I used tcl+tk. The lines you have to call are:
dial_ppp tdc - to connect to the tdc isp dial_ppp cut - to cut the ppp linkI'm not sure what is the correct way to bring a pppd link down, as I only have one, so I kill all of them. There is probably a better way of recording the pid and naming it later, or ifconfig ppp0 down
If you flit between different ISP's, you will need to change your selected nameserver to avoid timeouts. The ppp_script would also switch over the necessary /etc/resolv.conf file.
You probably want ppp-2.2.0f or better, if you are running a 1.3 or 2.0 kernel. If you want to use dip instead (for a SLIP link), you may need to edit the scripts so that it isn't called "dial_ppp"
dial_ppp is a nifty utility, I use it every day!
To make dial_ppp avaiable to everybody, without requiring them purchase Raven Issue-3, I am creating a .tgz file, and putting it on sunsite.unc.edu as Free software. system/Network/Serial
The package is much the same as this article, but may differ in a few details, and it's easier to use install it, than type it in from scratch! The package will get maintained seperately from this article.
In addition to making the software Free, I shall be bundling this article, to help document it, and a rather neat Tcl/tk menu utiltity. Note that the article and menu-utility are "contributed", and not Freely modifyable, but I think you'd rather have them than not.
IE the dial_ppp.html article may NOT be edited, but can be freely distributed as-is.
The dial_ppp.tcl code can only be customised to your configuration, you can't sell it, or derive from it. It is "on-loan" for 1 year.
The rest of dial_ppp.tgz is Free.
Watch this space!