Previous Next Table of Contents

7. dial_ppp

This is the command that calls pppd with the correct chat script, the correct options, and correct UID permission.

It allows a 'plain user' to bring a ppp link up or down without knowing the root password.

Some people prefer the scripts /usr/sbin/ppp-on and ppp-off. Many apps might try to use them, so you could rewrite them as

        #!/bin/sh
        # ppp-on
        /etc/ppp/dial_ppp tdc
and
        #!/bin/sh
        # ppp-off
        /etc/ppp/dial_ppp cut

This is still "secure", as only members of the "dial_ppp" group (or root) can run the dial_ppp command.

7.1 /etc/group

Add a new group, called dial_ppp. Members are allowed to start and stop pre-configured ppp links. Add the people to the line

        dial_ppp::19:gps,fred,kt 

You don't have to, but now is a good time to add a new group, called "phone". Members are allowed to use the modem at any time of the day for sesson type calls (eg minicom). the email ppp link, send faxes, make calls, etc.

dial_ppp and phone have nothing to do with each other. /etc/ppp/dial_ppp works by refusing non members of the dial_ppp group, who don't have permission to run the binary.

It then gives root uid and exec's a semi-safe script passing argv through untouched.

minicom and fax work by group permission on /dev/modem (or by a script such as this one!).

After editing /etc/group, those users will have to logout/login, for it to take effect.

7.2 /etc/ppp/dial_ppp.c

Here is a program. Type it in. Compile it.

/* /etc/ppp/dial_ppp.c */

#include <unistd.h>
#include <errno.h>
#include <stdio.h>

main( int argc, char ** argv, char ** envp )
{
        if( setgid(getegid()) ) perror( "setgid" );
        if( setuid(geteuid()) ) perror( "setuid" );
        execve( "/etc/ppp/dial_ppp.sh", argv, envp );
        perror( argv[0] );
        return errno;
}

7.3 chgrp dial_ppp /etc/ppp/dial_ppp

This is the only time the group permission is used, provided the chmod is done correctly.

7.4 chown root /etc/ppp/dial_ppp

The owner of the file will be the process UID.

7.5 chmod 6750 /etc/ppp/dial_ppp

It isn't 6755, because we only want members of the group to be able to run this command, and that zero stops them.

It can be 4750 or 6750, it makes no difference here.

The suid bit is fragile! If you chgrp or chown the file, you will have to chmod it again. Similarly recompiling needs a new chmod. If there is a Makefile, eg dial_ppp.mk, it should do that for you.

You might wish to allow the command to appear in ALL users space, so that they can run it by accident, when browsing for gif converters.

ln -s /etc/ppp/dial_ppp /usr/bin

7.6 /etc/ppp/dial_ppp.sh

This is the command that gets run. It is a suid shell script so be careful.

Edit the parts that have "tdc", that's the name of the isp. Put your details there.

#!/bin/sh
# /etc/ppp/dial_ppp.sh
#  echo "Running: $0 $* (\$#=$#)"
loc="tdc_me"
rem=""
speed=38400
modem=/dev/modem
OPTIONS="debug lock crtscts modem defaultroute persist"
PATH="/usr/sbin:$PATH"
case "$1"
in
        help)   echo "$0" "$@" "# see /etc/ppp/."
                exit 1

;;      id)     id

;;      cut)    killall pppd

;;      ppp_tdc)
                exec /etc/ppp/ppp_tdc 

;;      tdc)    
                rem="" 
                chat_script=/etc/ppp/chat_tdc
                # rem="tdc_gw" # allow remote to supply ip_addr
                
                set -x
                pppd connect "chat -v -f $chat_script" \
                        "$modem" $speed $OPTIONS \
                        "$loc:$rem"

;;      list)   echo "tdc # PPP link to dircon" # used by menu

;;      *)      echo "BAD USAGE: $0 $*"
                exit 1
esac

7.7 /etc/ppp/chat_tdc

chat does the actual modem initialisation and dialing. This script is alternating, expect '' send ATZ, expect 'OK' send AT Q0 ...,

I wish chat had a spectial line-string character such as @ that didn't echo the password into the trace files! You may need chmod 640 /var/log/messages to keep it's contents private.

        ABORT BUSY
        ABORT 'NO CARRIER'
        ABORT 'NO DIAL TONE'
        REPORT CONNECT
        '' ATZ
        TIMEOUT 5
        OK 'AT Q0 V1 E1 X4 L1 W1 S95=47 M1 I4'
        OK 'ATDT 0181 265 2211'
        TIMEOUT 45
        CONNECT ''
        TIMEOUT 10
        login: trix
        Password: password
        Protocol: ppp

7.8 /etc/ppp/ip-up

This is another shell script that also gets run as root, as does /etc/ppp/ip-down. I don't have to fetch email, but running finger @mailhost sooner, wakes it's sendmail up, and tells me when it's finished. That's local.

        #!/bin/sh
         mailq
         sleep 2
         sendmail -q
         finger @felix # seems to leave one in queue
         finger @felix # you might use popclient - faster
         echo "$0 $* exit $?" >> /var/log/messages

7.9 /etc/ppp/options

Mine is blank, but you can put the modem baud rate and options in there. Much tidier if you do.

Your ISP's PPP setup may be different than Dircon's ("The Direct Connection"). You might have to negociate your secret key challenge, but your ISP should tell you what settings you need.

7.10 persist

This option tells pppd, to redial if the connecton drops.

Note that if the chat script fails (eg BUSY), it won't redial again, if that is a problem, look at diald. Note that this is a new feature, and might not be in your pppd.

7.11 Anything else ?

You have got to have "tdc_me" and tdc_gw in /etc/hosts. These are alias names for the IP addresses of the two ends of the ppp link.

If you don't specify them, you can't complain about what the other end thinks it's called, or request it to become what you want.

You need a menu to call your new command. I used tcl+tk. The lines you have to call are:

        dial_ppp tdc    - to connect to the tdc isp
        dial_ppp cut    - to cut the ppp link
I'm not sure what is the correct way to bring a pppd link down, as I only have one, so I kill all of them. There is probably a better way of recording the pid and naming it later, or ifconfig ppp0 down

If you flit between different ISP's, you will need to change your selected nameserver to avoid timeouts. The ppp_script would also switch over the necessary /etc/resolv.conf file.

You probably want ppp-2.2.0f or better, if you are running a 1.3 or 2.0 kernel. If you want to use dip instead (for a SLIP link), you may need to edit the scripts so that it isn't called "dial_ppp"

7.12 ANNOUCE: dial_ppp.tgz

dial_ppp is a nifty utility, I use it every day!

To make dial_ppp avaiable to everybody, without requiring them purchase Raven Issue-3, I am creating a .tgz file, and putting it on sunsite.unc.edu as Free software. system/Network/Serial

The package is much the same as this article, but may differ in a few details, and it's easier to use install it, than type it in from scratch! The package will get maintained seperately from this article.

In addition to making the software Free, I shall be bundling this article, to help document it, and a rather neat Tcl/tk menu utiltity. Note that the article and menu-utility are "contributed", and not Freely modifyable, but I think you'd rather have them than not.

IE the dial_ppp.html article may NOT be edited, but can be freely distributed as-is.

The dial_ppp.tcl code can only be customised to your configuration, you can't sell it, or derive from it. It is "on-loan" for 1 year.

The rest of dial_ppp.tgz is Free.

Watch this space!


Previous Next Table of Contents