Home | History | Annotate | only in /src/external/bsd/ppp/dist
Up to higher level directory
NameDateSize
AUTHORS08-Jan-2025179
autogen.sh08-Jan-2025475
ChangeLog08-Jan-202590
Changes-2.408-Jan-20259.6K
chat/25-Feb-2026
configure.ac08-Jan-202511.7K
COPYING08-Jan-2025278
FAQ28-Nov-201325.3K
LICENSE.BSD08-Jan-20251.5K
LICENSE.GPL-208-Jan-202517.7K
m4/25-Feb-2026
NEWS08-Jan-20259.8K
PLUGINS08-Jan-202514K
pppd/25-Feb-2026
pppdump/25-Feb-2026
pppstats/25-Feb-2026
README08-Jan-20258K
README.cbcp08-Jan-20252K
README.eap-srp28-Nov-20136.2K
README.eap-tls08-Jan-20258.7K
README.MPPE28-Nov-20132.8K
README.MSCHAP8008-Jan-20256.1K
README.MSCHAP8128-Nov-20132.4K
README.pppol2tp28-Nov-20132.5K
README.pwfd28-Nov-20133.5K
sample/25-Feb-2026
SECURITY.md08-Jan-2025212
SETUP28-Nov-20134.1K
Submitting-patches.md09-Jan-20214.6K

README

      1 This is the README file for ppp-2.5, a package which implements the
      2 Point-to-Point Protocol (PPP) to provide Internet connections over
      3 serial lines and other types of links which can be considered to be
      4 point-to-point links.
      5 
      6 
      7 Introduction.
      8 *************
      9 
     10 The Point-to-Point Protocol (PPP) provides a standard way to establish
     11 a network connection over a serial link.  At present, this package
     12 supports IP and IPV6 and the protocols layered above them, such as TCP
     13 and UDP.
     14 
     15 This PPP implementation consists of two parts:
     16 
     17 - Kernel code, which establishes a network interface and passes
     18 packets between the serial port, the kernel networking code and the
     19 PPP daemon (pppd).  This code is implemented using STREAMS modules on
     20 Solaris, and as a line discipline under Linux.
     21 
     22 - The PPP daemon (pppd), which negotiates with the peer to establish
     23 the link and sets up the ppp network interface.  Pppd includes support
     24 for authentication, so you can control which other systems may make a
     25 PPP connection and what IP addresses they may use.
     26 
     27 The platforms supported by this package are Linux and Solaris.
     28 (There is also code to support various old flavours of Unix in the git
     29 repository, but it is quite old and unmaintained.)
     30 
     31 The kernel code for Linux is no longer distributed with this package,
     32 since the relevant kernel code is in the official Linux kernel source
     33 (and has been for many years) and is included in all reasonably modern
     34 Linux distributions.  The Linux kernel code supports using PPP over
     35 things other than serial ports, such as PPP over Ethernet and PPP over
     36 ATM.
     37 
     38 Similarly, the kernel code for Solaris is no longer distributed with
     39 this package.  See the Illumos web site for pointers to the kernel
     40 module source code and build environment.
     41 
     42   https://www.illumos.org/
     43 
     44 
     45 Installation.
     46 *************
     47 
     48 The file SETUP contains general information about setting up your
     49 system for using PPP.  There is also a README file for each supported
     50 system, which contains more specific details for installing PPP on
     51 that system.  The supported systems, and the corresponding README
     52 files, are:
     53 
     54 	Linux				README.linux
     55 	Solaris				README.sol2
     56 
     57 In each case you start by running the ./configure script.  This works
     58 out which operating system you are using and creates the appropriate
     59 makefiles.  You then run `make' to compile the user-level code, and
     60 (as root) `make install' to install the user-level programs pppd, chat
     61 and pppstats.
     62 
     63 N.B. Since 2.3.0, leaving the permitted IP addresses column of the
     64 pap-secrets or chap-secrets file empty means that no addresses are
     65 permitted.  You need to put a "*" in that column to allow the peer to
     66 use any IP address.  (This only applies where the peer is
     67 authenticating itself to you, of course.)
     68 
     69 
     70 What's new in ppp-2.5.2
     71 ***********************
     72 
     73 * Some old and probably unused code has been removed, notably the
     74   pppgetpass program and the passprompt plugin, and some of the files
     75   in the sample and scripts directories.
     76 
     77 * If a remote number has been set, it is available to scripts in the
     78   REMOTENUMBER environment variable.
     79 
     80 * The Solaris port has been updated, including updated installation
     81   instructions in README.sol2.
     82 
     83 * Various other bug fixes and minor enhancements.
     84 
     85 
     86 What was new in ppp-2.5.1
     87 *************************
     88 
     89 * The files copied to /etc/ppp (or <sysconfdir>/ppp) now have
     90   ".example" appended to their filenames, so as to indicate that they
     91   are just examples, and to avoid overwriting existing configuration
     92   files.
     93 
     94 * Pppd can now measure and log the round-trip time (RTT) of LCP
     95   echo-requests and record them in a binary file structured as a
     96   circular buffer.  Other programs or scripts can examine the file and
     97   provide real-time statistics on link latency.  This is enabled by a
     98   new "lcp-rtt-file" option.
     99 
    100 * New scripts net-init, net-pre-up and net-down are executed in the
    101   process of bringing the network interface up and down.  They provide
    102   additional, more deterministic ways for pppd to interact with the
    103   rest of the networking configuration.
    104 
    105 * New options have been added to allow the system administrator to
    106   set the location of various scripts and secrets files.
    107 
    108 * A new "noresolvconf" option tells pppd not to write the
    109   /etc/ppp/resolv.conf file; DNS server addresses, if obtained from
    110   the peer, are still passed to scripts in the environment.
    111 
    112 * Pppd will now create the directory for the TDB connection database
    113   if it doesn't already exist.
    114 
    115 * Kernel module code for Solaris is no longer included.
    116 
    117 * Support for decompressing compressed packets has been removed from
    118   pppdump, because the zlib code used was old and potentially
    119   vulnerable.
    120 
    121 * Some old code has been removed.
    122 
    123 * Various other bug fixes and minor enhancements.
    124 
    125 
    126 What was new in ppp-2.5.0.
    127 **************************
    128 
    129 The 2.5.0 release is a major release of pppd which contains breaking 
    130 changes for third-party plugins, a complete revamp of the build-system
    131 and that allows for flexibility of configuring features as needed.
    132 
    133 In Summary:
    134 * Support for PEAP authentication by Eivind Nss and Rustam Kovhaev
    135 * Support for loading PKCS12 certificate envelopes 
    136 * Adoption of GNU Autoconf / Automake build environment, by Eivind Nss
    137   and others.
    138 * Support for pkgconfig tool has been added by Eivind Nss.
    139 * Bunch of fixes and cleanup to PPPoE and IPv6 support by Pali Rohr.
    140 * Major revision to PPPD's Plugin API by Eivind Nss.
    141   - Defines in which describes what features was included in pppd
    142   - Functions now prefixed with explicit ppp_* to indicate that
    143     pppd functions being called.
    144   - Header files were renamed to better align with their features,
    145     and now use proper include guards
    146   - A pppdconf.h file is supplied to allow third-party modules to use
    147     the same feature defines pppd was compiled with.
    148   - No extern declarations of internal variable names of pppd, 
    149     continued use of these extern variables are considered 
    150     unstable.
    151 * Lots of internal fixes and cleanups for Radius and PPPoE by Jaco Kroon
    152 * Dropped IPX support, as Linux has dropped support in version 5.15
    153   for this protocol.
    154 * Many more fixes and cleanups.
    155 * Pppd is no longer installed setuid-root.
    156 * New pppd options:
    157   - ipv6cp-noremote, ipv6cp-nosend, ipv6cp-use-remotenumber,
    158     ipv6-up-script, ipv6-down-script
    159   - -v, show-options
    160   - usepeerwins, ipcp-no-address, ipcp-no-addresses, nosendip
    161 * On Linux, any baud rate can be set on a serial port provided the
    162   kernel serial driver supports that.
    163 
    164 Note that if you have built and installed previous versions of this
    165 package and you want to continue having configuration and TDB files in
    166 /etc/ppp, you will need to use the --sysconfdir option to ./configure.
    167 
    168 For a list of the changes made during the 2.4 series releases of this
    169 package, see the Changes-2.4 file.
    170 
    171 
    172 Compression methods.
    173 ********************
    174 
    175 This package supports two packet compression methods: Deflate and
    176 BSD-Compress.  Other compression methods which are in common use
    177 include Predictor, LZS, and MPPC.  These methods are not supported for
    178 two reasons - they are patent-encumbered, and they cause some packets
    179 to expand slightly, which pppd doesn't currently allow for.
    180 BSD-Compress and Deflate (which uses the same algorithm as gzip) don't
    181 ever expand packets.
    182 
    183 
    184 Contacts.
    185 *********
    186 
    187 Most communication relating to this package happens on github at
    188 https://github.com/ppp-project/ppp/.  The linux-ppp (a] vger.kernel.org
    189 mailing list also exists and can be used.
    190 
    191 If you find bugs in this package, the best thing to do is to create an
    192 issue on github.  If you can't or don't want to do that, you can post
    193 to linux-ppp (a] vger.kernel.org, or report them to the maintainer for the
    194 port for the operating system you are using:
    195 
    196 Linux			Paul Mackerras <paulus (a] ozlabs.org>
    197 Solaris			James Carlson <carlsonj (a] workingcode.com>
    198 
    199 
    200 Copyrights:
    201 ***********
    202 
    203 All of the code can be freely used and redistributed.  The individual
    204 source files each have their own copyright and permission notice.
    205 Pppd, pppstats and pppdump are under BSD-style notices.  Some of the
    206 pppd plugins are GPL'd.  Chat has an MIT licence notice.
    207 
    208 
    209 Distribution:
    210 *************
    211 
    212 The primary site for releases of this software is:
    213 
    214 	ftp://ftp.samba.org/pub/ppp/
    215 
    216 
    217 

README.cbcp

      1 	     Microsoft Call Back Configuration Protocol.
      2 			by Pedro Roque Marques
      3 			(updated by Paul Mackerras)
      4 
      5 The CBCP is a method by which the Microsoft Windows NT Server may
      6 implement additional security. It is possible to configure the server
      7 in such a manner so as to require that the client systems which
      8 connect with it are required that following a valid authentication to
      9 leave a method by which the number may be returned call.
     10 
     11 It is a requirement of servers to be so configured that the protocol be
     12 exchanged.
     13 
     14 So, this set of patches may be applied to the pppd process to enable
     15 the cbcp client *only* portion of the specification. It is primarily
     16 meant to permit connection with Windows NT Servers.
     17 
     18 The ietf-working specification may be obtained from ftp.microsoft.com
     19 in the developr/rfc directory.
     20 
     21 The ietf task group has decided to recommend that the LCP sequence be
     22 extended to permit the callback operation. For this reason, these
     23 patches are not 'part' of pppd but are an adjunct to the code.
     24 
     25 CBCP support is enabled or disabled in pppd at configure time using the
     26 --enable-cbcp and --disable-cbcp arguments to ./configure.  The default
     27 is disabled.
     28 
     29 I use such script to make a callback:
     30 
     31 pppd debug nodetach /dev/modem 115200 crtscts modem	\
     32 callback 222222 name NAME remotename SERVER	\
     33 connect 'chat -v "" atz OK atdt111111 CONNECT ""'
     34 sleep 1
     35 pppd debug /dev/modem 115200 crtscts modem	\
     36 name NAME remotename SERVER defaultroute	\
     37 connect 'chat -v RING ATA CONNECT "\c"'
     38 
     39 First we invoke pppd with 'nodetach' option in order to not detach from
     40 the controlling terminal and 'callback NUMBER' option, then wait for
     41 1 second and invoke pppd again which waits for a callback (RING) and
     42 then answers (ATA). Number 222222 is a callback number, i.e. server will
     43 call us back at this number, while number 111111 is the number we are
     44 calling to.
     45 
     46 You have to put in /etc/ppp/chap-secrets the following two lines:
     47 
     48 NAME SERVER PASSWORD
     49 SERVER NAME PASSWORD
     50 
     51 You have to use your real login name, remote server name and password.
     52 
     53 

README.eap-srp

      1 EAP with MD5-Challenge and SRP-SHA1 support
      2 by James Carlson, Sun Microsystems
      3 Version 2, September 22nd, 2002
      4 
      5 
      6 1.  What it does
      7 
      8     The Extensible Authentication Protocol (EAP; RFC 2284) is a
      9     security protocol that can be used with PPP.  It provides a means
     10     to plug in multiple optional authentication methods.
     11 
     12     This implementation includes the required default MD5-Challenge
     13     method, which is similar to CHAP (RFC 1994), as well as the new
     14     SRP-SHA1 method.  This latter method relies on an exchange that is
     15     not vulnerable to dictionary attacks (as is CHAP), does not
     16     require the server to keep a cleartext copy of the secret (as in
     17     CHAP), supports identity privacy, and produces a temporary shared
     18     key that could be used for data encryption.
     19 
     20     The SRP-SHA1 method is based on draft-ietf-pppext-eap-srp-03.txt,
     21     a work in progress.
     22 
     23 2.  Required libraries
     24 
     25     Two other packages are required first.  Download and install
     26     OpenSSL and Thomas Wu's SRP implementation.
     27 
     28 	http://www.openssl.org/ (or ftp://ftp.openssl.org/source/)
     29 	http://srp.stanford.edu/
     30 
     31     Follow the directions in each package to install the SSL and SRP
     32     libraries.  Once SRP is installed, you may run tconf as root to
     33     create known fields, if desired.  (This step is not required.)
     34 
     35 3.  Installing the patch
     36 
     37     The EAP-SRP patch described here is integrated into this version
     38     of pppd.  The following patch may be used with older pppd sources:
     39 
     40 	ftp://playground.sun.com/carlsonj/eap/ppp-2.4.1-eap-1.tar.gz
     41 
     42     Configure, compile, and install as root.  You may want to edit
     43     pppd/Makefile after configuring to enable or disable optional
     44     features.
     45 
     46 	% ./configure
     47 	% make
     48 	% su
     49 	# make install
     50 
     51     If you use csh or tcsh, run "rehash" to pick up the new commands.
     52 
     53     If you're using Solaris, and you run into trouble with the
     54     pseudonym feature on the server side ("no DES here" shows in the
     55     log file), make sure that you have the "domestic" versions of the
     56     DES libraries linked.  You should see "crypt_d" in "ldd
     57     /usr/local/bin/pppd".  If you see "crypt_i" instead, then make
     58     sure that /usr/lib/libcrypt.* links to /usr/lib/libcrypt_d.*.  (If
     59     you have the international version of Solaris, then you won't have
     60     crypt_d.  You might want to find an alternative DES library.)
     61 
     62 4.  Adding the secrets
     63 
     64     On the EAP SRP-SHA1 client side, access to the cleartext secret is
     65     required.  This can be done in two ways:
     66 
     67 	- Enter the client name, server name, and password in the
     68           /etc/ppp/srp-secrets file.  This file has the same format as
     69           the existing chap-secrets and pap-secrets files.
     70 
     71 	  clientname servername "secret here"
     72 
     73 	- Use the "password" option in any of the standard
     74           configuration files (or the command line) to specify the
     75           secret.
     76 
     77 	  password "secret here"
     78 
     79     On the EAP SRP-SHA1 server side, a secret verifier is required.
     80     This is a one-way hash of the client's name and password.  To
     81     generate this value, run the srp-entry program (see srp-entry(8)).
     82     This program prompts for the client name and the passphrase (the
     83     secret).  The output will be an entry, such as the following,
     84     suitable for use in the server's srp-secrets file.  Note that if
     85     this is transferred by cut-and-paste, the entry must be a single
     86     line of text in the file.
     87 
     88 pppuser srpserver 0:LFDpwg4HBLi4/kWByzbZpW6pE95/iIWBSt7L.DAkHsvwQphtiq0f6reoUy/1LC1qYqjcrV97lCDmQHQd4KIACGgtkhttLdP3KMowvS0wLXLo25FPJeG2sMAUEWu/HlJPn2/gHyh9aT.ZxUs5MsoQ1E61sJkVBc.2qze1CdZiQGTK3qtWRP6DOpM1bfhKtPoVm.g.MiCcTMWzc54xJUIA0mgKtpthE3JrqCc81cXUt4DYi5yBzeeGTqrI0z2/Gj8Jp7pS4Fkq3GmnYjMxnKfQorFXNwl3m7JSaPa8Gj9/BqnorJOsnSMlIhBe6dy4CYytuTbNb4Wv/nFkmSThK782V:2cIyMp1yKslQgE *
     89 
     90     The "secret" field consists of three entries separated by colons.
     91     The first entry is the index of the modulus and generator from
     92     SRP's /etc/tpasswd.conf.  If the special value 0 is used, then the
     93     well-known modulus/generator value is used (this is recommended,
     94     because it is much faster).  The second value is the verifier
     95     value.  The third is the password "salt."  These latter two values
     96     are encoded in base64 notation.
     97 
     98     For EAP MD5-Challenge, both client and server use the existing
     99     /etc/ppp/chap-secrets file.
    100 
    101 5.  Configuration options
    102 
    103     There are two main options relating to EAP available for the
    104     client.  These are:
    105 
    106 	refuse-eap		- refuse to authenticate with EAP
    107 	srp-use-pseudonym	- use the identity privacy if
    108 				  offered by server
    109 
    110     The second option stores a pseudonym, if offered by the EAP
    111     SRP-SHA1 server, in the $HOME/.ppp_pseudonym file.  The pseudonym
    112     is typically an encrypted version of the client identity.  During
    113     EAP start-up, the pseudonym stored in this file is offered to the
    114     peer as the identity.  If this is accepted by the peer, then
    115     eavesdroppers will be unable to determine the identity of the
    116     client.  Each time the client is authenticated, the server will
    117     offer a new pseudoname to the client using an obscured (reversibly
    118     encrypted) message.  Thus, access across successive sessions
    119     cannot be tracked.
    120 
    121     There are two main options for EAP on the server:
    122 
    123 	require-eap		- require client to use EAP
    124 	srp-pn-secret "string"	- set server's pseudoname secret
    125 
    126     The second option sets the long-term secret used on the server to
    127     encrypt the user's identity to produce pseudonames.  The
    128     pseudoname is constructed by hashing this string with the current
    129     date (to the nearest day) with SHA1, then using this hash as the
    130     key for a DES encryption of the client's name.  The date is added
    131     to the hash for two reasons.  First, this allows the pseudonym to
    132     change daily.  Second, it allows the server to decode any previous
    133     pseudonym by trying previous dates.
    134 
    135     See the pppd(8) man page for additional options.
    136 
    137 6.  Comments welcome!
    138 
    139     This is still an experimental implementation.  It has been tested
    140     and reviewed carefully for correctness, but may still be
    141     incomplete or have other flaws.  All comments are welcome.  Please
    142     address them to the author:
    143 
    144 		james.d.carlson (a] sun.com
    145 
    146     or, for EAP itself or the SRP extensions to EAP, to the IETF PPP
    147     Extensions working group:
    148 
    149 		ietf-ppp (a] merit.edu
    150 

README.eap-tls

      1 EAP-TLS authentication support for PPP
      2 ======================================
      3 
      4 1. Intro
      5 
      6     The Extensible Authentication Protocol (EAP; RFC 3748) is a
      7     security protocol that can be used with PPP.  It provides a means
      8     to plug in multiple optional authentication methods.
      9 
     10     Transport Level Security (TLS; RFC 5216) provides for mutual 
     11     authentication, integrity-protected ciphersuite negotiation and 
     12     key exchange between two endpoints.  It also provides for optional
     13     MPPE encryption.
     14 
     15     EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets,
     16     allowing TLS mutual authentication to be used as a generic EAP
     17     mechanism. It also provides optional encryption using the MPPE
     18     protocol.
     19 
     20     EAP-TLS support is included in pppd, and is enabled or disabled
     21     at configure time by using the --enable-eaptls and --disable-eaptls
     22     arguments to ./configure.
     23 
     24     This authentication method can be used in both client and server mode.
     25 
     26 2. Building
     27 
     28     To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org)
     29     is required. Any version from 0.9.7 should work.
     30     
     31     Configure, compile, and install as usual. 
     32 
     33 3. Configuration
     34 
     35     On the client side there are two ways to configure EAP-TLS:
     36 
     37     1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters
     38 
     39     2. edit the /etc/ppp/eaptls-client file.
     40     Insert a line for each system with which you use EAP-TLS.
     41     The line is composed of this fields separated by tab:
     42 
     43       - Client name 
     44         The name used by the client for authentication, can be *
     45       - Server name
     46         The name of the server, can be *
     47       - Client certificate file 
     48         The file containing the certificate chain for the 
     49         client in PEM format
     50       - Server certificate file
     51         If you want to specify the certificate that the 
     52         server is allowed to use, put the certificate file name.
     53         Else put a dash '-'.
     54       - CA certificate file
     55         The file containing the trusted CA certificates in PEM
     56         format.
     57       - Client private key file
     58         The file containing the client private key in PEM format.
     59 
     60 
     61     On the server side edit the /etc/ppp/eaptls-server file.
     62     Insert a line for each system with which you use EAP-TLS.
     63     The line is composed of this fields separated by tab:
     64 
     65       - Client name
     66         The name used by the client for authentication, can be *
     67       - Server name
     68         The name of the server, can be *
     69       - Client certificate file
     70         If you want to specify the certificate that the
     71         client is allowed to use, put the certificate file name.
     72         Else put a dash '-'.
     73       - Server certificate file
     74         The file containing the certificate chain for the
     75         server in PEM format
     76       - CA certificate file
     77         The file containing the trusted CA certificates in PEM format.
     78       - Client private key file
     79         The file containing the server private key in PEM format.
     80       - addresses
     81         A list of IP addresses the client is allowed to use.
     82 
     83 
     84     OpenSSL engine support is included starting with v0.95 of this patch. 
     85     Currently the only engine tested is the 'pkcs11' engine (hardware token
     86     support). To use the 'pksc11' engine:
     87       - Use a special private key fileiname in the /etc/ppp/eaptls-client file:
     88           <engine>:<identifier>
     89         e.g.
     90           pkcs11:123456
     91 
     92       - The certificate can also be loaded from the 'pkcs11' engine using
     93         a special client certificate filename in the /etc/ppp/eaptls-client file:
     94           <engine>:<identifier>
     95         e.g.
     96           pkcs11:123456
     97 
     98       - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior
     99         to starting 'pppd'. A sample openssl.cnf file is
    100 
    101         openssl_conf = openssl_def
    102 
    103         [ openssl_def ]
    104         engines = engine_section
    105 
    106         [ engine_section ]
    107         pkcs11 = pkcs11_section
    108 
    109         [ pkcs11_section ]
    110         engine_id = pkcs11
    111         dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so
    112         MODULE_PATH = /usr/lib64/libeTPkcs11.so
    113         init = 0
    114 
    115       - There are two ways to specify a password/PIN for the PKCS11 engine:
    116           - inside the openssl.cnf file using
    117               PIN = your-secret-pin
    118             Note The keyword 'PIN' is case sensitive!
    119           - Using the 'password' in the ppp options file.
    120         From v0.97 of the eap-tls patch the password can also be supplied
    121         using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c
    122         for an example).
    123 
    124 
    125 4. Options
    126 
    127     These pppd options are available:
    128 
    129       ca <ca-file>
    130         Use the CA public certificate found in <ca-file> in PEM format
    131       capath <directory>
    132         Use the directory <directory> as the CA public certificate directory
    133       cert <cert-file>
    134         Use the client public certificate found in <cert-file> in PEM format
    135         or in engine:engine_id format
    136       key <key-file>
    137         Use the client private key found in <key-file> in PEM format
    138         or in engine:engine_id format
    139       pkcs12 <pkcs12-file>
    140         Use a pkcs12 envelope as a substitute for cert and key. A password may be
    141         required to use this file. 
    142       crl <crl-file>
    143         Use the Certificate Revocation List (CRL) file <crl-file> in PEM format.
    144       crl-dir <dir>
    145         Use CRL files from directory <dir>. It contains CRL files in PEM
    146         format and each file contains a CRL. The files are looked up 
    147         by the issuer name hash value. Use the c_rehash utility 
    148         to create necessary links.
    149       need-peer-eap
    150         If the peer doesn't ask us to authenticate or doesn't use eap
    151         to authenticate us, disconnect.
    152       max-tls-version <1.0|1.1|1.2 (default)|1.3>
    153         Specify the maximum TLS protocol version to negotiate with peers. Defaults
    154         to TLSv1.2 as the TLSv1.3 code is experimental.
    155       tls-verify-key-usage
    156         Validate certificate purpose and extended key usage
    157       tls-verify-method <none|subject|name|suffix>
    158         Compare the remotename against the subject, certificate name, or
    159         match by suffix. Default is 'name'.
    160 
    161     Note: 
    162       password-encrypted certificates can be used as of v0.94 of this 
    163       patch. The password for the eap-tls.key file is specified using 
    164       the regular
    165           password ....
    166       statement in the ppp options file, or by using the appropriate
    167       plugin which supplies a 'eaptls_passwd_hook' routine.
    168 
    169 5. Connecting
    170 
    171     If you're setting up a pppd server, edit the EAP-TLS configuration file 
    172     as written above and then run pppd with the 'auth' option to authenticate
    173     the client. The EAP-TLS method will be used if the other eap methods can't
    174     be used (no secrets).
    175 
    176     If you're setting up a client, edit the configuration file and then run
    177     pppd with 'remotename' option to specify the server name. Add the 
    178     'need-peer-eap' option if you want to be sure the peer ask you to
    179     authenticate (and to use eap) and to disconnect if it doesn't.
    180 
    181 6. Example
    182 
    183     The following example can be used to connect a Linux client with the 'pptp'
    184     package to a Linux server running the 'pptpd' (PoPToP) package. The server
    185     was configured with a certificate with name (CN) 'pptp-server', the client
    186     was configured with a certificate with name (CN) 'pptp-client', both 
    187     signed by the same Certificate Authority (CA).
    188 
    189     Server side:
    190       - /etc/pptpd.conf file:
    191           option /etc/ppp/options-pptpd-eaptls
    192           localip 172.16.1.1
    193           remoteip 172.16.1.10-20 
    194       - /etc/ppp/options-pptpd-eaptls file:
    195           name pptp-server
    196           lock 
    197           mtu 1500 
    198           mru 1450
    199           auth 
    200           lcp-echo-failure 3 
    201           lcp-echo-interval 5 
    202           nodeflate 
    203           nobsdcomp
    204           nopredictor1
    205           nopcomp
    206           noaccomp
    207           
    208           require-eap
    209           require-mppe-128
    210           
    211           crl /home/janjust/ppp/keys/crl.pem
    212           
    213           debug
    214           logfile /tmp/pppd.log
    215 
    216       - /etc/ppp/eaptls-server file:
    217            * pptp-server - /etc/ppp/pptp-server.crt /etc/ppp/ca.crt /etc/ppp/pptp-server.key *
    218 
    219       - On the server, run 
    220           pptdp --conf /etc/pptpd.conf
    221        
    222     Client side:
    223       - Run
    224           pppd noauth require-eap require-mppe-128 \
    225             ipcp-accept-local ipcp-accept-remote noipdefault \
    226             cert  /etc/ppp/keys/pptp-client.crt \
    227             key   /etc/ppp/keys/pptp-client.key \
    228             ca    /etc/ppp/keys/ca.crt \
    229             name pptp-client remotename pptp-server \
    230             debug logfile /tmp/pppd.log
    231             pty "pptp pptp-server.example.com --nolaunchpppd"
    232 
    233     Check /var/log/messages and the files /tmp/pppd.log on both sides for debugging info.
    234 
    235 7. Notes
    236 
    237     This is experimental code.
    238     Send suggestions and comments to Jan Just Keijser <janjust (a] nikhef.nl>
    239 
    240 

README.MPPE

      1 PPP Support for MPPE (Microsoft Point to Point Encryption)
      2 ==========================================================
      3 
      4 Frank Cusack		frank (a] google.com
      5 Mar 19, 2002
      6 
      7 Updated by Paul Mackerras, Sep 2008
      8 
      9 
     10 DISCUSSION
     11 
     12 MPPE is Microsoft's encryption scheme for PPP links.  It is pretty much
     13 solely intended for use with PPP over Internet links -- if you have a true
     14 point to point link you have little need for encryption.  It is generally
     15 used with PPTP.
     16 
     17 MPPE is negotiated within CCP (Compression Control Protocol) as option
     18 18.  In order for MPPE to work, both peers must agree to do it.  This
     19 complicates things enough that I chose to implement it as strictly a binary
     20 option, off by default.  If you turn it on, all other compression options
     21 are disabled and MPPE *must* be negotiated successfully in both directions
     22 (CCP is unidirectional) or the link will be disconnected.  I think this is
     23 reasonable since, if you want encryption, you want encryption.  That is,
     24 I am not convinced that optional encryption is useful.
     25 
     26 While PPP regards MPPE as a "compressor", it actually expands every frame
     27 by 4 bytes, the MPPE overhead (encapsulation).
     28 
     29 Because of the data expansion, you'll see that ppp interfaces get their
     30 mtu reduced by 4 bytes whenever MPPE is negotiated.  This is because
     31 when MPPE is active, it is *required* that *every* packet be encrypted.
     32 PPPD sets the mtu = MIN(peer mru, configured mtu).  To ensure that
     33 MPPE frames are not larger than the peer's mru, we reduce the mtu by 4
     34 bytes so that the network layer never sends ppp a packet that's too large.
     35 
     36 There is an option to compress the data before encrypting (MPPC), however
     37 the algorithm is patented and requires execution of a license with Hifn.
     38 MPPC as an RFC is a complete farce.  I have no further details on MPPC.
     39 
     40 Some recommendations:
     41 
     42 - Use stateless mode.  Stateful mode is disabled by default.  Unfortunately,
     43   stateless mode is very expensive as the peers must rekey for every packet.
     44 - Use 128-bit encryption.
     45 - Use MS-CHAPv2 only.
     46 
     47 Reference documents:
     48 
     49     <http://www.ietf.org/rfc/rfc3078.txt> MPPE
     50     <http://www.ietf.org/rfc/rfc3079.txt> MPPE Key Derivation
     51     <http://www.ietf.org/rfc/rfc2118.txt> MPPC
     52     <http://www.ietf.org/rfc/rfc2637.txt> PPTP
     53     <http://www.ietf.org/rfc/rfc2548.txt> MS RADIUS Attributes
     54 
     55 You might be interested in PoPToP, a Linux PPTP server.  You can find it at
     56 <http://www.poptop.org/>
     57 
     58 RADIUS support for MPPE is from Ralf Hofmann, <ralf.hofmann (a] elvido.net>.
     59 
     60 
     61 BUILDING THE PPPD
     62 
     63 The userland component of PPPD has no additional requirements above
     64 those for MS-CHAP and MS-CHAPv2.
     65 
     66 MPPE support is now included in the mainline Linux kernel releases.
     67 
     68 
     69 CONFIGURATION
     70 
     71 See pppd(8) for the MPPE options.  Under Linux, if your modutils is earlier
     72 than 2.4.15, you will need to add
     73 
     74     alias ppp-compress-18 ppp_mppe
     75 
     76 to /etc/modules.conf.
     77 
     78 
     79 

README.MSCHAP80

      1 PPP Support for Microsoft's CHAP-80
      2 ===================================
      3 
      4 Eric Rosenquist          rosenqui (a] strataware.com
      5 (updated by Paul Mackerras)
      6 (updated by Al Longyear)
      7 (updated by Farrell Woods)
      8 (updated by Frank Cusack)
      9 
     10 INTRODUCTION
     11 
     12 Microsoft has introduced an extension to the Challenge/Handshake
     13 Authentication Protocol (CHAP) which avoids storing cleartext
     14 passwords on a server.  (Unfortunately, this is not as secure as it
     15 sounds, because the encrypted password stored on a server can be used
     16 by a bogus client to gain access to the server just as easily as if
     17 the password were stored in cleartext.)  The details of the Microsoft
     18 extensions can be found in the document:
     19 
     20     <http://www.ietf.org/rfc/rfc2433.txt>
     21 
     22 In short, MS-CHAP is identified as <auth chap 80> since the hex value
     23 of 80 is used to designate Microsoft's scheme.  Standard PPP CHAP uses
     24 a value of 5.  If you enable PPP debugging with the "debug" option and
     25 see something like the following in your logs, the remote server is
     26 requesting MS-CHAP:
     27 
     28   rcvd [LCP ConfReq id=0x2 <asyncmap 0x0> <auth MS> <magic 0x46a3>]
     29                                            ^^^^^^^
     30 
     31 MS-CHAP support in pppd (along with MPPE support) can be enabled or
     32 disabled at configure time using the --enable-microsoft-extensions and
     33 --disable-microsoft-extensions arguments.  The default is enabled.
     34 
     35 
     36 CONFIGURATION
     37 
     38 If you've never used PPPD with CHAP before, read the man page (type
     39 "man pppd") and read the description in there.  Basically, you need to
     40 edit the "chap-secrets" file typically named /etc/ppp/chap-secrets.
     41 This should contain the following two lines for each system with which
     42 you use CHAP (with no leading blanks):
     43 
     44     RemoteHost  Account     Secret
     45     Account     RemoteHost  Secret
     46 
     47 Note that you need both lines and that item 1 and 2 are swapped in the
     48 second line.  I'm not sure why you need it twice, but it works and I didn't
     49 have time to look into it further.  The "RemoteHost" is a somewhat
     50 arbitrary name for the remote Windows NT system you're dialing.  It doesn't
     51 have to match the NT system's name, but it *does* have to match what you
     52 use with the "remotename" parameter.  The "Account" is the Windows NT
     53 account name you have been told to use when dialing, and the "Secret" is
     54 the password for that account.  For example, if your service provider calls
     55 their machine "DialupNT" and tells you your account and password are
     56 "customer47" and "foobar", add the following to your chap-secrets file:
     57 
     58     DialupNT    customer47  foobar
     59     customer47  DialupNT    foobar
     60 
     61 The only other thing you need to do for MS-CHAP (compared to normal CHAP)
     62 is to always use the "remotename" option, either on the command line or in
     63 your "options" file (see the pppd man page for details).  In the case of
     64 the above example, you would need to use the following command line:
     65 
     66     pppd name customer47 remotename DialupNT <other options>
     67 
     68 or add:
     69 
     70     name customer47
     71     remotename DialupNT
     72 
     73 to your PPPD "options" file.
     74 
     75 The "remotename" option is required for MS-CHAP since Microsoft PPP servers
     76 don't send their system name in the CHAP challenge packet.
     77 
     78 
     79 E=691 (AUTHENTICATION_FAILURE) ERRORS WHEN YOU HAVE THE VALID SECRET (PASSWORD)
     80 
     81 If your RAS server is not the domain controller and is not a 'stand-alone'
     82 server then it must make a query to the domain controller for your domain.
     83 
     84 You need to specify the domain name with the user name when you attempt to
     85 use this type of a configuration. The domain name is specified with the
     86 local name in the chap-secrets file and with the option for the 'name'
     87 parameter.
     88 
     89 For example, the previous example would become:
     90 
     91     DialupNT            domain\\customer47   foobar
     92     domain\\customer47  DialupNT             foobar
     93 
     94 and
     95 
     96     pppd name 'domain\\customer47' remotename DialupNT <other options>
     97 
     98 or add:
     99 
    100     name domain\\customer47
    101     remotename DialupNT
    102 
    103 when the Windows NT domain name is simply called 'domain'.
    104 
    105 
    106 TROUBLESHOOTING
    107 
    108 Assuming that everything else has been configured correctly for PPP and
    109 CHAP, the MS-CHAP-specific problems you're likely to encounter are mostly
    110 related to your Windows NT account and its settings.  A Microsoft server
    111 returns error codes in its CHAP response.  The following are extracted from
    112 RFC 2433:
    113 
    114  646 ERROR_RESTRICTED_LOGON_HOURS
    115  647 ERROR_ACCT_DISABLED
    116  648 ERROR_PASSWD_EXPIRED
    117  649 ERROR_NO_DIALIN_PERMISSION
    118  691 ERROR_AUTHENTICATION_FAILURE
    119  709 ERROR_CHANGING_PASSWORD
    120 
    121 You'll see these in your pppd log as a line similar to:
    122 
    123    Remote message: E=649 R=0
    124 
    125 The "E=" is the error number from the table above, and the "R=" flag
    126 indicates whether the error is transient and the client should retry.  If
    127 you consistently get error 691, then either you're using the wrong account
    128 name/password, or the DES library or MD4 hashing (in md4.c) aren't working
    129 properly.  Verify your account name and password (use a Windows NT or
    130 Windows 95 system to dial-in if you have one available).  If that checks
    131 out, test the DES library with the "destest" program included with the DES
    132 library.  If DES checks out, the md4.c routines are probably failing
    133 (system byte ordering may be a problem) or my code is screwing up.  I've
    134 only got access to a Linux system, so you're on your own for anything else.
    135 
    136 Another thing that might cause problems is that some RAS servers won't
    137 respond at all to LCP config requests without seeing the word "CLIENT"
    138 from the other end.  If you see pppd sending out LCP config requests
    139 without getting any reply, try putting something in your chat script
    140 to send the word CLIENT after the modem has connected.
    141 
    142 STILL TO DO
    143 
    144 A site using only MS-CHAP to authenticate has no need to store cleartext
    145 passwords in the "chap-secrets" file.  A utility that spits out the ASCII
    146 hex MD4 hash of a given password would be nice, and would allow that hash
    147 to be used in chap-secrets in place of the password.  The code to do this
    148 could quite easily be lifted from chap_ms.c (you have to convert the
    149 password to Unicode before hashing it).  The chap_ms.c file would also have
    150 to be changed to recognize a password hash (16 binary bytes == 32 ASCII hex
    151 characters) and skip the hashing stage.  This would have no real security
    152 value as the hash is plaintext-equivalent.
    153 

README.MSCHAP81

      1 PPP Support for Microsoft's CHAP-81
      2 ===================================
      3 
      4 Frank Cusack		frank (a] google.com
      5 
      6 Some text verbatim from README.MSCHAP80,
      7 by Eric Rosenquist, rosenqui (a] strataware.com
      8 
      9 INTRODUCTION
     10 
     11 First, please read README.MSCHAP80; almost everything there applies here.
     12 MS-CHAP was basically devised by Microsoft because rather than store
     13 plaintext passwords, they (Microsoft) store the md4 hash of passwords.
     14 It provides no advantage over standard CHAP, since the hash is used
     15 as plaintext-equivalent.  (Well, the Change-Password packet is arguably
     16 an advantage.)  It does introduce a significant weakness if the LM hash
     17 is used.  Additionally, the format of the failure packet potentially
     18 gives information to an attacker.  The weakness of the LM hash is partly
     19 addressed in RFC 2433, which deprecates its use.
     20 
     21 MS-CHAPv2 adds 2 benefits to MS-CHAP.  (1) The LM hash is no longer
     22 used.  (2) Mutual authentication is required.  Note that the mutual
     23 authentication in MS-CHAPv2 is different than the case where both PPP
     24 peers require authentication from the other; the former proves that
     25 the server has access to the client's password, the latter proves that
     26 the server has access to a secret which the client also has -- which
     27 may or may not be the same as the client's password (but should not be
     28 the same, per RFC 1994).  Whether this provides any actual benefit is
     29 outside the scope of this document.  The details of MS-CHAPv2 can be
     30 found in the document:
     31 
     32     <http://www.ietf.org/rfc/rfc2759.txt>
     33 
     34 
     35 BUILDING THE PPPD
     36 
     37 In addition to the requirements for MS-CHAP, MS-CHAPv2 uses the SHA-1
     38 hash algorithm.  A public domain implementation is provided with pppd.
     39 
     40 
     41 TROUBLESHOOTING
     42 
     43 Assuming that everything else has been configured correctly for PPP and
     44 CHAP, the MS-CHAPv2-specific problems you're likely to encounter are mostly
     45 related to your Windows NT account and its settings.  A Microsoft server
     46 returns error codes in its CHAP response.  The following are extracted from
     47 RFC 2759:
     48 
     49  646 ERROR_RESTRICTED_LOGON_HOURS
     50  647 ERROR_ACCT_DISABLED
     51  648 ERROR_PASSWD_EXPIRED
     52  649 ERROR_NO_DIALIN_PERMISSION
     53  691 ERROR_AUTHENTICATION_FAILURE
     54  709 ERROR_CHANGING_PASSWORD
     55 
     56 You'll see these in your pppd log as a line similar to:
     57 
     58    Remote message: E=649 No dialin permission
     59 
     60 Previously, pppd would log this as:
     61 
     62    Remote message: E=649 R=0
     63 
     64 Now, the text message is logged (both for MS-CHAP and MS-CHAPv2).
     65 
     66 

README.pppol2tp

      1 PPPoL2TP plugin
      2 ===============
      3 
      4 The pppol2tp plugin lets pppd use the Linux kernel driver pppol2tp.ko
      5 to pass PPP frames in L2TP tunnels. The driver was integrated into the
      6 kernel in the 2.6.23 release. For kernels before 2.6.23, an
      7 out-of-tree kernel module is available from the pppol2tp-kmod package
      8 in the OpenL2TP project.
      9 
     10 Note that pppd receives only PPP control frames over the PPPoL2TP
     11 socket; data frames are handled entirely by the kernel.
     12 
     13 The pppol2tp plugin adds extra arguments to pppd and uses the Linux kernel
     14 PPP-over-L2TP driver to set up each session's data path.
     15 
     16 Arguments are:-
     17 
     18 pppol2tp <fd>                   - FD for PPPoL2TP socket
     19 pppol2tp_lns_mode               - PPPoL2TP LNS behavior. Default off.
     20 pppol2tp_send_seq               - PPPoL2TP enable sequence numbers in
     21                                   transmitted data packets. Default off.
     22 pppol2tp_recv_seq               - PPPoL2TP enforce sequence numbers in
     23                                   received data packets. Default off.
     24 pppol2tp_reorderto <millisecs>  - PPPoL2TP data packet reorder timeout.
     25                                   Default 0 (no reordering).
     26 pppol2tp_debug_mask <mask>      - PPPoL2TP debug mask. Bitwise OR of
     27 				  1 - verbose debug
     28 				  2 - control
     29 				  4 - kernel transport
     30 				  8 - ppp packet data
     31 				  Default: 0 (no debug).
     32 pppol2tp_ifname <ifname>	- Name of PPP network interface visible
     33 				  to "ifconfig" and "ip link".
     34 				  Default: "pppN"
     35 pppol2tp_tunnel_id <id>		- L2TP tunnel_id tunneling this PPP
     36 				  session.
     37 pppol2tp_session_id <id>	- L2TP session_id of this PPP session.
     38 				  The tunnel_id/session_id pair is used
     39 				  when sending event messages to openl2tpd.
     40 
     41 pppd will typically be started by an L2TP daemon for each L2TP sesion,
     42 supplying one or more of the above arguments as required. The pppd
     43 user will usually have no visibility of these arguments.
     44 
     45 Two hooks are exported by this plugin.
     46 
     47 void (*pppol2tp_send_accm_hook)(int tunnel_id, int session_id,
     48      uint32_t send_accm, uint32_t recv_accm);
     49 void (*pppol2tp_ip_updown_hook)(int tunnel_id, int session_id, int up);
     50 
     51 Credits
     52 =======
     53 
     54 This plugin was developed by Katalix Systems as part of the OpenL2TP
     55 project, http://openl2tp.sourceforge.net. OpenL2TP is a full-featured
     56 L2TP client-server, suitable for use as an enterprise L2TP VPN server
     57 or a VPN client.
     58 
     59 Please copy problems to the OpenL2TP mailing list:
     60 openl2tp-users (a] lists.sourceforge.net.
     61 
     62 Maintained by:
     63 	James Chapman
     64 	jchapman (a] katalix.com
     65 	Katalix Systems Ltd
     66 	http://www.katalix.com
     67 

README.pwfd

      1 
      2 	Support to pass the password via a pipe to the pppd
      3 	---------------------------------------------------
      4 
      5 	Arvin Schnell <arvin (a] suse.de>
      6 	2002-02-08
      7 
      8 
      9 1. Introduction
     10 ---------------
     11 
     12 Normally programs like wvdial or kppp read the online password from their
     13 config file and store them in the pap- and chap-secrets before they start the
     14 pppd and remove them afterwards. Sure they need special privileges to do so.
     15 
     16 The passwordfd feature offers a simpler and more secure solution. The program
     17 that starts the pppd opens a pipe and writes the password into it. The pppd
     18 simply reads the password from that pipe.
     19 
     20 This methods is used for quite a while on SuSE Linux by the programs wvdial,
     21 kppp and smpppd.
     22 
     23 
     24 2. Example
     25 ----------
     26 
     27 Here is a short C program that uses the passwordfd feature. It starts the pppd
     28 to buildup a pppoe connection.
     29 
     30 
     31 --snip--
     32 
     33 #include <stdio.h>
     34 #include <stdlib.h>
     35 #include <unistd.h>
     36 #include <signal.h>
     37 #include <string.h>
     38 #include <paths.h>
     39 
     40 #ifndef _PATH_PPPD
     41 #define _PATH_PPPD "/usr/sbin/pppd"
     42 #endif
     43 
     44 
     45 // Of course these values can be read from a configuration file or
     46 // entered in a graphical dialog.
     47 char *device = "eth0";
     48 char *username = "1122334455661122334455660001 (a] t-online.de";
     49 char *password = "hello";
     50 
     51 pid_t pid = 0;
     52 
     53 
     54 void
     55 sigproc (int src)
     56 {
     57     fprintf (stderr, "Sending signal %d to pid %d\n", src, pid);
     58     kill (pid, src);
     59     exit (EXIT_SUCCESS);
     60 }
     61 
     62 
     63 void
     64 sigchild (int src)
     65 {
     66     fprintf (stderr, "Daemon died\n");
     67     exit (EXIT_SUCCESS);
     68 }
     69 
     70 
     71 int
     72 start_pppd ()
     73 {
     74     signal (SIGINT, &sigproc);
     75     signal (SIGTERM, &sigproc);
     76     signal (SIGCHLD, &sigchild);
     77 
     78     pid = fork ();
     79     if (pid < 0) {
     80 	fprintf (stderr, "unable to fork() for pppd: %m\n");
     81 	return 0;
     82     }
     83 
     84     if (pid == 0) {
     85 
     86 	int i, pppd_argc = 0;
     87 	char *pppd_argv[20];
     88 	char buffer[32] = "";
     89 	int pppd_passwdfd[2];
     90 
     91 	for (i = 0; i < 20; i++)
     92 	    pppd_argv[i] = NULL;
     93 
     94 	pppd_argv[pppd_argc++] = "pppd";
     95 
     96 	pppd_argv[pppd_argc++] = "call";
     97 	pppd_argv[pppd_argc++] = "pwfd-test";
     98 
     99 	// The device must be after the call, since the call loads the plugin.
    100 	pppd_argv[pppd_argc++] = device;
    101 
    102 	pppd_argv[pppd_argc++] = "user";
    103 	pppd_argv[pppd_argc++] = username;
    104 
    105 	// Open a pipe to pass the password to pppd.
    106 	if (pipe (pppd_passwdfd) == -1) {
    107 	    fprintf (stderr, "pipe failed: %m\n");
    108 	    exit (EXIT_FAILURE);
    109 	}
    110 
    111 	// Of course this only works it the password is shorter
    112 	// than the pipe buffer. Otherwise you have to fork to
    113 	// prevent that your main program blocks.
    114 	write (pppd_passwdfd[1], password, strlen (password));
    115 	close (pppd_passwdfd[1]);
    116 
    117 	// Tell the pppd to read the password from the fd.
    118 	pppd_argv[pppd_argc++] = "passwordfd";
    119 	snprintf (buffer, 32, "%d", pppd_passwdfd[0]);
    120 	pppd_argv[pppd_argc++] = buffer;
    121 
    122 	if (execv (_PATH_PPPD, (char **) pppd_argv) < 0) {
    123 	    fprintf (stderr, "cannot execl %s: %m\n", _PATH_PPPD);
    124 	    exit (EXIT_FAILURE);
    125 	}
    126     }
    127 
    128     pause ();
    129 
    130     return 1;
    131 }
    132 
    133 
    134 int
    135 main (int argc, char **argv)
    136 {
    137     if (start_pppd ())
    138 	exit (EXIT_SUCCESS);
    139 
    140     exit (EXIT_FAILURE);
    141 }
    142 
    143 ---snip---
    144 
    145 
    146 Copy this file to /etc/ppp/peers/pwfd-test. The plugins can't be loaded on the
    147 command line (unless you are root) since the plugin option is privileged.
    148 
    149 
    150 ---snip---
    151 
    152 #
    153 # PPPoE plugin for kernel 2.4
    154 #
    155 plugin pppoe.so
    156 
    157 #
    158 # This plugin enables us to pipe the password to pppd, thus we don't have
    159 # to fiddle with pap-secrets and chap-secrets. The user is also passed
    160 # on the command line.
    161 #
    162 plugin passwordfd.so
    163 
    164 noauth
    165 usepeerdns
    166 defaultroute
    167 hide-password
    168 nodetach
    169 nopcomp
    170 novjccomp
    171 noccp
    172 
    173 ---snip---
    174 
    175