4. Note about authentication

When you connect to an Internet Services Provider, it is usually necesary that you send an username and a password. This can be accomplished using several methods; the exact method that you use is determined by your provider.

Added to the three shown options, you can use a link without authentication, (generally when the remote end is also yours).

4.1 Username and password - Login and password prompts.

Actually, this is not an usual authentication method to access the Internet through an ISP.

Identification is made before pppd is started, and it is the dialer, usually chat, who sends the login name and the password. This data is sent in plaintext, so this method should not be considered secure.

An example script for chat where you can see how to specify username and password to be sent before running pppd would look something like this:

ABORT BUSY
ABORT "NO CARRIER"
ABORT VOICE
ABORT "NO DIALTONE" 
ABORT "NO ANSWER"
"" ATZ
OK ATDT_TelephoneNumber_
CONNECT \d\c
ogin _Username_
assword _Password_

The last 2 lines define username and password, and when to send it (after receiving «ogin» and «assword» respectively. The chat script only needs to see parts of the words «login» and «password» and so we don't check the first letter of each. This is so that we don't need to worry about uppercase/lowercase characters.

Suppose that this script is called provider, and it is saved into the /etc/chatscripts directory. Then, you can run it with:

/usr/sbin/chat -v -f /etc/chatscripts/provider

4.2 PAP - Password Authentication Protocol

If the provider you are using requires PAP as the authentication protocol, during the LCP negotiation in PPP this protocol will be asked to use this protocol. When the phone call is connected after using chat, pppd is started. In this scenario, pppd will send the username and the password, which it will look for in the /etc/ppp/pap-secrets file. This file must have read and write permissions only for root only, so that nobody else can read the passwords inside it.

PAP is not very secure, as the password is sent in plaintext, so can be read by somebody that monitors your transmission line.

Simple example of /etc/ppp/pap-secrets:

_Username_ * _Password_

4.3 CHAP - Challenge Authentication Protocol

If the provider you are using requires CHAP as the authentication protocol, during the LCP negotiation in PPP this protocol will be asked to use this protocol. When the phone call is connected after using chat, pppd is started. In this scenario, pppd will send the username and the password, which it will look for in the /etc/ppp/chap-secrets file. This file must have read and write permissions only for root only, so that nobody else can read the passwords inside it.

CHAP is more secure than PAP, as the password is never sent through the transmission line in plaintext. The authentication server sends a random identifier (the challenge), that the client must encrypt with its password, and then send back to the server.

Simple example of /etc/ppp/chap-secrets:

_Username_ * _Password_

Sometimes an ISP uses PAP and other times CHAP, so it is common to define your username and password in both files.