Adding SLIP and PPP Clients

Enabling Dialin for SLIP and PPP Clients

• Client's hostname and domainname (this should be in NIS/YP, DNS, and (maybe) /etc/hosts)
• IP address that matches other configuration
• Login name and password used by the SLIP/PPP login

For IRIX SLIP:

/etc/passwd

/usr/etc/remoteslip

For IRIX PPP:

/etc/passwd

/etc/ppp.conf

For MorningStar (MST) PPP:

/etc/passwd

/usr/etc/ppp/Login

Terminology

The line to add in /etc/passwd for IRIX SLIP looks like the following (because of a potential security hole, the home directory for a SLIP or PPP account should only be writable by root, for example creating the special directory /var/secure, with permissions 700):

   Sclient::0:0:SLIP login client.sub.domain.foo.bar,,:/:/usr/etc/remoteslip

For IRIX PPP the /etc/passwd entry looks like:

   Pclient::0:0:Irix PPP login client.sub.domain.foo.bar,,:/:/usr/etc/ppp

(Note that IRIX SLIP and PPP must run as root!)

For MST PPP the /etc/passwd entry looks like:

   Pclient::0:0:MST PPP login client.sub.domain.foo.bar,,:/:/usr/etc/ppp/Login

   % su
   # passwd Sclient
   Changing password for Sclient on server.
   New password: password
   Re-enter new password: password
   #

On an IRIX server, add a section like the following in /usr/etc/remoteslip for the client login:

   Sclient)
      exec /usr/etc/slip -i -p cslip -r client.sub.domain.foo.bar
      ;;
   #

The servers can dialout to the clients. The IRIX SLIP client needs an entry in /usr/etc/remoteslip just like the server, however for IRIX4 routing is a royal pain. It is almost easiest to just login and manually add the route after the link comes up. For IRIX4, the entry in /usr/etc/remoteslip looks almost identical to the server case:

   Sserver)
      exec /usr/etc/slip -i -p cslip -r server.sub.domain.foo.bar
      ;;
   #

For IRIX5 SLIP clients, routing on clients is easier because of the -R option, add the following section to the /usr/etc/remoteslip file:

   Sserver)
      exec /usr/etc/slip -i -p cslip -R "" -r server.sub.domain.foo.bar
      ;;
   #

The following section must remain the last one in the file:

   *)
       exec /usr/etc/slip -i -r $USER
       ;;
   esac

MorningStar (aka MST) PPP

You usually do not need to edit the login "shell": /usr/etc/ppp/Login, unless you need to do something special for routing (which usually has the same problems as IRIX4 SLIP routing).

IRIX5 PPP (also IRIX6)

Uses the ppp binary as it's login shell. Configuration for both dialout and dialin is in the configuration file /etc/ppp.conf. If you are already dialing out to that host then you do not need to edit the file. If all the ppp defaults are acceptable, you don't even need an entry in the file for a dialin host, although I think it is wise to add a minimal entry:

   rmt in remotehost=client.domain.foo.bar

Where rmt is the login for the dialin-only clients (the remotehost=client.domain.foo.bar assigns the IP address to the dialin client). If this is the client, then you can use remotehost=0,0, but then the server must specify an IP address. It is vitally important that either the server or the client (or both) specifies an IP address to use. From a routing security point of view, the server should always specify the IP address.

If you are using PAP or CHAP authentication (CHAP is added in patch 517 for IRIX-5.3, and is in IRIX-6.2 and later), then you need to add the appropriate recv_name=Pclient and recv_passwd=password entries in /etc/ppp.conf, which might look like:

   Pclient in remotehost=client.domain.foo.bar
       recv_chap recv_pap
       recv_name=Pclient recv_passwd=password

There are some PPP implementations that do not handle protocol negotiation correctly. The Windoze95 stack seems to be one of these. This will either cause the link to fail to come up, or to cause it to fail "randomly" after a short uptime. The solution is to tell SGI's ppp to not try to negotiate the offending (advanced) protocols. Add the following options to the /etc/ppp.conf entry:

    -mp -ccp

Additional Client Dialin Considerations

1. use static IP addresses for each client
2. use IP addresses on a separate subnet, then routing is taken care of automatically via propagation of host routes (this is easier in IRIX-6.2, since it supports variable subnet masks, aka CIDR)

   #!/bin/sh
   arp -s client.domain.foo.bar
   ppp -r $USER
   arp -d client.domain.foo.bar

The script above is unneccessary if the server is running IRIX-6.3 or later, as a new capability was added to the PPP daemon to support dynamic proxy-ARP configuration:

   proxy_arp=ifname

IRIX SLIP and PPP are not designed to handle this case. The degenerate case of one dialin modem per host is actually workable, though. Just assign the same IP address (in /etc/ppp.conf or /usr/etc/remoteslip) to all dialup accounts. Since only one dialup account can be in use at any one time, this solves the issue of determining which IP address to assign to the client when it logs in. Just make sure that each server host assigns a different IP address to it's client accounts. The accounts can be the same across multiple dialin servers, but they must have a different IP address on each server.

There is a hack to handle multiple modems on a server host and do server-assigned IP addressing. The two that have been tried (not by me, and I don't know details -- these are hints for your implementation!) are:

statically assigned per port

The login shell is a script that chooses an IP address to assign based upon the port that the client is connected on. For SLIP, this should be an easy addition to /usr/etc/remoteslip, something like:

   #!/bin/sh
   case `tty` in
       /dev/ttyf2)
           ipaddr=192.26.50.31
           ;;
       /dev/ttyf3)
           ipaddr=192.26.50.105
           ;;
   esac
   arp -s $ipaddr `netstat -ian | grep :` pub
   slip -i -p cslip -r $ipaddr
   arp -d $ipaddr
   exit 0

For PPP, you would need to create a login script that might look something like:

   #!/bin/sh
   port=`tty`
   USER=`echo $port | sed -e 's,/dev/,,'`
   arp -s $USER `netstat -ian | grep :` pub
   ppp -r $USER
   arp -d $USER
   exit 0

and the real trick is that the IP addresses for the logins (and the entries in /etc/ppp.conf) are named after the ports, ie: ttyf2, ttyf3, ttyf44, etc. Note that you probably have to change /etc/resolv.conf to hostresorder local bind on the server to make this work. Example /etc/ppp.conf entries might look like:

   ttyf2 in remotehost=ttyf2
   ttyf3 in remotehost=ttyf3

If you want to use PAP or CHAP authentication, you will have to get a lot more clever. You may be able to get away with using the reconfigure keyword to reduce your work. You'll have to experiment, since I haven't.

Least Recently Used IP address

This is the most common implementation in dedicated terminal servers. This assigns the IP addresses in a round-robin fashion to clients as they dial in. In order to approximate this with IRIX PPP or SLIP, you would have to keep some additional information around (which IP addresses are in the pool), and you would need to parse the output of /usr/etc/netstat -in to figure out which of those addresses are in use. Then pick one of the addresses that is available. I would recommend have a pool of IP addresses several larger than the number of modems, to deal with multiple simultaneous logins and other race conditions. This is not going to be an easy programming task. Good Luck!

Even so, this will not give you the full capability of commercial terminal servers (like the Livingston Portmaster, which will (among other things) allow a client to negotiate a different IP address in the pool, if it is still available. (I used the Portmaster because I am familiar with it. Other Terminal servers behave similarly).

For the Obscure Bug of the Month Award

% /usr/etc/netstat -i
Name Mtu   Network     Address            Ipkts Ierrs    Opkts Oerrs  Coll
ec0  1500  192.82.281  server.sub.doma 16704753  2490 14890682    98 14870035
lo0  32880 loopback    localhost        2142995     0  2142995     0     0
du0* 1500  (pt-to-pt)  client.sub.doma     2364     0   106924     0     0
sl0* 512   (pt-to-pt)  client.sub.doma        5     1        0     0     0
sl1* 1006  none        none                   0     0        0     0     0
sl2* 1006  none        none                   0     0        0     0     0
sl3* 1006  none        none                   0     0        0     0     0

Note: This is fixed in IRIX-5.3 (and later).

Other Useful Information

• IP address and routing issues
• modem setup and configuration
• Proxy ARP routing on a split network
• resolving hostnames on an isolated machine
• configuring PPP for Irix-5.2 and later
• configuring SLIP for Irix
• debugging a PPP connection
• dialup access the parent page.

I hope and intend that this documentation can help you with your PPP connection problems. My other commitments (like work) permitting, I will attempt to help you on issues not covered, or that you are unclear on. Please make sure that you provide me a valid return email address! (I won't try to fix it).

Last modified: Sun Feb 1 14:37:09 1998