Installing and Administering PPP

134 Chapter 5

Security Techniques

Replacing getty with pppd

Incoming calls most often invoke the getty program because it enables

place of getty. Invoking pppd offers additional security because people

ﬁnd the beginning of LCP option negotiations much more difﬁcult to

circumvent than a simple ‘login:’ prompt. When the modem answers an

incoming call and raises the Carrier Detect signal, the caller sees a burst

of what looks like line noise.

To replace getty with pppd, ﬁrst use SAM to set up a getty on the

serial port. When setting up the serial port through SAM, be sure to

choose “Receive Incoming Calls (start getty process)”. This adds a getty

(or uugetty) line to the /etc/inittab ﬁle. As an example, suppose the

line added to /etc/inittab by SAM were:

a0:3:respawn:/usr/lbin/uucp/uugetty -r -t 60 -h ttyd0p1 19200

You can replace the uugetty with the pppd process and invoke it with

any arguments you like. For example:

a0:3:respawn:/usr/bin/pppd localhost: idle 120 requireauth ttyd0p1 19200

It should be noted that the device (ttyd0p1) and speed (19200) should be

speciﬁed on the pppd command line as pppd needs to know what device

to open and at what speed.

Note that Challenge Handshake Authentication Protocol (CHAP) is still

strongly recommended for security.