System Administration Guide: Network Services

Password Authentication Protocol (PAP)

PAP authentication is somewhat similar in operation to the UNIX login program, though PAP does not grant shell access to the user. PAP uses the PPP configuration files and PAP database in the form of the /etc/ppp/pap-secrets file for setting up authentication. PAP also uses /etc/ppp/pap-secrets for defining PAP security credentials. These credentials include a peer name, a “user name” in PAP parlance, and a password. PAP credentials also contain related information for each caller who is permitted to link to the local machine. The PAP user names and passwords can be identical to or different from the UNIX user names and passwords in the password database.

/etc/ppp/pap-secrets File

The PAP database is implemented in the /etc/ppp/pap-secrets file. Machines on both sides of the PPP link must have properly configured PAP credentials in their /etc/ppp/pap-secrets files for successful authentication. The caller (authenticatee) supplies credentials in the user and password columns of the /etc/ppp/pap-secrets file or in the obsolete +ua file. The server (authenticator) validates these credentials against information in /etc/ppp/pap-secrets, through the UNIX passwd database, or in the PAM facility.

The /etc/ppp/pap-secrets file has the following syntax.

myclient ISP-server mypassword *

The parameters have the following meaning.


PAP user name of the caller. Often, this name is identical to the caller's UNIX user name, particularly if the dial-in server uses the login option of PAP.


Name of the remote machine, often a dial-in server.


Caller's PAP password.


IP address that is associated with the caller. Use an asterisk (*) to indicate any IP address.

Creating PAP Passwords

PAP passwords are sent over the link in the clear, that is, in readable ASCII format. For the caller (authenticatee), the PAP password must be stored in the clear in any of the following locations:

On the server (authenticator), the PAP password can be hidden by doing one of the following:

What Happens During PAP Authentication

PAP authentication occurs in the following sequence.

Figure 22–1 PAP Authentication Process

The following context describes the sequence that is
shown in the flow diagram.

  1. The caller (authenticatee) calls the remote peer (authenticator) and provides its PAP user name and password as part of link negotiation.

  2. The peer verifies the identity of the caller in its /etc/ppp/pap-secrets file. If the peer uses the login option of PAP, the peer verifies the caller's user name and password in its password database.

  3. If authentication is successful, the peer continues link negotiation with the caller. If authentication fails, the link is dropped.

  4. (Optional) If the caller authenticates responses from remote peers, the remote peer must send its own PAP credentials to the caller. Thus, the remote peer becomes the authenticatee and the caller the authenticator.

  5. (Optional) The original caller reads its own /etc/ppp/pap-secrets to verify the identity of the remote peer.

    Note –

    If the original caller does require authentication credentials from the remote peer, Step 1 and Step 4 happen in parallel.

    If the peer is authenticated, negotiation continues. Otherwise, the link is dropped.

  6. Negotiation between caller and peer continues until the link is successfully established.

Using the login Option With /etc/ppp/pap-secrets

You can add the login option for authenticating PAP credentials to any PPP configuration file. When login is specified, for example, in /etc/ppp/options, pppd verifies that the caller's PAP credentials exist in the Solaris password database. The following shows the format of a /etc/ppp/pap-secrets file with the login option.

joe    *  ""  *
sally  *  ""  *
sue    *  ""  *

The parameters have the following meanings.


joe, sally, and sue are the names of the authorized callers.


Asterisk (*), which indicates that any server name is valid. The name option is not required in the PPP configuration files.


Double quotes, which indicate that any password is valid.

If a password is in this column, then the password from the peer must match both the PAP password and the UNIX passwd database.

IP Addresses

Asterisk (*), which indicates that any IP address is allowed.