Skip Navigation Links | |
Exit Print View | |
![]() |
System Administration Guide: Network Services Oracle Solaris 11 Express 11/10 |
Part I Network Services Topics
Part II Accessing Network File Systems Topics
4. Managing Network File Systems (Overview)
5. Network File System Administration (Tasks)
6. Accessing Network File Systems (Reference)
8. Planning and Enabling SLP (Tasks)
10. Incorporating Legacy Services
Part V Serial Networking Topics
15. Solaris PPP 4.0 (Overview)
16. Planning for the PPP Link (Tasks)
17. Setting Up a Dial-up PPP Link (Tasks)
18. Setting Up a Leased-Line PPP Link (Tasks)
19. Setting Up PPP Authentication (Tasks)
Configuring PPP Authentication (Task Map)
Configuring PAP Authentication
Setting Up PAP Authentication (Task Maps)
Configuring PAP Authentication on the Dial-in Server
How to Create a PAP Credentials Database (Dial-in Server)
Modifying the PPP Configuration Files for PAP (Dial-in Server)
How to Add PAP Support to the PPP Configuration Files (Dial-in Server)
Configuring PAP Authentication for Trusted Callers (Dial-out Machines)
How to Configure PAP Authentication Credentials for the Trusted Callers
Modifying PPP Configuration Files for PAP (Dial-out Machine)
How to Add PAP Support to the PPP Configuration Files (Dial-out Machine)
Configuring CHAP Authentication
Setting Up CHAP Authentication (Task Maps)
Configuring CHAP Authentication on the Dial-in Server
How to Create a CHAP Credentials Database (Dial-in Server)
Modifying the PPP Configuration Files for CHAP (Dial-in Server)
How to Add CHAP Support to the PPP Configuration Files (Dial-in Server)
Configuring CHAP Authentication for Trusted Callers (Dial-out Machines)
How to Configure CHAP Authentication Credentials for the Trusted Callers
Adding CHAP to the Configuration Files (Dial-out Machine)
How to Add CHAP Support to the PPP Configuration Files (Dial-out Machine)
20. Setting Up a PPPoE Tunnel (Tasks)
21. Fixing Common PPP Problems (Tasks)
22. Solaris PPP 4.0 (Reference)
23. Migrating From Asynchronous Solaris PPP to Solaris PPP 4.0 (Tasks)
25. Administering UUCP (Tasks)
Part VI Working With Remote Systems Topics
27. Working With Remote Systems (Overview)
28. Administering the FTP Server (Tasks)
29. Accessing Remote Systems (Tasks)
Part VII Monitoring Network Services Topics
The tasks in this section explain how to implement authentication on a PPP link by using the Challenge-Handshake Authentication Protocol (CHAP). The tasks use the example that is shown in Figure 16-4 to illustrate a working CHAP scenario for dialing up a private network. Use the instructions as the basis for implementing CHAP authentication at your site.
Before you perform the next procedures, you must have done the following:
Set up and tested the dial-up link between the dial-in server and dial-out machines that belong to trusted callers
Obtained superuser permission for the local machine, either dial-in server or dial-out machine
Table 19-4 Task Map for CHAP Authentication (Dial-in Server)
|
Table 19-5 Task Map for CHAP Authentication (Dial-out Machine)
|
The first task in setting up CHAP authentication is modifying the /etc/ppp/chap-secrets file. This file contains the CHAP security credentials, including the CHAP secret, that are used to authenticate callers on the link.
Note - UNIX or PAM authentication mechanisms do not work with CHAP. For example, you cannot use the PPP login option as described in How to Create a PAP Credentials Database (Dial-in Server). If your authentication scenario requires PAM or UNIX-style authentication, choose PAP instead.
The next procedure implements CHAP authentication for a dial-in server in a private network. The PPP link is the only connection to the outside world. The only callers who can access the network have been granted permission by managers of the network, possibly including the system administrator.
Trusted callers include all people who have been granted permission to call the private network.
Note - Be sure to choose a good CHAP secret that is not easily guessed. No other restrictions are placed on the CHAP secret's contents.
The method for assigning CHAP secrets depends on your site's security policy. Either you have the responsibility for creating the secrets, or the callers must create their own secrets. If you are not responsible for CHAP secret assignment, be sure to get the CHAP secrets that were created by, or for, each trusted caller.
For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.
This release includes an /etc/ppp/chap-secrets file that contains helpful comments but no options. You can add the following options for the server CallServe at the end of the existing /etc/ppp/chap-secrets file.
account1 CallServe key123 * account2 CallServe key456 *
key123 is the CHAP secret for trusted caller account1.
key456 is the CHAP secret for trusted caller account2.
The following list provides references to related information.
How to Add CHAP Support to the PPP Configuration Files (Dial-in Server)
Configuring CHAP Authentication for Trusted Callers (Dial-out Machines)
The task in this section explains how to update existing PPP configuration files to support CHAP authentication on the dial-in server.
Add the options that are shown in bold for CHAP support.
# cat /etc/ppp/options lock nodefaultroute name CallServe auth
See How to Configure Users of the Dial-in Server and How to Define Communications Over the Serial Line (Dial-in Server).
To configure CHAP authentication credentials for trusted callers, refer to How to Create a CHAP Credentials Database (Dial-in Server).
This section contains tasks for setting up CHAP authentication on the dial-out machines of trusted callers. Depending on your site's security policy, either you or the trusted callers might be responsible for setting up CHAP authentication.
For remote callers to configure CHAP, ensure that the callers' local CHAP secrets match the callers' equivalent CHAP secrets in the dial-in server's /etc/ppp/chap-secrets file. Then give the callers the tasks in this section for configuring CHAP.
Configuring CHAP for trusted callers involves two tasks:
Creating the callers' CHAP security credentials
Configuring the callers' dial-out machines to support CHAP authentication
This procedure shows how to set up CHAP credentials for two trusted callers. The steps in the procedure assume that you, the system administrator, are creating the CHAP credentials on the trusted callers' dial-out machines.
For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.
Using the sample CHAP configuration in Example of a Configuration Using CHAP Authentication, assume that the dial-out machine belongs to trusted caller account1.
This release includes an /etc/ppp/chap-secrets file that has helpful comments but no options. You can add the following options to the existing /etc/ppp/chap-secrets file.
account1 CallServe key123 *
CallServe is the name for the peer that account1 is trying to reach. key123 is the CHAP secret to be used for links between account1 and CallServer.
For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.
Assume that this machine belongs to caller account2.
account2 CallServe key456 *
Now, account2 has secret key456 as its CHAP credentials for use over links to peer CallServe.
The following list provides references to related information.
To learn more about CHAP authentication, refer to Challenge-Handshake Authentication Protocol (CHAP). The next task configures the dial-out machine that belongs to caller account1, which is introduced in Example of a Configuration Using CHAP Authentication.
# cat /etc/ppp/options lock nodefaultroute
# cat /etc/ppp/peers/CallServe /dev/cua/a 57600 noipdefault defaultroute idle 120 user account1 connect "chat -U 'mypassword' -f /etc/ppp/mychat"
The option user account1 sets account1 as the CHAP user name to be given to CallServe. For a description of the other options in the previous file, see the similar /etc/ppp/peers/myserver file in How to Define the Connection With an Individual Peer.
To test CHAP authentication by calling the dial-in server, refer to How to Call the Dial-in Server.