Welcome to the ACUA PPP over Ethernet HOWTO. Introduction: In this document I will describe how to set up a PPPoE server, where and how to get PPPoE clients, and how to set up ACUA for PPPoE monitoring. My test system is running Kernel 2.4.13 and a patched PPPD. Programs you'll need to get: Roaring Penguin's PPPoE for Linux (you need the server program out of this). Patched PPPD for Roaring Penguins PPPoE. http://www.roaringpenguin.com/pppoe/ ACUA v3.04 or newer. ACUA v3.04 is the first ACUA with PPPoE support. http://acua.ebbs.com.au/ Some basic stuff you should know: The PPPoE (PPP over Ethernet) server is called an Access Concentrator. I will show you how to make your Linux box emulate an Access Concentrator as you need this to get PPPoE working. I may at times call the Access Concentrator an AC for short. PPPoE is literally just that. The PPPoE protocol itself is simple, and basically it provides a way to fool pppd into thinking it's running over a phone line, where in fact it is running over an Ethernet connection. Lets get to it! The ACUA installation is really easy for PPPoE, in fact you probably wont need to configure a thing to actually get it working, but there are a few things I do suggest you configure, I'll get to that shortly. Unpack the ACUA archive that you have downloaded. At the moment because PPPoE support is still very new, I'd suggest always using the latest version of ACUA. Once you've unpacked ACUA (for this tutorial we will assume you have unpacked it to /usr/src/acua-3.04) cd /usr/src/acua-3.04 make dep make make install ACUA is now installed. There is two PPPoE-specific executables that come with ACUA v3.04. The executables are acua_login_pppoe and acua_logout_pppoe, which I'll explain how to use later. Next, unpack the Roaring Penguin PPPoE package. To keep things easy I will assume it's been unpacked into /usr/src/rp-pppoe-3.3 cd /usr/src/rp-pppoe-3.3/src ./configure make make install RP-PPPoE is now installed. Next, you need to install the patched PPPD which supports RP-PPPoE. If you haven't already, you can download the patched PPPD from the Roaring Penguin web site. To install the patched PPPD, unpack it to /usr/src/pppd-2.4.1.pppoe2, again, I'll now assume you've unpacked the special pppd into /usr/src/pppd-2.4.1.pppoe2. I've also seen a pppoe4 version of this pppd but I'm not sure if it's the official one to use or not, so I've used the pppoe2 version on my system. cd /usr/src/pppd-2.4.1.pppoe2 ./configure make make install The special PPPD is now installed. This PPPD can also accept and make normal modem connections. Configuring things: I'll keep the configuration simple. It took me a while to get the PPPoE server running. This I think was mainly because the PPPoE in my distribution was broken, so I had to download the vanilla source from the Roaring Penguin web site before it would work. That cost me at least 12 hours in development time, but it also gave me a chance to read through the pppoe-server source code, and I must say, the code is very good quality indeed. I also read the PPPoE RFC to familiarise myself with the way it all works, that was also well worth it, but you shouldn't have to go to those extremes. After all, what else is a HOWTO for, apart from letting you cheat? :) Configuring ACUA Very little has to be done to configure ACUA. There is however a thing or two that you'll probably want to change. Firstly, a standard feature of ACUA is to offer idle timeouts for both shell and ppp connections. I would suggest that you either increase the idle timeout, or disable it all together. The ACUA configuration file is /usr/lib/acua/acua.config, in that file you will see a few things. You can safely ignore the devices line in there as this doesn't apply to PPPoE. In the ACUA config file, I suggest you find the following and tweak them: MailProg - The location of the "mail" program on your system. If you are not sure where this program is then go to the Linux command prompt and type: which mail it will come back with something like /bin/mail or /usr/bin/mail. So, make the MailProg configuration line look like: MailProg /usr/bin/mail Next, you should tweak the Idle Timeout values. You can ignore the TTY Idle Timeouts, and just tweak the PPP ones. By default, the PPP Idle Timeout line looks like: PPPIdleBoot 15 15360 This means that PPP connections by default have a 15 minute timeout, and are also required to transfer 15360 bytes (15 * 1024 = 15360 bytes which is exactly 15k) The reason for the minimum data limit is to help stop people leaving a PPP connection running with ping going in the background continually pinging something to keep the link from looking like it is idle. For LANs and the like that have PPPoE running, I suggest that you set the PPPIdleBoot to something like: PPPIdleBoot 0 0 This effectively disables the PPP idle timeouts in ACUA. You can also set PPP idle timeouts on a per-user basis once the user has been created. One more very important thing you need to do is have acua_login_pppoe run automatically when there is a PPPoE connection. This is configured in the /etc/ppp/ip-up script. The way I have done this is like so: if [ "$PPP_TTY" == "" ]; then # PPPoE Connection Detected acua_login || kill -HUP "$PPPD_PID" fi You should also (but you don't need to) configure a similar thing in /etc/ppp/ip-down, like so: if [ "$PPP_TTY" == "" ]; then # PPPoE Connection Ended acua_logout fi If you neglect to configure the /etc/ppp/ip-down script with the above, users will not be logged out until acua_updated does it's next update run (once a minute), and because PPPoE connections can typically connect back very fast, if ACUA still thinks the old session is running, it will deny the login. Configuring the RP-PPPoE server (Access Concentrator) When you installed RP-PPPoE, it put some files into /etc/ppp. We should go and do some stuff here now. cd /etc/ppp cp pppoe-server-options-example pppoe-server-options Now you need to edit the pppoe-server-options file in /etc/ppp, make it look something like this: # PPP options for the PPPoE server require-pap login lcp-echo-interval 60 lcp-echo-failure 2 The "login" option is vital. ACUA needs this otherwise it will think your PPPoE client has terminated the connection to the PPPoE server. The "login" option tells PPPD to do two things. 1) Use /etc/passwd and /etc/shadow for authentication. 2) Write an entry into utmp, so the user shows up when you type "who" or "w" at the Linux prompt. Next, you need to edit /etc/ppp/pap-secrets, and add a line like so: * * "" * This line, along with the "login" option mentioned above, allows pppd to look in /etc/passwd and/or /etc/shadow for the users password when doing authentication. If you do not have this line, you will get an Authentication Failure when your PPPoE client attempts to connect to the Access Concentrator (the server). If you want to use CHAP authentication as opposed to PAP, you need to put the same line above into /etc/ppp/chap-secrets. The permissions on /etc/ppp/pap-secrets and /etc/ppp/chap-secrets are also important to set correctly, so to make sure everything has the right permissions, run the following commands: chown root.root /etc/ppp/pap-secrets chown root.root /etc/ppp/chap-secrets chmod 600 /etc/ppp/pap-secrets chmod 600 /etc/ppp/chap-secrets PPPD is fussy about these permissions, and if set too insecure, PPPD will refuse to authenticate the client, and you'll get another Authentication Failure. Adding users to the system: To add a user to the system, you really should take a look at the acua_adduser script and make it suit your system. After you have done any needed changes to that script (/usr/sbin/acua_adduser) you can then run acua_adduser and add a user to the system. acua_adduser test [ acua_adduser will ask you for a password for the account and a few other details ] Now you should give the user a subscription: acua subscribe test 30 1440 This will give the user "test" a 30-day account with 1440 minutes a day access time. You can also set session limits, download limits, upload limits, access times, etc. See the standard ACUA documentation for that though as I won't explain it here. Ok, so now you have ACUA, RP-PPPoE, and a special PPPD set up on your server. Now it's time to make the required programs start automatically, and the easiest way to do this is..... edit /etc/inittab, and add two lines to the end of it: au:2345:respawn:/usr/sbin/acua_updated -d ac:2345:respawn:/usr/sbin/pppoe-server -F -I eth0 ^^ Notice the au and ac is different at the start of the lines. The first line above starts the ACUA Update daemon which is in charge of kicking users off when they exceed time/data/session limits, or if their subscription expires, etc. This program is vital, and you will not like the results if it's not running (no accounting, no users being kicked off when necessary, etc). The second line above starts the PPPoE Access Concentrator (server). If your PPPoE clients are on eth1 instead of eth0, change the line above to suit. You do not actually need to specify an Ethernet interface to use though. On my test system I used eth0, which also had other computers running off it at the same time. Now at the Linux command prompt, you need to type the command: init q This will tell the INIT program (which is always running) to re-read /etc/inittab and to run the two new programs you just put in there. Once you type "init q" at the command-line, ACUA will be running and so will your PPPoE Access Concentrator. Setting up the PPPoE clients (Linux and Windows): Linux: This is probably the easiest part of the whole process. On Linux, you can type adsl-setup to set up your PPPoE connection. If you do not have adsl-setup, there is another tool which can be found in Debian called pppoeconf which is really nice, but a little dodgy when it comes to detecting your Ethernet card if it does not have an IP Address assigned to it. The adsl-setup package is included with RP-PPPoE. Windows: And the fun begins. When it comes to Windows, there doesn't seem to be many FREE PPPoE clients. One that I have used with this PPPoE setup is RASPPPoE, which works very well, and can be found at: RASPPPoE Web site - http://user.cs.tu-berlin.de/~normanb/ Alternatively, if you can't get along with RASPPPoE, there is another way to get PPPoE clients for free, but it's probably not really legal. I'll explain anyway and leave the choice up to you. It seems that most PPPoE clients are licensed to ISP's. Some of us are not going to pay for PPPoE client licenses. So, to get a good PPPoE client that you're probably supposed to in-directly pay for, but for free, you simply visit a few ISP's home pages which provide an ADSL service and download their client. Thats what I did and the client I got is a nice one, works exceptionally well (no faults yet, no crashes, no unexpected sessions terminated, etc). Some ISP's password protect their web site where the PPPoE clients reside, which I guess is probably what they're supposed to do (or at least restrict them to members only). So simply download either RASPPPoE which is legal (read the license though!) or go and get some other ISP's PPPoE client and change any settings you need to change. :) It has come to my attention that versions of EnterNet prior to v1.34 are buggy and sometimes (or always) don't put in a default route on the Windows PC. So, if using EnterNet and you're not getting anywhere, this could be why. Test your setup: Go on! Test it! Cross your fingers, ring everyone and make them prey for success on your behalf - you'll probably need it. Are you feeling confident now? Getting help: ACUA v3.04 is the first to have PPPoE support, and it was somewhat a fluke that I got it working as well and quickly that I did, so there is bound to be a glitch somewhere in the software. If you are having ANY PROBLEM AT ALL with ACUA, using the PPPoE stuff, you are more than welcome to contact me because I'm more than eager to help you and to find any bugs in the PPPoE support in ACUA! You can contact me on acua@acua.ebbs.com.au Or you may use the ACUA mailing list by sending an E-Mail containing your question to acua_list@lists.ebbs.com.au