pppd-pgsql(8)

NAME
pgsql.so - PostgreSQL authentication plugin for pppd(8)

SYNOPSIS
pppd [ options ] plugin pgsql.so

DESCRIPTION

The PostgreSQL plugin for pppd permits pppd to perform Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), MS-CHAP and MS-CHAPv2 authentication against a PostgreSQL server instead of the usual /etc/ppp/pap-secrets and /etc/ppp/chap-secrets files.

OPTIONS
The PostgreSQL plugin introduces some additional pppd options:

pgsql-host host
    The PostgreSQL server host to connect.

pgsql-port port
    The PostgreSQL server port to connect.

pgsql-user username
    The PostgreSQL username for database authentication.

pgsql-pass password
    The PostgreSQL password for database authentication.

pgsql-pass-encryption encryption
    The PostgreSQL encryption type used for the passwords stored in the PostgreSQL database in pgsql-column-pass. Possible values are:

    NONE  •
        Passwords are stored in plaintext.

    CRYPT •
        Passwords are stored using UNIX crypt() algorithm.

    MD5   •
        Passwords are stored using MD5 one-way hashing algorithm.

    AES   •
        Passwords are stored using AES (128-Bit Electronic Codebook Mode) symmetric cipher algorithm.

pgsql-pass-key key
    The key for the symmetric block cipher or the salt for the one-way hash function. This paramter is required if pgsql-pass-encryption is set to AES or CRYPT.

pgsql-database database
    The PostgreSQL database to connect.

pgsql-table table
    The PostgreSQL table to look for username, password and client ip address which should be assigned.

pgsql-column-user username-field
    The PostgreSQL column which stores the username.

pgsql-column-pass password-field
    The PostgreSQL column which stores the password.

pgsql-column-client-ip ip-address-field
    The PostgreSQL column which stores the client ip address.

pgsql-column-server-ip ip-address-field
    The PostgreSQL column which stores the server ip address.

pgsql-column-update update-field
    The PostgreSQL column which should be updated after authentication and ip negotiation. This field is only useful, if you use pgsql-exclusive (see below) too. Please keep in mind that this option requires write access to the database.

pgsql-condition query
    This is an extra PostgreSQL condition, if you need to join additional tables for username verification. The condition has to be valid for the read queries. (Default: not set)

pgsql-exclusive
    If this option is set, the plugin will forbid concurrent connections from the same user. The plugin itself don't know anything about a second connection so this information is stored in database. It is required to set pgsql-column-update to a value in pgsql-table which can be updated and pgsql-authoritative (see below) must be used. (Default: not set)

pgsql-authoritative
    If this option is set, the plugin will authenticate only against the database and if it fails the link will be terminated. If this option is not set, the plugin will fallback on authentication failure to usual /etc/ppp/pap-secrets and /etc/ppp/chap-secrets files. (Default: not set)

pgsql-ignore-multiple
    If this option is set, the plugin will ignore multiple result sets with the same username. The plugin will take the first entry and verifiy it against password. If this option is not set, the plugin will deny authentication and terminate the link. (Default: not set)

pgsql-ignore-null
    If this option is set, the plugin will treat NULL as string and verify username or password against it. If this option is not set, the plugin will deny authentication and terminate the link. (Default: not set)

pgsql-connect-timeout timeout
    The PostgreSQL connection timeout. (Default: 5 seconds)

pgsql-retry-connect retries
    The PostgreSQL connection retry limit, if connection failed it will be retried as often as in retries specified. (Default: 5)

pgsql-retry-query retries
    The PostgreSQL query retry limit, if query failed (maybe the table or row is locked) it will be retried as often as in retries specified. (Default: 5)

pgsql-ip-up /etc/ppp/ip-up-pgsql
    If this option is set, the plugin will execute the given script /etc/ppp/ip-up-pgsql when IPCP has come up after setting the login status inside database. The difference with the PPP internal version is, that this version adds the username as additional parameter and blocks the execution of the PPP daemon until the script returns. (Default: not set)

pgsql-ip-up-fail
    If this option is set, the exit code of the script is evaluated and if it is non-zero, the link will be terminated. If pgsql-exclusive, pgsql-authoritative and pgsql-column-update are set, the login status inside database was changed due to successful authentication and IPCP negotiation. It will be reverted if these options are set. (Default: not set)

pgsql-ip-down /etc/ppp/ip-down-pgsql
    If this option is set, the plugin will execute the given script /etc/ppp/ip-down-pgsql when IPCP goes down before setting the login status inside database. The difference with the PPP internal version is, that this version adds the username, received bytes, transmitted bytes and link duration as additional parameters and blocks the execution of the PPP daemon until the script returns. It does not evaluate the exit code. (Default: not set)

pgsql-ip-down-fail
    If this option is set, the exit code of the script is evaluated and if it is non-zero, the link will be terminated. Due to the fact, that the database is touched after successful execution of the script, nothing will happen to it. (Default: not set)

SEE ALSO
pppd(8)

AUTHOR
Check documentation.

pppd-sql is (c) 2008-2009
    Maik Broemme <mbroemme@plusserver.de>

The above e-mail address can be used to send bug reports, feedbacks or plugin enhancements.