ACCEL-PPP ========= ACCEL-PPP is a high-performance, multi-threaded VPN and broadband access concentrator for Linux. It has its own userspace PPP implementation, so one daemon can manage all connections without relying on pppd. The implementation was developed from scratch rather than as a wrapper around pppd. It uses Linux kernel interfaces for PPTP, L2TP, and PPPoE data paths, while SSTP is handled in userspace. Features ======== * Modular architecture and a multi-threaded I/O core * PPTP, PPPoE (including TR-101), L2TPv2, SSTP, and IPoE. ACCEL-PPP does not provide integrated IPsec for L2TPv2; deploy IPsec separately when required. * RADIUS authentication and accounting, including Disconnect Messages and Change of Authorization (DM/CoA) * PAP, CHAP-MD5, MS-CHAPv1, and MS-CHAPv2 authentication * Microsoft Point-to-Point Encryption (MPPE) * File, syslog, TCP, and optional PostgreSQL logging, including per-session logs * Extensible authentication sources, including RADIUS and pppd-compatible chap-secrets files * Extensible IP address pools populated by RADIUS, chap-secrets, or static configuration * pppd-compatible ip-up and ip-down scripts * TBF/HTB shaping and clsact policing * Telnet and TCP command-line interfaces * Optional SNMP support as a master agent or AgentX subagent EAP authentication and PPP compression are not supported. Requirements ============ Building the daemon requires: * Linux * A C compiler and standard build tools * CMake 3.10 or newer * OpenSSL development files * PCRE2 development files Kernel headers are also required when building the optional PPTP, IPoE, or VLAN monitoring kernel modules. Optional features require their corresponding development libraries: * Net-SNMP for NETSNMP=TRUE * PostgreSQL client libraries for LOG_PGSQL=TRUE * Lua for LUA=TRUE or a specific Lua version such as LUA=5.3 Building and installing ======================= Use an out-of-tree build directory: cmake -S . -B build \ -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_INSTALL_PREFIX=/usr/local cmake --build build sudo cmake --install build Useful build options: * BUILD_PPTP_DRIVER=TRUE builds the PPTP kernel module. * BUILD_IPOE_DRIVER=TRUE builds the IPoE kernel module. * BUILD_VLAN_MON_DRIVER=TRUE builds the VLAN monitoring kernel module. * BUILD_DRIVER_ONLY=TRUE builds only the selected kernel modules. * KDIR=/path/to/kernel/build sets the kernel build directory. * RADIUS=FALSE omits RADIUS support. * SHAPER=FALSE omits the traffic-shaping module. * NETSNMP=TRUE builds SNMP support. * LOG_PGSQL=TRUE builds PostgreSQL logging support. For example, to build the IPoE and VLAN monitoring modules for the running kernel: cmake -S . -B build \ -DBUILD_IPOE_DRIVER=TRUE \ -DBUILD_VLAN_MON_DRIVER=TRUE \ -DKDIR="/usr/src/linux-headers-$(uname -r)" cmake --build build Configuration ============= The sample configuration is installed as accel-ppp.conf.dist. See "man 5 accel-ppp.conf" for the complete configuration reference. Enable or disable functionality in the [modules] section. To authenticate from a pppd-compatible secrets file, enable chap-secrets instead of radius. RADIUS may remain compiled in; RADIUS=FALSE is only needed when it should be omitted from the build. Loading both providers does not provide dependable automatic fallback from RADIUS to chap-secrets because authentication providers are consulted in module registration order. For DM/CoA deployments, configure dae-allowed in the [radius] section to restrict permitted source addresses. Built-in shaper =============== The shaper supports TBF and HTB queueing disciplines and a clsact policer. Build it with SHAPER=TRUE (the default), then enable shaper in the configuration's [modules] section. RADIUS rate attributes accept a single rate or separate downstream/upstream rates. The default attribute is Filter-Id. Values are in Kbit/s unless Cisco-style attributes are used: Filter-Id=1000 Filter-Id=2000/3000 The first example sets both directions to 1000 Kbit/s. The second sets the downstream rate to 2000 Kbit/s and the upstream rate to 3000 Kbit/s. Set a custom rate attribute with attr. The named attribute must exist in the RADIUS dictionary: [shaper] attr=My-Custom-Rate-Attribute Alternatively, use separate attributes for each direction: [shaper] attr-down=PPPD-Downstream-Speed attr-up=PPPD-Upstream-Speed For Cisco-style attributes: [shaper] vendor=Cisco attr=Cisco-AVPair Send input and output attributes to set both directions. In Cisco-style attributes, input controls upstream traffic and output controls downstream traffic: Cisco-AVPair=lcp:interface-config#1=rate-limit input 2000000 8000 8000 conform-action transmit exceed-action drop Cisco-AVPair=lcp:interface-config#1=rate-limit output 2000000 8000 8000 conform-action transmit exceed-action drop These examples set a 2000 Kbit/s rate and an 8 KB burst in each direction. Burst configuration ------------------- For non-Cisco attributes, configure the factors used to calculate bursts from the rate. down-burst-factor applies to downstream TBF/HTB shaping; up-burst-factor applies to upstream policing/HTB shaping: [shaper] down-burst-factor=1.0 up-burst-factor=10.0 Time ranges ----------- Time ranges can change rates automatically: [shaper] time-range=1,1:00-3:00 time-range=2,3:00-5:00 time-range=3,5:00-7:00 Prefix a rate with its range ID and supply multiple RADIUS attributes: Filter-Id=1000 Filter-Id=1,2000 Filter-Id=2,3000 Filter-Id=3,4000 This sets a default of 1000 Kbit/s and rates of 2000, 3000, and 4000 Kbit/s in ranges 1, 2, and 3 respectively. For Cisco-style time ranges, the access-group value is the range ID: Cisco-AVPair=lcp:interface-config#1=rate-limit output access-group 1 1000000 8000 8000 conform-action transmit exceed-action drop Cisco-AVPair=lcp:interface-config#1=rate-limit input access-group 1 1000000 8000 8000 conform-action transmit exceed-action drop When using chap-secrets, an optional fifth column can provide rate information in the same format. Time ranges are not supported in chap-secrets. SNMP ==== Build SNMP support with NETSNMP=TRUE and enable net-snmp in [modules]. ACCEL-PPP starts as an AgentX subagent by default, so the Net-SNMP master agent must have AgentX enabled. Consult the Net-SNMP AgentX documentation when configuring the master agent. To run ACCEL-PPP as the master agent instead: [snmp] master=1 Install accel-pppd/extra/net-snmp/ACCEL-PPP-MIB.txt in the local MIB directory. The file also contains the numerical OIDs used by ACCEL-PPP. Examples: # Read statistics and sessions. snmpwalk -m +ACCEL-PPP-MIB -v 2c -c local 127.0.0.1 ACCEL-PPP-MIB::accelPPPStat snmptable -m +ACCEL-PPP-MIB -v 2c -c local 127.0.0.1 ACCEL-PPP-MIB::sessionsTable # Terminate sessions by accounting ID, interface, address, or username. snmpset -m +ACCEL-PPP-MIB -v 2c -c local 127.0.0.1 ACCEL-PPP-MIB::termBySID.0 = 0000000000000001 snmpset -m +ACCEL-PPP-MIB -v 2c -c local 127.0.0.1 ACCEL-PPP-MIB::termByIfName.0 = ppp2 snmpset -m +ACCEL-PPP-MIB -v 2c -c local 127.0.0.1 ACCEL-PPP-MIB::termByIP.0 = 192.0.2.1 snmpset -m +ACCEL-PPP-MIB -v 2c -c local 127.0.0.1 ACCEL-PPP-MIB::termByUsername.0 = user1 # Run a CLI command. snmpset -m +ACCEL-PPP-MIB -v 2c -c local 127.0.0.1 ACCEL-PPP-MIB::cli.0 = "shaper change all 1024 temp" Encrypted chap-secrets ====================== The chap-secrets module supports encrypted passwords through OpenSSL. Set encrypted=1 in the [chap-secrets] section. Usernames may remain in cleartext or be transformed through a hash chain configured with username-hash, for example: [chap-secrets] encrypted=1 username-hash=md5,sha1 Hashed usernames must be hexadecimal digest values. Passwords must contain the NT hash produced by smbencrypt. Encrypted secrets are incompatible with the auth_chap_md5 module. Hash chains are applied from left to right; for username-hash=md5,sha1, the binary MD5 result is passed to SHA-1 and the final digest is stored as hexadecimal. Kernel module warning ===================== The out-of-tree PPTP module conflicts with the kernel's ip_gre module. Do not build ip_gre into the kernel or load it at runtime when using that PPTP module. Do not mix ACCEL-PPP PPTP connections with poptop's pptpd; stop existing pptpd sessions before starting ACCEL-PPP. More information ================ * Project website: https://accel-ppp.org/ * Source and issue tracker: https://github.com/accel-ppp/accel-ppp * Additional RADIUS notes: docs/ * Email: contact@accel-ppp.org * ICQ: 337258064 * Jabber: dima@accel-ppp.org