Now that you're keeping the bad people out, and only letting the good people
in, you may need to make sure that the good people behave themselves. This is
most easily done by not letting them do anything except run pppd. This may
or may not be necessary. I restrict users because the system that I maintain
is dedicated to VPN, so users have no business doing anything else on it.
There is this neat little program called sudo that allows the admin on a
Unix system to grant certain users the ability to run certain programs
as root. This is necessary in this case since pppd must be run as root.
You'll need to use this method if you want to allow users shell access.
Read up on how to setup and use sudo in the sudo man page. Using sudo
is best on multi-use systems that typically host a small number of
trusted users.
If you decide to not allow users to have shell access, then the best way
to keep them from gaining it is to make their shell pppd. This is
done in the /etc/passwd file. You can see /etc/passwd file
that I did this for the last three users. The last field of the
/etc/passwd file is the user's shell. You needn't do anything special
to pppd in order to make it work. It gets executed as root when the
user connects. This is certainly the simplest setup to be had, as well
as the most secure, and ideal for large scale and corporate
systems. I describe exactly what all needs to be done later in this
document. You can Section 5.7 if you
like.
