If user is in group dip he can use pon and poff but he cant use plog to see why dial failed etc. I think such user should be able to use plog also so /var/log/ppp.log should be own by root.dip not root.adm