Ident protocol: Difference between revisions

Content deleted Content added

Inline

Revision as of 01:24, 27 October 2006

This article is about the Internet protocol. For the jargon contraction used in the broadcasting world, see station identification or Television ident.

The Ident Protocol, specified in RFC 1413, is an Internet protocol that helps identify the user of a particular TCP connection. One popular daemon program for providing the ident service is identd.

How Ident Works

The Ident Protocol is designed to work as a server daemon, on a user's computer, where it receives requests to a specified port, generally 113. The server will then send a specially designed response that identifies the username of the current user.

Usefulness of Ident

Ident is considered useful due to the fact that it is able to distinguish the name of the person most likely to make a connection to the requesting server, which can then be used as identification for abuse control and/or general reporting purposes. This is useful because on most operating systems more than one user can be logged in at a time. The protocol is of no help for users where the source of abuse is the computer administrator. To some extent the trustworthiness of the ident can be determined by seeing if the reverse DNS hostname is a typical ISP host (e.g. user12345.dsl.myisp.com) or a hostname more likely to be of a server.

Security

Filtering the ident port will often cause timeout delays when connecting to servers. Unless you are determined to leave your system totally invisible to the Internet it is best to either run an ident server or to leave the port cleanly rejecting connections using a firewall. It is possible to set up your system to filter ident connections from all systems you haven't made a connection to recently but this can be tricky to set up and few people bother.

The ident protocol is considered dangerous because it allows hackers to gain a list of usernames on a computer system which can later be used for attacks. A generally accepted solution to this is to setup a generic/generated identifier, returning node/hop IDs or Kerberos tickets, rather than usernames.

On Unix-like systems the identd service is generally either started from inetd/tcpd, xinetd or itself linked against libwrap, allowing TCP Wrapper filter rules to be set on some hosts (or entire subnets):

/etc/hosts.allow

identd authd: .intranet.lan, mail.isp.tld, ssh.isp.tld, irc.isp.tld, ftp.isp.tld

On denied requests the default timeout is 5 seconds. However since it is the 'protected' machine waiting to become a client to some other service, most probably, one wants to disable this timeout. Using something similar to the following:

/etc/hosts.deny

identd authd: ALL: twist( /bin/true & )

Uses

Ident is important on IRC as a large number of people connect to IRC servers via bouncers which either serve multiple users or are hosted on shared servers. Some users also use clients on Unix shells. Without ident there would be no way to ban a single user of a bouncer from a channel or network without banning the entire bouncer. It's also needed when complaining to the bouncer operator so they can identify which user is causing trouble. When an IRC server fails to get an identd response it has to fall back on the username given by the client. Ircds usually prefix usernames obtained directly from the client software with ~ (tilde) to indicate that they are not ident usernames and may be faked by the user (although with modern single-user home computers, the ident username itself may be set to whatever the user wants and is often returned by the same IRC client as the rest of the client information). Some IRC servers even go so far as blocking clients without an ident response, the main reason being that it makes it much harder to connect via an "open proxy" or a system where you have compromised a single account of some form but do not have root.

Special identds are used by those running large numbers of bouncers or a single bouncer that supports multiple users to allow bouncer usernames to be returned rather than simply the name of the user account on the system the bouncer is running under. The best known of these is probably oidentd.

References

RFC 912 - Authentication Service
RFC 931 - Authentication Server
Daniel J. Bernstein: TAP - INTERNET DRAFT 1992
Daniel J. Bernstein: Why TAP? A White Paper, draft 3 920820
RFC 1413 - Identification Protocol
RFC 1414 - Identification MIB
Peter Eriksson: TAPvsIDENT 3 Nov 1993
Damien Doligez: Why encrypt ident/TAP replies? 1994.02.22

External links

"IDENT is pointless and potentially dangerous", Erik Fair
"IDENT is not of use to servers", Russell Nelson - A response to the above article.

@@ Line 16: / Line 16: @@
 Filtering the ident port will often cause timeout delays when connecting to servers. Unless you are determined to leave your system totally invisible to the Internet it is best to either run an ident server or to leave the port cleanly rejecting connections using a [[firewall (networking)|firewall]]. It is possible to set up your system to filter ident connections from all systems you haven't made a connection to recently but this can be tricky to set up and few people bother.
-The ident protocol is considered dangerous by some users because it allows [[hackers]] to gain a list of [[username]]s on a [[computer system]] which can later be used for attacks. A generally accepted solution to this is to setup a generic/generated identifier, returning [[Node (networking)|node]]/[[Hop (telecommunications)|hop]] [[Identification (information)|ID]]s or [[Kerberos (protocol)|Kerberos]] tickets, rather than usernames.
+The ident protocol is considered dangerous because it allows [[hackers]] to gain a list of [[username]]s on a [[computer system]] which can later be used for attacks. A generally accepted solution to this is to setup a generic/generated identifier, returning [[Node (networking)|node]]/[[Hop (telecommunications)|hop]] [[Identification (information)|ID]]s or [[Kerberos (protocol)|Kerberos]] tickets, rather than usernames.
 On [[Unix-like]] systems the identd service is generally either started from [[inetd]]/tcpd, [[xinetd]] or itself [[Linker|linked]] against [[libwrap]], allowing [[TCP Wrapper]] filter rules to be set on some hosts (or entire [[Subnetwork|subnets]]):