MAN page from Old RedHat 5.X pidentd-2.7-2.i386.rpm

IDENTD

Section: Maintenance Commands (8)
Updated: 27 May 1992
Index

NAME

identd, in.identd - TCP/IP IDENT protocol server

SYNOPSIS

/usr/sbin/in.identd[-i|-w|-b][-t<seconds>][-u<uid>][-g<gid>][-p<port>][-a<address>][-c<charset>][-C[<keyfile>]][-o][-e][-l][-V][-m][-N][-d][-F<format>][kernelfile [kmemfile]]

DESCRIPTION

identdis a server which implements theTCP/IPproposed standardIDENTuser identification protocol as specified in theRFC 1413document.

identdoperates by looking up specificTCP/IPconnections and returning the user name of theprocess owning the connection. It can optionallyreturn other information instead of a user name.

ARGUMENTS

The-iflag, which is the default mode, should be used when starting thedaemon frominetdwith the "nowait" option in the/etc/inetd.conffile. Use of this mode will makeinetdstart oneidentddaemon for each connection request.

The-wflag should be used when starting the daemon frominetdwith the "wait" option in the/etc/inetd.conffile . This is the prefered mode ofoperation since that will start a copy ofidentdat the first connection request and thenidentdwill handle subsequent requestswithout having to do the nlist lookup in the kernel file forevery request as in the-imode above. Theidentddaemon will run either forever, until a bugmakes it crash or a timeout, as specified by the-tflag, occurs.

The-bflag can be used to make the daemon run in standalone mode withoutthe assistance frominetd.This mode is the least prefered mode sincea bug or any other fatal condition in the server will make it terminateand it will then have to be restarted manually. Other than that it has thesame advantage as the-wmode in that it parses the nlist only once.

The-t<seconds>option is used to specify the timeout limit. This is the numberof seconds a server started with the-wflag will wait for new connections before terminating. The server isautomatically restarted byinetdwhenever a new connection is requestedif it has terminated. A suitable value for this is 120 (2 minutes), ifused. It defaults to no timeout (i.e. will wait forever, or until afatal condition occurs in the server).

The-u<uid>option is used to specify a user id number which theidentserver shouldswitch to after binding itself to theTCP/IPport if using the-bmode of operation.

The-g<gid>option is used to specify a group id number which theidentserver shouldswitch to after binding itself to theTCP/IPport if using the-bmode of operation.

The-p<port>option is used to specify an alternative port number to bind to if usingthe-bmode of operation. It can be specified by name or by number. Defaults to theIDENTport (113).

The-a<address>option is used to specify the local address to bind the socket to if usingthe-bmode of operation. Can only be specified by IP address and not by domainname. Defaults to theINADDR_ANYaddress which normally means all local addresses.

The-Vflag makesidentddisplay the version number and then exit.

The-lflag tellsidentdto use the System logging daemonsyslogdfor logging purposes.

The-oflag tellsidentdto not reveal the operating system type it is run on and to insteadalways return "OTHER".

The-eflag tellsidentdto always return "UNKNOWN-ERROR" instead of the "NO-USER" or"INVALID-PORT" errors.

The-c<charset>flags tellsidentdto add the optional (according to the IDENT protocol) character setdesignator to the reply generated.charsetshould be a valid character set as described in the MIME RFC in uppercase characters.

The-C[<keyfile>]option tellsidentdto return encrypted tokens instead of user names.The local and remote IPaddresses and TCP port numbers, the local user's uid number, a timestamp,a random number, and a checksum, are all encrypted using DESwith a secret key derived from the first line of thekeyfile(usingdes_string_to_key(3)).The encrypted binary information is then encoded in a base64 string(32 characters in length) and enclosed in square brackets to producea token that is transmitted to the remote client.The encrypted token can later be decrypted byidecrypt(8).There may not be a space between the-Cand the name of thekeyfile.If thekeyfileis not specified, it defaults to/etc/identd.key.

The-nflag tellsidentdto always return user numbers instead of user names if you wish tokeep the user names a secret.

The-Nflag makesidentdcheck for a file ".noident" in each homedirectory for a user which thedaemon is about to return the user name for. It that file exists then thedaemon will give the errorHIDDEN-USERinstead of the normal USERID response.

-mflag makesidentduse a mode of operation that will allow multiple requests to beprocessed per session. Each request is specified one per line andthe responses will be returned one per line. The connection will notbe closed until the connecting part closes it's end of the line.PLEASE NOTE THAT THIS MODE VIOLATES THE PROTOCOL SPECIFICATION ASIT CURRENTLY STANDS.

The-dflag enables some debugging code that normally should NOTbe enabled since that breaks the protocol and may reveal informationthat should not be available to outsiders.

The-F<format>option makesidentduse the specified format to display info. The allowed format specifiers are:

%u   print user name%U   print user number%g   print (primary) group name%G   print (primary) group number%l   print list of all groups by name%L   print list of all groups by number%p   print process ID of running process%c   print command name%C   print command and arguments

The lists of groups (%l, %L) are comma-separated, and start with the primarygroup which is not repeated. The %p and the %c and %C formats are notsupported on all architecture implementations (printing 0 or empty stringinstead).
Any other characters (preceded by %, and those not preceded by it) areprinted literally. The "default" format is %u, and you should not useanything else without the-oflag.
Not implemented yet, but on my wish-list are the following:

%w   print working (current) directory%h   print home (login, naming) directory%e   print the environment

kernelfiledefaults to the normally running kernel file.

kmemfiledefaults to the memory space of the normally running kernel.

UNDOCUMENTED FLAGS

The-vflag enables more verbose output or messages. (Further occurences of the-vflag make things even more verbose.) Currently not used: ignored.

The-f<config-file>option causesidentdto use the named config file (instead of the default /etc/identd.conf ?).Currently not used: ignored, no config files are used.

The-r<indirect_host>option is used in some way (for proxy queries?).

The-C<keyfile>option is used in some way for DES encryption.

INSTALLATION

identdis invoked either by the internet server (seeinetd(8C)) for requests to connect to theIDENTport as indicated by the/etc/servicesfile (seeservices(5)) when using the-wor-imodes of operation or started manually by using the-bmode of operation.

EXAMPLES

Assuming the server is located in/usr/etc/in.identdone can put either:

ident stream tcp wait sys /usr/etc/in.identd in.identd -w -t120

or:

ident stream tcp nowait sys /usr/etc/in.identd in.identd -i

into the/etc/inetd.conffile. User "sys" should have enough rights to READ the kernelbut NOT to write to it.

To start it using the-bmode of operation one can put a line like this into the/etc/rc.localfile:

/usr/etc/in.identd -b -u2 -g2

This will make it run in the background as user 2, group 2 (user "sys",group "kmem" on SunOS 4.1.1).

NOTES

The username (or UID) returned ought to be the login name. However it(probably, for most architecture implementations) is the "real user ID" asstored with the process; there is no provision for returning the "effectiveuser ID". Thus the UID returned may be different from the login name forsetuid programs (or those running as root) which done asetuid(3)call and their children. For example, it may (should?) be wrong for anincomingftpd; and we are probably interested in the running shell, not thetelnetdfor an incoming telnet session. (But of courseidentdreturns info for outgoing connections, not incoming ones.)

The group or list of groups returned (with the-Foption) are as looked up in the/etc/passwdand/etc/groupfiles, based on the UID returned. Thus these may not relate well to thegroup(s) of the running process for setuid or setgid programs or theirchildren.

The command names returned with formats %c and %C may be different, useone or the other or both.

BUGS

The handling of fatal errors could be better.

This document was created byman2html,using the manual pages.