Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
The Internet

Why do we still use IDENTD? 102

Posted by Cliff from the I've-been-wondering-the-same-thing dept.
Wakko Warner asks: "So anyway, I was on IRC the other day (as I am often wont to do), and, as I was being banned from the network for not running 'identd', I thought to myself: 'Why do we still use this???' Can anyone come up with a valid reason why, in 2002, ident is still considered by some people to be a necessary component of the Internet? Most people use Windows for everything, and Windows has no identity services. Most UNIX folks I know disable it for security reasons. So, why do people still insist we run it in order to connect to their network? Is it still 1993 in some part of the world?"
This discussion has been archived. No new comments can be posted.

Why do we still use IDENTD? More

Why do we still use IDENTD?

Comments Filter:

  • Plenty of identd servers for Win32 (Score:5, Informative)

    by aderuwe ( 539595 ) on Monday December 09, 2002 @08:35AM (#4843082)
    There are plenty of identd servers for Win32:

    http://identd.sourceforge.net/ [sourceforge.net]
    http://freeware.teledanmark.no/identd/ [teledanmark.no]
    http://sourceforge.net/projects/winidentd/ [sourceforge.net]
    http://identd.dyndns.org/identd/ [dyndns.org]

    But on the other hand, here [clock.org] are some reasons why your question is valid...

    • Re:Plenty of identd servers for Win32 (Score:5, Funny)

      by aderuwe ( 539595 ) on Monday December 09, 2002 @08:43AM (#4843098)
      Heh, that last link even has some funny source code [clock.org] I didn't notice at first glance. ;)

    • Re:Plenty of identd servers for Win32 (Score:4, Interesting)

      by Anonymous Coward on Monday December 09, 2002 @08:45AM (#4843101)
      And every self-respecting irc-client has one built-in. That's not the point. The question is: Why do we want users to have identd running when the majority of users is in full control of the client machine anyway? Identd only makes sense in scenarios with multiple users per client ip and identd can't be manipulated by the users.
      • The answer is that all systems aren't single user. On a single user system, the IP address is probably sufficient to track somebody down with, and the ident responce can be ignored. On a multi-user system it isn't. Those multi-user systems also typically have more bandwidth than hundreds of single user systems combined. If somebody on one of those systems is abusing your service, you're really going to want to inform the administrator of that system which of his/her users should be booted. Just because 99% of the data is worthless doesn't mean that the 1% that isn't doesn't make up for the rest in value.

        Now, which do you think is the more likely scenario: All the l-users here that have never run an IRC server and are taking out of their ass know best, or that hundreds of experienced server and network ops know what they're doing and require identd for a reason?

        • Re:Plenty of identd servers for Win32 (Score:1, Insightful)

          by Anonymous Coward
          But since identd requires cooperation of the client system admin in all cases, why would an irc admin require that user systems have identd running? If the client admin is cooperative he is going to run the daemon, if just to have more information when it comes to delegating blame. If he is hostile or paranoid, he can just as easily fake identd as have it not running at all. It's not that identd can't be useful, but does requiring it make sense?

        • Re:Plenty of identd servers for Win32 (Score:5, Informative)

          by Wakko Warner ( 324 ) on Monday December 09, 2002 @12:08PM (#4844042) Homepage Journal
          Now, which do you think is the more likely scenario: All the l-users here that have never run an IRC server and are taking out of their ass know best, or that hundreds of experienced server and network ops know what they're doing and require identd for a reason?

          I've run several IRC servers since 1996. I am an "experienced server and network op", and I still can't figure it out. Speaking as an admin, I can assure you that ident buys me absolutely nothing in terms of dealing with problematic users. Every single one of them has spoofed a valid ident response, either by changing their "Username" value in mIRC, or by running a randomizing ident server. The commonly-held belief among IRC admins that ident provides security and some sort of audit trail is unquestionably false.

          I turned off ident checking on my servers a few months ago, and encourage others I know to do the same.

          - A.P.
          • I've run several IRC servers since 1996. I am an "experienced server and network op", and I still can't figure it out. Speaking as an admin, I can assure you that ident buys me absolutely nothing in terms of dealing with problematic users. Every single one of them has spoofed a valid ident response, either by changing their "Username" value in mIRC, or by running a randomizing ident server.

            The reason you are so confused is because you think that identd is supposed to help you in some way. It doesn't help you as the IRC server admin. The ident information is to help the administrator of the client. You see, if your abusive user is on a shell account, and you go to report abuse to the service provider, that admin is going to ask you for the ident information. Without it he is not going to know which of his users is the abuser. If you turn it off identd checking, you will have no recourse against the abuse.

            The commonly-held belief among IRC admins that ident provides security and some sort of audit trail is unquestionably false.

            I wasn't aware that this was a commonly held belief of experienced admins. This is something a newbie operator that doesn't know how to deal with abuse would think. Ident doesn't provide security, nor is it supposed to. The only time you are going to look at your ident information is when it is requested by the administrator of the multi-user client after you report abuse for his IP address. It's not good for anything else.
            • You seem to be mistaken here in assuming that an admin of any system in the entire world is going to give one tiny little piece of shit about someone abusing someone else's IRC server.

              It's never going to happen. identd is a useless pile of garbage, and IRC is the only service on earth that still uses it for anything, as far as I've seen. Actually, out of the last 16 years of internet usage.. I think IRC is the ONLY service that has ever used it for anything...

              • You seem to be mistaken here in assuming that an admin of any system in the entire world is going to give one tiny little piece of shit about someone abusing someone else's IRC server.

                That't funny, because I care, and I know alot of admins that care. We don't want our bandwidth being used up simply for the abuse of somebody else's network.

            • The reason you are so confused is because you think that identd is supposed to help you in some way. It doesn't help you as the IRC server admin.

              Then why do IRC server admins require it?

              The ident information is to help the administrator of the client. You see, if your abusive user is on a shell account, and you go to report abuse to the service provider, that admin is going to ask you for the ident information. Without it he is not going to know which of his users is the abuser. If you turn it off identd checking, you will have no recourse against the abuse.

              So, if I go to report an abusive user, and his ident string is "gofuckyourself@some.unix.box.somewhere", you're saying, chances are, it'll be helpful, even when 99% of ident responses are phony? Does anyone even read their "root@" or "abuse@" email? In my experience, these mailboxes go to /dev/null, either explicitly or through neglect.

              Why not just ditch ident, and simply ban the entire hostname, subnet, or domain of an abusive user, and let the admin sort it out once he starts receiving complaints from other, legit users? Hell, this is done all the time, anyway. When's the last time you saw a K-line for a single user@unix.box?

              Requiring everyone to run ident simply because there are one or two abusive shell account users out there is downright retarded. It's like forcing backward compatibility for Netscape 1.1N users. The times, they have a-changed. Ident must die.

              - A.P.

              - A.P.

              • Then why do IRC server admins require it?

                Admitedly, requiring it is silly, but requesting it and logging the response are not.

                So, if I go to report an abusive user, and his ident string is "gofuckyourself@some.unix.box.somewhere", you're saying, chances are, it'll be helpful, even when 99% of ident responses are phony?

                You would only look in the ident log if the admin you were reporting an abuser to requested the information, and in that case you would be assuerd it was valid.

                Why not just ditch ident, and simply ban the entire hostname, subnet, or domain of an abusive user, and let the admin sort it out once he starts receiving complaints from other, legit users? Hell, this is done all the time, anyway. When's the last time you saw a K-line for a single user@unix.box?

                What if you are dealing with a university UNIX server, and one student is abusing your network from their shell account, while at the same time some of your network ops access your network through the same system?

                I've never seen a single user banned from the IRC server side, but I have seen users loose their shell access (or worse) after an IRC server admin complained and the ident log was consulted.
              • Typically, proxied connections *do not* return ident, unless the proxy is configured to do so (which is rare). Nowadays, ident is usually used to curb proxy abuse more than anything else.
        • Now, which do you think is the more likely scenario: All the l-users here that have never run an IRC server and are taking out of their ass know best, or that hundreds of experienced server and network ops know what they're doing and require identd for a reason?

          I'll choose the third scenario: The hundreds of experienced server and network ops are living in the last decade and have completely forgotten that the case for a giant portion of internet users is that they are on single-user machines but sharing IP addresses with other users because their network or ISP has more users than IP addresses and is using network address translation.

          Thinking that identd is useful for security in this situation seems about as smart as assuming that anonymous ftp logs really do keep an accurate list of the e-mail addresses of people who have connected to the server.
  • Even if on hacked machine or on Windows you can report any identity you want, it's one of the ways to tell that the visitor is coming from civilized part of the world. From a machine that tries to play nicely with others, and runs identd. Many sites or FTP servers refuse access if you don't have correct reverse DNS, again, not so much for security reasons as to enforce that administrators on the other end take elementary care for their machines.

    • Why identd is used (Score:5, Insightful)

      by 0x0d0a ( 568518 ) on Monday December 09, 2002 @12:23PM (#4844131) Journal
      The reason identd is required is pretty straightforward, actually.

      Say I get on an IRC server and start abusing it. It's pretty easy to just ban my IP (or in extreme cases, up to my class B if dynamic IPs are in use and there's no better solution). So single-user machines are pretty easy to handle.

      A not-unreasonable people still use public access machines, however. And you can't just ban their IPs without potentially screwing a lot of people -- if I ban MITs or CMU's public access UNIX boxes, I'm going to hurt a lot of people to block one baddie. However, these machines can be trusted to run a legtimate identd, so I can say "Don't block *everyone* on these machines...just this one user".

      Granted, the utility value of identd is less now that Windows machines and single-user UNIX machines are dominant, but it still does solve a nasty problem sometimes.

      However, even given that identd helps, I don't see why it's *required*. You can just say "if the remote host isn't running identd, just ban the entire IP if we get a baddie on that machine".

  • Knock, Knock (Score:4, Funny)

    by cramped bowels ( 516728 ) on Monday December 09, 2002 @08:43AM (#4843099)
    SNL said it best : knock, knock Belushi : who's there ? voice on the other side of the door : candygram! (Belushi opens door) Belushi : Ahhhh! Landshark! (shark head consumes John Belushi) IOW , "identd" is only as trustworthy as the one who runs it; Odama's identd is not likely to respond "BinLadin".

  • Bots/Abuse (Score:3, Insightful)

    by Inominate ( 412637 ) on Monday December 09, 2002 @08:51AM (#4843116)
    Much abuse tends to come(or came) from commercial unix systems whos users would have purchased an account. Identd works well for keeping track of these people, even if it is of no use for individual users with thier own machines.
    • I would be willing to believe that if we were still back in the early days of irc, but nowadays most everyone has their Windows box or Mac connected straight up to the network and relatively few of the script kiddies I have met on irc know how to use unix.

  • IRC Servers do have a use (Score:3, Interesting)

    by Komarosu ( 538875 ) <nik_doof@ni3.14159kdoof.net minus pi> on Monday December 09, 2002 @08:57AM (#4843131) Homepage
    By enforcing identd usage on IRC, operators of channels can sucessfully ban abuse bots and users who use BNC relays or unix shells. has some sense of use in this case...
    • But those users can't disable identd so its still possible to ban such users

    • Re:IRC Servers do have a use (Score:4, Interesting)

      by Wakko Warner ( 324 ) on Monday December 09, 2002 @11:15AM (#4843761) Homepage Journal
      What if I run this identd server [hangout.de], which appears to give perfectly valid ident responses (though they're completely random strings of gibberish)? There are others in the FreeBSD ports collection and in Debian's dpkg list (and, I'm sure, elsewhere) that allow me to do the same.

      If I run mIRC, it's even easier to change my ident response. I don't even need to compile or install anything, let alone enable it in /etc/inetd.conf.

      - A.P.
      • Right, but it's your personal machine. They can just ban the whole thing then. If it's a public machine (like your univ. system) they can't ban the whole machine without screwing other users, but they can ban your username.
        • Why is identd *REQUIRED*?

          If it's running, then it may provide useful data.

          If it's not running, then almost surely if it were running it wouldn't provide trustworthy data.

          In short: If the user has the option of turning it on or off, the service can't be trusted. The ident data is nice to have in the case that it might actually be true, but it's too easy to fake.
      • We at QuakeNet don't give trust (more than 5 connections from one address permitted) to people not running a proper (non alterable by users) identd, trusts are used for shells, bots, bouncers and so on.
        If we get abuse from a user in the trustgroup, we just:
        /msg o trustgline some_shell_with_5000_vhosts ident 99y abuse

        and they're gone, with all possible vhosts banned (with that ident).

        Very very useful!

        • This at least makes reasonable sense. Unfortunately, the identd requirement still breaks IRC for anybody behind a reasonably-sized firewall, unless the admins pass identd through to the inside (yet another security issue IMO).

          - A.P.

  • Worthless for unix accounts too. (Score:4, Insightful)

    by AntipodesTroll ( 552543 ) on Monday December 09, 2002 @09:16AM (#4843176) Homepage
    No serious systems administrator running a public or private access unix system with user accounts allows such valuable user information out onto the net. Anyone who does (maybe the same idiots who run IRC servers that require ident?) deserve to have their user accounts 0wned. Everyone I know makes sure ident is at least faked, but usually plain dropped silently.

    There is NO good reason for crappy old fake-able, spoof-able, deny-able ident to be a requirement anymore. Certain IRC admins just need to get their heads out of their asses.
    • Amen brother, preach on!

      Almost every single ident response on IRC is faked. hell, even the stock identd daemons support .fakeid files these days. (at least FreeBSD's builtin identd does)

      identd is a protocol which only works if every user is trusted. despite this, some very ignorant irc admins try to use the protocol to create trust. clearly this is a poorly thought out plan. add to that the fact that identd listens on a low port, so it needs to be a privileged process and you have ignorant admins exposing their network's users to unneccessary risk, for no gain.

    • You ever thought of untrusted users on a multi-user system such as.. say.. a University's? In a multi-user system you can't spoof your ident unless you've got access to bind to port 113. Otherwise, it's a very helpful tool for the admin of those systems: you're just a goof if you think otherwise.

      "No serious systems administrator."

      Give me a break! SFU's system admins were some of the best UNIX-heads I've ever met!
    • well, yes there is one single reason that's good enough.
      Most IRC servers i know don't *require* identd if you have *one* irc session opened. They do *require* it if you want to have several sessions coming from the same IP, through. It is aimed at shell accounts boxes, those providing BitchX/BNC/eggdrop connnectivity to IRC.

  • Pretty Simple (Score:5, Informative)

    by SmallFurryCreature ( 593017 ) on Monday December 09, 2002 @09:30AM (#4843216) Journal

    First of ident is not insecure by itself. Some implementations had buffer overflow problems, but then wich server software hasn't. It can also provide login information like the username but this depends on the setup. For correct working, IRC related, it just needs to return a string on query.

    So why? IRC is well known for countless attacks against the servers and the users of it. It really seems to bring out the worst in a large group of people who, perhaps encouraged by anonymity(?), feel they can do anything to make other peoples use of the service a hassle.

    So how to defend against it? Knowing who a user is is the easiest defence. You can then ban that person from entering youre chatroom/network. There are a couple of pieces of information that are known when you use IRC.

    1. Youre nick. Obviously needs to be there but can be easily randomly changed or be changed to the nicks of other people. Useless for identification therefore. Ban on nick is useless except to stop unwanted nicknames.
    2. Youre IP/hostname. Not really unique, think proxy situations and for some people extremely easy to change. Modem users and users of shell accounts. Ban on IP doesn't work since it could also affect a large group of innocent users who use the same network.
    3. Ident. This is an extra service run on port 113 it reports on query a string containing data corresponding to user information. In fact all you can be really certain of is that if it runs it will return something when you connect to it. Mine for instance always responds the same info. It can also be setup to return a random string each time. Pretty useless therefore as well.

    So why require ident to be running? Can't it be as easily changed as the nick? Yes it can, on certain setups. However if you are using/abusing a shell account then the Ident service should be fixed by the admin. It makes therefore the misuse of a certain kinda setup harder (University accounts). Shell accounts are popular for abuse since you are using someone elses IP for youre abuse.

    Other posts have indicated that there are plenty of Ident servers for windows around. Saying just because windows does not support something it is obsolete is stupid. There are plenty of things on windows you need third party apps for.

    Perhaps the real problem with this question is that to many people feel they have a right to use/abuse a service run by someone else. IRC is a free service run by people who out of their kindness of their hearts run one of the most attacked services on the net. If they then require you to run a tiny little program to make their live easier then so be it. Don't like the rules? Don't use the service. Think you can do better? Run youre own.

    • Re:Pretty Simple (Score:5, Insightful)

      by sql*kitten ( 1359 ) on Monday December 09, 2002 @10:25AM (#4843448)
      Perhaps the real problem with this question is that to many people feel they have a right to use/abuse a service run by someone else. IRC is a free service run by people who out of their kindness of their hearts run one of the most attacked services on the net. If they then require you to run a tiny little program to make their live easier then so be it.

      But does it make their lives easier? Consider: Unix reserves ports up to 1024 for the superuser. The theory was always that you could trust these ports on a remote host, if you trusted the sysadmin, because no ordinary user could bind a process to them. If the sysadmin was an employee of a university or a major corporation, then it was quite reasonable to do so. Barring man-in-the-middle attacks, this system worked quite well. At the time this convention was created, it was considered highly unlikely that you could buy your own Unix host for under $500! You could trust the owners of the machine because machines were expensive, and the owners would take adequate action to ensure that only legitimate users had accounts. The convention also allowed the designers of TCP/IP to cut corners; unlike DECnet they only needed to route by port and IP address, not by the username/process name of the source and destination processes. (That's a seperate rant of mine, how brain-dead the designers of TCP/IP were, and how DECnet is infinitely superior).

      Nowadays, identd is useless for confirming the identity of a remote user, since you cannot trust the sysadmin of a remote host any more than you can trust an ordinary user, because in the Linux world, they are most likely one and the same.

      The logical successor to identd is PKI, but no-one's quite sure how to make that work seamlessly yet.
      • Hmmm. While factually correct, you miss the point of the post your are responding to, nl. that yes, when running your own host, identd is pretty useless, but still, it will allow for limited protection against a very specific type of abuse.

        I do agree that PKI is the way to go though. There are organisation that know how to make it work seamlessly though. Ask Novell.

      • For the thousandth time, identd is NOT for the IRC network admin. It's for the remote admin who requests it in order to help track down *which* of their users was being neughty.

        Get it? Jesus you people, get a fuckin clue!

    • Re:Pretty Simple (Score:5, Insightful)

      by Wakko Warner ( 324 ) on Monday December 09, 2002 @11:36AM (#4843875) Homepage Journal
      First of ident is not insecure by itself. Some implementations had buffer overflow problems, but then wich server software hasn't. It can also provide login information like the username but this depends on the setup. For correct working, IRC related, it just needs to return a string on query.

      Not true. The real ident servers need to run as root (since they're running on a low port), or if you want to be fancy, they can be started by root and assume another (perhaps jailed) user's identity. Let's assume they all running as root, since I've not seen one that doesn't do so. They need to access /etc/passwd (or the NIS equivalent) as well. Some day or another, someone will figure out a way to exploit the most common version of the ident server(s). It's happened before, it'll happen again.

      I tend to treat every service I run on my machines as exploitable. To this end, I disable as many as possible, and, if I have to run a service, I make sure I keep up with it from a security standpoint. Running ident is more work for me, for no real reason.

      That someone requires I run a useless service like identd in order to connect to their network has always bugged me. In this day and age, when ident responses are faked far more often than they aren't (EVERY Windows IRC client fakes ident!!), what's the point of opening up a low port and exposing my systems to even more abuse?

      So why require ident to be running? Can't it be as easily changed as the nick? Yes it can, on certain setups.

      On just about every setup, you mean.

      However if you are using/abusing a shell account then the Ident service should be fixed by the admin. It makes therefore the misuse of a certain kinda setup harder (University accounts).

      Very few people use their university shell accounts to IRC these days.

      Shell accounts are popular for abuse since you are using someone elses IP for youre abuse.

      So are Wingate hosts, but there are other ways of dealing with that kind of abuse, as well. If someone's fucking with my server from a shell account (or from anywhere else), banning that hostname or IP range is more than enough.

      Other posts have indicated that there are plenty of Ident servers for windows around. Saying just because windows does not support something it is obsolete is stupid. There are plenty of things on windows you need third party apps for.

      Yes, and others have noted that "ident" is built into most Windows IRC clients. In nearly all cases, on Windows, ident is faked; I can type whatever I want into the "Username" box in mIRC.

      - A.P.

      • The real ident servers need to run as root (since they're running on a low port), or if you want to be fancy, they can be started by root and assume another (perhaps jailed) user's identity. Let's assume they all running as root, since I've not seen one that doesn't do so. They need to access /etc/passwd (or the NIS equivalent) as well.



        You're just scratching the surface of the problem here. It goes even deeper than that. An ident daemon needs to be able to read kernel memory. Why? Think about it. You connect from host A port a to host B port b. Host B then connects to host A port 113 and says "What is the name of the user who connected to me from port a?" A normal userspace daemon has no way to answer this question. It needs to go poking around inside kernel memory in order to learn who has bound to port a.



        In addition to this, I'd like to point out another problem associated with identd: firewalls. Right now, I'm at work, behind a firewall. When I connect from my workstation to a remote service, it might wish to connect back to me for purposes of querying my ident service. But it can't -- port 113 is blocked at the router. Even if I wanted to run ident (which I don't), I wouldn't be able to respond to that query, because I never receive it. Eventually the request times out. This means that connecting to any service that blocks awaiting an ident response has a built-in delay. And if the ident response is mandatory, it means I'm completely shut out.



        At home, I just run nullidentd. I return the string rfc1413 for the response. Most people don't react to that, but I've had a few people ask "Which RFC is that?", and one or two have complimented me on it.

        • You're just scratching the surface of the problem here. It goes even deeper than that. An ident daemon needs to be able to read kernel memory. Why? Think about it. You connect from host A port a to host B port b. Host B then connects to host A port 113 and says "What is the name of the user who connected to me from port a?" A normal userspace daemon has no way to answer this question. It needs to go poking around inside kernel memory in order to learn who has bound to port a.


          Or use netstat (-p under linux?) or lsof.

    • I've had this talk on IRC b4, it is impossible to ID client users at all.
      Lets look at what the server can find out:

      Nick, =/

      Hostname/IP, at home I have a modem account and each time I dial out I get a new IP/hostname

      Ident, well I run oidentd on my box and that provides a ~/.oident for users to config their responce (inc random), there is a /etc/oident to limit what users can do, but hey I know the root pw to my box (plus windows irc clients eg mirc have a configurable identd build in)

      public/private keys, users can always generate a new key pair, and if you try stop this be handing out keys whats stop the user just getting more?
      Theres a whole load of ideas to ID users, but each one doesn't stop those who want to get round them. Because there is no system that doesn't place some trust on the client system!

  • Identd is useless for trusting an outside host, however, it is exactly what you need when someone outside complains about something one of your hosts is doing. Or you are trying to track down a trouble user locally.

    Identd is perfectly usable and mostly trustable when on hosts that you have control over.

    Now, probably should run it in DES encrypted mode, but most sites do not.

    As for why IRC does it? Who knows, doesn't seem to accomplish anything much to me.
  • postgresql can use ident for authentitication. useful for doing unattended maintainance activities, such as vacuuming the database. the other alternative is to have username/password information on the machine in cleartext somewhere. i run ident on postgresql machines, but use iptables to disallow remote access to the service.
  • No, it's more like end of 1990 [oup-usa.org].

  • The solution to any problem with IRC is simple:

    It's a layer 8 problem.

    Everyone remembers the 7 layer ISO model for networks right... and what's just above layer 7 -- the human (ie: layer 8) and in my years of IRCing, I have yet to meet a sane IRC layer 8. I'm sure there must be one, or at a stretch, two sane ircadmins, but I've certainly never encountered them.

    Think that netsplit is due to some massive connectivity problem on the internet -- nope, it's a netadmin doing layer 8 routing. Having trouble with a jerk and want to have a ban placed -- except *.com gets banned -- that's a layer 8 problem.

    rant on These people think that identd will save them from the world... when really, the only solution is getting the hell off of IRC and getting a life rant off.

    Sigh Some days, it's just not worth thinking about.

    • The OSI model is often extended to take human issues into account. In the most commonly seen extension, Layer 8 is Financial and layer 9 is Political [1 [tufts.edu], 2 [twgrid.org]] although there is some variability as to the stacking order, and even mention of a possible Religious layer [3 [edgarschwarz.de]]. Although these informal layers are considered something of a joke, issues at these layers are frequently encountered when trying to actually get anything done.

      • Thank you for an intelligent reply!

        I've often encountered these issues and never bothered to google -- most of the people I work with are in the quoted layer 8 and 9 -- and I'd pretty much just lumped them all together with the incompetant administrators as a problem layer!

  • Identd is the least of our worries. (Score:3, Insightful)

    by Tom7 ( 102298 ) on Monday December 09, 2002 @12:24PM (#4844141) Homepage Journal
    There are loads of obsolete, insecure protocols that we still insist on using. Identd is the least of our worries. Let's take some examples:

    SMTP! Mailbox filled with spam? Well, that's because we use a mail transfer protocol that makes it trivial to forge the from: address and to create thousands of messages from one!

    FTP! Password in the cleartext? Carriage returns dropped? 3rd-party interceptible/forgeable downloads? That's FTP...

    Identd is simple enough to fake, so it shouldn't really trouble anyone. But it's pretty hard to get by day-to-day without using SMTP.
  • It increases accountability. Sure, Windows clients can generally change their identification, but Windows clients generally are run by the system administrator. So if I get hacked by bill_gates@1.2.3.4, I'm going to ignore the identd at first. If it turns out to be a dialup then I can proceed to sue whoever was using that IP address. But if on the other hand it's a multiuser unix box, I'm not going to sue the admin, as long as the admin tells me who owns that account.
    • You're making it harder for Windows users to connect to your irc server when you know it can't be trusted to give you any sort of identifying information about people who connect from a Windows box.

      Make it optional, so UNIX admins can run identd for the reason you mentioned.
  • So, it's been mentioned at least twice in comments on this Ask Slashdot post, we need new protocols. So, what about it? Is anyone working on any improvements to our dusty old technology?

    Encryption/PKI seems to be where it's at now, and P2P as well. P2P IRC? P2P email? How about it?

    If the old toys are broken and laying in the corner, perhaps it's time to build some new ones.
  • Yes, and in some places in the miswest US it is still 1950.

    It is really interesting to travel back in time, by just traveling to some parts of the US where they are still 50 years behind the times.

  • Without it, people could irc from multi-user systems with complete impunity.
  • with two answers.

    A) Why do the servers require it?
    Well, its their servers. If they want to say you must kill a dog before connecting and if you dont you are banned, that is their call.

    b) Ident is useful to the server admin.
    If i let users use my system, and i know my own ident server is reliable, i know which user did something by remote and local logs.

    If someone else claims to have ident info, i can match the exact TCP connection in their logs with mine, and thus gain exact timestamps (as most people dont sync to the same clocks) as well as if it occoured at all or not, thus weather to believe anything else they claim or not.

    Granetd one can do the same thing with a logging firewall, but again, its the admins choice on how to run a system.
  • The main reason identd is still used is to prevent people from overcoming their own ban by finding and using proxy servers with either open access or closed access but with known passwords. There are lists of these servers available in various places on the net, and many individuals who have worn out their welcome and been banned from an IRC network have tried hopping on a proxy.

    IRC servers prevent this in a few ways; they will actively test if the address a connection comes from has an open proxy server on the standard port and will automatically disallow the connection. This doesn't help when the proxy server is closed but is still being hijacked, though. Further, some proxy servers don't use the standard port, and it's not efficient for the IRC server to scan all possible ports, while an attacker has the leisure to find and use these servers.

    By checking for ident response, only people going through proxy servers whose admins also run ident can get through. These are few and far between, and are usually closed, private proxy servers run by people who have specific need of them. Those few which are abused can be individually k-lined.
  • There's the standard reason that everyone here talks about: there are tons of public shell servers that offer accounts. Many people buy shell accounts to run irc bots and the like. If there's someone abusive, you want to be able to ban them, not the entire shell server.

    Then, there's irc-enabled trojans/viruses. These things spread by means of email, newsgroups, outlook/IE exploits, open windows shares, and IRC itself. They come on IRC as a convenient spot for whoever wrote the virus to control them all and use for ddos attacks. They take up space, and they're generally not nice things to have lying around. However, the majority of these viruses were never coded with identd support, and they run on windows machines of users who never use IRC. Therefore, by banning users who do not have ident enabled, you are banning a huge amount of ddos attack drones.

    I'm actively involved in this kind of thing. :)

    • If there's someone abusive, you want to be able to ban them, not the entire shell server.

      If you ban the entire shell server, you force the legitimate users on that shell server to force the shell server's admin to force the misbehaving user not to misbehave. It works on the same principle as SPEWS banning a whole /24 or larger IPv4 address block.

      Mail doesn't use identd.

  • Use this if you need to (Score:2, Interesting)

    by rsax ( 603351 )
    Fake Identd [hangout.de]

    I agree with the poster that identd is kinda pointless but that doesn't change the fact that it's a headache trying to find an irc server (on some networks) which doesn't require you to have identd running. FakeIdentd is small and simple, you start it up and give it a text string which it will use to reply to any servers. No bells & whistles but it does the job and compiles on pretty much every UNIX-like operating system I've tried.

  • the same reason that Internet Explorer is required for some web sites. RETARDED ADMIN !

    get used to it.

  • Everyone keeps mentioning the following 2 reasons for identd.

    1) Proxies
    Proxies are scanned for and blocked on connect to most major irc networks, so that isn't a good reason.

    2) Shells
    Shell users are already running identd, this means that no matter what username i try to use it will be superseded by the identd response sent by the box.

    3) Multiple connects
    When running a legit shell on any host that doesn't have it's own domain name, ie a cable or dsl user, they still block multiple connects even when you have a legit identd.

    Let's face it, requiring identd is stupid and doesn't make sense.

  • Why we require Ident (Score:4, Informative)

    by Isomer ( 48061 ) on Monday December 09, 2002 @07:56PM (#4848850) Homepage
    I'm one of the coders for Undernet (one of the larger IRC networks), and while ident is basically useless for a large portion of the userbase it does have some use.

    A lot of people on IRC (for whatever reason) like to IRC from (brought) shell accounts. It's in these shell account owners best interest to run Ident, otherwise the only way to ban an abusive user is to ban the entire netblock of the shell provider, basically killing off their entire customer base. If we see that there are multiple people from the same IP with different Ident and only one of them is abusing we'll ban by ident. If they change ident and come back, we ban the entire IP (or netblock).

    Many servers have different "connection classes" or different levels of service to different people. You can say for instance that you will allow 5,000 people from your country to connect, 2,000 other people from around the world that are on helpful and cooperative ISP's, and 1,000 people from elsewhere. Thus, if you're outside an IRC servers catchment area, they start placing harsh rules on you, like requiring ident. eg: If your server is in the US, and it's a lot easier to track down abusers within the US than outside it, so you require people outside the US to make a "better effort" to use your server.

    Kinda going back to the previous point, a lot of boxes that are used on IRC are hacked, or people aren't supposed to be IRCing from (eg company machines). Running an ident server is trivial if you (legitmately) have root on the machine, if you don't then it starts making it more obvious that the machine is hacked ("Hmm, I don't remember that machine having ident enabled...")

    • Sorry, I'm not going to run ident just to have the ident server exploited :P

      If an irc network won't let me connect I'll go elsewhere.

      • Re:Why we require Ident (Score:2, Interesting)

        by Isomer ( 48061 )
        ident isn't inheritantly insecure, just because most of the implementations were written by script kiddies who want to get on IRC, but can't code and are less secure than a naked freshman in a gay bar doesn't mean that all ident daemons are insecure.

        I run an ident daemon, but first I audited the entire thing by hand, they're not complicated pieces of software, and are fairly trivial to audit.

        I personally think that you shouldn't require ident to connect, and afaik no undernet server requires ident to connect, but I can understand the reasoning of why people would do it.

  • 1993 (Score:2)

    by ari_j ( 90255 )
    Is it still 1993 in some part of the world?

    [Some indeterminate music is heard in the background, probably Spin Doctors]

    What? 1993? Um, dude...let me check Webcrawler on that.
  • While in the majority of cases now, ident information can't be trusted, there are still systems (universities, etc...) that run the real deal. The problem is, requiring ident is just an exercise in futility. If someone has control of the box and doesn't want to give you their username, they aren't going to. The outcome is the same whether they disable ident, or simply have it serve up fake information.

    Now thats not saying ident can't be useful. If you run a large system with multiple users, running ident can help you track down the 1 or 2 abusers since you know your ident is offering the correct information. If the server is logging ident, then when problems arise you can ask them for it and make your life a hell of a lot easier.

    So ident isn't something you should be using to authenticate your clients, but keeping track of it (when it is available on the client) can prove useful when working with the administration of the client's host.

    I think i've rambled enough to get to the point now:
    Don't REQUIRE ident, it'll just get spoofed 99.9% of the time. However, if it is available, you might as well use it to your advantage when the friendly sysadmin asks you for it so he can cut off the jerk who's abusing you.
  • Frankly, I ran identd because I always found it interesting to see who was requesting my ident. Now I'm behind a tight firewall, so it serves no purpose on my workstation, but my dial-up days were interesting in that regard.

    I'm surprised that not a single post here mentioned this aspect of running the daemon. You guys are so friggin' busy trying to be anonymous you fail to see the obvious point of watching who's watching you. To me, that smacks of more time spent bein' a kiddie than an administrator.
  • IDENTD is helpful in preventing against mass-join attacks. I've never seen a mass-join channel attack where the clones have ident. Thus, it allows legit users to continue doing their thing while there's an evident attack.

  • Because it is better to run perl -pi -e 's/(?<=nullidentd\s)John/Dick/' /etc/inetd.conf; killall -HUP inetd; echo "This John won't bother you again, Sir." | mail admin@complaining.to.abuse.at.your.system.com than it is to have your IP banned. Isn't that obvious?

Slashdot Top Deals

Truly simple systems... require infinite testing. -- Norman Augustine

Close