identd problems – patch

identd problems – patch

I had some identd problems on IRC today and I think I figured out the cause.

You
may also want to see auth/tcp server failing (looping),
service terminated.

The issue

Today I did some firewall work and rearranged the startup procedures on my box.  
Basically, I moved stuff from /etc/rc.local to /usr/local/etc/rc.d
(because the former is now deprecated and it is recommended that you use the latter only;
see Starting stuff at boot time).   After restarting the box
and gettng back onto IRC, I found my hostmask wasn’t correct.  It had a ~ in front of
it.  This indicates that your ident failed (I admit to not knowing much about this
area, so my basics may be wrong).

What I tried

My first thoughts were that my firewall was blocking the incoming requests.  So I
tried this from an external connection:

$ telnet mydomain.org 113
Trying my.ip.addre.ss...
Connected to my.org.
Escape character is '^]'.

OK.  The incoming requests are being accepted.  So what’s wrong?

What worked

After trying the above, I remembered that I’d been fooling around with the identd
command line options.  I had recently added -o and -e  so
I removed both of these and hup’d inetd.  identd now
worked.   With a bit more playing, I figured out it was the -o option which was
causing the ident to fail.  From the ident man page:

The  -o flag tells identd to not reveal the operating sys-
tem type it  is  run  on  and  to  instead  always  return
"OTHER".

Interesting.

Other notes

Most of you will know that I run Windows NT on my desktop.  mIRC is my
favoured IRC client.  Within mIRC, under File | Setup | Identd, you’ll see the
options for an identd server.  I found these options were not necessary when
I was running identd on my gateway.  In fact, they had no effect.

Testing identd

Here is an easy way to test if identd is working.  This is best done
with two telnet sessions.  This example assumes you have telnet enabled and you are
worked

ident works quite simply by providing a mechanism to verify if someone is
connected or not.  It allows one computer to ask another "is so-and-so connected
to my port from this port on your box?".  It is a simple verification
method.  In this test, we will connect to our box from our box, then check the ports
being used, then ask ident for a verification.

In the first telnet session, we will set up a telnet to ourselves but not do anything
with it.  In the second telnet session, we look at the first session and see what
port it is connecting from.  Then we’ll use that information in our ident query.

1. In your first telnet session, connect to the localhost, and leave it sitting there.
     You don’t have to login.

   # telnet localhost
   Trying 127.0.0.1...
   Connected to localhost.
   Escape character is '^]'.
   login:

2. In your second telnet session, find out what port your telnet is trying to connect from.
     Run netstat -a and look for something like this:

   tcp 0 0
   localhost.telnet localhost.1380 ESTABLISHED

3. Then type this.  113 is the identd port.  23 is the port telnet
   connects to.  And 1380 is the port we were connecting from in step 2.  
   Subsititute the port you found in step 2.

$ telnet localhost 113
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
23,1380
23 , 1380 : USERID : UNIX:DAN
Connection closed by foreign host.

Given all of the above steps, you should be able to verify that identd is
running.

An identd patch

I created a patch for pidentd-2.8.5 because I didn’t like the way the -N
option worked.  From man identd:

The  -n  flag  tells  identd to always return user numbers
instead of user names if you wish to keep the user names a
secret.   The  -N  flag  makes  identd  check  for  a file
".noident" in each homedirectory for a user which the dae-
mon  is  about  to  return the user name for. It that file
exists then the daemon will  give  the  error  HIDDEN-USER
instead of the normal USERID response.

However, identd returns this if you use the -N flag and have a .noident
file in the home directory:

23 , 1380 : ERROR : HIDDEN-USER

which is an error, oddly enough.  I’d rather have success than a error.  So I
made a patch to fix this.  With that patch,
the following is returned for a .noident user:

23 , 1380 : USERID : UNIX:HIDDEN-USER

That’s useful for some users which you may not wish to ident, but still wish to return
a valid ident response.