| Internet protocol suite |
|---|
| Application layer |
| Transport layer |
| Internet layer |
| Link layer |
The Ident Protocol, specified in RFC 1413, is an Internet protocol that helps identify the user of a particular TCP connection. One popular daemon program for providing the ident service is identd.
Contents |
The Ident Protocol is designed to work as a server daemon, on a user's computer, where it receives requests to a specified port, generally 113. In a query, a client specifies a pair of ports (a local and a remote port). The server will then send a specially designed response that identifies the username of the user who runs the program that uses the specified pair of ports.
Dialup hosts or shared shell servers often provide ident to enable abuse to be tracked back to specific users. In the case that abuse is handled on this host the concern about trusting the ident daemon is mostly irrelevant. Spoofing of the service and privacy concerns can be avoided by providing varying cryptographically strong tokens instead of real usernames.
If abuse is to be handled by the administrators of the service users connect to using the ident providing host, then the ident service must provide information identifying each user. Usually it is impossible for the administrators of the remote service to know whether specific users are connecting via a trustable server or from a computer they themselves control. In the latter case the ident service provides no reliable information.
The usefulness of Ident for proving of a known identity to a remote host is limited to circumstances when:
The ident protocol is considered dangerous because it allows crackers to gain a list of usernames on a computer system which can later be used for attacks. A generally accepted solution to this is to set up a generic/generated identifier, returning node information or even gibberish (from the requesters point of view) rather than usernames. This gibberish may be turned into real usernames by the ident administrator, when he is contacted about possible abuse, which means the usefulness for tracking abuse is preserved.
Ident is important on IRC as a large number of people connect to IRC from a server shared by multiple users, often using a bouncer. Without Ident there would be no way to ban a single user without banning the entire host. The server administrator may also use this information to identify the abusive user.
On most IRC networks, when the server fails to get an Ident response it falls back to the username given by client, but marks it as "not verified", usually by prefixing with a tilde; e.g. ~josh. Some IRC servers even go as far as blocking clients without an ident response [1], the main reason being that it makes it much harder to connect via an "open proxy" or a system where you have compromised a single account of some form but do not have root (on Unix-like systems, only root can listen for network connections on ports below 1024).
However, Ident is next to ineffective when used with personal computers, on which the user often has enough privileges to make the Ident daemon reply whatever the user wants. In fact, most Ident servers for Windows don't even bother checking the owner of a connection and just reply with a preconfigured username.