Why do we still use IDENTD?

Wakko Warner asks: "So anyway, I was on IRC the other day (as I am often wont to do), and, as I was being banned from the network for not running 'identd', I thought to myself: 'Why do we still use this???' Can anyone come up with a valid reason why, in 2002, ident is still considered by some people to be a necessary component of the Internet? Most people use Windows for everything, and Windows has no identity services. Most UNIX folks I know disable it for security reasons. So, why do people still insist we run it in order to connect to their network? Is it still 1993 in some part of the world?"

Comments

Plenty of identd servers for Win32

[aderuwe]

There are plenty of identd servers for Win32:

http://identd.sourceforge.net/
http://freeware.teledanmark.no/identd/
http://sourceforge.net/projects/winidentd/
http://identd.dyndns.org/identd/

But on the other hand, here are some reasons why your question is valid...

Re:Plenty of identd servers for Win32

[ivan256]

The answer is that all systems aren't single user. On a single user system, the IP address is probably sufficient to track somebody down with, and the ident responce can be ignored. On a multi-user system it isn't. Those multi-user systems also typically have more bandwidth than hundreds of single user systems combined. If somebody on one of those systems is abusing your service, you're really going to want to inform the administrator of that system which of his/her users should be booted. Just because 99% of the data is worthless doesn't mean that the 1% that isn't doesn't make up for the rest in value.

Now, which do you think is the more likely scenario: All the l-users here that have never run an IRC server and are taking out of their ass know best, or that hundreds of experienced server and network ops know what they're doing and require identd for a reason?

Re:Plenty of identd servers for Win32

[Wakko Warner]

Now, which do you think is the more likely scenario: All the l-users here that have never run an IRC server and are taking out of their ass know best, or that hundreds of experienced server and network ops know what they're doing and require identd for a reason?

I've run several IRC servers since 1996. I am an "experienced server and network op", and I still can't figure it out. Speaking as an admin, I can assure you that ident buys me absolutely nothing in terms of dealing with problematic users. Every single one of them has spoofed a valid ident response, either by changing their "Username" value in mIRC, or by running a randomizing ident server. The commonly-held belief among IRC admins that ident provides security and some sort of audit trail is unquestionably false.

I turned off ident checking on my servers a few months ago, and encourage others I know to do the same.

- A.P.

Re:Plenty of identd servers for Win32

[ivan256]

I've run several IRC servers since 1996. I am an "experienced server and network op", and I still can't figure it out. Speaking as an admin, I can assure you that ident buys me absolutely nothing in terms of dealing with problematic users. Every single one of them has spoofed a valid ident response, either by changing their "Username" value in mIRC, or by running a randomizing ident server.

The reason you are so confused is because you think that identd is supposed to help you in some way. It doesn't help you as the IRC server admin. The ident information is to help the administrator of the client. You see, if your abusive user is on a shell account, and you go to report abuse to the service provider, that admin is going to ask you for the ident information. Without it he is not going to know which of his users is the abuser. If you turn it off identd checking, you will have no recourse against the abuse.

The commonly-held belief among IRC admins that ident provides security and some sort of audit trail is unquestionably false.

I wasn't aware that this was a commonly held belief of experienced admins. This is something a newbie operator that doesn't know how to deal with abuse would think. Ident doesn't provide security, nor is it supposed to. The only time you are going to look at your ident information is when it is requested by the administrator of the multi-user client after you report abuse for his IP address. It's not good for anything else.

Pretty Simple

[SmallFurryCreature]

First of ident is not insecure by itself. Some implementations had buffer overflow problems, but then wich server software hasn't. It can also provide login information like the username but this depends on the setup. For correct working, IRC related, it just needs to return a string on query.

So why? IRC is well known for countless attacks against the servers and the users of it. It really seems to bring out the worst in a large group of people who, perhaps encouraged by anonymity(?), feel they can do anything to make other peoples use of the service a hassle.

So how to defend against it? Knowing who a user is is the easiest defence. You can then ban that person from entering youre chatroom/network. There are a couple of pieces of information that are known when you use IRC.

1. Youre nick. Obviously needs to be there but can be easily randomly changed or be changed to the nicks of other people. Useless for identification therefore. Ban on nick is useless except to stop unwanted nicknames.
2. Youre IP/hostname. Not really unique, think proxy situations and for some people extremely easy to change. Modem users and users of shell accounts. Ban on IP doesn't work since it could also affect a large group of innocent users who use the same network.
3. Ident. This is an extra service run on port 113 it reports on query a string containing data corresponding to user information. In fact all you can be really certain of is that if it runs it will return something when you connect to it. Mine for instance always responds the same info. It can also be setup to return a random string each time. Pretty useless therefore as well.

So why require ident to be running? Can't it be as easily changed as the nick? Yes it can, on certain setups. However if you are using/abusing a shell account then the Ident service should be fixed by the admin. It makes therefore the misuse of a certain kinda setup harder (University accounts). Shell accounts are popular for abuse since you are using someone elses IP for youre abuse.

Other posts have indicated that there are plenty of Ident servers for windows around. Saying just because windows does not support something it is obsolete is stupid. There are plenty of things on windows you need third party apps for.

Perhaps the real problem with this question is that to many people feel they have a right to use/abuse a service run by someone else. IRC is a free service run by people who out of their kindness of their hearts run one of the most attacked services on the net. If they then require you to run a tiny little program to make their live easier then so be it. Don't like the rules? Don't use the service. Think you can do better? Run youre own.

Re:IRC Servers do have a use

[Wakko Warner]

This at least makes reasonable sense. Unfortunately, the identd requirement still breaks IRC for anybody behind a reasonably-sized firewall, unless the admins pass identd through to the inside (yet another security issue IMO).

- A.P.

Well, two valid reasons...

[darkrot]

There's the standard reason that everyone here talks about: there are tons of public shell servers that offer accounts. Many people buy shell accounts to run irc bots and the like. If there's someone abusive, you want to be able to ban them, not the entire shell server.

Then, there's irc-enabled trojans/viruses. These things spread by means of email, newsgroups, outlook/IE exploits, open windows shares, and IRC itself. They come on IRC as a convenient spot for whoever wrote the virus to control them all and use for ddos attacks. They take up space, and they're generally not nice things to have lying around. However, the majority of these viruses were never coded with identd support, and they run on windows machines of users who never use IRC. Therefore, by banning users who do not have ident enabled, you are banning a huge amount of ddos attack drones.

I'm actively involved in this kind of thing. :)

Why we require Ident

[Isomer]

I'm one of the coders for Undernet (one of the larger IRC networks), and while ident is basically useless for a large portion of the userbase it does have some use.

A lot of people on IRC (for whatever reason) like to IRC from (brought) shell accounts. It's in these shell account owners best interest to run Ident, otherwise the only way to ban an abusive user is to ban the entire netblock of the shell provider, basically killing off their entire customer base. If we see that there are multiple people from the same IP with different Ident and only one of them is abusing we'll ban by ident. If they change ident and come back, we ban the entire IP (or netblock).

Many servers have different "connection classes" or different levels of service to different people. You can say for instance that you will allow 5,000 people from your country to connect, 2,000 other people from around the world that are on helpful and cooperative ISP's, and 1,000 people from elsewhere. Thus, if you're outside an IRC servers catchment area, they start placing harsh rules on you, like requiring ident. eg: If your server is in the US, and it's a lot easier to track down abusers within the US than outside it, so you require people outside the US to make a "better effort" to use your server.

Kinda going back to the previous point, a lot of boxes that are used on IRC are hacked, or people aren't supposed to be IRCing from (eg company machines). Running an ident server is trivial if you (legitmately) have root on the machine, if you don't then it starts making it more obvious that the machine is hacked ("Hmm, I don't remember that machine having ident enabled...")