Article 13259 of alt.sources:
Path: nntpd.lkg.dec.com!pa.dec.com!news1.digital.com!nntp-hub2.barrnet.net!news.Stanford.EDU!agate!howland.reston.ans.net!newsfeed.internetmci.com!in1.uu.net!nwnews.wa.com!news.halcyon.com!Ikkoku-Kan.Panda.COM!mrc
From: Mark Crispin <mrc@Panda.COM>
Newsgroups: alt.sources,alt.security
Subject: tired of IDENT queries?
Date: Sun, 17 Mar 1996 13:22:49 -0800
Organization: Pandamonium Reigns
Lines: 111
Message-ID: <Pine.NXT.3.92.960317130524.3678A-100000@Ikkoku-Kan.Panda.COM>
Reply-To: Mark Crispin <mrc@Panda.COM>
NNTP-Posting-Host: panda.wa.com
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Xref: nntpd.lkg.dec.com alt.sources:13259 alt.security:35366

Are you sick and tired of your system getting hit with these IDENT (port
113) protocol queries?  Are you sick and tired of having your mail timeout
because of stupid SMTP servers that want an answer from port 113?  Are you
concerned about the security implications of having random people being
able to probe your system for userids?  Are you aggrieved that you have to
add yet another port to your firewall's "pass" list to cause your mail to
flow smoothly again?

Then this little program is for you!

Set it up on your system as the server listening to port 113.  You need to
make sure there is a line such as:
	auth	113/tcp
in your /etc/services file (note if you have NIS or NetInfo you need to
load it in those database), and a line like
	auth	stream	tcp	nowait	root	/usr/etc/identd	identd
in your /etc/inetd.conf file.  Compile the program below, and save it as
/usr/etc/ident or whatever path you put in the /etc/inetd.conf file.

As distributed, this program will report "root".  You should extend the
list in lietab to have at least a few hundred randomly-selected userids.
One good way to collect such names is to go through a few newsgroups and
gather what you find in the "From:" header lines.

Some IDENT clients do two queries in quick succession to catch lying IDENT
servers (which if fully random would return different names in the two
queries); this program stymies this by making the results semi-random.
IDENT clients may try to escalate the warfare by making deliberately bogus
requests and seeing if they get a lie instead of an error back.  That's
the purpose of the syslog(); if you start seeing this happen you'll know
that it's time to make this program fancier.

This program is a product of the Committee to Stamp Out Pseudo "Security"
Features That Reduce Security and Hurt Performance.  CSOPSFTRSHP
encourages firewall vendors to provide this functionality in all firewall
products, in order to restore mail performance for networks behind the
firewall.

/* Lying IDENT server */

#include <stdio.h>
#include <ctype.h>
#include <string.h>
#include <syslog.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>

#define TMPLEN 8192
























/* Table of lies for IDENT answers.
 *
 * In order to prevent IDENT clients from recognizing that a lie is occuring
 * and taking defensive action, the lietab should be generated locally.
 *
 * Note that the table must be 0-terminated!
 */

char *lietab[] = {
  "root",0
};

































/* Main program */

void main ()
{
  long i = -1,j = -1,numlies = 0;
  char *s,tmp[TMPLEN],hst[TMPLEN];
  char *msg = "ERROR : ",*lie = "UNKNOWN ERROR";
  struct hostent *hn;
  struct sockaddr_in from;
  int fromlen = sizeof (from);
  while (lietab[++numlies]);
  strcpy (hst,getpeername (0,(struct sockaddr *) &from,&fromlen) ? "UNKNOWN" :
	  (hn = gethostbyaddr ((char *) &from.sin_addr,
			       sizeof (struct in_addr),from.sin_family)) ?
	  hn->h_name : inet_ntoa (from.sin_addr));
  if (s = fgets (tmp,TMPLEN-1,stdin)) {
    while ((*s == ' ') || (*s == '\t') || (*s == '-')) *s++;
    if (isdigit (*s) && ((i = strtol (s,&s,10)) >= 0) && (i < 65536)) {
      while ((*s == ' ') || (*s == '\t') || (*s == '-')) *s++;
      if (*s++ == ',') {
	while ((*s == ' ') || (*s == '\t') || (*s == '-')) *s++;
	if (isdigit (*s) && ((j = strtol (s,&s,10)) >= 0) && (j < 65536)) {
	  while ((*s == ' ') || (*s == '\t') || (*s == '-')) *s++;
	  if ((!*s || (*s == '\015') || (*s = '\012')) &&
	      (i != 1) && (j != 1)) { /* SATAN queries -1,-1 */
	    msg = "USERID: UNIX: ";
	    gethostname (tmp,TMPLEN-1);
	    lie = lietab [((time (0) / (60 * 60 * 24)) + i + j +
			   ((hn = gethostbyname (tmp)) ? hn->h_addr[0] +
			    hn->h_addr[1] + hn->h_addr[2] + hn->h_addr[3] : 0))
			  % numlies];
	  }
	}
      }
    }
  }
  if (i >= 0) {
    printf ("%ld, ",i);
    if (j >= 0) printf ("%ld",j);
  }
  printf (": %s%s\015\012",msg,lie);
  openlog ("identd",LOG_PID,LOG_LOCAL7);
  syslog (LOG_INFO,"Returned %s for %ld,%ld to %s",lie,i,j,hst);
}





