Re: Ident Spoofin

From: Barry Margolin (barmar@genuity.net)
Date: 06/05/02

  • Next message: JDS: "Re: secure UNIX log server" 

    From: Barry Margolin <barmar@genuity.net>
Date: Wed, 05 Jun 2002 18:57:00 GMT

    In article <3cd6e113.0206050835.248cbafe@posting.google.com>,
    cod3x <c0dex@asia.com> wrote:
    >Hi,
    > I'm currently running Redhat 7.2. I'm trying to set up my ident
    >service, without using the standard identd included in the
    >distribution. Instead i used oidentd as it supports IP Masquerading as
    >well as hiding idents and spoofing. This program has been working fine
    >during my previous installation of Redhat 7.1. Now after i've
    >intstalled 7.2, ident doesn't seem to work anymore.
    > When i run Nmap locally against the auth port, it detects the
    >connection and replies with the spoofed ident. However, when trying to
    >connect remotely, the port seems to be unreachable. This happens when
    >i try connecting to irc servers, which does ident checking. Tcpdump
    >shows that the irc server is attempting connection to auth port, but
    >the kernel is replying 'tcp port auth unreachable'. My guess is that
    >the ident server is running, but only detecting local connections. It
    >doesnt seem to detect remote connections. Any ideas why this happens?
    >Please point me in the right direction. Thanks.

    My guess is that you have something like iptables enabled and don't have
    the ident port opened up. 

    -- 
Barry Margolin, barmar@genuity.net
Genuity, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

    Relevant Pages

    • Re: Turn off Ident request on Sendmail Sessions
      ... >Can anyone provide a link or other instructions on how to configure Sendmail ... >Currently, anytime a machine attempts to connect to port 25, Sendmail hangs ... >up until it attempts to do an Ident by connecting back to the originating ... >port 113 stealthed (just drops the packets, not refusing a connection), I've ...
      (comp.mail.sendmail)
    • RE: Odd identd behavior
      ... Yes, he said mailserver logs, but that's because the mailservers in question were connecting back to the ident port which is fairly standard behavior. ... What's not standard is that they were getting a response back from the service listening on the ident port that was not consistent with an ident server. ... The conclusion of "it looks like an FTP server" is based on the fact that many warez kiddies install FTP servers on non-standard ports, and that the remainder of the header looks like a warez banner. ...
      (Incidents)
    • Re: [Solved] Re: how to close port 113 ident xinetd
      ... Nmap listed the service as ident. ... port was still open, but changed its service description to "auth?". ... Thank you - I restarted xinetd and the port seems to be closed now (at ...
      (Debian-User)
    • Re: Ident Spoofin
      ... > I'm currently running Redhat 7.2. ... ident doesn't seem to work anymore. ... >connection and replies with the spoofed ident. ... the port seems to be unreachable. ...
      (comp.security.unix)
    • Re: nmap shows open UDP port 113
      ... > My friend asked me to see if I could scan or penetrate his firewall. ... If I had to guess, all traffic to port 113 TCP is disallowed, but the ... the connections to ident would take much longer to ... connections, a TCP RST is sent, and for UDP, an icmp port unreachable is ...
      (Pen-Test)