S/Ident for Unix source code

DESCRIPTION

This is source code that implements S/Ident protocol proposed by Robert Morgan

morgan@stanford.edu
. It is based on the RFC1413 identification protocol but attempts to conduct the identification transaction in a secure manner. The code is based on the pidentd/libident code from Peter Eriksson
pen@lysator.liu.se
with the SASL-like kerberos exchange based on code from CMU's imapd-1.4 release. Currently, the code only supports Kerberos4 as a security method.

Compiling

Here's the source code,version 1.5. It uses the standard gnu autoconf to build. It should work for any OS that is supported in the pidentd.3.0.* code. If you are using version 1.3, I highly recommend upgrading to version 1.5. Version 1.3 has a serious bug that prevented it from working on most systems. The changes from version 1.4 are mostly to support using the MIT krb5 k4 emulation libraries.

There are some OS's that were supported in 1.2 that are not supported in 1.5. You can get version 1.2 from code

Usage

The source code contains both a unix-based responder and a library for applications to link against. You should read the rfc describing the protocol closely before using this software. The primary use for this software at Stanford is to support the Stanford Web auth. READ THE MAN PAGE for sidentd, I would also suggest running sidentd under tcp wrappers if you are only using the kerberos 4 authentication. It's useless outside your realm, and may only confuse things like sendmail and httpd.

Operational Issues

Speed, Speed, Speed...

The responder is slow. Generally, it takes 1-2secs to authenticate a tcp socket. Otherwise it behaves quite well under stress.

Security, Security, Security...

If you can hijack the tcp stream, this authentication can be circumvented. The data stream to the requesting application is NOT encrypted. YOU USE THIS SOFTWARE AT YOUR OWN RISK.

Future Plans

  1. Add GSSAPI authentication to s/ident(or maybe SASL???).
bbense@stanford.edu

Last modified: Thursday May 1st 1997