identuser(3)

NAME
identuser - remote identification library using the Identification Server

SYNTAX
#include <identuser.h> unsigned short ident_tcpport; char *ident_xline(user,fd,&inremote); int ident_fd(fd,&inremote,&local,&remote);
int ident_fd2(fd,&inlocal,&inremote,&local,&remote); int ident_tcpsock(fd,inlocal,inremote); char *ident_tcpuser(inremote,local,remote);
char *ident_tcpuser2(inlocal,inremote,local,remote);
char *ident_tcpuser3(inlocal,inremote,local,remote,timeout); char *ident_sockuser(s,local,remote); char *user;
int fd;
int s;
unsigned long inlocal;
unsigned long inremote;
unsigned short local;
unsigned short remote;
int timeout;

DESCRIPTION
The identuser library provides a simple interface for finding out the remote identity of a connection through the Identification Server as specified by RFC 931/1413. Use the -lidentuser loader option to compile a program with this library. ident_xline(user,fd,&inremote) returns a line of the form X-Ident-User: user or X-Forgery-By: username, depending upon what the host on the other side of fd thinks of the user. This is particularly appropriate for mail and news headers.

If the remote host reports that user owns the connection on that side, ident_xline will return X-Ident-User: user. If the remote host reports that a different username owns the connection, ident_xline will return X-Forgery-By: username. If user is NULL, it returns X-Ident-User: username with the username reported by the remote host. If fd is not a TCP connection or identification is impossible, ident_xline returns NULL, setting errno appropriately. The line is not cr-lf terminated. It is stored in a static area which is overwritten on each call to ident_xline. ident_xline places the Internet address of the other host into inremote. ident_fd2(fd,&inlocal,&inremote,&local,&remote) retrieves address information from the connection in socket fd. It places the Internet addresses of the connection into inlocal and inremote and the local and remote TCP ports into local and remote. ident_fd2 returns -1 upon error, setting errno appropriately. ident_tcpuser2(inlocal,inremote,local,remote) returns the name of the user on the other end of the TCP connection between remote@inremote and local@inlocal. If identification is impossible, ident_tcpuser2 returns NULL, setting errno appropriately. The user name is stored in a static area which is overwritten on each call to ident_tcpuser2, ident_tcpuser, ident_sockuser, and ident_xline. s = ident_tcpsock(fd,inlocal,inremote) sets s to a non-blocking socket which is connecting to the Identification Server at inremote. It returns -1 on error, setting errno appropriately. ident_sockuser(s,local,remote) makes sure that the socket has connected and then does the same job as ident_tcpuser2, returning the name of the user on the other end of the TCP connection between remote@inremote and local@inlocal, or NULL (with errno set) if identification is not possible. s is closed by ident_sockuser. The advantage of using ident_tcpsock and ident_sockuser instead of ident_tcpuser2 is that you can perform other actions while waiting for the identification request to complete. You can select s for writing to see if it is ready for ident_sockuser yet. ident_tcpuser3(inlocal,inremote,local,remote,timeout) is like ident_tcpuser2 but returns NULL with errno set to ETIMEDOUT if the identification request has not been accepted or refused after timeout seconds. ident_fd(fd,&inremote,&local,&remote) is the same as ident_fd2 but throws away the inlocal information. ident_tcpuser(inremote,local,remote) is the same as ident_tcpuser2 but may not bind to the proper local address on hosts with multiple IP addresses. These functions do not perform properly on multihomed hosts and should not be used. They are provided only for backwards compatibility. The identification routines check with the remote Identification Server on port ident_tcpport, which defaults to 113 as specified by RFC 931/1413. You can set ident_tcpport to other values for nonstandard implementations.

RESTRICTIONS
identuser does no backslash interpretation upon the remote user name. This is conformance with the proposed revision to RFC 931/1413. identuser does not use the operating system type information provided by the Identification Server.

VERSION
identuser version 4.0, February 9, 1992.

AUTHOR
Placed into the public domain by Daniel J. Bernstein.

REFERENCES
The identification server is more secure than passwords in some ways, but less secure than passwords in many ways. (It's certainly better than no password at all---e.g., for mail or news.) It is not the final solution. For an excellent discussion of security problems within the TCP/IP protocol suite, see Steve Bellovin's article ``Security Problems in the TCP/IP Protocol Suite.''

SEE ALSO
tcpclient(1), tcpserver(1), getpeername(3), getsockname(3), tcp(4), identd(8)