[BACK]Return to identd.8 CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / src / libexec / identd

File: [cvs.NetBSD.org] / src / libexec / identd / identd.8 (download)

Revision 1.22, Mon Dec 12 10:07:48 2016 UTC (4 years, 10 months ago) by wiz
Branch: MAIN
CVS Tags: prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, phil-wifi-base, phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, phil-wifi-20190609, phil-wifi, pgoyette-localcount-20170426, pgoyette-localcount-20170320, pgoyette-localcount-20170107, pgoyette-compat-merge-20190127, pgoyette-compat-base, pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315, pgoyette-compat, perseant-stdc-iso10646-base, perseant-stdc-iso10646, netbsd-9-base, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1, netbsd-9, netbsd-8-base, netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, netbsd-8, matt-nb8-mediatek-base, matt-nb8-mediatek, is-mlppp-base, is-mlppp, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-socketcan-base1, bouyer-socketcan-base, bouyer-socketcan, HEAD
Changes since 1.21: +2 -2 lines


.\" $NetBSD: identd.8,v 1.22 2016/12/12 10:07:48 wiz Exp $
.\" This software is in the public domain.
.\" Written by Peter Postma <peter@NetBSD.org>
.Dd December 9, 2016
.Nm identd
.Nd TCP/IP Ident protocol server
.Op Fl 46beIilNnr
.Op Fl a Ar address
.Op Fl c Ar charset
.Op Fl F Ar format
.Op Fl f Ar username
.Op Fl g Ar uid
.Op Fl L Ar username
.Op Fl m Ar filter
.Op Fl o Ar osname
.Op Fl P Ar address
.Op Fl p Ar portno
.Op Fl t Ar seconds
.Op Fl u Ar uid
is a TCP/IP server which implements the user identification protocol
as specified in RFC 1413.
operates by looking up specific TCP/IP connections and returning
information which may or may not be associated with the process owning
the connection.
The following options are available:
.Bl -tag -width XXusernameXX
.It Fl 4
Bind to IPv4 addresses only
(valid with flag
.Fl b ) .
.It Fl 6
Bind to IPv6 addresses only
(valid with flag
.Fl b ) .
.It Fl a Ar address
Bind to the specified
.Ar address .
This may be an IPv4 or IPv6 address or even a hostname.
If a hostname is specified then
will resolve it to an address (or addresses) and will bind this address
(valid with flag
.Fl b ) .
.It Fl b
Run in the background (as daemon).
.It Fl c Ar charset
Specify an optional character set designator to be included in replies.
.Ar charset
should be a valid charset set as described in the
in upper case characters.
.It Fl e
instead of the usual
error replies.
.It Fl F Ar format
Specify the format to display info.
The allowed format specifiers are:
.Bd -literal
%u	print user name
%U	print user number
%g	print (primary) group name
%G	print (primary) group number
%l	print list of all groups by name
%L	print list of all groups by number
The lists of groups (%l, %L) are comma-separated, and start with the primary
group which is not repeated.
Any other characters (preceded by %, and those not preceded by it)
are printed literally.
.It Fl f Ar username
Specify a fall back
.Ar username .
If the lookup fails then this username will be returned.
This can be useful for when running this service on a NAT host and
not using the forward/proxy functionality.
.It Fl g Ar gid
Specify the group id number or name which the server should switch to after
binding itself to the TCP/IP port.
.It Fl I
Same as
.Fl i
but without the restriction that the username in
.Pa .ident
must not match an existing user.
.It Fl i
If the
.Pa .ident
file exists in the home directory of the identified user, return the username
found in that file instead of the real username.
If the username found in
.Pa .ident
is that of an existing user, then the real username will be returned.
.It Fl L Ar username
Specify a
.Dq lie
.Ar username .
will return this name for all valid ident requests.
.It Fl l
.Xr syslogd 8
for logging purposes.
.It Fl m Ar filter
Enables forwarding of ident queries.
.Ar filter
argument specifies which packet filter should be used to lookup the
connections, currently
.Sq ipfilter ,
.Sq npf ,
.Sq pf
are supported packet filters.
Note that
changes the ident queries to use the local port on the NAT host instead of
the local port on the forwarding host.
This is needed because otherwise we can't do a lookup on the proxy host.
On the proxy host,
.Dq proxy mode
should be enabled with the
.Fl P
flag or
.Dq lying mode
with the
.Fl L
.It Fl N
.Pa .noident
If this file exists in the home directory of the identified user then return
instead of the normal USERID response.
.It Fl n
Return numeric user IDs instead of usernames.
.It Fl o Ar osname
.Ar osname
instead of the default
.Dq UNIX .
.It Fl P Ar address
Specify a proxy server which will be used to receive proxied ident
queries from.
See also the
.Fl m
flag how this operates.
.It Fl p Ar portno
Specify an alternative port number under which the server should run.
The default is port 113
(valid with flag
.Fl b ) .
.It Fl r
Return a random name of alphanumeric characters.
If the
.Fl n
flag is also enabled then a random number will be returned.
.It Fl t Ar seconds
Specify a timeout for the service.
The default timeout is 30 seconds.
.It Fl u Ar uid
Specify the user id number or name to which the server should switch after
binding itself to the TCP/IP port.
.Pa /etc/inetd.conf
operates from
.Xr inetd 8
or as standalone daemon.
Put the following lines into
.Xr inetd.conf 5
to enable
as an IPv4 and IPv6 service via inetd:
ident stream tcp nowait nobody /usr/libexec/identd identd -l
ident stream tcp6 nowait nobody /usr/libexec/identd identd -l
To run
as standalone daemon, use the
.Fl b
.Xr inetd.conf 5 ,
.Xr inetd 8
This implementation of
is written by
.An Peter Postma
.Aq peter@NetBSD.org .
should typically not be run as a privileged user or group,
.Pa .ident
files for use when running with the
.Fl I
.Fl i
flags will need to be world accessible.
The same applies for
.Pa .noident
files when running with the
.Fl N
When forwarding is enabled with the
.Fl m
flag then
will need access to either
.Pa /dev/ipnat
.Pa /dev/pf
(pf), or
.Pa /dev/npf .
Since it's not a good idea to run
under root, you'll need to adjust group owner/permissions to the device(s)
and run
under that group.