| oidentd.conf(5) | File Formats Manual | oidentd.conf(5) |
oidentd.conf - The oidentd configuration file.
The oidentd configuration file is used to specify the amount of control users have over the responses oidentd returns upon successful lookups for connections owned by them.
The $HOME/.oidentd.conf file allows a user to specify what ident response will be returned for specific connections.
The user directive has the following syntax:
default {
<range directive>
}
OR
user <username> {
<range directive>
}
The default directive matches all users for whom rules are not defined. There should only be one default directive, and it should be the first statement in the file. All entries for users defined after the default definition will inherit the capabilities of the default user. Capabilities can then be allowed, denied, or forced on a per-user basis by way of the user statement followed by the username of the user to whom the properties that follow will apply.
The range directive is used to specify a host/port range for which a set of capabilities is binding. A range directive consists of 1 or more statements of the following form:
default {
<capability directive>
}
OR
to <host> fport <fport> from <host> lport <lport> {
<capability directive>
}
The default directive matches all host/port pairs for which rules are not defined. There should only be one default directive, and it should be the first statement in the block.
Anywhere from 1 to all 4 of the to, fport, from, and lport parameters may be specified.
The to parameter is used to specify the address to which a connection is made.
The from parameter is used to specify the address from which a connection originates. It may be useful to specify this address when a system has more than one IP address.
The to and from parameters take either an IP address or a hostname argument.
The lport parameter is used to specify the local port from which a connection originates.
The fport parameter is used to specify the destination port of a connection.
The fport and lport parameters take either a port or a port range. Ports can be specified numerically (e.g. 113) or by giving a service name (e.g. "auth"). Ranges of ports take the form <starting port>:<ending port>. The ending port is optional. If the ending port is omitted, the range is taken to be any port greater than or equal to the starting port.
The omission of any of the to, fport, from and lport parameters acts like a wildcard for that parameter. For example, the statement "from localhost" matches all connections from localhost on any port to any host on any port.
Capabilities are used to assign or deny privileges to specific users. Valid capabilities inside user directives are allow, deny, and force.
The capability directive consists of one or more statements of the form:
allow OR deny OR force <capability>.
The capability argument must be one of the capabilities described in the capability section below.
The force action takes a third argument when the capability is reply. For example, force reply "randomuser".
The force action takes four arguments when the capability is forward. For example, force forward 127.0.0.1 1113.
A user's $HOME/.oidentd.conf configuration file may contain 0 or more of the following statements:
global {
<capability>
}
OR
<range directive> {
<capability>
}
The global directive acts as a wildcard, matching all connections, so if used at all, the global directive should be the first entry in the file and should be used only once. Use is permitted anywhere in the file and infinitely many times, however it doesn't make much sense to use it in this manner.
The range directive has the same syntax and semantics as the range directive in the /etc/oidentd.conf file. See above for a description.
Valid capabilities are reply, forward, random, numeric, random_numeric, and hide. Descriptions can be found below.
In a user's $HOME/.oidentd.conf file, up to 20 strings may be specified for a reply statement.
In the /etc/oidentd.conf file, there is no limitation on the number of strings that may be specified.
The strings must be quoted strings (e.g. "string"). Strings may contain the following escape characters:
This capability only applies to the force action.
default {
default {
deny spoof
deny spoof_all
deny spoof_privport
deny forward
allow random_numeric
allow numeric
allow hide
}
}
Grant all users the ability to generate random numeric ident replies, the ability to generate numeric ident replies and the ability to hide their identities on all ident queries. Explicitly deny the ability to spoof ident responses or forward requests.
user root {
default {
force reply "UNKNOWN"
}
}
Reply with "UNKNOWN" for all successful ident queries for root.
user ryan {
default {
allow spoof
allow spoof_all
allow random
allow hide
}
from 127.0.0.1 {
allow spoof_privport
}
}
Grant the user "ryan" the capability to spoof ident replies, including the ability to use other usernames as ident replies, generate random replies and hide his ident for all connections, and grant the user "ryan" the capability to spoof ident replies to privileged ports (< 1024) on connections originating from the host 127.0.0.1.
user jester {
default {
force forward 127.0.0.1 1113
}
}
Forward requests for connections belonging to the user "jester" to the server running at 127.0.0.1:1113.
global {
reply "unknown"
}
Reply with "unknown" to all successful ident lookups.
to irc.example.org {
reply "example"
}
Reply with "example" to ident lookups for connections to irc.example.org.
Janik Rabe <oidentd@janikrabe.com>
https://oidentd.janikrabe.com
Originally written by Ryan McCabe <ryan@numb.org>.
| 2019-01-10 | version 2.3.2 |