How to remediate – slident / fake identd Detection

1. Introduction

The vulnerability “slident / fake identd Detection” concerns a remote ident server returning random tokens instead of real user IDs. This is generally a positive security outcome, indicating an attempt to obscure legitimate identification information. Systems running ident servers, particularly those exposed to the internet, are usually affected. Likely impact on confidentiality is low, integrity is unaffected, and availability remains normal.

2. Technical Explanation

The remote ident/authd server is configured to return random tokens rather than user IDs. This prevents attackers from gathering information about users logged into a system via the ident protocol. The precondition for this detection is an accessible ident service on the target host. An attacker attempting to identify users connected to the system will receive meaningless data instead of valid usernames.

• Root cause: intentional configuration of the ident server to return random tokens.
• Exploit mechanism: an attacker connects to the ident service (port 113) using a client like `ident` or `nmap –script ident-info`. The server responds with arbitrary data instead of user information.
• Scope: Systems running slidentd, fake identd, or similar implementations are affected.

3. Detection and Assessment

Confirming this configuration involves checking the response from the ident service. A quick check is to connect manually; a thorough method uses a port scanner.

• Quick checks: use `telnet 113` and observe the response. If it’s random data, the system likely has a fake identd configured.
• Scanning: Nmap can detect this with the `ident-info` script: `nmap -p 113 –script ident-info `. Note that results may vary depending on scanner configuration.
• Logs and evidence: Ident server logs, if enabled, will show connection attempts but not necessarily reveal the fake response without manual inspection.

telnet  113

4. Solution / Remediation Steps

This detection is usually a sign of good security practice and does not require remediation unless it’s unexpected or interferes with legitimate services.

4.1 Preparation

• Backups are generally not needed for this configuration change. No services need to be stopped.
• Change window needs: This change typically doesn’t require a formal change window unless it impacts other services. Approval may be needed from the system owner if the ident service is used for legitimate purposes.

4.2 Implementation

1. Step 1: Verify that the current configuration is intentional and does not disrupt any applications.
2. Step 2: If the configuration is confirmed as desired, no further action is needed. Document the configuration in system records.

4.3 Config or Code Example

This vulnerability doesn’t involve a traditional insecure config; it’s an intentional setting.

Before

#Example identd.conf file (may vary)
#Standard configuration leaking user IDs
users = *

After

#Example identd.conf file (may vary)
#Configuration returning random tokens
users = -* 

4.4 Security Practices Relevant to This Vulnerability

Least privilege and defence in depth are relevant here.

• Practice 1: Least privilege – limiting the exposure of services reduces the attack surface, even if they are not vulnerable.
• Practice 2: Defence in depth – multiple layers of security make it harder for attackers to gain information or access.

4.5 Automation (Optional)

Automation is generally not needed for this configuration.

#No automation script required

5. Verification / Validation

Confirm the fix by re-connecting to the ident service and verifying it still returns random tokens.

• Post-fix check: `telnet 113` should continue to return random data.
• Re-test: Re-run the Nmap scan (`nmap -p 113 –script ident-info `) and confirm it still reports a fake identd configuration.
• Smoke test: Ensure any applications relying on network connectivity remain functional.
• Monitoring: Monitor system logs for unexpected connection attempts to port 113.

telnet  113

6. Preventive Measures and Monitoring

Regular security reviews and baseline configurations are helpful.

• Baselines: Include a check for the ident server configuration in your system security baseline.
• Pipelines: Consider including checks in CI/CD pipelines to ensure new systems are configured securely.
• Asset and patch process: Review network service configurations during regular asset assessments.

7. Risks, Side Effects, and Roll Back

The main risk is unexpected disruption if applications rely on the ident protocol.

• Roll back: If issues occur, revert any changes made to the ident server configuration file and restart the service.

8. References and Resources

Information about the ident protocol is available in RFC 1413.

• Vendor advisory or bulletin: Not applicable for this detection.
• NVD or CVE entry: Not applicable for this detection.
• Product or platform documentation relevant to the fix: https://tools.ietf.org/html/rfc1413