Using Net::Ident?

dgaramond2 has asked for the wisdom of the Perl Monks concerning the following question:

$ perl -MNet::Ident -MO::Socket::INET -le'
  $sock=IO::Socket::INET->new(
    PeerAddr => "localhost:smtp(25)"
  );
  print join ", ", Net::Ident::lookup($sock);'

prints something like

 vcESTuEcDGGJRPKKKAvySLm3r9lcMRko, OTHER

How do I decrypt the token if I'm not root on the local machine? I'm going to install this ident-using code from my Perl mail server (which does not run as root).

Do I have to turn off encryption in /etc/identd.conf?

Comment on Using Net::Ident?

Replies are listed 'Best First'.
Re: Using Net::Ident? by ikegami (Patriarch) on Oct 13, 2004 at 15:40 UTC
Do you have access to the key file? From my identd man page: The -C[<keyfile>] option tells identd to return encrypted tokens instead of user names. The local and remote IP addresses and TCP port numbers, the local user's uid num- ber, a timestamp, a random number, and a checksum, are all encrypted using DES with a secret key derived from the first line of the keyfile (using des_string_to_key(3)). The encrypted binary information is then encoded in a base64 string (32 characters in length) and enclosed in square brackets to produce a token that is transmitted to the remote client. The encrypted token can later be decrypted by idecrypt(8). There may not be a space between the -C and the name of the keyfile. If the key- file is not specified, it defaults to !!PRE- FIX!!/etc/identd.key. [download] Should be easy to find a DES crypto module on CPAN. I'd hazard a guess at its name: Crypt::DES (I didn't check this link or any module it might return.) Be sure to decode_base64() (from MIME::Base64) the string first if the crypto module doesn't do it for you.	[reply] [d/l]
Re^2: Using Net::Ident? by dgaramond2 (Monk) on Oct 15, 2004 at 16:21 UTC
Yes, I know it's DES-encrypted and the key is at /etc/identd.key. But it's (root,root,600). Basically, what I want to do is to only allow certain Unix accounts to access the local mailserver (and the qmail-inject program). I wonder how other non-root programs do this, e.g. postgres.	[reply]