INSTALL file for oidentd version 1.6.1
--------------------------------------

INSTALLING OIDENTD
------------------

Issuing the commands "./configure", then "make", then "make install" will
(respectively) configure, compile and install the oidentd daemon and its
manual page. By default, the daemon is installed to
/usr/local/sbin/oidentd and the uncompressed manual page is installed to 
/usr/local/man/man8.

A number of compile time values can be manipulated via the configure
script. For a summary, put "./configure --help".

After oidentd has been installed, an entry for must be added in the 
/etc/inetd.conf file, if you are running inetd. A generic example is:

auth	stream	tcp	nowait	nobody	/usr/sbin/oidentd	oidentd -i

If you prefer not to use inetd, oidentd can be run as a stand-alone
daemon. For more information and complete a description of all options,
refer to the manual page.

Do not run oidentd as root.


IP-MASQUERADING
---------------

If you are using IP masquerading, oidentd can optionally return a
username for all masqueraded connections from other machines. Support for
this is specified by calling oidentd with the -m flag and by creating an
/etc/oidentd.users file. This file must be readable by the oidentd daemon
user and has the following format:

IP-ADDRESS		USER-NAME	SYSTEM-TYPE

Example:
192.168.1.1					someone		UNIX
192.168.1.2					noone		WINDOWS
192.168.1.1/0				user1		UNIX
192.168.1.1/32				user2		UNIX
192.168.1.0/24				user3		UNIX
192.168.0.0/16				user4		UNIX
10.0.0.0/8					user4		UNIX
192.168.1.0/255.255.255.0	user5		UNIX
somehost					user		UNIX
(you get the point)

As of version 1.4 (1.6.0, successfully!), oidentd can forward requests
for an IP masqueraded connection to the machine from which connection
originates by way of the -f option. This will only work if the host to
which the connections are forwarded is running oidentd (with -P <proxy>)
or if the host's ident daemon will return a valid reply regardless of the
input supplied by and address of the host requesting the info (some ident
daemons for windows do this, maybe others).


IDENT SPOOFING
--------------

Oidentd can optionally return an ident other than the default (your
username or UID, depending on how oidentd is run). To enable identd
spoofing, observe the following procedure:

1. Add -s or -S to the flags with which oidentd is called. Consult the
   manual page for a description of these options.

2. If the file /etc/identd.spoof does not exist, create it and
   give the user as which oidentd runs read permission for it.

  - In order for local users to spoof identd replies, their usernames must
    be contained in the /etc/identd.spoof file. If oidentd was called with
    -S instead of -s, their usernames must *not* be contained in this file
    if they are to be able to spoof identd replies; with -S all users
    except those users listed in /etc/identd.spoof may spoof identd
    replies.

    - The format of the /etc/identd.spoof file is one
      username per line. Lines beginning with '#' are considered
      comments. For example:

# comment
user
user2

3. When identd spoofing is enabled, oidentd looks for the reply it should
   return in an .ispoof file, which must be located in the home directory of
   users. This file should only contain the reply that oidentd will return
   upon a successful request for the user. The .ispoof file must be owned
   by the user for which the request is made. Be sure
   this file is readable by the daemon user (ie, the user as which oidentd
   runs has at least search permission for the home directory and read
   permission for .ispoof). For example:

$ id
uid=500(user) gid=100(users)
$ echo response > ~/.ispoof && chmod o+x ~ && chmod o+r ~/.ispoof

OPTIONS
-------

Usage: oidentd [options]
  -a <address>	Bind to <address>. (Defaults to INADDR_ANY)
  -A		When spoofing is enabled, enable users to spoof
    		ident on connections to privileged ports.
  -c <charset>	Specify an alternate charset. (Defaults to "US-ASCII")
  -d		Enable debugging.
  -e		Return "UNKNOWN-ERROR" for all errors.
  -f <port>	Forward requests for masqueraded hosts to the host on <port>
  -g <gid>	Run with specified gid. (standalone and wait modes)
  -i		Run from inetd.
  -m		Enable support for IP masquerading.
  -n		Return UIDs instead of usernames
  -N		Allow identd hiding via ".noident"
  -o		Return "OTHER" instead of the operating system.
  -p <port>	Listen for connections on specified port. (Defaults to 113)
  -P <host>	<host> acts as a proxy, forwarding connections to us.
  -r		Randomize identd replies.
    			Note: The -n and -r options are incompatible.
  -s		Allow identd spoofing.
  -S		Same as -s but allow all users but those listed in
    		 /etc/identd.spoof to spoof replies.
  -t <seconds>	Wait for <seconds> before closing connection. (Defaults to 30)
  -T <seconds>	oidentd will remain accepting connections when run
    		with -w for <seconds>.
  -u <uid>	Run with specified uid. (standalone and wait modes)
  -v/-V		Display version information and exit.
  -w		Do not exit after handling requests. (Wait) (To be used with -i)
  -W		oidentd is wrapped. (tcp wrappers)
  -h		This help message.
