2

I'm looking at Apache's mod_ident:

http://httpd.apache.org/docs/2.2/mod/mod_ident.html

However, on this page it has the following disclaimer:

The information should not be trusted in any way except for rudimentary usage tracking.

Why not? What are the security trade-offs? What potential attacks exist? I have a specific use case in mind, but I need to be able to trust its output, and without any other information I can't see a way to understand what the issues might be.

Specifically: I'd like to use it for authentication. If I control the host which is using mod_ident, the host from which the connections are coming from, can ensure that no other host can connect, and control the network in between... can I trust it?

closed as too broad by John Conde Mar 15 '15 at 2:11

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    It seems to me that this question has a very specific and reasonably concise answer. – Mala Mar 15 '15 at 2:27
  • 1
    See RFC 1413 - Identification Protocol section 6.Security Considerations, "The information returned by this protocol is at most as trustworthy as the host providing it OR the organization operating the host. For example, a PC in an open lab has few if any controls on it to prevent a user from having this protocol return any identifier the user wants. Likewise, if the host has been compromised the information returned may be completely erroneous and misleading. The Identification Protocol is not intended as an authorization [..] protocol." – MrWhite Mar 15 '15 at 10:52
  • Awesome, thanks for the link. After going over that document and my specification carefully, it looks like it would be safe for use in the scenario I intend :) – Mala Mar 15 '15 at 17:11