I'm looking at Apache's mod_ident:


However, on this page it has the following disclaimer:

The information should not be trusted in any way except for rudimentary usage tracking.

Why not? What are the security trade-offs? What potential attacks exist? I have a specific use case in mind, but I need to be able to trust its output, and without any other information I can't see a way to understand what the issues might be.

Specifically: I'd like to use it for authentication. If I control the host which is using mod_ident, the host from which the connections are coming from, can ensure that no other host can connect, and control the network in between... can I trust it?

  • 1
    It seems to me that this question has a very specific and reasonably concise answer.
    – Mala
    Mar 15 '15 at 2:27
  • 1
    See RFC 1413 - Identification Protocol section 6.Security Considerations, "The information returned by this protocol is at most as trustworthy as the host providing it OR the organization operating the host. For example, a PC in an open lab has few if any controls on it to prevent a user from having this protocol return any identifier the user wants. Likewise, if the host has been compromised the information returned may be completely erroneous and misleading. The Identification Protocol is not intended as an authorization [..] protocol."
    – MrWhite
    Mar 15 '15 at 10:52
  • Awesome, thanks for the link. After going over that document and my specification carefully, it looks like it would be safe for use in the scenario I intend :)
    – Mala
    Mar 15 '15 at 17:11