712739 - Add identd to people.mozilla.com.

Status: RESOLVED WONTFIX

(mozilla.org Graveyard :: Server Operations, task)

Description

[Blake Winton (:bwinton) (:☕️)]

I'm trying to set up irssi on people.mozilla.com so that I can see messages when I'm not logged in, but Freenode won't let me connect to their server, giving me the error:
[freenode] -!- ERROR Closing Link: people.mozilla.com (Too many user connections (global))

I asked in #freenode on irc.freenode.net, and marienz said "bwinton_: ah, people.mozilla.com is lacking an identd. Fixing that will help (and we may require, or at least strongly recommend, fixing that before it gets an iline)"

So, here I am, asking for an identd to be installed on people.mozilla.com…  :)

Thanks,
Blake.

Comment 1

[Justin Dow [:jabba]]

CC'ing infrasec. Is this something that we want to do? I'm not very familiar with identd or its security implications. If so, can you provide a reasonable and secure configuration suggestion?

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

Ident can be both a security and privacy issue.

1) it listens and open another service to attacks, even thus ident is small, it may have bugs.
2) it allows an attacker to eventually get a list of user names on the system, and people.mozilla.com allows SSH logging - aka user enumeration.
3) it discloses your username, which is also often your real name

2 and 3 can be worked around by sending pseudonyms of the usernames (like moz1, moz2, etc - mapping needs to be respected for the bans to work) and "nothing" for non-irc processes listening (often returns "nobody").

The reason why Freenode wants to require ident is that it's the standard way (even thus it has obvious flaws) for IRC to ban single users on a host (instead of all users) and to some degree, to avoid large bouncers/proxies which are often used for spam.

It also mean that we control which users can be banned/stay banned since we can send any user name for any connection - and that anyone with root/sudo to root on people can also do that.

For completeness:

RHEL uses oidentd as the default ident daemon.
It allows returning "unknown" to all hosts but freenode hosts but that require an up to date range of ips.
It also allows to setup pseudonyms globally or as the discretion of the user.

It has many lines of codes, configuration is tedious (ranges setup and/or user can configure the reply anyway, also need a list of users preconfigured on the system) and I don't really like the idea of running that on such a server.

There are other ident daemons which just return "whatever" to allow IRC servers to work, but add no functionality.

If we do need something accurate and secure, with proper pseudonym mapping (aka bans work and ident doesnt just send gibberish), I would suggest rolling out our own in python (or a similar language) since the ident protocol is very simple, unless somebody is aware of a better daemon that would already exists.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

I spoke to Marien on IRC the other day, and he seemed to think they could iline people.m.o without identd, given the restricted set of people who have access to IRC from there.

Comment 4

[Guillaume Destuynder [:kang] [this account is no longer active]]

It might also be possible to be listed as a Freenode primary contact for the Mozilla project, or it might be that we already have such a contact.
That way, the contact can request unbans and serve also as intermediary for solving issues (this has to be confirmed by Marien). It also allow getting a nice cloak ;-)

For example I'm a primary contact for the RSBAC project (www.rsbac.org).
Note that only management can be listed as primary contact for Mozilla as it's a legal entity (it can delegate it's duty however)

See http://freenode.net/group_registration.shtml

Comment 5

[Justin Dow [:jabba]]

Given the security concerns in comment 2 and that we might be able to work with freenode directly, I'll wontfix this. It seems a little extra trouble and our primary scope of support is around irc.mozilla.org, so taking these extra steps to work with freenode is likely easier done if we can get them to iline people.m.o, especially if someone here can be a primary contact. I think bkero has already requested an iline or a connection limit increase. CC'ing him.