Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know in the "old days" it was good practice to shut this off.

But nowadays I have heard that it improves deliverability of email. In the old days people were not worried about spam (or having their outbound email rejected), so that made sense.

Of course, the question is only relevant to servers that send email.

What is the current, common practice among discerning Linux admins? Run identd or leave it off?

Thanks

share|improve this question

5 Answers 5

The days of finger or ident are long since past. They belong in the protocol dustbin with gopher and rlogin.

share|improve this answer
1  
I actually like finger. –  Warner May 10 '10 at 0:53
    
Sure, but in what situation in 2010 is finger actually useful? Do you have port 79 forwarded from your cable modem to your SunOS 4.1.3 server at home? usenet -> this sort of thing; muds -> world of warcraft; finger -> tweets (at least if you ever updated your .plan); and so on. Plus ça change, plus c'est la même chose –  chris May 10 '10 at 14:26
    
I used to read John Carmack's finger file all the time, until he finally stopped updating it. I finger @finger.kernel.org. I used to keep one updated myself but don't spend as much time doing things like that on any medium anymore. –  Warner May 10 '10 at 17:48
    
Oh, and don't forget archie. –  Warner May 10 '10 at 17:48
    
@warner -- archie! good thing I wasn't drinking any milk when you said that. –  chris May 11 '10 at 15:14

I use identd (well, oidentd) for IRC and Postgres.

share|improve this answer

I don't run an ident daemon ever anymore. I wouldn't consider it part of any e-Mail delivery best practices.

IRC networks sometimes require it, which is why many IRC clients have a daemon built in.

It might be worth weighing the benefit of running on a multi-user system where the users have system level access but wouldn't by default due to information disclosure.

share|improve this answer

If you might have clients using IRC, run identd. If you are hosting shells or IRC bouncers, RUN IDENTD.

This will allow IRC networks to ban people by their ident@ip instead of *@ip. Additionally, running identd has no real security implications - someone else can never know if the ident response contains a real or a spoofed username.

Besides that, mail servers might give you a lower spam score if there is a valid identd response. Especially when sending newsletters etc. everything that lowers spam ratings is good.

share|improve this answer

I haven't seen a mail server running identd for a long time. It doesn't mean much on Windows, and few Unix admins accept the resulting risks. I haven't logged probes to the port for a while, but last time I did, there weren't enough to indicate it was being used. Some firewall still reject packets on the port rather than drop them, just in case.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.