Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I think question title is self-explanatory, but I can re-iterate.

I have just recently got annoyed enough at my own dedicated server's FTP connection delay to go hunting for what causes delay.

"Perpetrator" was IdentLookups configuration option. It defaults to on, thus causing noticeable delay on connection attempt. When switched off, connections are done instantly.

So, my question is: what's intended use of indent lookups? Not just in context of FTP server, but in general? Most firewalls block ident probes, so I don't see the point...

Somebody to enlighten me, please? :)

Thanks!

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

The ident protocol is used to provide the username related to a TCP connection, mainly when there are many users using a single IP address like shared hosts, etc. It's not very common those days, so for FTP I think it's safe to disable it. IRC still uses it a lot. You can say it's a dying protocol but hey, you never know.

It works querying pairs of tcp ports, like, the ident client asks a port on server:port on client pair to the ident server that answer who is the user responsible for that connection.

Security people don't like this very much, that's why most firewalls block it too, and I tend to agree with them: you can easily enumerate pretty much all users on your servers using it.

RFC 1413 defines a 60-180 second timeout window on the server time, and a minimum wait time of 30 seconds on the client side, that can cause some nasty delays.

share|improve this answer
    
Thanks. This answer contains info I was looking for. I already knew its intended purpose (to get remote username), but not if it has any (real) value today. –  mr.b Sep 12 '10 at 17:57
add comment

With IdentLookups on proftpd will attempt to get the username of a new connection using the RFC 1413 ident protocol. The delay will be caused by proftpd waiting for the ident protocol to timeout.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.