Ident user enumeration

The Ident protocol (RFC 1413, port 113/TCP) was meant to let a server ask the client machine which local user was behind a given TCP connection. Today it's an anachronism, but when a host has it enabled it turns against it: it lets you find out which user runs each service, without authenticating.

The idea: for each open port on the target, we open a connection and then ask the ident service (113) who owns that connection. The answer is the system user holding the socket. The classic tool is pentestmonkey's ident-user-enum (Perl, needs the Net::Ident module):

apt install libnet-ident-perl        # script dependency
./ident-user-enum.pl <ip> 22 113 5432 8080 10000
# alternative with nmap (owner of each service)
nmap -p113 --script auth-owners <ip>
# manual query: "<remote-port>,<local-port>"
echo "22,54321" | nc <ip> 113

192.168.x.x:22       root
192.168.x.x:113      nobody
192.168.x.x:10000    eleanor

The value to an attacker is twofold: it discovers real usernames (valid for a targeted spray or brute force) and reveals which account each service runs as, which guides exploitation. On Peppo, ident gave away that the port-10000 service runs as eleanor, a user the SSH attack was then aimed at.

Keep in mind ident is informational: it confirms those users exist and which process they're tied to, but it grants no access by itself; it's the starting point for a brute-force attack or for trying the username as the password.

How to detect it. The probe opens a connection to each port and asks 113/TCP for its owner, so the network signature is a burst of connections to port 113 from a single IP, one per target service, within seconds. Since almost nobody uses ident legitimately today, any inbound traffic to 113 is already suspicious: an IDS or a firewall rule logging connections to that port detects it with almost no false positives. Correlating it with a prior port scan from the same source confirms the reconnaissance phase.

Defence. Don't expose 113/TCP (it's a service with no real value today); if a legacy app needs it, restrict it to trusted networks. Filtering that port removes a free user-information leak.