CFINGERD(1)

NAME
cfingerd - Custom/Configurable Finger Daemon (1.0.3)

SYNTAX
in.fingerd

COMPATIBLE WITH
Linux 1.0.9+, BSDI

DOCUMENTATION

This finger daemon was created so that people could configure it the way they wanted to. Many people were posting on news- groups asking about such a program.

I looked at the "Secure Finger Daemon" and it didn't really quite impress me. The reason being, it was not a real finger daemon, but a wrapper.

The purpose of the Configurable Finger Daemon is this: To make the finger output display what you want people to see both from other sites, and from local sites.

This documentation (manual page, actually) is designed to give you the most information about configuring the configure daemon allt he way from the beginning to the end. Enjoy it. I spent alot of time to write it.

I suppose you could disable finger completely, but why do that when you can show them a limited amount of information, or even REJECT hosts?

STARTING OUT

When you first get the file, and untar it, simply type "Configure" and you will be on your way. (You MUST have Perl 4.036 or better to run this... I have not yet written a Shell version of this yet, and don't know if I will.)

Follow all of the instructions that are given in the script, and set what you need. The options that are set are the standards, and if you are unsure, keep it the way it is.

Edit your "inet.conf" file and change the line from the README file. If you don't have a line that looks like that, change your 5th option in the line that contains finger, and change it to root. This program *MUST* be run as root.

After that, do a "ps -ax", find the process ID for inetd, and send a "-HUP" kill to it. This will make it reload inetd.

If you have already run Configure before, and want to see what options Configure provides, simply type "Configure ?" or "Configure help" and you will get a verbose listing of the options you can use.

INSTALLING DOCUMENTS

Basically, what you will want to do after you type "make" after the Configure file is done, is to copy all of the files from the "cfingerd" directory into your text file directory, which is nomally /etc/cfingerd (all depends on what you set your Configuration to.)

At that point, all you will want to do is "cp * /etc/cfingerd" and you will be ready to change your documents.

Use your favorite text file editor to edit your documents.

Create any scripts you want to create in the standard directory, /etc/cfingerd/scripts, but make sure that they are root executable!

Also, you must have the cfingerd.conf (or whatever you name your configuration file) present in order for cfingerd to work.

SYSLOG OUTPUT

You may be interested in seeing what happens when a system requests a finger from your system. This is one of the most beneficial options to the Configurable Finger Daemon.

When a user fingers your system, you will see the following output in your syslog:

host cfingerd[pid]: ip.address (host.name <TRUSTED/REJECTED>) : user

Where "host" is the local host (as formatted in syslog), "fingerd" is the name of the program, "pid" is the process ID of the current running copy of cfingerd, "ip.address" is the fingering system's NUMERIC IP ADDRESS, "host.name" is the fingering system's host name by address, "<TRUSTED/REJECTED>" is shown if they are on the proper list, and "user" is the name of the user that they fingered.

If the user fingers root, you will see "ROOT FINGER" in your syslog as the username. This will let you know if someone is trying to hack into your system. (This way you can write a flame letter to the sysadmin! :-)

If you see any error messages in there, they are probably a result of configuration-error, or something strange.

Any errors are logged as "daemon.err", warnings are logged as "daemon.warn", and notices are logged as "daemon.notice".

PROCESS LISTING

One nice addition to cfingerd that was added in version 1.0.2 is the addition of a different process listing output. This is displayed so you can find out what exactly is going on when someone fingers your site.

For example, if someone from "yee.org" fingers a user on your site, the process listing would show:

CFINGERD: yee.org active

as the process output. If this were different because of a site not having a registered domain name, the output would be:

CFINGERD: ??? active

This may change in a later release of cfingerd.

EXTENDED SYSLOG OUTPUT

Other syslog messages are as follows:

When a user does a standard no-name query to your system, the program will report a "USER LIST" in the place of a username in your syslog.

If a user fingers a fake user, then you will see "FAKE USER" in the place of a username in your syslog.

TESTING IT OUT

Testing out the finger daemon is quite simple after it has been successfully installed.

To test the finger daemon, simply type "finger @" to finger the user-listing at your site.

To finger a user at your site, simply type "finger user@" and you will get a user listing based on what you have configured.

To finger the test script and pass BIG, LONG query reports, simply type "finger test."Your ultra long query question"."and so forth and so on"."Other tests"@" and you will get the report returned. :-) (This is GREAT for this procedure.)

Remember, to include extra options, use the PERIOD separator, or ".". Do not use a SPACE or anything else strange like that. This is an extra compliance that the program requires.

Older versions of cfingerd used to allow the ability of users to execute programs on other peoples' machines, by doing the following type of finger:

finger uptime.\`"ls -al 1>&2"\`.other.stuff@your.site

and it would not only give you an UPTIME listing, but it would also display a directory listing of the root directory. This was fixed, so don't worry about it now. :)

FUTURE PLANS

I am constantly battling bugs with my trusty cans of RAID, but sometimes they don't work (ie. the bugs become immune...) I hope to get rid of most bugs, but as with any program, that is nearly impossible. If you find a bug, please report it. Each bug you find is another bug spray. :)

PROGRAM SIGNALS

CFINGERD now has extended signal handling. This signalling system will give you slightly verbose output about what the signal was that happened, and what the signal means.

If any bugs ARE reported, they will be in the form of a signal exception. The known, and stopped signals used by cfingerd are:

SIGHUP, SIGINT, SIGQUIT, SIGILL, SIGTRAP, SIGABRT, SIGUNUSED, SIGFPE, SIGKILL, SIGUSR1, SIGSEGV, SIGUSR2, SIGPIPE, SIGALRM, SIGTERM, SIGSTKFLT, SIGCHLD, SIGCONT, SIGTSTP, SIGTTIN, SIGTTOU, SIGIO, SIGXCPU, SIGXFSZ, SIGVTALRM, SIGPROF, SIGWINCH.

Some signals do not kill the finger daemon, such as SIGINT, or SIGALRM. These only report warnings in your syslog display. In all politeness, however, you should terminate cfingerd with the "kill -9" directive on the process, since it doesn't write anything to the drive. This should only be done if the process ever hangs for any reason.

For BSDI purposes, the SIGCHLD signal is ignored. The reason being is because BSDI's OS insists on sending a SIGCHLD when the child (in this case, this program is a child of inetd) process completes itself.

BUGS

Don't know of any off the top of my head. :)

If you have any problems with compilation, simply copy the in.fingerd file out of the ./bin directory into your /usr/sbin directory, and try it again.

ACKNOWLEDGEMENTS

I would like to thank Dan Hollis for giving me the idea of a local-and-global finger idea. Thanks to Andrew Smith for the idea of the no-finger banner. Thanks to Thomas McWilliams, creator of WorkBone, for his "strmcpy". A million thanks to Allen Oepping for his bug report (the *HUGE* bug that I fixed thanks to him regarding a script-execution security hole), to Derron Simon for the GCC 2.6.3 fix, and MANY thanks to Kevin Rosenberg for the fix to get cfingerd to compile under BSDI.

Thanks to Martin Radford for the bug fixes in rejected and trusted hosts.

Also, many thanks to the betatesters for the many hours of testing on their public access system, and to the many people who were interested in joining the mailing list. Also, thanks to those who reported the bugs. I have fixed them (hopefully) and added more functionality.

AUTHOR

Ken Hollis (khollis@bitgate.chatlink.com)

MAILING LIST

I have an update mailing list in which I send everyone updates of the new programs, and let them ask questions about the daemon, or make suggestions. If you would like to be a part of that mailing list, please write to me; I would be more than happy to include you in the mailing listing. The mailing list doesn't just cover cfingerd. It also covers other works in progress. It is current, and running as of April 6, 1995.

A PERSONAL REQUEST

Even though this program is released under the GPL, I would like to request that instead of fixing bugs by yourself and releasing the program with bug fixes, that you send me the patch so I can fix it. You never know, I may have fixed the bug you showed me.

Before you create a patchlevel update, please check my personal FTP site to make sure the bug hasn't already been fixed. There may be a very high chance that it is fixed.

I also suggest that if people have any other future plans for the software, that they send me the plans. I may be working on the same plan.

I have also seen that people are removing the "version" username from the finger daemon. I kindly ask that you do not do this. I am interested in finding out which systems out there are running cfingerd. This also assists me in debugging the program.

Thanks, that's all I ask.

AVAILABILITY

Basically, wherever you got this file is where I uploaded it. The primary upload site that I like is sunsite.unc.edu, and you can find the latest version on bitgate.chatlink.com in the directory "/pub/security/cfingerd". You can get the latest version there (including the patchlevels if you are not on the mailing list.)

OTHER WORKS IN PROGRESS

I am also working on an anti-forgery mail program, which will prevent people from using your site as either a mail forwarder or from faking mail from a specific user. And, I am always working on making cfingerd better. :)

SEE ALSO

cfingerd.conf(1), finger(1), fingerd(1), identd(8)