--- name: "authuser" section: "3" platform: "linux" package: "zmailer" version: "2.99.55-3" release: "Debian 3.0 (Woody)" platforms: ["linux"] url: "https://new.carta.tech/authuser" --- # authuser(3) remote authentication library using the Authentication Server ## NAME authuser - remote authentication library using the Authentication Server ## SYNTAX **#include \** unsigned short **auth\_tcpport**; char \***auth\_xline(***user,fd,&inremote***)**; int **auth\_fd(***fd,&inremote,&local,&remote***)**;\ int **auth\_fd2(***fd,&inlocal,&inremote,&local,&remote***)**; int **auth\_tcpsock(***fd,inlocal,inremote***)**; char \***auth\_tcpuser(***inremote,local,remote***)**;\ char \***auth\_tcpuser2(***inlocal,inremote,local,remote***)**;\ char \***auth\_tcpuser3(***inlocal,inremote,local,remote,timeout***)**; char \***auth\_sockuser(***s,local,remote***)**; char \**user*;\ int *fd*;\ int *s*;\ unsigned long *inlocal*;\ unsigned long *inremote*;\ unsigned short *local*;\ unsigned short *remote*;\ int *timeout*; ## DESCRIPTION The **authuser** library provides a simple interface for finding out the remote identity of a connection through the Authentication Server as specified by RFC 931. Use the -lauthuser loader option to compile a program with this library. **auth\_xline(*user,fd,&inremote*)** returns a line of the form X-Auth-User: user or X-Forgery-By: username, depending upon what the host on the other side of *fd* thinks of the user. This is particularly appropriate for mail and news headers. If the remote host reports that *user* owns the connection on that side, **auth\_xline** will return X-Auth-User: user. If the remote host reports that a different username owns the connection, **auth\_xline** will return X-Forgery-By: username. If user is NULL, it returns X-Auth-User: username with the username reported by the remote host. If *fd* is not a TCP connection or authentication is impossible, **auth\_xline** returns NULL, setting errno appropriately. The line is not cr-lf terminated. It is stored in a static area which is overwritten on each call to **auth\_xline.** **auth\_xline** places the Internet address of the other host into *inremote.* **auth\_fd2(*fd,&inlocal,&inremote,&local,&remote*)** retrieves address information from the connection in socket *fd.* It places the Internet addresses of the connection into *inlocal* and *inremote* and the local and remote TCP ports into *local* and *remote.* **auth\_fd2** returns -1 upon error, setting errno appropriately. **auth\_tcpuser2(*inlocal,inremote,local,remote*)** returns the name of the user on the other end of the TCP connection between *remote@inremote* and *local@inlocal.* If authentication is impossible, **auth\_tcpuser2** returns NULL, setting errno appropriately. The user name is stored in a static area which is overwritten on each call to **auth\_tcpuser2,** **auth\_tcpuser,** **auth\_sockuser,** and **auth\_xline.** ***s* = auth\_tcpsock(*fd,inlocal,inremote*)** sets *s* to a non-blocking socket which is connecting to the Authentication Server at *inremote.* It returns -1 on error, setting errno appropriately. **auth\_sockuser(*s,local,remote*)** makes sure that the socket has connected and then does the same job as **auth\_tcpuser2,** returning the name of the user on the other end of the TCP connection between *remote@inremote* and *local@inlocal,* or NULL (with errno set) if authentication is not possible. *s* is closed by **auth\_sockuser.** The advantage of using **auth\_tcpsock** and **auth\_sockuser** instead of **auth\_tcpuser2** is that you can perform other actions while waiting for the authentication request to complete. You can select *s* for writing to see if it is ready for **auth\_sockuser** yet. **auth\_tcpuser3(*inlocal,inremote,local,remote,timeout*)** is like **auth\_tcpuser2** but returns NULL with errno set to ETIMEDOUT if the authentication request has not been accepted or refused after *timeout* seconds. **auth\_fd(*fd,&inremote,&local,&remote*)** is the same as **auth\_fd2** but throws away the *inlocal* information. **auth\_tcpuser(*inremote,local,remote*)** is the same as **auth\_tcpuser2** but may not bind to the proper local address on hosts with multiple IP addresses. These functions do not perform properly on multihomed hosts and should not be used. They are provided only for backwards compatibility. The authentication routines check with the remote Authentication Server on port **auth\_tcpport,** which defaults to 113 as specified by RFC 931. You can set **auth\_tcpport** to other values for nonstandard implementations. ## RESTRICTIONS **authuser** does no backslash interpretation upon the remote user name. This is conformance with the proposed revision to RFC 931. **authuser** does not use the operating system type information provided by the Authentication Server. ## VERSION authuser version 4.0, February 9, 1992. ## AUTHOR Placed into the public domain by Daniel J. Bernstein. ## REFERENCES The authentication server is more secure than passwords in some ways, but less secure than passwords in many ways. (It's certainly better than no password at all---e.g., for mail or news.) It is not the final solution. For an excellent discussion of security problems within the TCP/IP protocol suite, see Steve Bellovin's article \`\`Security Problems in the TCP/IP Protocol Suite.'' ## SEE ALSO [tcpclient(1)](/tcpclient/1.md), [tcpserver(1)](/tcpserver/1.md), getpeername(3), getsockname(3), [tcp(4)](/tcp/4.md), authd(8)