grsecurity forums

Is there some kind of workaround for oidentd in order to have nat (masquerade) support when running oidentd as user nobody with a grsecurity patched kernel ?

Cause I am having problems with oidentd when I run it as user nobody
' oidentd -m -u 99 ' --> masquerade request doesnt work :

Feb 21 01:50:53 amidala oidentd[778]: Connection from blablal.fancydomain.com (xx.xx.xxx.xx):0
Feb 21 01:50:53 amidala oidentd[778]: [blablal.fancydomain.com] 1802 , 10001 : ERROR : NO-USER

However when I run oidentd as root , I have no problems.

And when I dont use the grsecurity kernel patch at all , "oidentd -m -u 99" works just fine with nat requests

Sounds like oident needs access to some /proc stuff that is restricted by grsec. You may need to create a semi privaledged group that has access to this like root does and add the oidentd to that group so it can read this information.

You need to re-read the configuration help for /proc restrictions, since it discusses this very issue directly.

-Brad