identd — opaque UCSPI-TCP IDENT server
identd {root}
identd provides opaque IDENT service. Its raison d'être is to handle other machines that might be running tcpserver(1) without the -R option, or some such, without just refusing IDENT service outright.
The Bernstein convention is for root to be /public/file, but it can use other conventional locations such as /home/publicfile/public or /var/www.
identd accepts a request on standard input, and responds in a fixed manner on standard output. identd also prints local log information on standard error.
If identd runs out of memory, encounters an I/O error, or does not receive an input line within 60 seconds, it exits silently.
Normally identd is run under a UCSPI-TCP server program (tcp-socket-accept, s6-tcpserver, or tcpserver spawning a server program per connection) to handle IDENT connections from hosts around the Internet. It can also be run under a UCSPI-SSL server program, although no-one uses IDENT/SSL.
Most IDENT clients as of 2025 are malicious, and send things like requests that aim to fingerprint OpenVPN or Minecraft servers, or requests that simply copy the example in RFC 1413. The few non-malicious IDENT clients left in real-world use are tcpserver(1), s6-tcpserver(1), and other compatible tools. And even that is a misconfiguration, nowadays.
identd strictly validates the syntax of the requests, to match the particular format that is employed by these few non-malicious IDENT clients.
They use a format different to the RFC example's, one that has a strict pattern of whitespace.
It comprises lines terminated by CR+LF with solely two decimal digit sequences separated by strictly “ , ” (SPC, comma, SPC).
The actual numerical values are ignored; and any other whitespace anywhere is considered to be a malformed request.
tcpserver(1) with the (default) -r option does not recognize the IDENT protocol's error response, or handle the "Other" operating system code.
identd thus always provides positive responses.
Its fixed response identifies all requests, extant connections or not, as belonging to root on Xenix.
identd chroots to root when it starts.
It then sets its group id and user id to the numbers given in environment variables GID and UID, as set by envuidgid (or equivalent).
/etc/leapsecs.dat file before the chroot, and does not require it to be copied under root .
The root argument, changed root, and dropped privileges exist because of security code common to all publicfile services.
identd provides a purely opaque service that provides clients with no real information.
It accesses no files, nor obtains information about any sockets, nor looks up anything in any login or account database.
Attackers can fingerprint that a system is running this identd, as opposed to one that actually publishes real information, but not the system that it is running on or anything about that system. identd's responses do not even convey real information about the operating system let alone about its sockets and user accounts.