Name

identd — opaque UCSPI-TCP IDENT server

Synopsis

identd {root}

Description

identd provides opaque IDENT service. Its raison d'être is to handle other machines that might be running tcpserver(1) without the -R option, or some such, without just refusing IDENT service outright.

The Bernstein convention is for root to be /public/file, but it can use other conventional locations such as /home/publicfile/public or /var/www.

identd accepts a request on standard input, and responds in a fixed manner on standard output. identd also prints local log information on standard error.

If identd runs out of memory, encounters an I/O error, or does not receive an input line within 60 seconds, it exits silently.

Normally identd is run under a UCSPI-TCP server program (tcp-socket-accept, s6-tcpserver, or tcpserver spawning a server program per connection) to handle IDENT connections from hosts around the Internet. It can also be run under a UCSPI-SSL server program, although no-one uses IDENT/SSL.

Caution

tcpserver(1)must be run with the -R option if it is used as the server program.

Request and response format

Most IDENT clients as of 2025 are malicious, and send things like requests that aim to fingerprint OpenVPN or Minecraft servers, or requests that simply copy the example in RFC 1413. The few non-malicious IDENT clients left in real-world use are tcpserver(1), s6-tcpserver(1), and other compatible tools. And even that is a misconfiguration, nowadays.

Caution

If accommodating wrongly-configured tcpserver(1) on hosts on the Internet is not a concern, just do not run any IDENT service at all.

identd strictly validates the syntax of the requests, to match the particular format that is employed by these few non-malicious IDENT clients. They use a format different to the RFC example's, one that has a strict pattern of whitespace. It comprises lines terminated by CR+LF with solely two decimal digit sequences separated by strictly  ,  (SPC, comma, SPC). The actual numerical values are ignored; and any other whitespace anywhere is considered to be a malformed request.

tcpserver(1) with the (default) -r option does not recognize the IDENT protocol's error response, or handle the "Other" operating system code. identd thus always provides positive responses. Its fixed response identifies all requests, extant connections or not, as belonging to root on Xenix.

Security

identd chroots to root when it starts. It then sets its group id and user id to the numbers given in environment variables GID and UID, as set by envuidgid (or equivalent).

Note

identd reads the /etc/leapsecs.dat file before the chroot, and does not require it to be copied under root .

The root argument, changed root, and dropped privileges exist because of security code common to all publicfile services. identd provides a purely opaque service that provides clients with no real information. It accesses no files, nor obtains information about any sockets, nor looks up anything in any login or account database.

Attackers can fingerprint that a system is running this identd, as opposed to one that actually publishes real information, but not the system that it is running on or anything about that system. identd's responses do not even convey real information about the operating system let alone about its sockets and user accounts.

History

identd was added to djbwares in 2025.

Author

Derived from original code by Daniel J. Bernstein. Documentation by Jonathan de Boyne Pollard.