identd

## Name

identd — opaque UCSPI-TCP IDENT server

## Synopsis

`identd` {`root`}

## Description

identd provides opaque IDENT service. Its raison d'être is to handle other machines that might be running tcpserver(1) without the -R option, or some such, without just refusing IDENT service outright.

### Note

tcpserver(1) with the (default) -r option does not recognize the IDENT protocol's error response, or handle the "Other" operating system code. identd thus always provides positive responses, that however do not even convey real information about the operating system let alone its sockets and user accounts.

The Bernstein convention is for `root` to be `/public/file`, but it can use other conventional locations such as `/home/publicfile/public` or `/var/www`.

identd accepts a request on standard input, and responds in a fixed manner on standard output. identd also prints local log information on standard error.

If identd runs out of memory, encounters an I/O error, or does not receive an input line within 60 seconds, it exits silently.

Normally identd is run under a UCSPI-TCP server program (tcp-socket-accept, s6-tcpserver, or tcpserver spawning a server program per connection) to handle IDENT connections from hosts around the Internet. It can also be run under a UCSPI-SSL server program, although no-one uses IDENT/SSL.

### Caution

tcpserver(1)must be run with the -R option if it is used.

## Security

identd chroots to `root` when it starts. It then sets its group id and user id to the numbers given in environment variables `GID` and `UID`, as set by envuidgid (or equivalent).

### Note

identd reads the `/etc/leapsecs.dat` file before the chroot, and does not require it to be copied under `root` .

The `root` argument, changed root, and dropped privileges exist because of security code common to all publicfile services. identd provides a purely opaque service that provides clients with no real information. It accesses no files, nor obtains information about any sockets, nor looks up anything in any login or account database.

identd does not even validate the syntax of the requests, beyond that they are lines or characters ending in CRLF. Its fixed response identifies all requests, extant connections or not, as belonging to `root` on Xenix. Attackers can fingerprint that a system is running this identd, as opposed to one that actually publishes real information, but not the system that it is running on or anything about that system.

### Note

If accommodating wrongly-configured tcpserver(1) on hosts on the Internet is not a concern, just do not run any IDENT service at all.

## History

identd was added to djbwares in 2025.

## Author

Derived from original code by Daniel J. Bernstein. Documentation by Jonathan de Boyne Pollard.