identd

Identd is a network service that provides identification of the user associated with a TCP connection. It implements the IDENT protocol, defined in RFC 1413, and typically listens on TCP port 113. When a client connects to port 113 and sends a query containing the two port numbers describing the connection, the identd attempts to determine the user responsible for that connection and returns a line with the result. The service has historically been used by servers such as IRC networks and mail servers to verify the identity of a connecting user, but its importance has declined in modern networks due to privacy concerns and reliability issues.

How identd works: A client connects to the server’s port 113 and sends a request that includes the local and remote port numbers of the connection being identified. The identd daemon then maps the connection to a local user account and replies with a line indicating the user identity, typically including the operating system type and the username. If the mapping cannot be determined or is restricted, the daemon may return an error response. The protocol is simple and can be affected by network middleboxes, NAT, and misconfigurations, which can lead to incorrect or missing information.

Implementation and deployment: On Unix-like systems, identd is often provided by a daemon that runs under inetd/xinetd or systemd socket activation and binds to the privileged port 113. After starting, many implementations drop privileges and operate with restricted access. In contemporary networks, identd is frequently disabled or restricted to trusted clients, or replaced by alternative authentication mechanisms, as it can reveal usernames and be unreliable across complex network paths.

Security and privacy: The IDENT protocol can disclose userNames, making it attractive for information harvesting or social engineering. It can also be abused for denial-of-service or misdirection if exposed to untrusted clients. To reduce risk, administrators may disable identd, isolate it behind firewalls, restrict access by source IP, or avoid relying on identd in favor of more privacy-preserving methods.