[svn] Apply ratbox flood fix.

[irc/rqf/shadowircd.git] / doc / example.conf

/* doc/example.conf - brief example configuration file
 *
 * Copyright (C) 2000-2002 Hybrid Development Team
 * Copyright (C) 2002-2005 ircd-ratbox development team
 * Copyright (C) 2005-2006 charybdis development team
 *
 * $Id: example.conf 3446 2007-05-14 22:21:16Z jilles $
 *
 * See reference.conf for more information.
 */

/* Extensions */
#loadmodule "extensions/createauthonly.so";
#loadmodule "extensions/extb_account.so";
#loadmodule "extensions/extb_canjoin.so";
#loadmodule "extensions/extb_channel.so";
#loadmodule "extensions/extb_extgecos.so";
#loadmodule "extensions/extb_oper.so";
#loadmodule "extensions/extb_realname.so";
#loadmodule "extensions/extb_server.so";
#loadmodule "extensions/hurt.so";
#loadmodule "extensions/ip_cloaking.so";
#loadmodule "extensions/m_findforwards.so";
#loadmodule "extensions/m_identify.so";
#loadmodule "extensions/no_oper_invis.so";
#loadmodule "extensions/sno_farconnect.so";
#loadmodule "extensions/sno_globalkline.so";
#loadmodule "extensions/sno_globaloper.so";

serverinfo {
	name = "hades.arpa";
	use_ts6 = yes;
	sid = "42X";
	description = "charybdis test server";
	network_name = "AthemeNET";
	network_desc = "Your IRC network.";
	hub = yes;

	/* On multi-homed hosts you may need the following. These define
	 * the addresses we connect from to other servers. */
	/* for IPv4 */
	#vhost = "192.169.0.1";
	/* for IPv6 */
	#vhost6 = "3ffe:80e8:546::2";

	/* max_clients: This should be set to the maximum amount of clients
	 * that the server should support. Note that you should leave some
	 * file descriptors free for log files, server connections, ident
	 * lookups (if enabled), exceed_limit clients, etc.
	 */
	max_clients = 1024;
};

admin {
	name = "Lazy admin (lazya)";
	description = "AthemeNET client server";
	email = "nobody@127.0.0.1";
};

log {
	fname_userlog = "logs/userlog";
	#fname_fuserlog = "logs/fuserlog";
	fname_operlog = "logs/operlog";
	#fname_foperlog = "logs/foperlog";
	fname_serverlog = "logs/serverlog";
	fname_glinelog = "logs/glinelog";
	#fname_klinelog = "logs/klinelog";
	fname_killlog = "logs/killlog";
	fname_operspylog = "logs/operspylog";
	#fname_ioerrorlog = "logs/ioerror";
};

/* class {} blocks MUST be specified before anything that uses them.  That
 * means they must be defined before auth {} and before connect {}.
 */
class "users" {
	ping_time = 2 minutes;
        number_per_ident = 10;
	number_per_ip = 10;
        number_per_ip_global = 50;
	cidr_bitlen = 64;
	number_per_cidr = 8;
	max_number = 3000;
	sendq = 400 kbytes;
};

class "opers" {
	ping_time = 5 minutes;
	number_per_ip = 10;
	max_number = 1000;
	sendq = 1 megabyte;
};

class "server" {
	ping_time = 5 minutes;
	connectfreq = 5 minutes;
	max_number = 1;
	sendq = 4 megabytes;
};

listen {
	/* If you want to listen on a specific IP only, specify host.
	 * host definitions apply only to the following port line.
	 */
	#host = "192.169.0.1";
	port = 5000, 6665 .. 6669;

	/* Listen on IPv6 (if you used host= above). */
	#host = "3ffe:1234:a:b:c::d";
        #port = 5000, 6665 .. 6669;
};

/* auth {}: allow users to connect to the ircd (OLD I:)
 * auth {} blocks MUST be specified in order of precedence.  The first one
 * that matches a user will be used.  So place spoofs first, then specials,
 * then general access, then restricted.
 */
auth {
	/* user: the user@host allowed to connect.  multiple IPv4/IPv6 user 
	 * lines are permitted per auth block.
	 */
	user = "*@172.16.0.0/12";
	user = "*test@123D:B567:*";

	/* password: an optional password that is required to use this block.
	 * By default this is not encrypted, specify the flag "encrypted" in
	 * flags = ...; below if it is.
	 */
	password = "letmein";
	
	/* spoof: fake the users user@host to be be this.  You may either
	 * specify a host or a user@host to spoof to.  This is free-form,
	 * just do everyone a favour and dont abuse it. (OLD I: = flag)
	 */
        spoof = "I.still.hate.packets";

	/* Possible flags in auth:
	 * 
	 * encrypted                  | password is encrypted with mkpasswd
	 * spoof_notice               | give a notice when spoofing hosts
	 * exceed_limit (old > flag)  | allow user to exceed class user limits
	 * kline_exempt (old ^ flag)  | exempt this user from k/g/xlines&dnsbls
	 * dnsbl_exempt		      | exempt this user from dnsbls
	 * gline_exempt (old _ flag)  | exempt this user from glines
	 * spambot_exempt	      | exempt this user from spambot checks
	 * shide_exempt		      | exempt this user from serverhiding
	 * jupe_exempt                | exempt this user from generating
	 *                              warnings joining juped channels
	 * resv_exempt		      | exempt this user from resvs
         * flood_exempt               | exempt this user from flood limits
         *                                     USE WITH CAUTION.
	 * no_tilde     (old - flag)  | don't prefix ~ to username if no ident
	 * need_ident   (old + flag)  | require ident for user in this class
	 * need_sasl                  | require SASL id for user in this class
	 */
	flags = kline_exempt, exceed_limit;
	
	/* class: the class the user is placed in */
	class = "opers";
};

auth {
	user = "*@*";
	class = "users";
};

operator "god" {
	/* name: the name of the oper must go above */

	/* user: the user@host required for this operator.  CIDR *is*
	 * supported now. auth{} spoofs work here, other spoofs do not.
 	 * multiple user="" lines are supported.
	 */
	user = "*god@127.0.0.1";

	/* password: the password required to oper.  Unless ~encrypted is
	 * contained in flags = ...; this will need to be encrypted using 
	 * mkpasswd, MD5 is supported
	 */
	password = "etcnjl8juSU1E";

	/* rsa key: the public key for this oper when using Challenge.
	 * A password should not be defined when this is used, see 
	 * doc/challenge.txt for more information.
	 */
	#rsa_public_key_file = "/usr/local/ircd/etc/oper.pub";

	/* umodes: the specific umodes this oper gets when they oper.
	 * If this is specified an oper will not be given oper_umodes
	 * These are described above oper_only_umodes in general {};
	 */
	#umodes = locops, servnotice, operwall, wallop;

	/* snomask: specific server notice mask on oper up.
	 * If this is specified an oper will not be given oper_snomask.
	 */
	snomask = "+Zbfkrsuy";

	/* privileges: controls the activities and commands an oper is
	 * allowed to do on the server.  You may prefix an option with ~ to
	 * disable it, ie ~operwall
	 *
	 * Default flags are operwall, remoteban and encrypted.
	 *
	 * Available options:
	 *
	 * encrypted:    the password above is encrypted [DEFAULT]
	 * local_kill:   allows local users to be /KILL'd
	 * global_kill:  allows local and remote users to be 
	 *               /KILL'd                           (OLD 'O' flag)
	 * remote:       allows remote SQUIT and CONNECT   (OLD 'R' flag)
	 * kline:        allows KILL, KLINE and DLINE      (OLD 'K' flag)
	 * unkline:      allows UNKLINE and UNDLINE        (OLD 'U' flag)
	 * gline:        allows GLINE                      (OLD 'G' flag)
	 * nick_changes: allows oper to see nickchanges    (OLD 'N' flag)
	 *               via usermode +n
	 * rehash:       allows oper to REHASH config      (OLD 'H' flag)
	 * die:          allows DIE and RESTART            (OLD 'D' flag)
	 * admin:        gives admin privileges.  admins
	 *               may (un)load modules and see the
	 *               real IPs of servers.
	 * hidden_admin: gives admin privileges except
	 *		 will not have the admin lines in
	 *		 stats p and whois.
	 * xline:	 allows use of /quote xline/unxline
	 * operwall:     allows the oper to send operwalls [DEFAULT]
	 * oper_spy:	 allows 'operspy' features to see through +s
	 * 		 channels etc. see /quote help operspy
	 * hidden_oper:  hides the oper from /stats p    (OLD UMODE +p)	
	 * remoteban:    allows remote kline etc [DEFAULT]
         */
	flags = global_kill, remote, kline, unkline, gline,
		die, rehash, admin, xline, operwall;
};

connect "irc.uplink.com" {
	host = "192.168.0.1";
	send_password = "password";
	accept_password = "anotherpassword";
	port = 6666;
	hub_mask = "*";
	class = "server";
	flags = compressed, topicburst;

	/* If the connection is IPv6, uncomment below */
	#aftype = ipv6;
};

service {
	name = "services.int";
};

cluster {
	name = "*";
	flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv;
};

shared {
	oper = "*@*", "*";
	flags = all, rehash;
};

/* exempt {}: IPs that are exempt from Dlines. (OLD d:) */
exempt {
	ip = "127.0.0.1";
};

channel {
	use_invex = yes;
	use_except = yes;
	use_knock = yes;
	use_forward = yes;
	knock_delay = 5 minutes;
	knock_delay_channel = 1 minute;
	max_chans_per_user = 15;
        max_bans = 100;
        max_bans_large = 500;
	default_split_user_count = 0;
	default_split_server_count = 0;
	no_create_on_split = no;
	no_join_on_split = no;
	burst_topicwho = yes;
	kick_on_split_riding = no;
};

serverhide {
	flatten_links = yes;
	links_delay = 5 minutes;
        hidden = no;
	disable_hidden = no;
};

/* These are the blacklist settings.
 * You can have multiple combinations of host and rejection reasons.
 * They are used in pairs of one host/rejection reason, or multiple hosts/rejection reason.
 *
 * These settings should be adequate for most networks, and are (presently)
 * required for use on AthemeNet.
 *
 * Word to the wise: Do not use blacklists like SPEWS for blocking IRC
 * connections.
 *
 * As of charybdis 2.1.3, you can do some keyword substitution on the rejection
 * reason. The available keyword substitutions are:
 *
 *   ${ip}           - the user's IP
 *   ${host}         - the user's canonical hostname
 *   ${dnsbl-host}   - the dnsbl hostname the lookup was done against
 *   ${nick}         - the user's nickname
 *   ${network-name} - the name of the network
 *
 * Note: AHBL (the providers of the below BLs) request that they be
 * contacted, via email, at admins@2mbit.com before using these BLs.
 * See <http://www.ahbl.org/services.php> for more information.
 */
#blacklist {
#	host = "ircbl.ahbl.org";
#	reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for having an open proxy. In order to protect ${network-name} from abuse, we are not allowing connections with open proxies to connect.";
#
#	host = "tor.ahbl.org";
#	reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
#};

alias "NickServ" {
	target = "NickServ";
};

alias "ChanServ" {
	target = "ChanServ";
};

alias "OperServ" {
	target = "OperServ";
};

alias "MemoServ" {
	target = "MemoServ";
};

alias "NS" {
	target = "NickServ";
};

alias "CS" {
	target = "ChanServ";
};

alias "OS" {
	target = "OperServ";
};

alias "MS" {
	target = "MemoServ";
};

general {
	hide_error_messages = opers;
	hide_spoof_ips = yes;

	/*
	 * default_umodes: umodes to enable on connect.
	 * If you have enabled the ip_cloaking module, and you want
	 * to make use of it, add +h to this option, i.e.:
	 *	default_umodes = "+ih";
	 */
	default_umodes = "+i";

	default_operstring = "is an IRC Operator";
	default_adminstring = "is a Server Administrator";
	servicestring = "is a Network Service";
	disable_fake_channels = no;
        tkline_expire_notices = no;
        default_floodcount = 10;
	failed_oper_notice = yes;
	dots_in_ident=2;
        dot_in_ip6_addr = no;
	min_nonwildcard = 4;
	min_nonwildcard_simple = 3;
        max_accept = 100;
	max_monitor = 100;
	anti_nick_flood = yes;
	max_nick_time = 20 seconds;
	max_nick_changes = 5;
        anti_spam_exit_message_time = 5 minutes;
	ts_warn_delta = 30 seconds;
	ts_max_delta = 5 minutes;
	client_exit = yes;
	collision_fnc = yes;
	global_snotices = yes;
	dline_with_reason = yes;
	kline_delay = 0 seconds;
	kline_with_reason = yes;
	kline_reason = "K-Lined";
	identify_service = "NickServ@services.int";
	identify_command = "IDENTIFY";
	non_redundant_klines = yes;
	warn_no_nline = yes;
	stats_e_disabled = no;
	stats_c_oper_only=no;
	stats_h_oper_only=no;
	stats_y_oper_only=no;
	stats_o_oper_only=yes;
	stats_P_oper_only=no;
	stats_i_oper_only=masked;
	stats_k_oper_only=masked;
        map_oper_only = no;
	operspy_admin_only = no;
	operspy_dont_care_user_info = no;
	caller_id_wait = 1 minute;
	pace_wait_simple = 1 second;
	pace_wait = 10 seconds;
	short_motd = no;
	ping_cookie = no;
	connect_timeout = 30 seconds;
	disable_auth = no;
	no_oper_flood = yes;
	glines = no;
	gline_time = 1 day;
	gline_min_cidr = 16;
        idletime = 0;
	max_targets = 4;
	client_flood = 20;
        use_whois_actually = no;
	oper_only_umodes = operwall, locops, servnotice;
	oper_umodes = locops, servnotice, operwall, wallop;
	oper_snomask = "+s";
        burst_away = yes;
	nick_delay = 0 seconds; # 15 minutes if you want to enable this
	reject_ban_time = 1 minute;
	reject_after_count = 3;
	reject_duration = 5 minutes;
	max_unknown_ip = 2;
};

modules {
	path = "modules";
	path = "modules/autoload";
};