* that matches a user will be used. So place spoofs first, then specials,
* then general access, then restricted.
*
+ * privset {} blocks MUST be specified before anything that uses them. That
+ * means they must be defined before operator {}.
+ *
* Both shell style (#) and C style comments are supported.
*
* Files may be included by either:
/* Extensions:
*
- * Charybdis contains several extensions that are not enabled by default.
- * To use them, uncomment the lines below.
+ * ShadowIRCd contains several extensions that are not enabled by default.
+ * To use them, uncomment the lines below. More information on each extension
+ * can be found in extensions/README
*
+ * Channel mode +-A (admin only) -- chm_adminonly.so
+ * Channel mode +-O (oper only) -- chm_operonly.so
+ * Channel mode +-S (ssl only) -- chm_sslonly.so
* Emulates channel mode +-O (oper only) (+-iI $o) -- chm_operonly_compat.so
* Emulates channel mode +-R (quiet unreg) (+-q $~a) -- chm_quietunreg_compat.so
* Emulates channel mode +-S (ssl only) (+-b $~z) -- chm_sslonly_compat.so
* Server bans (+b $s:mask) -- extb_server.so
* SSL bans (+b $z) -- extb_ssl.so
* HURT system -- hurt.so
- * Host mangling (umode +h) -- ip_cloaking.so
+ * New host mangling (umode +x) -- ip_cloaking.so
* Find channel forwards -- m_findforwards.so
* /identify support -- m_identify.so
+ * /mkpassword support -- m_mkpasswd.so
+ * Send message to all admins network-wide -- m_adminwall.so
+ * /opme - op self in opless channels, admin only -- m_opme.so
+ * /ojoin - join despite restrictions, admin only -- m_ojoin.so
+ * /omode - force modes in channels, admin only -- m_omode.so
+ * /olist - see all channels in /list, oper only -- m_olist.so
+ * /forcejoin - force join users, admin only -- m_force.so
* Opers cannot be invisible (umode +i) -- no_oper_invis.so
* Far connection notices (snomask +F) -- sno_farconnect.so
* Remote k/d/x line active notices -- sno_globalkline.so
* Remote oper up notices -- sno_globaloper.so
* /whois notifications (snomask +W) -- sno_whois.so
*/
+#loadmodule "extensions/chm_adminonly.so";
+loadmodule "extensions/chm_operonly.so";
+#loadmodule "extensions/chm_sslonly.so";
#loadmodule "extensions/chm_operonly_compat.so";
#loadmodule "extensions/chm_quietunreg_compat.so";
#loadmodule "extensions/chm_sslonly_compat.so";
#loadmodule "extensions/createauthonly.so";
-#loadmodule "extensions/extb_account.so";
-#loadmodule "extensions/extb_canjoin.so";
-#loadmodule "extensions/extb_channel.so";
-#loadmodule "extensions/extb_extgecos.so";
-#loadmodule "extensions/extb_oper.so";
-#loadmodule "extensions/extb_realname.so";
+loadmodule "extensions/extb_account.so";
+loadmodule "extensions/extb_canjoin.so";
+loadmodule "extensions/extb_channel.so";
+loadmodule "extensions/extb_extgecos.so";
+loadmodule "extensions/extb_oper.so";
+loadmodule "extensions/extb_realname.so";
#loadmodule "extensions/extb_server.so";
#loadmodule "extensions/extb_ssl.so";
#loadmodule "extensions/hurt.so";
-#loadmodule "extensions/ip_cloaking.so";
+loadmodule "extensions/ip_cloaking.so";
#loadmodule "extensions/m_findforwards.so";
-#loadmodule "extensions/m_identify.so";
+loadmodule "extensions/m_identify.so";
+loadmodule "extensions/m_mkpasswd.so";
+#loadmodule "extensions/m_adminwall.so";
+#loadmodule "extensions/m_opme.so";
+#loadmodule "extensions/m_ojoin.so";
+#loadmodule "extensions/m_omode.so";
+#loadmodule "extensions/m_olist.so";
+#loadmodule "extensions/m_force.so";
#loadmodule "extensions/no_oper_invis.so";
-#loadmodule "extensions/sno_farconnect.so";
-#loadmodule "extensions/sno_globalkline.so";
-#loadmodule "extensions/sno_globaloper.so";
+loadmodule "extensions/sno_farconnect.so";
+loadmodule "extensions/sno_globalkline.so";
+loadmodule "extensions/sno_globaloper.so";
#loadmodule "extensions/sno_whois.so";
+
/* serverinfo {}: Contains information about the server. (OLD M:) */
serverinfo {
/* description: the description of our server. '[' and ']' may not
* be used here for compatibility with older servers.
*/
- description = "charybdis test server";
+ description = "shadowircd test server";
/* network info: the name and description of the network this server
* is on. Shown in the 005 reply and used with serverhiding.
/* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */
ssl_dh_params = "etc/dh.pem";
- /* ssld_count: number of ssld processes you want to start, if you have a really busy
- * server, using N-1 where N is the number of cpu/cpu cores you have might be useful
+ /* ssld_count: number of ssld processes you want to start, if you
+ * have a really busy server, using N-1 where N is the number of
+ * cpu/cpu cores you have might be useful. A number greater than one
+ * can also be useful in case of bugs in ssld and because ssld needs
+ * two file descriptors per SSL connection.
*/
ssld_count = 1;
*/
number_per_ip_global = 5;
- /* cidr_bitlen: Limits numbers of connections from a subnet size
+ /* cidr_ipv4_bitlen: Limits numbers of connections from a subnet size
+ */
+ cidr_ipv4_bitlen = 24;
+
+ /* cidr_ipv6_bitlen: Limits numbers of connections from a subnet size
* the following example makes the subnet /64 this is useful
* for IPv6 connections in particular
- * Also note that the way charybdis is written if you have
- * compiled support for IPv6, IPv4 cidr bitlens need to be modified
- * Basically to get the approriate length add 96 to the IPv4 length
- * For example for a /24 do 96+24 = 120
- *
*/
- cidr_bitlen = 64;
+ cidr_ipv6_bitlen = 64;
/* number_per_cidr: Number of connections to allow from a subnet of the
- * size given in cidr_bitlen. 4 seems to be a good default to me.
+ * size given in cidr_ipv4_bitlen/cidr_ipv6_bitlen.
+ * 4 seems to be a good default to me.
*/
number_per_cidr = 4;
*/
spoof = "I.still.hate.packets";
+ /* autojoin: Channel (or channels, comma-seperated) to join users
+ * in this auth block to on connect. Note that this won't join
+ * the user through any bans or otherwise restrictive chmodes.
+ */
+ autojoin = "#shadowircd,#test";
+
+ /* autojoin_opers : Channel (or channels, comma-seperated) to join
+ * opers to on oper-up.
+ */
+ autojoin_opers = "#opers,#help";
+
/* Possible flags in auth:
*
* encrypted | password is encrypted with mkpasswd
* USE WITH CAUTION.
* no_tilde (old - flag) | don't prefix ~ to username if no ident
* need_ident (old + flag) | require ident for user in this class
+ * need_ssl | require SSL/TLS for user in this class
* need_sasl | require SASL id for user in this class
*/
flags = kline_exempt, exceed_limit;
flags = need_ident;
};
-/* operator {}: defines ircd operators. (OLD O:)
- * charybdis no longer supports local operators, privileges are
- * controlled via flags.
- */
+/* privset{}: defines operator privilege sets. */
+privset "local_op" {
+ /* privs: controls the activities and commands an oper is
+ * allowed to do on the server
+ *
+ * Available options:
+ *
+ * oper:local_kill: allows local users to be /KILL'd
+ * oper:global_kill: allows local and remote users to be /KILL'd
+ * oper:routing: allows remote SQUIT and CONNECT
+ * oper:kline: allows KLINE and DLINE
+ * oper:unkline: allows UNKLINE and UNDLINE
+ * snomask:nick_changes: allows oper to see nickchanges via snomask +n
+ * oper:rehash: allows oper to REHASH config
+ * oper:die: allows DIE and RESTART
+ * oper:admin: gives admin privileges. admins
+ * may (un)load modules and see various
+ * additional information.
+ * oper:hidden_admin: gives admin privileges except
+ * will not have the admin lines in
+ * whois.
+ * oper:xline: allows use of /quote xline/unxline
+ * oper:resv: allows /quote resv/unresv and cmode +LP
+ * oper:operwall: allows the oper to send/receive operwalls
+ * oper:spy: allows 'operspy' features to see through +s
+ * channels etc. see /quote help operspy
+ * oper:hidden: hides the oper from /stats p
+ * oper:remoteban: allows remote kline etc
+ * oper:mass_notice: allows sending wallops and mass notices
+ */
+ privs = oper:local_kill, oper:operwall;
+};
+
+privset "server_bot" {
+ /* extends: a privset to inherit in this privset */
+ extends = "local_op";
+ privs = oper:kline, oper:remoteban, snomask:nick_changes;
+};
+
+privset "global_op" {
+ extends = "local_op";
+ privs = oper:global_kill, oper:routing, oper:kline, oper:unkline, oper:xline,
+ oper:resv, oper:mass_notice, oper:remoteban;
+};
+
+privset "admin" {
+ extends = "global_op";
+ privs = oper:admin, oper:die, oper:rehash, oper:spy;
+};
+
+/* operator {}: defines ircd operators. (OLD O:) */
operator "god" {
/* name: the name of the oper must go above */
*/
#rsa_public_key_file = "/usr/local/ircd/etc/oper.pub";
+ /* fingerprint: if specified, the oper's client certificate
+ * fingerprint will be checked against the specified fingerprint
+ * below.
+ */
+ #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b";
+
/* umodes: the specific umodes this oper gets when they oper.
* If this is specified an oper will not be given oper_umodes
* These are described above oper_only_umodes in general {};
*/
snomask = "+Zbfkrsuy";
- /* privileges: controls the activities and commands an oper is
- * allowed to do on the server. You may prefix an option with ~ to
- * disable it, ie ~operwall
+ /* flags: misc options for the operator. You may prefix an option
+ * with ~ to disable it, e.g. ~encrypted.
*
- * Default flags are operwall, remoteban and encrypted.
+ * Default flags are encrypted.
*
* Available options:
*
* encrypted: the password above is encrypted [DEFAULT]
- * local_kill: allows local users to be /KILL'd
- * global_kill: allows local and remote users to be
- * /KILL'd (OLD 'O' flag)
- * remote: allows remote SQUIT and CONNECT (OLD 'R' flag)
- * kline: allows KLINE and DLINE (OLD 'K' flag)
- * unkline: allows UNKLINE and UNDLINE (OLD 'U' flag)
- * nick_changes: allows oper to see nickchanges (OLD 'N' flag)
- * via snomask +n
- * rehash: allows oper to REHASH config (OLD 'H' flag)
- * die: allows DIE and RESTART (OLD 'D' flag)
- * admin: gives admin privileges. admins
- * may (un)load modules and see the
- * real IPs of servers.
- * hidden_admin: gives admin privileges except
- * will not have the admin lines in
- * stats p and whois.
- * xline: allows use of /quote xline/unxline
- * resv: allows /quote resv/unresv and cmode +LP [DEFAULT]
- * operwall: allows the oper to send/receive operwalls [DEFAULT]
- * oper_spy: allows 'operspy' features to see through +s
- * channels etc. see /quote help operspy
- * hidden_oper: hides the oper from /stats p (OLD UMODE +p)
- * remoteban: allows remote kline etc [DEFAULT]
- * mass_notice: allows sending wallops and mass notices [DEFAULT]
+ * need_ssl: must be using SSL/TLS to oper up
*/
- flags = global_kill, remote, kline, unkline,
- die, rehash, admin, xline, operwall;
+ flags = encrypted;
+
+ /* privset: privileges set to grant */
+ privset = "admin";
};
/* connect {}: controls servers we connect to (OLD C:, N:, H:, L:) */
/* The channel block contains options pertaining to channels */
channel {
+ /* autochanmodes: Modes that will be set on a unregistered channel
+ * when the first user joins it.
+ */
+ autochanmodes = "nt";
+
+ /* halfop: Enable/disable channel mode +h, which adds halfop,
+ * a channel status below op that has op powers (kick, ban, mode, etc.)
+ * halfops can only kick/devoice/etc people who are +v or
+ * do not have any channel status. Disabling this via rehash will
+ * cause things which are rather confusing to occur, it is highly
+ * recommended to restart if you wish to disable this option, though
+ * it may be enabled by rehash with no problems.
+ */
+ use_halfop = yes;
+
+ /* owner: Enable/disable channel mode +a, which adds owner,
+ * a channel status above op that has op powers (kick, ban, mode, etc.)
+ * owners can only be kicked/deownered by other owners, and may kick
+ * or deop ops and halfops. Disabling this via rehash will
+ * cause things which are rather confusing to occur, it is highly
+ * recommended to restart if you wish to disable this option, though
+ * it may be enabled by rehash with no problems.
+ */
+ use_owner = yes;
+
/* invex: Enable/disable channel mode +I, a n!u@h list of masks
- * that can join a +i channel without an invite.
+ * that can join a +i channel without an invite. Disabling this option
+ * via rehash will leave all previously set invexes hanging around,
+ * though they will not do anything. For this reason, you may want to
+ * restart to disable this option.
*/
use_invex = yes;
/* except: Enable/disable channel mode +e, a n!u@h list of masks
- * that can join a channel through a ban (+b).
+ * that can join a channel through a ban (+b). Disabling this option
+ * via rehash will leave all previously set excepts hanging around,
+ * though they will not do anything. For this reason, you may want to
+ * restart to disable this option.
*/
use_except = yes;
* ratbox-services does.
*/
kick_on_split_riding = no;
+
+ /* only ascii channels: disable local users joining channels
+ * containing characters outside the range 33-126 (non-printable
+ * or non-ASCII).
+ */
+ only_ascii_channels = no;
+
+ /* cycle_host_change: Should a user be cycled in the channels
+ * they're in when their host changes. If set to no, this may
+ * cause client desyncs.
+ */
+ cycle_host_change = yes;
+
+ /* host_in_topic: Defines whether or not the topicsetter's
+ * host is shown when users request the TOPIC. If this option
+ * is set to no, it will only show the nick of the topicsetter.
+ */
+ host_in_topic = yes;
+
+ /* resv_forcepart: force any local users to part a channel
+ * when a RESV is issued.
+ */
+ resv_forcepart = yes;
+
+ /* kick_no_rejoin_time: the amount of time that a user cannot
+ * rejoin for after being kicked out of a +J channel.
+ */
+ kick_no_rejoin_time = 30 seconds;
};
/* These are the blacklist settings.
* You can have multiple combinations of host and rejection reasons.
- * They are used in pairs of one host/rejection reason, or multiple hosts/rejection reason.
+ * They are used in pairs of one host/rejection reason.
*
* These settings should be adequate for most networks, and are (presently)
* required for use on AthemeNet.
target = "MemoServ";
};
+alias "HostServ" {
+ target = "HostServ";
+};
+
+alias "BotServ" {
+ target = "BotServ";
+};
+
alias "NS" {
target = "NickServ";
};
target = "MemoServ";
};
+alias "HS" {
+ target = "HostServ";
+};
+
+alias "BS" {
+ target = "BotServ";
+};
+
/* The general block contains many of the options that were once compiled
* in options in config.h. The general block is read at start time.
*/
/* default umodes: umodes to set upon connection
* If you have enabled the ip_cloaking extension, and you wish for
- * incoming clients to be set +h upon connection, add +h to the umode
- * string below.
+ * incoming clients to be cloaked upon connection, +x must be in
+ * the umode string below.
*/
- default_umodes = "+i";
+ default_umodes = "+ix";
/* default operstring: defines the default oper response
* in /whois queries, eg "is an IRC Operator".
* protected. */
operspy_dont_care_user_info = no;
+ /* secret channels in whois: display secret channels in /whois
+ * even if operspy was not used, as long as the oper doing the
+ * whois has the oper:spy priv. this will not send any kind of
+ * server notice. */
+ secret_channels_in_whois = no;
+
/* caller id wait: time between notifying a +g user that somebody
* is messaging them.
*/
* +s - servnotice - See server notices
* +w - wallop - See oper and server generated WALLOPS
* +z - operwall - See operwalls
+ * +C - noctcp - Block CTCPs to user.
+ * +V - noinvite - Block INVITE to user.
+ * +B - bot - Marks as a bot.
*/
/* oper only umodes: usermodes only opers may set */
* provided they have umode +s set */
oper_snomask = "+s";
- /* servlink path: path to 'servlink' program used by ircd to handle
- * encrypted/compressed server <-> server links.
- *
- * only define if servlink is not in same directory as ircd itself.
- */
- #servlink_path = "/usr/local/ircd/bin/servlink";
-
/* use egd: if your system does not have *random devices yet you
* want to use OpenSSL and encrypted links, enable this. Beware -
* EGD is *very* CPU intensive when gathering data for its pool
projects / irc / rqf / shadowircd.git / blobdiff