X-Git-Url: https://jfr.im/git/irc/rqf/shadowircd.git/blobdiff_plain/54015b5fea2584a35aa605ebe37217010b448cff..5274a6d761a756725be24da301b61f94ea87f63e:/doc/reference.conf diff --git a/doc/reference.conf b/doc/reference.conf index be0c3a1..b5dab50 100755 --- a/doc/reference.conf +++ b/doc/reference.conf @@ -6,7 +6,7 @@ * * Written by ejb, wcampbel, db, leeh and others * - * $Id: reference.conf 3446 2007-05-14 22:21:16Z jilles $ + * $Id: reference.conf 3582 2007-11-17 21:55:48Z jilles $ */ /* IMPORTANT NOTES: @@ -18,6 +18,9 @@ * that matches a user will be used. So place spoofs first, then specials, * then general access, then restricted. * + * privset {} blocks MUST be specified before anything that uses them. That + * means they must be defined before operator {}. + * * Both shell style (#) and C style comments are supported. * * Files may be included by either: @@ -41,23 +44,37 @@ * Charybdis contains several extensions that are not enabled by default. * To use them, uncomment the lines below. * - * Restrict channel creation to logged in users -- createauthonly.so - * Account bans (+b $a[:mask]) -- extb_account.so - * Banned from another channel (+b $j:mask) -- extb_canjoin.so - * Other-channel bans (+b $c:mask) -- extb_channel.so - * Extended ban (+b $x:mask) -- extb_extgecos.so - * Oper bans (+b $o) -- extb_oper.so - * Realname (gecos) bans (+b $r:mask) -- extb_realname.so - * Server bans (+b $s:mask) -- extb_server.so - * HURT system -- hurt.so - * Host mangling (umode +h) -- ip_cloaking.so - * Find channel forwards -- m_findforwards.so - * /identify support -- m_identify.so - * Opers cannot be invisible (umode +i) -- no_oper_invis.so - * Far connection notices (snomask +F) -- sno_farconnect.so - * Remote k/d/g/x line active notices -- sno_globalkline.so - * Remote oper up notices -- sno_globaloper.so + * Channel mode +-A (admin only) -- chm_adminonly.so + * Channel mode +-O (oper only) -- chm_operonly.so + * Channel mode +-S (ssl only) -- chm_sslonly.so + * Emulates channel mode +-O (oper only) (+-iI $o) -- chm_operonly_compat.so + * Emulates channel mode +-R (quiet unreg) (+-q $~a) -- chm_quietunreg_compat.so + * Emulates channel mode +-S (ssl only) (+-b $~z) -- chm_sslonly_compat.so + * Restrict channel creation to logged in users -- createauthonly.so + * Account bans (+b $a[:mask]) -- extb_account.so + * Banned from another channel (+b $j:mask) -- extb_canjoin.so + * Other-channel bans (+b $c:mask) -- extb_channel.so + * Extended ban (+b $x:mask) -- extb_extgecos.so + * Oper bans (+b $o) -- extb_oper.so + * Realname (gecos) bans (+b $r:mask) -- extb_realname.so + * Server bans (+b $s:mask) -- extb_server.so + * SSL bans (+b $z) -- extb_ssl.so + * HURT system -- hurt.so + * Host mangling (umode +h) -- ip_cloaking.so + * Find channel forwards -- m_findforwards.so + * /identify support -- m_identify.so + * Opers cannot be invisible (umode +i) -- no_oper_invis.so + * Far connection notices (snomask +F) -- sno_farconnect.so + * Remote k/d/x line active notices -- sno_globalkline.so + * Remote oper up notices -- sno_globaloper.so + * /whois notifications (snomask +W) -- sno_whois.so */ +#loadmodule "extensions/chm_adminonly.so"; +#loadmodule "extensions/chm_operonly.so"; +#loadmodule "extensions/chm_sslonly.so"; +#loadmodule "extensions/chm_operonly_compat.so"; +#loadmodule "extensions/chm_quietunreg_compat.so"; +#loadmodule "extensions/chm_sslonly_compat.so"; #loadmodule "extensions/createauthonly.so"; #loadmodule "extensions/extb_account.so"; #loadmodule "extensions/extb_canjoin.so"; @@ -66,6 +83,7 @@ #loadmodule "extensions/extb_oper.so"; #loadmodule "extensions/extb_realname.so"; #loadmodule "extensions/extb_server.so"; +#loadmodule "extensions/extb_ssl.so"; #loadmodule "extensions/hurt.so"; #loadmodule "extensions/ip_cloaking.so"; #loadmodule "extensions/m_findforwards.so"; @@ -74,22 +92,18 @@ #loadmodule "extensions/sno_farconnect.so"; #loadmodule "extensions/sno_globalkline.so"; #loadmodule "extensions/sno_globaloper.so"; +#loadmodule "extensions/sno_whois.so"; /* serverinfo {}: Contains information about the server. (OLD M:) */ serverinfo { /* name: the name of our server */ name = "hades.arpa"; - /* use ts6: whether we want to use the TS6 protocol to other servers - * or not. - */ - use_ts6 = yes; - /* sid: the unique server id of our server. This must be three * characters long. The first character must be a digit [0-9], the * remaining two chars may be letters [A-Z] or digits [0-9]. * - * This must be specified even if use_ts6 is set to no. + * This parameter must be specified for the server to start. */ sid = "42X"; @@ -118,13 +132,27 @@ serverinfo { * This should be an ipv6 IP only. */ #vhost6 = "3ffe:80e8:546::2"; + + /* ssl_private_key: our ssl private key */ + ssl_private_key = "etc/test.key"; + + /* ssl_cert: certificate for our ssl server */ + ssl_cert = "etc/test.cert"; + + /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */ + ssl_dh_params = "etc/dh.pem"; - /* max_clients: this should be set to the maximum amount of clients - * that the server should support. Note that you should leave some - * file descriptors free for log files, server connections, ident - * lookups (if enabled), exceed_limit clients, etc. + /* ssld_count: number of ssld processes you want to start, if you have a really busy + * server, using N-1 where N is the number of cpu/cpu cores you have might be useful */ - max_clients = 1024; + ssld_count = 1; + + /* default max clients: the default maximum number of clients + * allowed to connect. This can be changed once ircd has started by + * issuing: + * /quote set maxclients + */ + default_max_clients = 1024; }; /* admin {}: contains admin information about the server. (OLD A:) */ @@ -145,7 +173,6 @@ log { * - operlog: /oper usage * - foperlog: failed /oper usage * - serverlog: server connects/disconnects - * - glinelog: glines * - klinelog: klines, etc * - killlog: kills * - operspylog: operspy usage @@ -156,7 +183,6 @@ log { fname_operlog = "logs/operlog"; #fname_foperlog = "logs/foperlog"; fname_serverlog = "logs/serverlog"; - fname_glinelog = "logs/glinelog"; #fname_klinelog = "logs/klinelog"; fname_killlog = "logs/killlog"; fname_operspylog = "logs/operspylog"; @@ -187,19 +213,19 @@ class "users" { */ number_per_ip_global = 5; - /* cidr_bitlen: Limits numbers of connections from a subnet size + /* cidr_ipv4_bitlen: Limits numbers of connections from a subnet size + */ + cidr_ipv4_bitlen = 24; + + /* cidr_ipv6_bitlen: Limits numbers of connections from a subnet size * the following example makes the subnet /64 this is useful * for IPv6 connections in particular - * Also note that the way charybdis is written if you have - * compiled support for IPv6, IPv4 cidr bitlens need to be modified - * Basically to get the approriate length add 96 to the IPv4 length - * For example for a /24 do 96+24 = 120 - * */ - cidr_bitlen = 64; + cidr_ipv6_bitlen = 64; /* number_per_cidr: Number of connections to allow from a subnet of the - * size given in cidr_bitlen. 4 seems to be a good default to me. + * size given in cidr_ipv4_bitlen/cidr_ipv6_bitlen. + * 4 seems to be a good default to me. */ number_per_cidr = 4; @@ -246,26 +272,37 @@ listen { /* port: the specific port to listen on. if no host is specified * before, it will listen on all available IPs. * + * sslport: the specific port to listen ssl connections on. if no + * host is specified before, it will listen on all available IPs. + * * ports are seperated via a comma, a range may be specified using ".." */ /* port: listen on all available IPs, ports 5000 and 6665 to 6669 */ port = 5000, 6665 .. 6669; + + /* sslport: listen for ssl connections on all available IPs, port 9999 */ + sslport = 9999; /* host: set a specific IP/host the ports after the line will listen * on. This may be ipv4 or ipv6. */ host = "1.2.3.4"; port = 7000, 7001; + sslport = 9000, 9001; host = "3ffe:1234:a:b:c::d"; port = 7002; + sslport = 9002; }; /* auth {}: allow users to connect to the ircd (OLD I:) */ auth { - /* user: the user@host allowed to connect. multiple IPv4/IPv6 user - * lines are permitted per auth block. + /* user: the user@host allowed to connect. Multiple IPv4/IPv6 user + * lines are permitted per auth block. This is matched against the + * hostname and IP address (using :: shortening for IPv6 and + * prepending a 0 if it starts with a colon) and can also use CIDR + * masks. */ user = "*@172.16.0.0/12"; user = "*test@123D:B567:*"; @@ -289,7 +326,6 @@ auth { * exceed_limit (old > flag) | allow user to exceed class user limits * kline_exempt (old ^ flag) | exempt this user from k/g/xlines&dnsbls * dnsbl_exempt | exempt this user from dnsbls - * gline_exempt (old _ flag) | exempt this user from glines * spambot_exempt | exempt this user from spambot checks * shide_exempt | exempt this user from serverhiding * jupe_exempt | exempt this user from generating @@ -299,6 +335,7 @@ auth { * USE WITH CAUTION. * no_tilde (old - flag) | don't prefix ~ to username if no ident * need_ident (old + flag) | require ident for user in this class + * need_ssl | require SSL/TLS for user in this class * need_sasl | require SASL id for user in this class */ flags = kline_exempt, exceed_limit; @@ -328,10 +365,57 @@ auth { flags = need_ident; }; -/* operator {}: defines ircd operators. (OLD O:) - * charybdis no longer supports local operators, privileges are - * controlled via flags. - */ +/* privset{}: defines operator privilege sets. */ +privset "local_op" { + /* privs: controls the activities and commands an oper is + * allowed to do on the server + * + * Available options: + * + * oper:local_kill: allows local users to be /KILL'd + * oper:global_kill: allows local and remote users to be /KILL'd + * oper:routing: allows remote SQUIT and CONNECT + * oper:kline: allows KLINE and DLINE + * oper:unkline: allows UNKLINE and UNDLINE + * snomask:nick_changes: allows oper to see nickchanges via snomask +n + * oper:rehash: allows oper to REHASH config + * oper:die: allows DIE and RESTART + * oper:admin: gives admin privileges. admins + * may (un)load modules and see various + * additional information. + * oper:hidden_admin: gives admin privileges except + * will not have the admin lines in + * whois. + * oper:xline: allows use of /quote xline/unxline + * oper:resv: allows /quote resv/unresv and cmode +LP + * oper:operwall: allows the oper to send/receive operwalls + * oper:spy: allows 'operspy' features to see through +s + * channels etc. see /quote help operspy + * oper:hidden: hides the oper from /stats p + * oper:remoteban: allows remote kline etc + * oper:mass_notice: allows sending wallops and mass notices + */ + privs = oper:local_kill, oper:operwall; +}; + +privset "server_bot" { + /* extends: a privset to inherit in this privset */ + extends = "local_op"; + privs = oper:global_kill, oper:kline, oper:remoteban, snomask:nick_changes; +}; + +privset "global_op" { + extends = "local_op"; + privs = oper:global_kill, oper:routing, oper:kline, oper:unkline, oper:xline, + oper:resv, oper:mass_notice, oper:remoteban; +}; + +privset "admin" { + extends = "global_op"; + privs = oper:admin, oper:die, oper:rehash, oper:spy; +}; + +/* operator {}: defines ircd operators. (OLD O:) */ operator "god" { /* name: the name of the oper must go above */ @@ -365,41 +449,20 @@ operator "god" { */ snomask = "+Zbfkrsuy"; - /* privileges: controls the activities and commands an oper is - * allowed to do on the server. You may prefix an option with ~ to - * disable it, ie ~operwall + /* flags: misc options for the operator. You may prefix an option + * with ~ to disable it, e.g. ~encrypted. * - * Default flags are operwall, remoteban and encrypted. + * Default flags are encrypted. * * Available options: * * encrypted: the password above is encrypted [DEFAULT] - * local_kill: allows local users to be /KILL'd - * global_kill: allows local and remote users to be - * /KILL'd (OLD 'O' flag) - * remote: allows remote SQUIT and CONNECT (OLD 'R' flag) - * kline: allows KILL, KLINE and DLINE (OLD 'K' flag) - * unkline: allows UNKLINE and UNDLINE (OLD 'U' flag) - * gline: allows GLINE (OLD 'G' flag) - * nick_changes: allows oper to see nickchanges (OLD 'N' flag) - * via usermode +n - * rehash: allows oper to REHASH config (OLD 'H' flag) - * die: allows DIE and RESTART (OLD 'D' flag) - * admin: gives admin privileges. admins - * may (un)load modules and see the - * real IPs of servers. - * hidden_admin: gives admin privileges except - * will not have the admin lines in - * stats p and whois. - * xline: allows use of /quote xline/unxline - * operwall: allows the oper to send operwalls [DEFAULT] - * oper_spy: allows 'operspy' features to see through +s - * channels etc. see /quote help operspy - * hidden_oper: hides the oper from /stats p (OLD UMODE +p) - * remoteban: allows remote kline etc [DEFAULT] + * need_ssl: must be using SSL/TLS to oper up */ - flags = global_kill, remote, kline, unkline, gline, - die, rehash, admin, xline, operwall; + flags = encrypted; + + /* privset: privileges set to grant */ + privset = "admin"; }; /* connect {}: controls servers we connect to (OLD C:, N:, H:, L:) */ @@ -443,11 +506,16 @@ connect "irc.uplink.com" { * autoconn - automatically connect to this server * compressed - compress traffic via ziplinks * topicburst - burst topics between servers + * ssl - ssl/tls encrypted server connections */ flags = compressed, topicburst; }; connect "ipv6.some.server" { + /* Hosts that are IPv6 addresses must be in :: shortened form + * if applicable. Addresses starting with a colon get an extra + * zero prepended, for example: 0::1 + */ host = "3ffd:dead:beef::1"; send_password = "password"; accept_password = "password"; @@ -460,6 +528,19 @@ connect "ipv6.some.server" { class = "server"; }; +connect "ssl.uplink.com" { + /* Example of ssl server-to-server connection, ssl flag doesn't need + * compressed flag, 'cause it uses own compression + */ + host = "192.168.0.1"; + send_password = "password"; + accept_password = "anotherpassword"; + port = 9999; + hub_mask = "*"; + class = "server"; + flags = ssl, topicburst; +}; + /* cluster {}; servers that we propagate things to automatically. * NOTE: This does NOT grant them privileges to apply anything locally, * you must add a seperate shared block for that. Clustering will @@ -534,6 +615,9 @@ shared { * all - allow oper/server to do all of above. * locops - allow locops - only used for servers who cluster * rehash - allow rehashing + * dline - allow setting perm/temp dlines + * tdline - allow setting temp dlines + * undline - allow removing dlines * none - disallow everything */ @@ -555,7 +639,7 @@ shared { flags = tkline; }; -/* exempt {}: IPs that are exempt from Dlines. (OLD d:) */ +/* exempt {}: IPs that are exempt from Dlines and rejectcache. (OLD d:) */ exempt { ip = "192.168.0.0/16"; @@ -654,18 +738,19 @@ channel { /* The serverhide block contains the options regarding serverhiding */ serverhide { - /* flatten links: this option will show all servers in /links appear - * that they are linked to this current server + /* flatten links: this option will hide various routing information + * and make all servers in /links appear that they are linked to + * this server. */ flatten_links = no; - /* links delay: how often to update the links file when it is - * flattened. + /* links delay: how long to wait before showing splits or new + * servers in a flattened /links output. */ links_delay = 5 minutes; - /* hidden: hide this server from a /links output on servers that - * support it. this allows hub servers to be hidden etc. + /* hidden: hide this server from a /links output on servers with + * flatten_links enabled. this allows hub servers to be hidden etc. */ hidden = no; @@ -694,17 +779,20 @@ serverhide { * ${nick} - the user's nickname * ${network-name} - the name of the network * - * Note: AHBL (the providers of the below BLs) request that they be + * Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be * contacted, via email, at admins@2mbit.com before using these BLs. * See for more information. */ -#blacklist { +blacklist { + host = "dnsbl.dronebl.org"; + reject_reason = "${nick}, your IP (${ip}) is listed in DroneBL. For assistance, see http://dronebl.org/lookup_branded.do?ip=${ip}&network=${network-name}"; + # host = "ircbl.ahbl.org"; # reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for having an open proxy. In order to protect ${network-name} from abuse, we are not allowing connections with open proxies to connect."; # # host = "tor.ahbl.org"; # reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network."; -#}; +}; /* * Alias blocks allow you to define custom commands. (Old m_sshortcut.c) @@ -755,11 +843,13 @@ alias "MS" { */ general { /* hide error messages: defines whether error messages from - * servers are hidden or not. These can sometimes contain IPs and - * can have an adverse effect on server ip hiding. Set to: + * servers that are not deemed fully safe are hidden or not. + * These can sometimes contain IPs and can have an adverse + * effect on server ip hiding. Set to: * yes: hide from opers and admin * opers: hide from opers only * no: do not hide error messages + * Admins on other servers count as opers. */ hide_error_messages = opers; @@ -824,12 +914,6 @@ general { */ dots_in_ident=2; - /* dot in ipv6: ircd-hybrid-6.0 and earlier will disallow hosts - * without a '.' in them. this will add one to the end. only needed - * for older servers. - */ - dot_in_ip6_addr = no; - /* min nonwildcard: the minimum non wildcard characters in k/d/g lines * placed via the server. klines hand placed are exempt from limits. * wildcard chars: '.' '*' '?' '@' @@ -897,7 +981,7 @@ general { */ kline_delay = 0 seconds; - /* kline reason: show the user the reason why they are k/d/glined + /* kline reason: show the user the reason why they are k/dlined * on exit. may give away who set k/dline when set via tcm. */ kline_with_reason = yes; @@ -1009,22 +1093,6 @@ general { /* no oper flood: increase flood limits for opers. */ no_oper_flood = yes; - /* glines: enable glines, network wide temp klines */ - glines = no; - - /* gline time: the amount of time a gline will remain before expiring */ - gline_time = 1 day; - - /* gline_min_cidr: If using a CIDR gline, the minimum length the - * mask must be - */ - gline_min_cidr = 16; - - /* idletime: the maximum amount of time a user may idle before - * they are disconnected - */ - idletime = 0; - /* REMOVE ME. The following line checks you've been reading. */ havent_read_conf = yes; @@ -1067,13 +1135,6 @@ general { * provided they have umode +s set */ oper_snomask = "+s"; - /* servlink path: path to 'servlink' program used by ircd to handle - * encrypted/compressed server <-> server links. - * - * only define if servlink is not in same directory as ircd itself. - */ - #servlink_path = "/usr/local/ircd/bin/servlink"; - /* use egd: if your system does not have *random devices yet you * want to use OpenSSL and encrypted links, enable this. Beware - * EGD is *very* CPU intensive when gathering data for its pool @@ -1120,10 +1181,14 @@ general { /* reject duration: the amount of time to cache the rejection */ reject_duration = 5 minutes; - /* max_unknown_ip: maximum number of pending connections to the server - * that are allowed per IP address + /* throttle_duration: Amount of time that throttling will be applied to an IP + * address. */ - max_unknown_ip = 2; + throttle_duration = 60; + + /* throttle_count: Number of connections within throttle_duration that it takes + * for throttling to take effect */ + throttle_count = 4; }; modules {