X-Git-Url: https://jfr.im/git/irc/rqf/shadowircd.git/blobdiff_plain/92fb5c3175786a5ca7ed04cd207cf23a263576a8..5323ec7352c35bfdb7e9144aceff357904a0918e:/doc/reference.conf

diff --git a/doc/reference.conf b/doc/reference.conf
index 4b43fae..539ee69 100755
--- a/doc/reference.conf
+++ b/doc/reference.conf
@@ -1,12 +1,12 @@
-/* doc/reference.conf - charybdis Example configuration file
+/* doc/reference.conf - shadowircd Example configuration file
  *
  * Copyright (C) 2000-2002 Hybrid Development Team
  * Copyright (C) 2002-2005 ircd-ratbox development team
  * Copyright (C) 2005-2006 charybdis development team
  *
- * Written by ejb, wcampbel, db, leeh and others
+ * Written by ejb, wcampbel, db, leeh, Taros, jdhore and others
  *
- * $Id: reference.conf 3159 2007-01-25 07:08:21Z nenolod $
+ * $Id: reference.conf 3582 2007-11-17 21:55:48Z jilles $
  */
 
 /* IMPORTANT NOTES:
@@ -18,6 +18,9 @@
  * that matches a user will be used.  So place spoofs first, then specials,
  * then general access, then restricted.
  *
+ * privset {} blocks MUST be specified before anything that uses them.  That
+ * means they must be defined before operator {}.
+ *
  * Both shell style (#) and C style comments are supported.
  *
  * Files may be included by either:
@@ -38,65 +41,100 @@
 
 /* Extensions:
  *
- * Charybdis contains several extensions that are not enabled by default.
- * To use them, uncomment the lines below.
+ * ShadowIRCd contains several extensions that are not enabled by default.
+ * To use them, uncomment the lines below. More information on each extension
+ * can be found in extensions/README
  *
- * Restrict channel creation to logged in users   -- createauthonly.so
- * Account bans (+b $a[:mask])                    -- extb_account.so
- * Banned from another channel (+b $j:mask)       -- extb_canjoin.so
- * Other-channel bans (+b $c:mask)                -- extb_channel.so
- * Extended ban (+b $x:mask)                      -- extb_extgecos.so
- * Oper bans (+b $o)                              -- extb_oper.so
- * Realname (gecos) bans (+b $r:mask)             -- extb_realname.so
- * Server bans (+b $s:mask)                       -- extb_server.so
- * HURT system                                    -- hurt.so
- * Host mangling (umode +h)                       -- ip_cloaking.so
- * Find channel forwards                          -- m_findforwards.so
- * /identify support                              -- m_identify.so
- * Opers cannot be invisible (umode +i)           -- no_oper_invis.so
- * Far connection notices (snomask +F)            -- sno_farconnect.so
- * Remote k/d/g/x line active notices             -- sno_globalkline.so
- * Remote oper up notices                         -- sno_globaloper.so
+ * Channel mode +-A (admin only)                     -- chm_adminonly.so
+ * Channel mode +-O (oper only)                      -- chm_operonly.so
+ * Channel mode +-S (ssl only)                       -- chm_sslonly.so
+ * Emulates channel mode +-O (oper only) (+-iI $o)   -- chm_operonly_compat.so
+ * Emulates channel mode +-R (quiet unreg) (+-q $~a) -- chm_quietunreg_compat.so
+ * Emulates channel mode +-S (ssl only) (+-b $~z)    -- chm_sslonly_compat.so
+ * Restrict channel creation to logged in users      -- createauthonly.so
+ * Account bans (+b $a[:mask])                       -- extb_account.so
+ * Banned from another channel (+b $j:mask)          -- extb_canjoin.so
+ * Other-channel bans (+b $c:mask)                   -- extb_channel.so
+ * Extended ban (+b $x:mask)                         -- extb_extgecos.so
+ * Oper bans (+b $o)                                 -- extb_oper.so
+ * Realname (gecos) bans (+b $r:mask)                -- extb_realname.so
+ * Server bans (+b $s:mask)                          -- extb_server.so
+ * SSL bans (+b $z)                                  -- extb_ssl.so
+ * HURT system                                       -- hurt.so
+ * New host mangling (umode +x)                      -- ip_cloaking.so
+ * Find channel forwards                             -- m_findforwards.so
+ * /identify support                                 -- m_identify.so
+ * /mkpassword support                               -- m_mkpasswd.so
+ * WEBIRC support                                    -- m_webirc.so
+ * Server-side /CYCLE                                -- m_cycle.so
+ * /oaccept - add to target's accept list, oper only -- m_oaccept.so
+ * /opme - op self in opless channels, admin only    -- m_opme.so
+ * /ojoin - join despite restrictions, admin only    -- m_ojoin.so
+ * /omode - force modes in channels, admin only      -- m_omode.so
+ * /olist - see all channels in /list, oper only     -- m_olist.so
+ * /okick - kick users without having ops, oper only -- m_okick.so
+ * /forcejoin - force join users, admin only         -- m_force.so
+ * roleplay commands - send msgs from fake users     -- m_roleplay.so
+ * Opers cannot be invisible (umode +i)              -- no_oper_invis.so
+ * Far connection notices (snomask +F)               -- sno_farconnect.so
+ * Remote k/d/x line active notices                  -- sno_globalkline.so
+ * Remote oper up notices                            -- sno_globaloper.so
+ * /whois notifications (snomask +W)                 -- sno_whois.so
  */
+#loadmodule "extensions/chm_adminonly.so";
+loadmodule "extensions/chm_operonly.so";
+#loadmodule "extensions/chm_sslonly.so";
+#loadmodule "extensions/chm_operonly_compat.so";
+#loadmodule "extensions/chm_quietunreg_compat.so";
+#loadmodule "extensions/chm_sslonly_compat.so";
 #loadmodule "extensions/createauthonly.so";
-#loadmodule "extensions/extb_account.so";
-#loadmodule "extensions/extb_canjoin.so";
-#loadmodule "extensions/extb_channel.so";
-#loadmodule "extensions/extb_extgecos.so";
-#loadmodule "extensions/extb_oper.so";
-#loadmodule "extensions/extb_realname.so";
+loadmodule "extensions/extb_account.so";
+loadmodule "extensions/extb_canjoin.so";
+loadmodule "extensions/extb_channel.so";
+loadmodule "extensions/extb_extgecos.so";
+loadmodule "extensions/extb_oper.so";
+loadmodule "extensions/extb_realname.so";
 #loadmodule "extensions/extb_server.so";
+#loadmodule "extensions/extb_ssl.so";
 #loadmodule "extensions/hurt.so";
-#loadmodule "extensions/ip_cloaking.so";
+loadmodule "extensions/ip_cloaking.so";
 #loadmodule "extensions/m_findforwards.so";
-#loadmodule "extensions/m_identify.so";
+loadmodule "extensions/m_identify.so";
+loadmodule "extensions/m_mkpasswd.so";
+loadmodule "extensions/m_webirc.so";
+#loadmodule "extensions/m_cycle.so";
+#loadmodule "extensions/m_oaccept.so";
+#loadmodule "extensions/m_opme.so";
+#loadmodule "extensions/m_ojoin.so";
+#loadmodule "extensions/m_omode.so";
+#loadmodule "extensions/m_olist.so";
+#loadmodule "extensions/m_okick.so";
+#loadmodule "extensions/m_force.so";
+#loadmodule "extensions/m_roleplay.so";
 #loadmodule "extensions/no_oper_invis.so";
-#loadmodule "extensions/sno_farconnect.so";
-#loadmodule "extensions/sno_globalkline.so";
-#loadmodule "extensions/sno_globaloper.so";
+loadmodule "extensions/sno_farconnect.so";
+loadmodule "extensions/sno_globalkline.so";
+loadmodule "extensions/sno_globaloper.so";
+#loadmodule "extensions/sno_whois.so";
+
  
 /* serverinfo {}:  Contains information about the server. (OLD M:) */
 serverinfo {
 	/* name: the name of our server */
 	name = "hades.arpa";
 
-	/* use ts6: whether we want to use the TS6 protocol to other servers
-	 * or not.
-	 */
-	use_ts6 = yes;
-
 	/* sid: the unique server id of our server.  This must be three
 	 * characters long.  The first character must be a digit [0-9], the
 	 * remaining two chars may be letters [A-Z] or digits [0-9].
 	 *
-	 * This must be specified even if use_ts6 is set to no.
+	 * This parameter must be specified for the server to start.
 	 */
 	sid = "42X";
 
 	/* description: the description of our server.  '[' and ']' may not
 	 * be used here for compatibility with older servers.
 	 */
-	description = "charybdis test server";
+	description = "shadowircd test server";
 
 	/* network info: the name and description of the network this server
 	 * is on.  Shown in the 005 reply and used with serverhiding.
@@ -104,6 +142,14 @@ serverinfo {
 	network_name = "MyNet";
 	network_desc = "This is My Network";
 
+	/* helpchan/helpurl: These 2 items are shown when a user does
+	 * /quote help with no additional parameters to direct them
+	 * to a channel/URL where they can get more or network-specific help.
+	 * They can be commented out and will not show to users if they are.
+	 */
+	helpchan = "#help";
+	helpurl = "http://www.mynet.net/help";
+
 	/* hub: allow this server to act as a hub and have multiple servers
 	 * connected to it.  
 	 */
@@ -118,6 +164,30 @@ serverinfo {
 	 * This should be an ipv6 IP only.
 	 */
 	#vhost6 = "3ffe:80e8:546::2";
+	
+	/* ssl_private_key: our ssl private key */
+	ssl_private_key = "etc/ssl.key";
+
+	/* ssl_cert: certificate for our ssl server */
+	ssl_cert = "etc/ssl.cert";
+
+	/* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */
+	ssl_dh_params = "etc/dh.pem";
+
+	/* ssld_count: number of ssld processes you want to start, if you
+	 * have a really busy server, using N-1 where N is the number of
+	 * cpu/cpu cores you have might be useful. A number greater than one
+	 * can also be useful in case of bugs in ssld and because ssld needs
+	 * two file descriptors per SSL connection.
+	 */
+	ssld_count = 1;
+
+	/* default max clients: the default maximum number of clients
+	 * allowed to connect.  This can be changed once ircd has started by
+	 * issuing:
+	 *   /quote set maxclients <limit>
+	 */
+	default_max_clients = 1024;
 };
 
 /* admin {}: contains admin information about the server. (OLD A:) */
@@ -138,7 +208,6 @@ log {
 	 * - operlog:    /oper usage
 	 * - foperlog:   failed /oper usage
 	 * - serverlog:  server connects/disconnects
-	 * - glinelog:   glines
 	 * - klinelog:   klines, etc
 	 * - killlog:    kills
 	 * - operspylog: operspy usage
@@ -149,7 +218,6 @@ log {
 	fname_operlog = "logs/operlog";
 	#fname_foperlog = "logs/foperlog";
 	fname_serverlog = "logs/serverlog";
-	fname_glinelog = "logs/glinelog";
 	#fname_klinelog = "logs/klinelog";
 	fname_killlog = "logs/killlog";
 	fname_operspylog = "logs/operspylog";
@@ -180,19 +248,19 @@ class "users" {
          */
         number_per_ip_global = 5;
 
-	/* cidr_bitlen:  Limits numbers of connections from a subnet size
+	/* cidr_ipv4_bitlen:  Limits numbers of connections from a subnet size
+	 */
+	cidr_ipv4_bitlen = 24;
+
+	/* cidr_ipv6_bitlen:  Limits numbers of connections from a subnet size
 	 * the following example makes the subnet /64 this is useful
 	 * for IPv6 connections in particular
-	 * Also note that the way charybdis is written if you have
-	 * compiled support for IPv6, IPv4 cidr bitlens need to be modified
-	 * Basically to get the approriate length add 96 to the IPv4 length
-	 * For example for a /24 do 96+24 = 120
-	 *
 	 */
-	cidr_bitlen = 64;
+	cidr_ipv6_bitlen = 64;
 
 	/* number_per_cidr:  Number of connections to allow from a subnet of the 
-	 * size given in cidr_bitlen.  4 seems to be a good default to me.
+	 * size given in cidr_ipv4_bitlen/cidr_ipv6_bitlen.
+	 * 4 seems to be a good default to me.
 	 */
 	number_per_cidr = 4;
 
@@ -239,30 +307,50 @@ listen {
 	/* port: the specific port to listen on.  if no host is specified
 	 * before, it will listen on all available IPs.
 	 *
+	 * sslport: the specific port to listen ssl connections on. if no 
+	 * host is specified before, it will listen on all available IPs.
+	 *
 	 * ports are seperated via a comma, a range may be specified using ".."
 	 */
 	
 	/* port: listen on all available IPs, ports 5000 and 6665 to 6669 */
 	port = 5000, 6665 .. 6669;
+	
+	/* sslport: listen for ssl connections on all available IPs, port 9999 */
+	sslport = 9999;
 
 	/* host: set a specific IP/host the ports after the line will listen 
 	 * on.  This may be ipv4 or ipv6.
 	 */
 	host = "1.2.3.4";
 	port = 7000, 7001;
+	sslport = 9000, 9001;
 
 	host = "3ffe:1234:a:b:c::d";
         port = 7002;
+        sslport = 9002;
 };
 
 /* auth {}: allow users to connect to the ircd (OLD I:) */
 auth {
-	/* user: the user@host allowed to connect.  multiple IPv4/IPv6 user 
-	 * lines are permitted per auth block.
+	/* user: the user@host allowed to connect.  Multiple IPv4/IPv6 user
+	 * lines are permitted per auth block.  This is matched against the
+	 * hostname and IP address (using :: shortening for IPv6 and
+	 * prepending a 0 if it starts with a colon) and can also use CIDR
+	 * masks.
 	 */
 	user = "*@172.16.0.0/12";
 	user = "*test@123D:B567:*";
 
+	/* auth_user: The username (authenticated via SASL or PASS) allowed
+	 * to connect. You are able to put multiple auth_user lines. If people
+	 * are authenticating via SASL in this way, it is recommended to comment
+	 * out the password option below. You will also *NEED* to specify a user
+	 * line above auth_user, this can safely be "*@*", however.
+	 */
+	auth_user = "jilles";
+	auth_user = "jdhore";
+
 	/* password: an optional password that is required to use this block.
 	 * By default this is not encrypted, specify the flag "encrypted" in
 	 * flags = ...; below if it is.
@@ -275,6 +363,17 @@ auth {
 	 */
         spoof = "I.still.hate.packets";
 
+	/* autojoin: Channel (or channels, comma-seperated) to join users
+	 * in this auth block to on connect. Note that this won't join
+	 * the user through any bans or otherwise restrictive chmodes.
+	 */
+	autojoin = "#shadowircd,#test";
+
+	/* autojoin_opers : Channel (or channels, comma-seperated) to join
+	 * opers to on oper-up.
+	 */
+	autojoin_opers = "#opers,#help";
+
 	/* Possible flags in auth:
 	 * 
 	 * encrypted                  | password is encrypted with mkpasswd
@@ -282,7 +381,6 @@ auth {
 	 * exceed_limit (old > flag)  | allow user to exceed class user limits
 	 * kline_exempt (old ^ flag)  | exempt this user from k/g/xlines&dnsbls
 	 * dnsbl_exempt		      | exempt this user from dnsbls
-	 * gline_exempt (old _ flag)  | exempt this user from glines
 	 * spambot_exempt	      | exempt this user from spambot checks
 	 * shide_exempt		      | exempt this user from serverhiding
 	 * jupe_exempt                | exempt this user from generating
@@ -292,6 +390,7 @@ auth {
          *                                     USE WITH CAUTION.
 	 * no_tilde     (old - flag)  | don't prefix ~ to username if no ident
 	 * need_ident   (old + flag)  | require ident for user in this class
+	 * need_ssl                   | require SSL/TLS for user in this class
 	 * need_sasl                  | require SASL id for user in this class
 	 */
 	flags = kline_exempt, exceed_limit;
@@ -300,6 +399,24 @@ auth {
 	class = "opers";
 };
 
+/* Example WEBIRC authblock */
+auth {
+	/* user: webirc@IP.OF.YOUR.WEBIRC . the webirc@ part is required */
+	user = "webirc@192.168.1.1";
+
+	/* password: password the webirc client sends in the WEBIRC command.
+	* You can use a encrypted password here (see above auth block).
+	*/
+	password = "<password>";
+
+	/* spoof: This is required to keep it what it is currently if you
+	* want the webirc client to show the users' real host as their
+	* host on IRC.
+	*/
+	spoof = "webirc.";
+	class = "users";
+};
+
 auth {
 	/* redirect: the server and port to redirect a user to.  A user does
 	 * not have to obey the redirection, the ircd just suggests to them
@@ -321,10 +438,60 @@ auth {
 	flags = need_ident;
 };
 
-/* operator {}: defines ircd operators. (OLD O:)
- * charybdis no longer supports local operators, privileges are
- * controlled via flags.
- */
+/* privset{}: defines operator privilege sets. */
+privset "local_op" {
+	/* privs: controls the activities and commands an oper is
+	 * allowed to do on the server
+	 *
+	 * Available options:
+	 *
+	 * oper:local_kill:      allows local users to be /KILL'd
+	 * oper:global_kill:     allows local and remote users to be /KILL'd
+	 * oper:routing:         allows remote SQUIT and CONNECT
+	 * oper:kline:           allows KLINE and DLINE
+	 * oper:unkline:         allows UNKLINE and UNDLINE
+	 * snomask:nick_changes: allows oper to see nickchanges via snomask +n
+	 * oper:rehash:          allows oper to REHASH config
+	 * oper:die:             allows DIE and RESTART
+	 * oper:admin:           gives admin privileges.  admins
+	 *                       may (un)load modules and see various
+	 *                       additional information.
+	 * oper:hidden_admin:    gives admin privileges except
+	 *		         will not have the admin lines in
+	 *		         whois.
+	 * oper:xline:	         allows use of /quote xline/unxline
+	 * oper:resv:	         allows /quote resv/unresv and cmode +LP
+	 * oper:operwall:        allows the oper to send/receive operwalls
+	 * oper:override:        allows the oper to set umode +p on themself
+                                 which grants the ability to have implicit
+                                 operator access in all channels.
+	 * oper:spy:	         allows 'operspy' features to see through +s
+	 * 		         channels etc. see /quote help operspy
+	 * oper:hidden:          hides the oper from /stats p
+	 * oper:remoteban:       allows remote kline etc
+	 * oper:mass_notice:     allows sending wallops and mass notices
+	 */
+	privs = oper:local_kill, oper:operwall;
+};
+
+privset "server_bot" {
+	/* extends: a privset to inherit in this privset */
+	extends = "local_op";
+	privs = oper:kline, oper:remoteban, snomask:nick_changes;
+};
+
+privset "global_op" {
+	extends = "local_op";
+	privs = oper:global_kill, oper:routing, oper:kline, oper:unkline, oper:xline,
+		oper:resv, oper:mass_notice, oper:remoteban;
+};
+
+privset "admin" {
+	extends = "global_op";
+	privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:override;
+};
+
+/* operator {}: defines ircd operators. (OLD O:) */
 operator "god" {
 	/* name: the name of the oper must go above */
 
@@ -347,6 +514,12 @@ operator "god" {
 	 */
 	#rsa_public_key_file = "/usr/local/ircd/etc/oper.pub";
 
+	/* fingerprint: if specified, the oper's client certificate
+	 * fingerprint will be checked against the specified fingerprint
+	 * below.
+	 */
+	#fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b";
+
 	/* umodes: the specific umodes this oper gets when they oper.
 	 * If this is specified an oper will not be given oper_umodes
 	 * These are described above oper_only_umodes in general {};
@@ -356,43 +529,39 @@ operator "god" {
 	/* snomask: specific server notice mask on oper up.
 	 * If this is specified an oper will not be given oper_snomask.
 	 */
-	snomask = "+Zbfkrsuy";
+	snomask = "+FZbcfkrsuy";
+
+	/* vhost: defines the vhost that this oper will get on oper up.
+	 * this must be a valid hostmask. If this is specified the oper
+	 * will not be given default_operhost.
+	 */
+	vhost = "is.an.oper";
+
+	/* swhois: defines an additional line that will be displayed
+	 * whenever someone does /whois on the oper in question.
+	 */
+	swhois = "is wearing pants.";
 
-	/* privileges: controls the activities and commands an oper is
-	 * allowed to do on the server.  You may prefix an option with ~ to
-	 * disable it, ie ~operwall
+	/* operstring: defines a custom operstring for this oper,
+	 * which will be shown in whois instead of default_operstring
+	 * or default_adminstring.
+	 */
+	operstring = "is a lazy IRC Operator";
+
+	/* flags: misc options for the operator.  You may prefix an option
+	 * with ~ to disable it, e.g. ~encrypted.
 	 *
-	 * Default flags are operwall, remoteban and encrypted.
+	 * Default flags are encrypted.
 	 *
 	 * Available options:
 	 *
 	 * encrypted:    the password above is encrypted [DEFAULT]
-	 * local_kill:   allows local users to be /KILL'd
-	 * global_kill:  allows local and remote users to be 
-	 *               /KILL'd                           (OLD 'O' flag)
-	 * remote:       allows remote SQUIT and CONNECT   (OLD 'R' flag)
-	 * kline:        allows KILL, KLINE and DLINE      (OLD 'K' flag)
-	 * unkline:      allows UNKLINE and UNDLINE        (OLD 'U' flag)
-	 * gline:        allows GLINE                      (OLD 'G' flag)
-	 * nick_changes: allows oper to see nickchanges    (OLD 'N' flag)
-	 *               via usermode +n
-	 * rehash:       allows oper to REHASH config      (OLD 'H' flag)
-	 * die:          allows DIE and RESTART            (OLD 'D' flag)
-	 * admin:        gives admin privileges.  admins
-	 *               may (un)load modules and see the
-	 *               real IPs of servers.
-	 * hidden_admin: gives admin privileges except
-	 *		 will not have the admin lines in
-	 *		 stats p and whois.
-	 * xline:	 allows use of /quote xline/unxline
-	 * operwall:     allows the oper to send operwalls [DEFAULT]
-	 * oper_spy:	 allows 'operspy' features to see through +s
-	 * 		 channels etc. see /quote help operspy
-	 * hidden_oper:  hides the oper from /stats p    (OLD UMODE +p)	
-	 * remoteban:    allows remote kline etc [DEFAULT]
+	 * need_ssl:     must be using SSL/TLS to oper up
          */
-	flags = global_kill, remote, kline, unkline, gline,
-		die, rehash, admin, xline, operwall;
+	flags = encrypted;
+
+	/* privset: privileges set to grant */
+	privset = "admin";
 };
 
 /* connect {}: controls servers we connect to (OLD C:, N:, H:, L:) */
@@ -436,11 +605,16 @@ connect "irc.uplink.com" {
 	 * autoconn	- automatically connect to this server
 	 * compressed	- compress traffic via ziplinks
 	 * topicburst	- burst topics between servers
+	 * ssl		- ssl/tls encrypted server connections
 	 */
 	flags = compressed, topicburst;
 };
 
 connect "ipv6.some.server" {
+	/* Hosts that are IPv6 addresses must be in :: shortened form
+	 * if applicable.  Addresses starting with a colon get an extra
+	 * zero prepended, for example: 0::1
+	 */
         host = "3ffd:dead:beef::1";
         send_password = "password";
         accept_password = "password";
@@ -453,6 +627,19 @@ connect "ipv6.some.server" {
         class = "server";
 };
 
+connect "ssl.uplink.com" {
+	/* Example of ssl server-to-server connection, ssl flag doesn't need
+	 * compressed flag, 'cause it uses own compression
+	 */
+	host = "192.168.0.1";
+	send_password = "password";
+	accept_password = "anotherpassword";
+	port = 9999;
+	hub_mask = "*";
+	class = "server";
+	flags = ssl, topicburst;
+};
+
 /* cluster {}; servers that we propagate things to automatically.
  * NOTE: This does NOT grant them privileges to apply anything locally,
  *       you must add a seperate shared block for that.  Clustering will
@@ -524,9 +711,14 @@ shared {
 	 *    resv    - allow setting perm/temp resvs
 	 *    tresv   - allow setting temp resvs
 	 *    unresv  - allow removing xlines
+ 	 *    rehash  - allow rehashing
 	 *    all     - allow oper/server to do all of above.
 	 *    locops  - allow locops - only used for servers who cluster
- 	 *    rehash  - allow rehashing
+	 *    die     - allow restarting/dying of servers
+	 *    modules - allow loading/unloading/reloading of modules
+	 *    dline   - allow setting perm/temp dlines
+	 *    tdline  - allow setting temp dlines
+	 *    undline - allow removing dlines
 	 *    none    - disallow everything
 	 */
 
@@ -548,7 +740,7 @@ shared {
 	flags = tkline;
 };
 
-/* exempt {}: IPs that are exempt from Dlines. (OLD d:) */
+/* exempt {}: IPs that are exempt from Dlines and rejectcache. (OLD d:) */
 exempt {
 	ip = "192.168.0.0/16";
 
@@ -559,20 +751,52 @@ exempt {
 
 /* The channel block contains options pertaining to channels */
 channel {
-	/* invex: Enable/disable channel mode +I, a n!u@h list of masks
-	 * that can join a +i channel without an invite.
+	/* disabledmodes: Modes that will be disabled, users will not be
+	 * able to set them. This is only read on startup, you need to 
+	 * restart the ircd for this to have any effect. This only prevents 
+	 * local users/opers from setting these modes. This does not prevent 
+	 * remote servers/users (ex: services) from setting them. Make sure 
+	 * your services and remote servers are properly configured when 
+	 * using this option!
+	 * Valid parameters are: CLPFQITDENGJKMrczgqefj
+	 */
+	#disabledmodes = "ME";
+
+	/* autochanmodes: Modes that will be set on a unregistered channel
+	 * when the first user joins it.
+	 */
+	autochanmodes = "nt";
+
+	/* admin_on_channel_create: If set to yes, users joining new channels
+	 * will be given +ao instead of just +o. Requires use_admin.
+	 */
+	admin_on_channel_create = no;
+
+	/* exemptchanops: Channel modes that any form of channel ops (+aoh) 
+	 * will be exempt from. Even if the mode is set, it will not apply to the
+	 * channel ops if it is listed in this option. Valid modes are cCDTNGK.
 	 */
-	use_invex = yes;
+	exemptchanops = "NT";
 
-	/* except: Enable/disable channel mode +e, a n!u@h list of masks
-	 * that can join a channel through a ban (+b).
+	/* halfop: Enable/disable channel mode +h, which adds halfop,
+	 * a channel status below op that has op powers (kick, ban, mode, etc.)
+	 * halfops can only kick/devoice/etc people who are +v or
+	 * do not have any channel status. Disabling this via rehash will
+	 * cause things which are rather confusing to occur, it is highly
+	 * recommended to restart if you wish to disable this option, though
+	 * it may be enabled by rehash with no problems.
 	 */
-	use_except = yes;
+	use_halfop = yes;
 
-	/* forward: Enable/disable channel mode +f, a channel to forward
-	 * users to if they can't join because of +i etc.
+	/* admin: Enable/disable channel mode +a, which adds admin,
+	 * a channel status above op that has op powers (kick, ban, mode, etc.)
+	 * admins can only be kicked/deadmined by other admins, and may kick
+	 * or deop anyone. Disabling this via rehash will cause things which
+	 * are rather confusing to occur, it is highly recommended to restart
+	 * if you wish to disable this option, though it may be enabled 
+	 * by rehash with no problems.
 	 */
-	use_forward = yes;
+	use_admin = yes;
 
 	/* knock: Allows users to request an invite to a channel that
 	 * is locked somehow (+ikl).  If the channel is +p or you are banned
@@ -580,10 +804,11 @@ channel {
 	 */
 	use_knock = yes;
 
-	/* invite ops only: Restrict /invite to ops on channels, rather than
-	 * allowing unopped users to invite people to a -i channel.
+	/* local channels: &Channel - a channel that exists only on one server
+	 * people on other servers will not be able to see or join local channels
+	 * from another server.
 	 */
-	invite_ops_only = yes;
+	use_local_channels = yes;
 
 	/* knock delay: The amount of time a user must wait between issuing
 	 * the knock command.
@@ -599,7 +824,7 @@ channel {
 	max_chans_per_user = 15;
 
         /* max bans: maximum number of +b/e/I/q modes in a channel */
-        max_bans = 25;
+        max_bans = 100;
 
         /* max bans: maximum number of +b/e/I/q modes in a +L channel */
         max_bans_large = 500;
@@ -647,23 +872,53 @@ channel {
 	 * ratbox-services does.
 	 */
 	kick_on_split_riding = no;
+
+	/* only ascii channels: disable local users joining channels
+	 * containing characters outside the range 33-126 (non-printable
+	 * or non-ASCII).
+	 */
+	only_ascii_channels = no;
+
+	/* cycle_host_change: Should a user be cycled in the channels
+	 * they're in when their host changes. If set to no, this may
+	 * cause client desyncs.
+	 */
+	cycle_host_change = yes;
+
+	/* host_in_topic: Defines whether or not the topicsetter's
+	 * host is shown when users request the TOPIC. If this option
+	 * is set to no, it will only show the nick of the topicsetter.
+	 */
+	host_in_topic = yes;
+ 
+	/* resv_forcepart: force any local users to part a channel
+	 * when a RESV is issued.
+	 */
+	resv_forcepart = yes;
+
+	/* channel target change: restrict how many channels users can
+	 * message per unit of time. IRC operators, channel operators and
+	 * voiced users are exempt.
+	 */
+	channel_target_change = yes;
 };
 
 
 /* The serverhide block contains the options regarding serverhiding */
 serverhide {
-	/* flatten links: this option will show all servers in /links appear
-	 * that they are linked to this current server
+	/* flatten links: this option will hide various routing information
+	 * and make all servers in /links appear that they are linked to
+	 * this server. This option also disallows non-opers from using /map
 	 */
 	flatten_links = no;
 
-	/* links delay: how often to update the links file when it is
-	 * flattened.
+	/* links delay: how long to wait before showing splits or new
+	 * servers in a flattened /links output.
 	 */
 	links_delay = 5 minutes;
 
-	/* hidden: hide this server from a /links output on servers that
-	 * support it.  this allows hub servers to be hidden etc.
+	/* hidden: hide this server from a /links output on servers with
+	 * flatten_links enabled.  this allows hub servers to be hidden etc.
 	 */
         hidden = no;
 
@@ -675,7 +930,7 @@ serverhide {
 
 /* These are the blacklist settings.
  * You can have multiple combinations of host and rejection reasons.
- * They are used in pairs of one host/rejection reason, or multiple hosts/rejection reason.
+ * They are used in pairs of one host/rejection reason.
  *
  * These settings should be adequate for most networks, and are (presently)
  * required for use on AthemeNet.
@@ -692,17 +947,23 @@ serverhide {
  *   ${nick}         - the user's nickname
  *   ${network-name} - the name of the network
  *
- * Note: AHBL (the providers of the below BLs) request that they be
+ * Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be
  * contacted, via email, at admins@2mbit.com before using these BLs.
  * See <http://www.ahbl.org/services.php> for more information.
  */
-#blacklist {
+blacklist {
+	host = "rbl.efnetrbl.org";
+	reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}";
+	
+	host = "dnsbl.dronebl.org";
+	reject_reason = "${nick}, your IP (${ip}) is listed in DroneBL. For assistance, see http://dronebl.org/lookup_branded.do?ip=${ip}&network=${network-name}";
+
 #	host = "ircbl.ahbl.org";
 #	reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for having an open proxy. In order to protect ${network-name} from abuse, we are not allowing connections with open proxies to connect.";
 #
 #	host = "tor.ahbl.org";
 #	reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
-#};
+};
 
 /*
  * Alias blocks allow you to define custom commands. (Old m_sshortcut.c)
@@ -732,6 +993,22 @@ alias "MemoServ" {
 	target = "MemoServ";
 };
 
+alias "HostServ" {
+	target = "HostServ";
+};
+
+alias "BotServ" {
+	target = "BotServ";
+};
+
+alias "InfoServ" {
+	target = "InfoServ";
+};
+
+alias "GroupServ" {
+	target = "GroupServ";
+};
+
 alias "NS" {
 	target = "NickServ";
 };
@@ -748,16 +1025,34 @@ alias "MS" {
 	target = "MemoServ";
 };
 
+alias "HS" {
+	target = "HostServ";
+};
+
+alias "BS" {
+	target = "BotServ";
+};
+
+alias "IS" {
+	target = "InfoServ";
+};
+
+alias "GS" {
+	target = "GroupServ";
+};
+
 /* The general block contains many of the options that were once compiled
  * in options in config.h.  The general block is read at start time.
  */
 general {
 	/* hide error messages: defines whether error messages from
-	 * servers are hidden or not.  These can sometimes contain IPs and
-	 * can have an adverse effect on server ip hiding.  Set to:
+	 * servers that are not deemed fully safe are hidden or not.
+	 * These can sometimes contain IPs and can have an adverse
+	 * effect on server ip hiding.  Set to:
 	 *   yes:   hide from opers and admin
 	 *   opers: hide from opers only
 	 *   no:    do not hide error messages
+	 * Admins on other servers count as opers.
 	 */
 	hide_error_messages = opers;
 
@@ -772,10 +1067,10 @@ general {
 
 	/* default umodes: umodes to set upon connection
 	 * If you have enabled the ip_cloaking extension, and you wish for
-	 * incoming clients to be set +h upon connection, add +h to the umode
-	 * string below.
+	 * incoming clients to be cloaked upon connection, +x must be in
+	 * the umode string below.
 	 */
-	default_umodes = "+i";
+	default_umodes = "+ix";
 
 	/* default operstring: defines the default oper response
 	 * in /whois queries, eg "is an IRC Operator".
@@ -789,6 +1084,18 @@ general {
 	 */
 	default_adminstring = "is a Server Administrator";
 
+	/* default operhost: defines the default virtual host that
+	 * operators will receiving upon opering up. Can be overriden
+	 * by the vhost option in individual operator blocks. This
+	 * must be a valid hostmask.
+	 */
+	default_operhost = "staff.testnet.net";
+
+	/* static quit: Quit message to display for all users (not opers)
+	 * on QUIT.
+	 */
+	#static_quit = "I like turtles!";
+
 	/* servicestring: defines the response for opered services (+S)
 	 * in /whois queries, eg "is a Network Service".
 	 * This is updated on rehash.
@@ -801,6 +1108,12 @@ general {
 	 */
 	disable_fake_channels = no;
 
+	/* hide_channel_below_users: Amount of users a channel must have in it
+	 * before it is shown in a standard LIST. This can be overridden by
+	 * invoking LIST like: /LIST <3
+	 */
+	hide_channel_below_users = 3;
+
         /* tkline_expire_notices: give a notice to opers when a tkline
          * expires
          */
@@ -822,12 +1135,6 @@ general {
 	 */
 	dots_in_ident=2;
 
-	/* dot in ipv6: ircd-hybrid-6.0 and earlier will disallow hosts 
-	 * without a '.' in them.  this will add one to the end.  only needed
-	 * for older servers.
-	 */
-        dot_in_ip6_addr = no;
-        
         /* min nonwildcard: the minimum non wildcard characters in k/d/g lines
 	 * placed via the server.  klines hand placed are exempt from limits.
 	 * wildcard chars: '.' '*' '?' '@'
@@ -840,7 +1147,7 @@ general {
 	 */
 	min_nonwildcard_simple = 3;
 
-        /* max accept: maximum allowed /accept's for +g usermode */
+        /* max accept: maximum allowed /accept's for +gGR usermodes */
         max_accept = 20;
 
 	/* max monitor: the maximum amount of nicknames a client may have in
@@ -855,10 +1162,16 @@ general {
 	max_nick_time = 20 seconds;
 	max_nick_changes = 5;
 
-        /* anti spam time: the minimum time a user must be connected before
+	/* anti spam time: the minimum time a user must be connected before
 	 * custom quit messages are allowed.
 	 */
-        anti_spam_exit_message_time = 5 minutes;
+	anti_spam_exit_message_time = 5 minutes;
+
+	/* use part messages: This option controls whether users should be
+	 * allowed to send PART messages to channels. It should probably
+	 * be set to no if static_quit is set.
+	 */
+	use_part_messages = yes;
 
 	/* ts delta: the time delta allowed between server clocks before
 	 * a warning is given, or before the link is dropped.  all servers
@@ -895,7 +1208,7 @@ general {
 	 */
 	kline_delay = 0 seconds;
 
-	/* kline reason: show the user the reason why they are k/d/glined 
+	/* kline reason: show the user the reason why they are k/dlined 
 	 * on exit.  may give away who set k/dline when set via tcm.
 	 */
 	kline_with_reason = yes;
@@ -903,7 +1216,7 @@ general {
 	/* kline reason: make the users quit message on channels this
 	 * reason instead of the oper's reason.
 	 */
-	kline_reason = "Connection closed";
+	kline_reason = "K-Lined";
 
 	/* identify to services via server password
 	 * if auth{} block had no password but the user specified a
@@ -922,6 +1235,13 @@ general {
 	 */
 	warn_no_nline = yes;
 
+	/* use propagated bans: KLINE, XLINE and RESV set fully propagated bans.
+	 * That means the bans are part of the netburst and restarted/split
+	 * servers will get them, but they will not apply to 3.2 and older
+	 * servers at all.
+	 */
+	use_propagated_bans = yes;
+
 	/* stats e disabled: disable stats e.  useful if server ips are
 	 * exempted and you dont want them listing on irc.
 	 */
@@ -971,6 +1291,12 @@ general {
 	 * protected. */
 	operspy_dont_care_user_info = no;
 
+	/* secret channels in whois: display secret channels in /whois
+	 * even if operspy was not used, as long as the oper doing the
+	 * whois has the oper:spy priv. this will not send any kind of
+	 * server notice. */
+	secret_channels_in_whois = no;
+
 	/* caller id wait: time between notifying a +g user that somebody
 	 * is messaging them.
 	 */
@@ -1001,27 +1327,28 @@ general {
 	 */
 	connect_timeout = 30 seconds;
 
+	/* ident timeout: Amount of time (in seconds) that the IRCd will
+	 * wait for a user to respond to an ident request.
+	 */
+	default_ident_timeout = 5;
+
 	/* disable auth: disables identd checking */
 	disable_auth = no;
 
-	/* no oper flood: increase flood limits for opers. */
-	no_oper_flood = yes;
-
-	/* glines: enable glines, network wide temp klines */
-	glines = no;
-
-	/* gline time: the amount of time a gline will remain before expiring */
-	gline_time = 1 day;
-
-	/* gline_min_cidr: If using a CIDR gline, the minimum length the
-	 * mask must be
+	/* no oper flood: increase flood limits for opers.
+	 * This option quadruples the user command flood limits, it
+	 * DOES NOT affect PRIVMSG/NOTICE usage.
 	 */
-	gline_min_cidr = 16;
+	no_oper_flood = yes;
 
-	/* idletime: the maximum amount of time a user may idle before
-	 * they are disconnected
+	/* true no oper flood: Allow opers to NEVER hit flood limits.
+	 * With the above setting, flood limits are set to 4x what they
+	 * are for normal users. With this setting, they're removed entirely.
+	 * For this setting to work, you need to have no_oper_flood enabled as well.
+	 * This option DOES allow PRIVMSG/NOTICE flooding.
+	 * ENABLE THIS SETTING WITH CAUTION.
 	 */
-        idletime = 0;
+	true_no_oper_flood = no;
 
 	/* REMOVE ME.  The following line checks you've been reading. */
 	havent_read_conf = yes;
@@ -1053,6 +1380,11 @@ general {
 	 * +s - servnotice - See server notices
 	 * +w - wallop     - See oper and server generated WALLOPS
 	 * +z - operwall   - See operwalls
+	 * +C - noctcp     - Block CTCPs to user.
+	 * +V - noinvite   - Block INVITE to user.
+	 * +B - bot        - Marks as a bot.
+	 * +p - override   - Implicit operator access in all channels.
+	 *                   This is oper-only and requires the oper:override priv.
 	 */
 	 
 	/* oper only umodes: usermodes only opers may set */
@@ -1065,13 +1397,6 @@ general {
 	 * provided they have umode +s set */
 	oper_snomask = "+s";
 
-	/* servlink path: path to 'servlink' program used by ircd to handle
-	 * encrypted/compressed server <-> server links.
-	 *
-	 * only define if servlink is not in same directory as ircd itself.
-	 */
-	#servlink_path = "/usr/local/ircd/bin/servlink";
-
 	/* use egd: if your system does not have *random devices yet you
 	 * want to use OpenSSL and encrypted links, enable this.  Beware -
 	 * EGD is *very* CPU intensive when gathering data for its pool
@@ -1117,6 +1442,20 @@ general {
 
 	/* reject duration: the amount of time to cache the rejection */
 	reject_duration = 5 minutes;
+
+	/* throttle_duration: Amount of time that throttling will be applied to an IP
+	 * address.
+	 */
+	throttle_duration = 60;
+
+	/* throttle_count: Number of connections within throttle_duration that it takes
+	 * for throttling to take effect */
+	throttle_count = 4;
+
+	/* expire_override_time: User mode +p will be automatically unset
+	 * this long after it is set. 0 disables this. Default is 5 minutes.
+	 */
+	expire_override_time = 5 minutes;
 };
 
 modules {