X-Git-Url: https://jfr.im/git/irc/rqf/shadowircd.git/blobdiff_plain/d5a432fa0092f39dbb517b5665f35dc87e5a88f7..1434082803efc1c59376156bfd2db4827a34ca5b:/doc/reference.conf diff --git a/doc/reference.conf b/doc/reference.conf index eb742e8..fe082d7 100755 --- a/doc/reference.conf +++ b/doc/reference.conf @@ -1,4 +1,4 @@ -/* doc/reference.conf - charybdis Example configuration file +/* doc/reference.conf - shadowircd Example configuration file * * Copyright (C) 2000-2002 Hybrid Development Team * Copyright (C) 2002-2005 ircd-ratbox development team @@ -18,6 +18,9 @@ * that matches a user will be used. So place spoofs first, then specials, * then general access, then restricted. * + * privset {} blocks MUST be specified before anything that uses them. That + * means they must be defined before operator {}. + * * Both shell style (#) and C style comments are supported. * * Files may be included by either: @@ -38,9 +41,13 @@ /* Extensions: * - * Charybdis contains several extensions that are not enabled by default. - * To use them, uncomment the lines below. + * ShadowIRCd contains several extensions that are not enabled by default. + * To use them, uncomment the lines below. More information on each extension + * can be found in extensions/README * + * Channel mode +-A (admin only) -- chm_adminonly.so + * Channel mode +-O (oper only) -- chm_operonly.so + * Channel mode +-S (ssl only) -- chm_sslonly.so * Emulates channel mode +-O (oper only) (+-iI $o) -- chm_operonly_compat.so * Emulates channel mode +-R (quiet unreg) (+-q $~a) -- chm_quietunreg_compat.so * Emulates channel mode +-S (ssl only) (+-b $~z) -- chm_sslonly_compat.so @@ -54,36 +61,60 @@ * Server bans (+b $s:mask) -- extb_server.so * SSL bans (+b $z) -- extb_ssl.so * HURT system -- hurt.so - * Host mangling (umode +h) -- ip_cloaking.so + * New host mangling (umode +x) -- ip_cloaking.so * Find channel forwards -- m_findforwards.so * /identify support -- m_identify.so + * /mkpassword support -- m_mkpasswd.so + * WEBIRC support -- m_webirc.so + * Server-side /CYCLE -- m_cycle.so + * /oaccept - add to target's accept list, oper only -- m_oaccept.so + * /opme - op self in opless channels, admin only -- m_opme.so + * /ojoin - join despite restrictions, admin only -- m_ojoin.so + * /omode - force modes in channels, admin only -- m_omode.so + * /olist - see all channels in /list, oper only -- m_olist.so + * /okick - kick users without having ops, oper only -- m_okick.so + * /forcejoin - force join users, admin only -- m_force.so * Opers cannot be invisible (umode +i) -- no_oper_invis.so * Far connection notices (snomask +F) -- sno_farconnect.so - * Remote k/d/g/x line active notices -- sno_globalkline.so + * Remote k/d/x line active notices -- sno_globalkline.so * Remote oper up notices -- sno_globaloper.so * /whois notifications (snomask +W) -- sno_whois.so */ +#loadmodule "extensions/chm_adminonly.so"; +loadmodule "extensions/chm_operonly.so"; +#loadmodule "extensions/chm_sslonly.so"; #loadmodule "extensions/chm_operonly_compat.so"; #loadmodule "extensions/chm_quietunreg_compat.so"; #loadmodule "extensions/chm_sslonly_compat.so"; #loadmodule "extensions/createauthonly.so"; -#loadmodule "extensions/extb_account.so"; -#loadmodule "extensions/extb_canjoin.so"; -#loadmodule "extensions/extb_channel.so"; -#loadmodule "extensions/extb_extgecos.so"; -#loadmodule "extensions/extb_oper.so"; -#loadmodule "extensions/extb_realname.so"; +loadmodule "extensions/extb_account.so"; +loadmodule "extensions/extb_canjoin.so"; +loadmodule "extensions/extb_channel.so"; +loadmodule "extensions/extb_extgecos.so"; +loadmodule "extensions/extb_oper.so"; +loadmodule "extensions/extb_realname.so"; #loadmodule "extensions/extb_server.so"; #loadmodule "extensions/extb_ssl.so"; #loadmodule "extensions/hurt.so"; -#loadmodule "extensions/ip_cloaking.so"; +loadmodule "extensions/ip_cloaking.so"; #loadmodule "extensions/m_findforwards.so"; -#loadmodule "extensions/m_identify.so"; +loadmodule "extensions/m_identify.so"; +loadmodule "extensions/m_mkpasswd.so"; +loadmodule "extensions/m_webirc.so"; +#loadmodule "extensions/m_cycle.so"; +#loadmodule "extensions/m_oaccept.so"; +#loadmodule "extensions/m_opme.so"; +#loadmodule "extensions/m_ojoin.so"; +#loadmodule "extensions/m_omode.so"; +#loadmodule "extensions/m_olist.so"; +#loadmodule "extensions/m_okick.so"; +#loadmodule "extensions/m_force.so"; #loadmodule "extensions/no_oper_invis.so"; -#loadmodule "extensions/sno_farconnect.so"; -#loadmodule "extensions/sno_globalkline.so"; -#loadmodule "extensions/sno_globaloper.so"; +loadmodule "extensions/sno_farconnect.so"; +loadmodule "extensions/sno_globalkline.so"; +loadmodule "extensions/sno_globaloper.so"; #loadmodule "extensions/sno_whois.so"; + /* serverinfo {}: Contains information about the server. (OLD M:) */ serverinfo { @@ -101,7 +132,7 @@ serverinfo { /* description: the description of our server. '[' and ']' may not * be used here for compatibility with older servers. */ - description = "charybdis test server"; + description = "shadowircd test server"; /* network info: the name and description of the network this server * is on. Shown in the 005 reply and used with serverhiding. @@ -109,6 +140,14 @@ serverinfo { network_name = "MyNet"; network_desc = "This is My Network"; + /* helpchan/helpurl: These 2 items are shown when a user does + * /quote help with no additional parameters to direct them + * to a channel/URL where they can get more or network-specific help. + * They can be commented out and will not show to users if they are. + */ + helpchan = "#help"; + helpurl = "http://www.mynet.net/help"; + /* hub: allow this server to act as a hub and have multiple servers * connected to it. */ @@ -133,8 +172,11 @@ serverinfo { /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */ ssl_dh_params = "etc/dh.pem"; - /* ssld_count: number of ssld processes you want to start, if you have a really busy - * server, using N-1 where N is the number of cpu/cpu cores you have might be useful + /* ssld_count: number of ssld processes you want to start, if you + * have a really busy server, using N-1 where N is the number of + * cpu/cpu cores you have might be useful. A number greater than one + * can also be useful in case of bugs in ssld and because ssld needs + * two file descriptors per SSL connection. */ ssld_count = 1; @@ -204,19 +246,19 @@ class "users" { */ number_per_ip_global = 5; - /* cidr_bitlen: Limits numbers of connections from a subnet size + /* cidr_ipv4_bitlen: Limits numbers of connections from a subnet size + */ + cidr_ipv4_bitlen = 24; + + /* cidr_ipv6_bitlen: Limits numbers of connections from a subnet size * the following example makes the subnet /64 this is useful * for IPv6 connections in particular - * Also note that the way charybdis is written if you have - * compiled support for IPv6, IPv4 cidr bitlens need to be modified - * Basically to get the approriate length add 96 to the IPv4 length - * For example for a /24 do 96+24 = 120 - * */ - cidr_bitlen = 64; + cidr_ipv6_bitlen = 64; /* number_per_cidr: Number of connections to allow from a subnet of the - * size given in cidr_bitlen. 4 seems to be a good default to me. + * size given in cidr_ipv4_bitlen/cidr_ipv6_bitlen. + * 4 seems to be a good default to me. */ number_per_cidr = 4; @@ -310,6 +352,17 @@ auth { */ spoof = "I.still.hate.packets"; + /* autojoin: Channel (or channels, comma-seperated) to join users + * in this auth block to on connect. Note that this won't join + * the user through any bans or otherwise restrictive chmodes. + */ + autojoin = "#shadowircd,#test"; + + /* autojoin_opers : Channel (or channels, comma-seperated) to join + * opers to on oper-up. + */ + autojoin_opers = "#opers,#help"; + /* Possible flags in auth: * * encrypted | password is encrypted with mkpasswd @@ -326,6 +379,7 @@ auth { * USE WITH CAUTION. * no_tilde (old - flag) | don't prefix ~ to username if no ident * need_ident (old + flag) | require ident for user in this class + * need_ssl | require SSL/TLS for user in this class * need_sasl | require SASL id for user in this class */ flags = kline_exempt, exceed_limit; @@ -334,6 +388,24 @@ auth { class = "opers"; }; +/* Example WEBIRC authblock */ +auth { + /* user: webirc@IP.OF.YOUR.WEBIRC . the webirc@ part is required */ + user = "webirc@192.168.1.1"; + + /* password: password the webirc client sends in the WEBIRC command. + * You can use a encrypted password here (see above auth block). + */ + password = ""; + + /* spoof: This is required to keep it what it is currently if you + * want the webirc client to show the users' real host as their + * host on IRC. + */ + spoof = "webirc."; + class = "users"; +}; + auth { /* redirect: the server and port to redirect a user to. A user does * not have to obey the redirection, the ircd just suggests to them @@ -355,10 +427,60 @@ auth { flags = need_ident; }; -/* operator {}: defines ircd operators. (OLD O:) - * charybdis no longer supports local operators, privileges are - * controlled via flags. - */ +/* privset{}: defines operator privilege sets. */ +privset "local_op" { + /* privs: controls the activities and commands an oper is + * allowed to do on the server + * + * Available options: + * + * oper:local_kill: allows local users to be /KILL'd + * oper:global_kill: allows local and remote users to be /KILL'd + * oper:routing: allows remote SQUIT and CONNECT + * oper:kline: allows KLINE and DLINE + * oper:unkline: allows UNKLINE and UNDLINE + * snomask:nick_changes: allows oper to see nickchanges via snomask +n + * oper:rehash: allows oper to REHASH config + * oper:die: allows DIE and RESTART + * oper:admin: gives admin privileges. admins + * may (un)load modules and see various + * additional information. + * oper:hidden_admin: gives admin privileges except + * will not have the admin lines in + * whois. + * oper:xline: allows use of /quote xline/unxline + * oper:resv: allows /quote resv/unresv and cmode +LP + * oper:operwall: allows the oper to send/receive operwalls + * oper:override: allows the oper to set umode +p on themself + which grants the ability to have implicit + operator access in all channels. + * oper:spy: allows 'operspy' features to see through +s + * channels etc. see /quote help operspy + * oper:hidden: hides the oper from /stats p + * oper:remoteban: allows remote kline etc + * oper:mass_notice: allows sending wallops and mass notices + */ + privs = oper:local_kill, oper:operwall; +}; + +privset "server_bot" { + /* extends: a privset to inherit in this privset */ + extends = "local_op"; + privs = oper:kline, oper:remoteban, snomask:nick_changes; +}; + +privset "global_op" { + extends = "local_op"; + privs = oper:global_kill, oper:routing, oper:kline, oper:unkline, oper:xline, + oper:resv, oper:mass_notice, oper:remoteban; +}; + +privset "admin" { + extends = "global_op"; + privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:override; +}; + +/* operator {}: defines ircd operators. (OLD O:) */ operator "god" { /* name: the name of the oper must go above */ @@ -381,6 +503,12 @@ operator "god" { */ #rsa_public_key_file = "/usr/local/ircd/etc/oper.pub"; + /* fingerprint: if specified, the oper's client certificate + * fingerprint will be checked against the specified fingerprint + * below. + */ + #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b"; + /* umodes: the specific umodes this oper gets when they oper. * If this is specified an oper will not be given oper_umodes * These are described above oper_only_umodes in general {}; @@ -390,44 +518,39 @@ operator "god" { /* snomask: specific server notice mask on oper up. * If this is specified an oper will not be given oper_snomask. */ - snomask = "+Zbfkrsuy"; + snomask = "+FZbcfkrsuy"; + + /* vhost: defines the vhost that this oper will get on oper up. + * this must be a valid hostmask. If this is specified the oper + * will not be given default_operhost. + */ + vhost = "is.an.oper"; + + /* swhois: defines an additional line that will be displayed + * whenever someone does /whois on the oper in question. + */ + swhois = "is wearing pants."; - /* privileges: controls the activities and commands an oper is - * allowed to do on the server. You may prefix an option with ~ to - * disable it, ie ~operwall + /* operstring: defines a custom operstring for this oper, + * which will be shown in whois instead of default_operstring + * or default_adminstring. + */ + operstring = "is a lazy IRC Operator"; + + /* flags: misc options for the operator. You may prefix an option + * with ~ to disable it, e.g. ~encrypted. * - * Default flags are operwall, remoteban and encrypted. + * Default flags are encrypted. * * Available options: * * encrypted: the password above is encrypted [DEFAULT] - * local_kill: allows local users to be /KILL'd - * global_kill: allows local and remote users to be - * /KILL'd (OLD 'O' flag) - * remote: allows remote SQUIT and CONNECT (OLD 'R' flag) - * kline: allows KLINE and DLINE (OLD 'K' flag) - * unkline: allows UNKLINE and UNDLINE (OLD 'U' flag) - * nick_changes: allows oper to see nickchanges (OLD 'N' flag) - * via snomask +n - * rehash: allows oper to REHASH config (OLD 'H' flag) - * die: allows DIE and RESTART (OLD 'D' flag) - * admin: gives admin privileges. admins - * may (un)load modules and see the - * real IPs of servers. - * hidden_admin: gives admin privileges except - * will not have the admin lines in - * stats p and whois. - * xline: allows use of /quote xline/unxline - * resv: allows /quote resv/unresv and cmode +LP [DEFAULT] - * operwall: allows the oper to send/receive operwalls [DEFAULT] - * oper_spy: allows 'operspy' features to see through +s - * channels etc. see /quote help operspy - * hidden_oper: hides the oper from /stats p (OLD UMODE +p) - * remoteban: allows remote kline etc [DEFAULT] - * mass_notice: allows sending wallops and mass notices [DEFAULT] + * need_ssl: must be using SSL/TLS to oper up */ - flags = global_kill, remote, kline, unkline, - die, rehash, admin, xline, operwall; + flags = encrypted; + + /* privset: privileges set to grant */ + privset = "admin"; }; /* connect {}: controls servers we connect to (OLD C:, N:, H:, L:) */ @@ -577,9 +700,14 @@ shared { * resv - allow setting perm/temp resvs * tresv - allow setting temp resvs * unresv - allow removing xlines + * rehash - allow rehashing * all - allow oper/server to do all of above. * locops - allow locops - only used for servers who cluster - * rehash - allow rehashing + * die - allow restarting/dying of servers + * modules - allow loading/unloading/reloading of modules + * dline - allow setting perm/temp dlines + * tdline - allow setting temp dlines + * undline - allow removing dlines * none - disallow everything */ @@ -612,18 +740,58 @@ exempt { /* The channel block contains options pertaining to channels */ channel { + /* autochanmodes: Modes that will be set on a unregistered channel + * when the first user joins it. + */ + autochanmodes = "nt"; + + /* exemptchanops: Channel modes that any form of channel ops (+aoh) + * will be exempt from. Even if the mode is set, it will not apply to the + * channel ops if it is listed in this option. Valid modes are cCDTNGK. + */ + exemptchanops = "NT"; + + /* halfop: Enable/disable channel mode +h, which adds halfop, + * a channel status below op that has op powers (kick, ban, mode, etc.) + * halfops can only kick/devoice/etc people who are +v or + * do not have any channel status. Disabling this via rehash will + * cause things which are rather confusing to occur, it is highly + * recommended to restart if you wish to disable this option, though + * it may be enabled by rehash with no problems. + */ + use_halfop = yes; + + /* admin: Enable/disable channel mode +a, which adds admin, + * a channel status above op that has op powers (kick, ban, mode, etc.) + * admins can only be kicked/deadmined by other admins, and may kick + * or deop anyone. Disabling this via rehash will cause things which + * are rather confusing to occur, it is highly recommended to restart + * if you wish to disable this option, though it may be enabled + * by rehash with no problems. + */ + use_admin = yes; + /* invex: Enable/disable channel mode +I, a n!u@h list of masks - * that can join a +i channel without an invite. + * that can join a +i channel without an invite. Disabling this option + * via rehash will leave all previously set invexes hanging around, + * though they will not do anything. For this reason, you may want to + * restart to disable this option. */ use_invex = yes; /* except: Enable/disable channel mode +e, a n!u@h list of masks - * that can join a channel through a ban (+b). + * that can join a channel through a ban (+b). Disabling this option + * via rehash will leave all previously set excepts hanging around, + * though they will not do anything. For this reason, you may want to + * restart to disable this option. */ use_except = yes; - /* forward: Enable/disable channel mode +f, a channel to forward - * users to if they can't join because of +i etc. + /* forward: Enable/disable channel mode +f, which allows you to set + * a channel to forward users to if they can't join because of +i etc. + * Disabling this option via rehash will leave all previously set + * forwards hanging around, though they will not do anything. For + * this reason, you may want to restart to disable this option. */ use_forward = yes; @@ -633,6 +801,12 @@ channel { */ use_knock = yes; + /* local channels: &Channel - a channel that exists only on one server + * people on other servers will not be able to see or join local channels + * from another server. + */ + use_local_channels = yes; + /* knock delay: The amount of time a user must wait between issuing * the knock command. */ @@ -695,6 +869,34 @@ channel { * ratbox-services does. */ kick_on_split_riding = no; + + /* only ascii channels: disable local users joining channels + * containing characters outside the range 33-126 (non-printable + * or non-ASCII). + */ + only_ascii_channels = no; + + /* cycle_host_change: Should a user be cycled in the channels + * they're in when their host changes. If set to no, this may + * cause client desyncs. + */ + cycle_host_change = yes; + + /* host_in_topic: Defines whether or not the topicsetter's + * host is shown when users request the TOPIC. If this option + * is set to no, it will only show the nick of the topicsetter. + */ + host_in_topic = yes; + + /* resv_forcepart: force any local users to part a channel + * when a RESV is issued. + */ + resv_forcepart = yes; + + /* kick_no_rejoin_time: the amount of time that a user cannot + * rejoin for after being kicked out of a +J channel. + */ + kick_no_rejoin_time = 30 seconds; }; @@ -724,7 +926,7 @@ serverhide { /* These are the blacklist settings. * You can have multiple combinations of host and rejection reasons. - * They are used in pairs of one host/rejection reason, or multiple hosts/rejection reason. + * They are used in pairs of one host/rejection reason. * * These settings should be adequate for most networks, and are (presently) * required for use on AthemeNet. @@ -784,6 +986,14 @@ alias "MemoServ" { target = "MemoServ"; }; +alias "HostServ" { + target = "HostServ"; +}; + +alias "BotServ" { + target = "BotServ"; +}; + alias "NS" { target = "NickServ"; }; @@ -800,6 +1010,14 @@ alias "MS" { target = "MemoServ"; }; +alias "HS" { + target = "HostServ"; +}; + +alias "BS" { + target = "BotServ"; +}; + /* The general block contains many of the options that were once compiled * in options in config.h. The general block is read at start time. */ @@ -826,10 +1044,10 @@ general { /* default umodes: umodes to set upon connection * If you have enabled the ip_cloaking extension, and you wish for - * incoming clients to be set +h upon connection, add +h to the umode - * string below. + * incoming clients to be cloaked upon connection, +x must be in + * the umode string below. */ - default_umodes = "+i"; + default_umodes = "+ix"; /* default operstring: defines the default oper response * in /whois queries, eg "is an IRC Operator". @@ -843,6 +1061,18 @@ general { */ default_adminstring = "is a Server Administrator"; + /* default operhost: defines the default virtual host that + * operators will receiving upon opering up. Can be overriden + * by the vhost option in individual operator blocks. This + * must be a valid hostmask. + */ + default_operhost = "staff.testnet.net"; + + /* static quit: Quit message to display for all users (not opers) + * on QUIT. + */ + #static_quit = "I like turtles!"; + /* servicestring: defines the response for opered services (+S) * in /whois queries, eg "is a Network Service". * This is updated on rehash. @@ -888,7 +1118,7 @@ general { */ min_nonwildcard_simple = 3; - /* max accept: maximum allowed /accept's for +g usermode */ + /* max accept: maximum allowed /accept's for +gGR usermodes */ max_accept = 20; /* max monitor: the maximum amount of nicknames a client may have in @@ -903,10 +1133,16 @@ general { max_nick_time = 20 seconds; max_nick_changes = 5; - /* anti spam time: the minimum time a user must be connected before + /* anti spam time: the minimum time a user must be connected before * custom quit messages are allowed. */ - anti_spam_exit_message_time = 5 minutes; + anti_spam_exit_message_time = 5 minutes; + + /* use part messages: This option controls whether users should be + * allowed to send PART messages to channels. It should probably + * be set to no if static_quit is set. + */ + use_part_messages = yes; /* ts delta: the time delta allowed between server clocks before * a warning is given, or before the link is dropped. all servers @@ -951,7 +1187,7 @@ general { /* kline reason: make the users quit message on channels this * reason instead of the oper's reason. */ - kline_reason = "Connection closed"; + kline_reason = "K-Lined"; /* identify to services via server password * if auth{} block had no password but the user specified a @@ -970,6 +1206,13 @@ general { */ warn_no_nline = yes; + /* use propagated bans: KLINE, XLINE and RESV set fully propagated bans. + * That means the bans are part of the netburst and restarted/split + * servers will get them, but they will not apply to 3.2 and older + * servers at all. + */ + use_propagated_bans = yes; + /* stats e disabled: disable stats e. useful if server ips are * exempted and you dont want them listing on irc. */ @@ -1019,6 +1262,12 @@ general { * protected. */ operspy_dont_care_user_info = no; + /* secret channels in whois: display secret channels in /whois + * even if operspy was not used, as long as the oper doing the + * whois has the oper:spy priv. this will not send any kind of + * server notice. */ + secret_channels_in_whois = no; + /* caller id wait: time between notifying a +g user that somebody * is messaging them. */ @@ -1049,12 +1298,25 @@ general { */ connect_timeout = 30 seconds; + /* ident timeout: Amount of time (in seconds) that the IRCd will + * wait for a user to respond to an ident request. + */ + default_ident_timeout = 5; + /* disable auth: disables identd checking */ disable_auth = no; /* no oper flood: increase flood limits for opers. */ no_oper_flood = yes; + /* true no oper flood: Allow opers to NEVER hit flood limits. + * With the above setting, flood limits are set to 4x what they + * are for normal users. With this setting, they're removed entirely. + * For this setting to work, you need to have no_oper_flood enabled as well. + * ENABLE THIS SETTING WITH CAUTION. + */ + true_no_oper_flood = no; + /* REMOVE ME. The following line checks you've been reading. */ havent_read_conf = yes; @@ -1085,6 +1347,11 @@ general { * +s - servnotice - See server notices * +w - wallop - See oper and server generated WALLOPS * +z - operwall - See operwalls + * +C - noctcp - Block CTCPs to user. + * +V - noinvite - Block INVITE to user. + * +B - bot - Marks as a bot. + * +p - override - Implicit operator access in all channels. + * This is oper-only and requires the oper:override priv. */ /* oper only umodes: usermodes only opers may set */ @@ -1097,13 +1364,6 @@ general { * provided they have umode +s set */ oper_snomask = "+s"; - /* servlink path: path to 'servlink' program used by ircd to handle - * encrypted/compressed server <-> server links. - * - * only define if servlink is not in same directory as ircd itself. - */ - #servlink_path = "/usr/local/ircd/bin/servlink"; - /* use egd: if your system does not have *random devices yet you * want to use OpenSSL and encrypted links, enable this. Beware - * EGD is *very* CPU intensive when gathering data for its pool @@ -1150,10 +1410,19 @@ general { /* reject duration: the amount of time to cache the rejection */ reject_duration = 5 minutes; - /* max_unknown_ip: maximum number of pending connections to the server - * that are allowed per IP address + /* throttle_duration: Amount of time that throttling will be applied to an IP + * address. + */ + throttle_duration = 60; + + /* throttle_count: Number of connections within throttle_duration that it takes + * for throttling to take effect */ + throttle_count = 4; + + /* expire_override_time: User mode +p will be automatically unset + * this long after it is set. 0 disables this. Default is 5 minutes. */ - max_unknown_ip = 2; + expire_override_time = 5 minutes; }; modules {