[solanum.git] / doc / oper-guide / oprivs.rst

Oper privileges
===============

These are specified in privset{}.

oper:admin, server administrator
--------------------------------

Various privileges intended for server administrators. Among other
things, this automatically sets umode +a and allows loading modules.

oper:die, die and restart
-------------------------

This grants permission to use ``DIE`` and ``RESTART``, shutting down or
restarting the server.

oper:global\_kill, global kill
------------------------------

Allows using ``KILL`` on users on any server.

oper:hidden, hide from /stats p
-------------------------------

This privilege currently does nothing, but was designed to hide bots
from /stats p so users will not message them for help.

oper:hidden\_admin, hidden administrator
----------------------------------------

This grants everything granted to the oper:admin privilege, except the
ability to set umode +a. If both oper:admin and oper:hidden\_admin are
possessed, umode +a can still not be used.

oper:kline, kline and dline
---------------------------

Allows using ``KLINE`` and ``DLINE``, to ban users by user@host mask or IP
address.

oper:local\_kill, kill local users
----------------------------------

This grants permission to use ``KILL`` on users on the same server,
disconnecting them from the network.

oper:mass\_notice, global notices and wallops
---------------------------------------------

Allows using server name ($$mask) and hostname ($#mask) masks in ``NOTICE``
and ``PRIVMSG`` to send a message to all matching users, and allows using
the ``WALLOPS`` command to send a message to all users with umode +w set.

oper:operwall, send/receive operwall
------------------------------------

Allows using the ``OPERWALL`` command and umode +z to send and receive
operwalls.

oper:rehash, rehash
-------------------

Allows using the ``REHASH`` command, to rehash various configuration files
or clear certain lists.

oper:remoteban, set remote bans
-------------------------------

This grants the ability to use the ON argument on ``DLINE``/``KLINE``/``XLINE``/``RESV``
and ``UNDLINE``/``UNKLINE``/``UNXLINE``/``UNRESV`` to set and unset bans on other
servers, and the server argument on ``REHASH``. This is only allowed if the
oper may perform the action locally, and if the remote server has a
shared{} block.

.. note:: If a cluster{} block is present, bans are sent remotely even
          if the oper does not have oper:remoteban privilege.

oper:resv, channel control
--------------------------

This allows using /resv, /unresv and changing the channel modes +L and
+P.

oper:routing, remote routing
----------------------------

This allows using the third argument of the ``CONNECT`` command, to instruct
another server to connect somewhere, and using ``SQUIT`` with an argument
that is not locally connected. (In both cases all opers with +w set will
be notified.)

oper:spy, use operspy
---------------------

This allows using ``/mode !#channel``, ``/whois !nick``, ``/who !#channel``,
``/chantrace !#channel``, ``/topic !#channel``, ``/who !mask``, ``/masktrace
!user@host :gecos`` and ``/scan umodes +modes-modes global list`` to see
through secret channels, invisible users, etc.

All operspy usage is broadcasted to opers with snomask ``+Z`` set (on the
entire network) and optionally logged. If you grant this to anyone, it
is a good idea to establish concrete policies describing what it is to
be used for, and what not.

If ``operspy_dont_care_user_info`` is enabled, ``/who mask`` is operspy
also, and ``/who !mask``, ``/who mask``, ``/masktrace !user@host :gecos`` and ``/scan
umodes +modes-modes global list`` do not generate ``+Z`` notices or logs.

oper:unkline, unkline and undline
---------------------------------

Allows using ``UNKLINE`` and ``UNDLINE``.

oper:xline, xline and unxline
-----------------------------

Allows using ``XLINE`` and ``UNXLINE``, to ban/unban users by realname.

snomask:nick\_changes, see nick changes
---------------------------------------

Allows using snomask ``+n`` to see local client nick changes. This is
designed for monitor bots.
Commit	Line	Data
2ae078d8 AB	1	Oper privileges
	2	===============
	3
2ae078d8 AB	4	These are specified in privset{}.
	5
	6	oper:admin, server administrator
	7	--------------------------------
	8
	9	Various privileges intended for server administrators. Among other
	10	things, this automatically sets umode +a and allows loading modules.
	11
	12	oper:die, die and restart
	13	-------------------------
	14
90a29f9a	15	This grants permission to use ``DIE`` and ``RESTART``, shutting down or
2ae078d8 AB	16	restarting the server.
	17
	18	oper:global\_kill, global kill
	19	------------------------------
	20
90a29f9a	21	Allows using ``KILL`` on users on any server.
2ae078d8 AB	22
	23	oper:hidden, hide from /stats p
	24	-------------------------------
	25
	26	This privilege currently does nothing, but was designed to hide bots
	27	from /stats p so users will not message them for help.
	28
	29	oper:hidden\_admin, hidden administrator
	30	----------------------------------------
	31
	32	This grants everything granted to the oper:admin privilege, except the
	33	ability to set umode +a. If both oper:admin and oper:hidden\_admin are
	34	possessed, umode +a can still not be used.
	35
	36	oper:kline, kline and dline
	37	---------------------------
	38
90a29f9a	39	Allows using ``KLINE`` and ``DLINE``, to ban users by user@host mask or IP
2ae078d8 AB	40	address.
	41
	42	oper:local\_kill, kill local users
	43	----------------------------------
	44
90a29f9a	45	This grants permission to use ``KILL`` on users on the same server,
2ae078d8 AB	46	disconnecting them from the network.
	47
	48	oper:mass\_notice, global notices and wallops
	49	---------------------------------------------
	50
90a29f9a AB	51	Allows using server name ($$mask) and hostname ($#mask) masks in ``NOTICE``
	52	and ``PRIVMSG`` to send a message to all matching users, and allows using
	53	the ``WALLOPS`` command to send a message to all users with umode +w set.
2ae078d8 AB	54
	55	oper:operwall, send/receive operwall
	56	------------------------------------
	57
90a29f9a	58	Allows using the ``OPERWALL`` command and umode +z to send and receive
2ae078d8 AB	59	operwalls.
	60
	61	oper:rehash, rehash
	62	-------------------
	63
90a29f9a	64	Allows using the ``REHASH`` command, to rehash various configuration files
2ae078d8 AB	65	or clear certain lists.
	66
	67	oper:remoteban, set remote bans
	68	-------------------------------
	69
90a29f9a AB	70	This grants the ability to use the ON argument on ``DLINE``/``KLINE``/``XLINE``/``RESV``
	71	and ``UNDLINE``/``UNKLINE``/``UNXLINE``/``UNRESV`` to set and unset bans on other
	72	servers, and the server argument on ``REHASH``. This is only allowed if the
2ae078d8 AB	73	oper may perform the action locally, and if the remote server has a
	74	shared{} block.
	75
4245facd AB	76	.. note:: If a cluster{} block is present, bans are sent remotely even
4245facd AB	77	if the oper does not have oper:remoteban privilege.
2ae078d8 AB	78
	79	oper:resv, channel control
	80	--------------------------
	81
	82	This allows using /resv, /unresv and changing the channel modes +L and
	83	+P.
	84
	85	oper:routing, remote routing
	86	----------------------------
	87
90a29f9a AB	88	This allows using the third argument of the ``CONNECT`` command, to instruct
90a29f9a AB	89	another server to connect somewhere, and using ``SQUIT`` with an argument
2ae078d8 AB	90	that is not locally connected. (In both cases all opers with +w set will
	91	be notified.)
	92
	93	oper:spy, use operspy
	94	---------------------
	95
90a29f9a AB	96	This allows using ``/mode !#channel``, ``/whois !nick``, ``/who !#channel``,
	97	``/chantrace !#channel``, ``/topic !#channel``, ``/who !mask``, ``/masktrace
	98	!user@host :gecos`` and ``/scan umodes +modes-modes global list`` to see
2ae078d8 AB	99	through secret channels, invisible users, etc.
2ae078d8 AB	100
90a29f9a	101	All operspy usage is broadcasted to opers with snomask ``+Z`` set (on the
2ae078d8 AB	102	entire network) and optionally logged. If you grant this to anyone, it
	103	is a good idea to establish concrete policies describing what it is to
	104	be used for, and what not.
	105
90a29f9a AB	106	If ``operspy_dont_care_user_info`` is enabled, ``/who mask`` is operspy
	107	also, and ``/who !mask``, ``/who mask``, ``/masktrace !user@host :gecos`` and ``/scan
	108	umodes +modes-modes global list`` do not generate ``+Z`` notices or logs.
2ae078d8 AB	109
	110	oper:unkline, unkline and undline
	111	---------------------------------
	112
90a29f9a	113	Allows using ``UNKLINE`` and ``UNDLINE``.
2ae078d8 AB	114
	115	oper:xline, xline and unxline
	116	-----------------------------
	117
90a29f9a	118	Allows using ``XLINE`` and ``UNXLINE``, to ban/unban users by realname.
2ae078d8 AB	119
	120	snomask:nick\_changes, see nick changes
	121	---------------------------------------
	122
90a29f9a	123	Allows using snomask ``+n`` to see local client nick changes. This is
2ae078d8	124	designed for monitor bots.