iacd Administrator's Guide
Thomas Graf |
Contents
This document gives step by step instructions to install and run iacd
from an administrator's viewpoint.
Thanks to all who helped develop iacd with code or social support.
1.1 Disclaimer & License
This document is distributed WITHOUT ANY WARRANTY; without even the
implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
This document may be distributed only subject to the terms and conditions
set forth in the Open Publication License, v1.0 or later (the latest
version is presently available at http://www.opencontent.org/openpub/).
2.1 Requirements
The following requirements need to be fulfilled to successfully compile and install iacd:
-
make utility
- GNU C Compiler (gcc)
- POSIX complaint libc
- libcrypt
2.2 Supported Platforms
-
Linux i386 2.2/2.4
- SunOS sparc 5.8
I would be pleased if you drop me a line if you successfully compile
and run iacd on a platform not listed here.
2.3 Getting the Source Code
Download the latest stable version of iacd from http://trash.net/~reeler/iacd/.
I recommend to also download the .md5sum and .sig file besides the source tarball.
Check the MD5 sum, check if the source was not modified by a third party and finally
unpack the source:
$ md5sum -c iacd-<version>.tar.gz.md5sum
$ gpg --verify iacd-<version>.tar.gz.sig
gpg: Signature made <date> using DSA key ID 4E663A79
gpg: Good signature from "Thomas Graf <tgr@reeler.org>"
$ tar xzvf iacd-<version>.tar.gz
iacd-<version>/
iacd-<version>/doc/
...
$ cd iacd-<version>
2.4 Compile Time Options
All compile time options entail a recompliation before taking effect. Therefore
you need to restart the server after changing the settings. If you need to change
the same option over and over you can contact me and I'll make a configuration
option out of it.
The configure script is generated by autoconf and thus supports --prefix
and --sysconfdir etc. Besides that, table 2.1 contains
a list of all options recognized by the iacd configure script.
--enable-ipv6 |
Enables the IPv6 code. |
--disable-client-hacks |
Disables all the hacks needed to support
buggy clients like mIRC. |
--enable-debug |
Compiles iacd with debug symbols. |
--enable-static |
Enables static linking. |
--enable-scripts |
Enables script support (see XXX) |
Table 2.1: list of configure options
Table 2.2 lists the most important compile time options which
can be changed in config.h with your favourite text editor. Most of this options
define upper limits of values and are not implemented as configuration option
because of performance issues or more likely because I was too lazy.
MAX_SOCK_CONNECTS |
Max. sockets created, setrlimit(2) will be called if the value exceeds 1024 and thus needs root privileges |
MAX_CLONES |
Nr. of connections allowed from the same host |
MAX_CHANNELS |
Nr. of channels allowed on the server |
MAX_CHANNEL_JOINS |
Nr. of channels a user may have joined at the same time |
MAX_SERVER_CONNECTIONS |
Nr. of server connections |
MAX_MODE_CHANGES |
Length of mode change string per mode change |
MAX_WAITING |
Max. Nr. of clients connected but not registed yet (no NICK or USER sent) |
MAX_LASTLOG |
Size of lastlog1 list |
PROTECT_COMMAND |
Used to protect commands i.e. they need ircop to be executed |
AUTOAWWAY |
Enable server side autoway feature |
AUTOAWAY_DEFAULT |
Default auto away value before being marked as being away. |
AUTOAWAY_CHECK |
Interval to check for users that should be marked as away |
CMD_USAGE |
Make statistics about usage of each command |
COUNT_IDLETIME |
Calculate idle time for each user |
TLIST_MAX |
Max. topics to keep for each channel |
PING_TIMEOUT |
Time in seconds before a user gets killed because of ping timeout. |
Table 2.2: config.h Options
Table 2.3 contains a list of all text limits. I separated them
because each IRC network administrator has other ideas about maximum nickname etc.
MSGLEN |
Max. size of messages being sent out. |
PARSELEN |
All messages are cuted to this length before being parsed. |
NICKLEN |
Max. size of a nick. |
USERLEN |
Max. size of a username. |
IRCNAMELEN |
Max. size of a real name. |
QUITMSGLEN |
Max. size of a quit message. |
AWAYLEN |
Max. size of a away message. |
SERVERINFOLEN |
Max. size of the server info line. |
PINGLEN |
All PING sequences are shortened to this size. |
CHANNAMELEN |
Max. size of a channel name. |
TOPICLEN |
Max. size of a topic. |
SERV_OPTIONSLEN |
Max. size of server options. |
PASSWORDLEN |
Max. size of a password. |
Table 2.3: config.h Limits
2.5 Compiling
So, you finally finished to configure iacd and are ready to compile it.
$ make
This will compile and link iacd like you requested in the configure options.
You can recompile iacd anytime with:
$ make clean all
2.6 Installing
2.6.1 Normal Installation
The normal installation procedure will install iacd into the directory you specified
with --prefix (default is /usr/local). Run
$ make install
to install iacd. The default permissions allow everyone to start the server.
2.6.2 Chroot Installation
iacd has support to chroot() at runtime since version 0.0.23 and therefore no
special installation is required.
See chapter 2.6.1 for further instructions to install iacd.
- 1
- list containing nick!user@host of the last new connections
iacd can be configured through a configuration file which is read at start
time or if SIGHUP is received.
client_port |
is the port used to listen for new client connections. |
server_port |
is the port used to listen for new server connections. |
server_numeric |
must be unique in the network and is used to identify server nodes. |
server_info is |
a short description about the server shown in WHOIS replies. |
server_name |
overwrites gethostname().getdomainname() results. |
lastlog |
enables LASTLOG command. |
motd |
points to the motd file. |
interface |
is the interface iacd will listen on. |
timestamps |
Print timestamps per line in verbose output. |
Table 3.1: Configuration Identifiers
4.1 Arguments
Type iacd -h to get a list of all suported command line options.
$ iacd -h
-d run in background
-f <file> configuration file
-u <user> drop privs and change to this user
-g <group> drop privs and change to this group
-c <path> chroot() to this path
-v <level> verbose output
4.1.1 Daemon mode (-d)
The -d flag will fork iacd into the background and force all log messages to
be sent to syslog. You should use this flag instead of using the shell's builtin
job background control mechanism.
$ iacd -d
$
4.1.2 Configuration file path (-f)
Alternative path to configurtion file, default is SYSCONFDIR/iacd.conf where
SYSCONFDIR is the value you've given with –sysconfdir=.
$ iacd -f /d1/iacd/etc/iacd.conf
4.1.3 Privileges drop (-u -g)
iacd is able to drop it's privileges. The privileges drop is done after all actions
that require the superuser status are done (chroot, setrlimit). Here's a list of all
actions that are taken before the privileges drop:
-
data structure initialization
- command line option parsing
- daemon mode
- getting hostname/domainname
- installation of signal handleres
- setrlimit
- parsing of config file
- reading of motd file
- chroot
Privileges drop means changing uid/gid to a user/group which does only have
permissions required to run iacd.
$ iacd -u irc -g irc
Will run iacd with uid=irc gid=irc. In case of an exploitable overrun the
attacker only gets limited privileges on your system.
4.1.4 Chroot (-c)
Chroot is yet another way to reduce risc in case of an attack. It does change
root directory to another path after all file descriptors and libraries have
been loaded. This means you can REHASH your configuration placed outside the
chroot directory while iacd is running.
$ iacd -c /chroot/iacd/
Note: The chroot option is very useful but makes using scripts quite
difficult, because you have to copy the perl interpreter into the chroot
if you're using perl scripts etc.
4.1.5 Verbose output (-v)
Verbose output prints debug and other messages to stdout or syslog. Note that
iacd will not print any messages except error and warning messages if -v <level>
is not specified. See table 4.1 for a list of message levels.
1 |
Verbose messages |
2 |
Debug messages |
3 |
Raw I/O |
Table 4.1: Verbose message levels
Note: Most RAW I/O messages are protected with a #ifdef DEBUG to save a few
cpu cycles, this means you need to compile iacd with --enable-debug to get
this messages.
4.2 Administrator's interface
4.2.1 Stats Reports
/STATS returns information about the status of the irc server. See
table 4.2 for a list of available modes.
Example:
> stats u
-!- Server Up 4 days 13:58:13
-!- u End of STATS report.
Some of the stat reports required IRCOP privileges.
l |
list connected server links |
m |
command usage, nr of calls |
o |
list configured operator lines |
u |
uptime |
c |
list configured server links |
Table 4.2: stats modes
DUMP is an extensions not described in the RFCs but might be useful
to an administrator.
4.2.2.1 Dumping User Information
Syntax:
DUMP USER <nick>
Example:
> dump user reeler
!kirika Dumping user: reeler!tgr@kirika
!kirika Nick: reeler
!kirika User: tgr
!kirika Hostname: kirika
!kirika Ircname: Thomas Graf
!kirika IP: 127.0.0.1
!kirika Port: 33182
!kirika Hopcount: 0
!kirika Away Message: blah
!kirika Server: kirika
!kirika Server info: my irc server ;)
!kirika Quit message: none set
!kirika Signon: 1026652023 [Sun Jul 14 15:07:03 2002]
!kirika Idle: 1026652068 [9 seconds]
!kirika Flags: 4bf
!kirika - IAC_NICKSENT
!kirika - IAC_USERSENT
!kirika - IAC_OK
!kirika - IAC_LOCAL
!kirika - IAC_LOG
!kirika - IAC_PONG
!kirika - IAC_OPERATOR
!kirika - IAC_INVISIBLE
!kirika Joined channels:
!kirika - #42
4.2.2.2 Dumping Channel Information
Syntax:
DUMP CHANNEL <channel>
Example:
> dump channel #42
!kirika Dumping channel: #42
!kirika Flags (0):
!kirika Owner: reeler
!kirika Logfile: (NULL)
!kirika Topic 00: (none:0) none
!kirika Topic 01: (reeler:1026652379) this is a test topic
!kirika Topic 02: (reeler:1026652385) this is a newer topic
!kirika Topic 99: (reeler:1026652392) this is the newest topic
!kirika Topic 04: (none:0) none
!kirika Topic 05: (none:0) none
!kirika Topic 06: (none:0) none
!kirika Topic 07: (none:0) none
!kirika Topic 08: (none:0) none
!kirika Topic 09: (none:0) none
4.2.2.3 Dumping Server Information
Syntax:
DUMP SERVER <servername>
Example:
> dump server kirika
!kirika Dumping server: kirika
!kirika Info: my irc server ;)
!kirika Numeric: 1
!kirika Hopcount: 0
!kirika Flags: 0
4.2.2.4 Dumping Block Information
Syntax:
DUMP BLOCK <mask>
Example:
> dump block
!kirika Dumping block *!*@207.46*
!kirika Reason: Don't abuse the network
!kirika #Matches: 0
!kirika Next pointer: (NULL)
4.2.2.5 Dumping Link Information
Syntax:
DUMP LINK <remote host>
Example:
> dump link
!kirika Dumping link: 0
!kirika Host: localhost
!kirika Port: 7002
!kirika Password: secret
!kirika Options: m
!kirika Mask: *
!kirika Flags: 0
!kirika Next pointer: (NULL)
4.2.2.6 Dumping Script Information
Syntax:
> dump script mail
!kirika Dumping script mail
!kirika Nick: mail
!kirika Command: scripts/mail
!kirika Char Regex: -
!kirika Next Pointer: (nil)
4.2.2.7 Dumping Server Connection Information
Syntax:
DUMP SERVER_CONN <remote hostname>
Example:
> dump server_conn test2
!kirika Dumping server connection test2
!kirika Numeric: 2
!kirika Info: test server 2
!kirika IP: 127.0.0.1
!kirika Init time: Sun Jul 14 15:29:06 2002
!kirika Hopcount: 0
!kirika Ping (seconds): 0
!kirika Port: 7002
!kirika Socket: 6
!kirika Queue length: 0
!kirika Bytes sent: 238
!kirika Messages sent: 8
!kirika Bytes received: 127
!kirika Messages received: 5
!kirika Flags: b5
!kirika - IAC_PASSSENT
!kirika - IAC_OK
!kirika - IAC_MASTER
!kirika - IAC_PONG
!kirika - IAC_USEMSGID
!kirika Current message being sent:
4.2.3 Server Linking
iacd has it's own server linking interface for the administrator, the
way suggested by the RFC is also supported though.
4.2.3.1 List of Configured Links
> LINK
!kirika Host Port Mask Password A Flags
!kirika 127.0.0.1 7002 * secret 0 Disconnected
4.2.3.2 Adding Links
Syntax:
LINK ADD <autoconnect> <mask> <host> <port> <password> [<options>]
Example:
> LINK ADD 0 * 42.42.42.42 1337 leet m
!kirika Added 42.42.42.42:1337 (*) to link table
> LINK
!kirika Host Port Mask Password A Flags
!kirika 42.42.42.42 1337 * leet 0 Disconnected
!kirika 127.0.0.1 7002 * secret 0 Disconnected
4.2.3.3 Removing Links
Example:
> LINK REMOVE 42.42.42.42
!kirika Removed link entry 42.42.42.42
> LINK
!kirika Host Port Mask Password A Flags
!kirika 127.0.0.1 7002 * secret 0 Disconnected
4.2.3.4 Connecting
Example:
> LINK CONNECT 127.0.0.1
!kirika Now linked to 127.0.0.1:7002
!kirika New server connection (127.0.0.1:7002)
!kirika New server test2 (2) 127.0.0.1:7002 [test server 2]
> LINK
!kirika 127.0.0.1 7002 * secret 0 Connected, Master
Or if something goes wrong:
> LINK CONNECT 127.0.0.1
!kirika While linking to (127.0.0.1:7002): Could not connect to
server 127.0.0.1: Connection refused
> LINK
!kirika Host Port Mask Password A Flags
!kirika 127.0.0.1 7002 * secret 0 Disconnected,
Failed, Retry
iacd will retry to connect to the server.
4.2.3.5 Stop Retrying
Example:
> LINK
!kirika Host Port Mask Password A Flags
!kirika 127.0.0.1 7002 * secret 0 Disconnected,
Failed, Retry
> LINK STOP 127.0.0.1
!kirika Link 127.0.0.1 no longer being retried
> LINK
!kirika Host Port Mask Password A Flags
!kirika 127.0.0.1 7002 * secret 0 Disconnected, Failed
4.2.3.6 Closing a Server Link
Example:
> LINK
!kirika Host Port Mask Password A Flags
!kirika 127.0.0.1 7002 * secret 0 Connected, Master
> LINK CLOSE 127.0.0.1
!kirika Closing server link to test2
!kirika Lost server connection (127.0.0.1:7002)
4.3 Client Blocking
iacd has support to block clients from connecting to the server.
Syntax:
BLOCK [<mask> [<reason>]
mask is compared each time a user is connecting to the server, this is done
after nick and username has been sent. The string being compared has the format: nick!username@ip:port[realname]. If no mask is given all configured block lines are printed out. reason is the string sent to the user before
he gets disconnected, default value is "You are banned".
Example:
> BLOCK reeler*
!kirika reeler* now being blocked (You are banned)
> BLOCK
!kirika Being blocked:
!kirika reeler* -> You are banned (0)
> UNBLOCK reeler*
!kirika Removing block reeler* (You are banned)
4.4 Lastlog
The lastlog replaces WHOWAS and shows who has logged in at what
time.
> LASTLOG
!kirika Jul 14 15:59:37 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33361)
!kirika Jul 14 15:59:34 hans!tgr@kirika [Thomas Graf] (127.0.0.1:33359)
!kirika Jul 14 15:59:27 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33357)
!kirika Jul 14 15:59:26 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33356)
This document was translated from LATEX by
HEVEA.