iacd Administrator's Guide

Thomas Graf

Contents

Chapter 1  Introduction

This document gives step by step instructions to install and run iacd from an administrator's viewpoint.

Thanks to all who helped develop iacd with code or social support.

1.1  Disclaimer & License

This document is distributed WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This document may be distributed only subject to the terms and conditions set forth in the Open Publication License, v1.0 or later (the latest version is presently available at http://www.opencontent.org/openpub/).

Chapter 2  Installing iacd

2.1  Requirements

The following requirements need to be fulfilled to successfully compile and install iacd:

2.2  Supported Platforms

I would be pleased if you drop me a line if you successfully compile and run iacd on a platform not listed here.

2.3  Getting the Source Code

Download the latest stable version of iacd from http://trash.net/~reeler/iacd/. I recommend to also download the .md5sum and .sig file besides the source tarball.

Check the MD5 sum, check if the source was not modified by a third party and finally unpack the source:

$ md5sum -c iacd-<version>.tar.gz.md5sum
$ gpg --verify iacd-<version>.tar.gz.sig 
gpg: Signature made <date> using DSA key ID 4E663A79
gpg: Good signature from "Thomas Graf <tgr@reeler.org>"
$ tar xzvf iacd-<version>.tar.gz
iacd-<version>/
iacd-<version>/doc/
...
$ cd iacd-<version>

2.4  Compile Time Options

All compile time options entail a recompliation before taking effect. Therefore you need to restart the server after changing the settings. If you need to change the same option over and over you can contact me and I'll make a configuration option out of it.

The configure script is generated by autoconf and thus supports --prefix and --sysconfdir etc. Besides that, table 2.1 contains a list of all options recognized by the iacd configure script.


--enable-ipv6Enables the IPv6 code.
--disable-client-hacksDisables all the hacks needed to support buggy clients like mIRC.
--enable-debugCompiles iacd with debug symbols.
--enable-staticEnables static linking.
--enable-scriptsEnables script support (see XXX)
Table 2.1: list of configure options

Table 2.2 lists the most important compile time options which can be changed in config.h with your favourite text editor. Most of this options define upper limits of values and are not implemented as configuration option because of performance issues or more likely because I was too lazy.


MAX_SOCK_CONNECTSMax. sockets created, setrlimit(2) will be called if the value exceeds 1024 and thus needs root privileges
MAX_CLONESNr. of connections allowed from the same host
MAX_CHANNELSNr. of channels allowed on the server
MAX_CHANNEL_JOINSNr. of channels a user may have joined at the same time
MAX_SERVER_CONNECTIONSNr. of server connections
MAX_MODE_CHANGESLength of mode change string per mode change
MAX_WAITINGMax. Nr. of clients connected but not registed yet (no NICK or USER sent)
MAX_LASTLOGSize of lastlog1 list
PROTECT_COMMANDUsed to protect commands i.e. they need ircop to be executed
AUTOAWWAYEnable server side autoway feature
AUTOAWAY_DEFAULTDefault auto away value before being marked as being away.
AUTOAWAY_CHECKInterval to check for users that should be marked as away
CMD_USAGEMake statistics about usage of each command
COUNT_IDLETIMECalculate idle time for each user
TLIST_MAXMax. topics to keep for each channel
PING_TIMEOUTTime in seconds before a user gets killed because of ping timeout.
Table 2.2: config.h Options

Table 2.3 contains a list of all text limits. I separated them because each IRC network administrator has other ideas about maximum nickname etc.


MSGLENMax. size of messages being sent out.
PARSELENAll messages are cuted to this length before being parsed.
NICKLENMax. size of a nick.
USERLENMax. size of a username.
IRCNAMELENMax. size of a real name.
QUITMSGLENMax. size of a quit message.
AWAYLENMax. size of a away message.
SERVERINFOLENMax. size of the server info line.
PINGLENAll PING sequences are shortened to this size.
CHANNAMELENMax. size of a channel name.
TOPICLENMax. size of a topic.
SERV_OPTIONSLENMax. size of server options.
PASSWORDLENMax. size of a password.
Table 2.3: config.h Limits

2.5  Compiling

So, you finally finished to configure iacd and are ready to compile it.

$ make

This will compile and link iacd like you requested in the configure options.

You can recompile iacd anytime with:

$ make clean all

2.6  Installing

2.6.1  Normal Installation

The normal installation procedure will install iacd into the directory you specified with --prefix (default is /usr/local). Run

$ make install

to install iacd. The default permissions allow everyone to start the server.

2.6.2  Chroot Installation

iacd has support to chroot() at runtime since version 0.0.23 and therefore no special installation is required.

See chapter 2.6.1 for further instructions to install iacd.


1
list containing nick!user@host of the last new connections

Chapter 3  Configuring iacd

iacd can be configured through a configuration file which is read at start time or if SIGHUP is received.


client_portis the port used to listen for new client connections.
server_portis the port used to listen for new server connections.
server_numericmust be unique in the network and is used to identify server nodes.
server_info isa short description about the server shown in WHOIS replies.
server_nameoverwrites gethostname().getdomainname() results.
lastlogenables LASTLOG command.
motdpoints to the motd file.
interfaceis the interface iacd will listen on.
timestampsPrint timestamps per line in verbose output.
Table 3.1: Configuration Identifiers

Chapter 4  Running iacd

4.1  Arguments

Type iacd -h to get a list of all suported command line options.

$ iacd -h
-d          run in background
-f <file>   configuration file
-u <user>   drop privs and change to this user
-g <group>  drop privs and change to this group
-c <path>   chroot() to this path
-v <level>  verbose output

4.1.1  Daemon mode (-d)

The -d flag will fork iacd into the background and force all log messages to be sent to syslog. You should use this flag instead of using the shell's builtin job background control mechanism.

$ iacd -d
$

4.1.2  Configuration file path (-f)

Alternative path to configurtion file, default is SYSCONFDIR/iacd.conf where SYSCONFDIR is the value you've given with –sysconfdir=.

$ iacd -f /d1/iacd/etc/iacd.conf

4.1.3  Privileges drop (-u -g)

iacd is able to drop it's privileges. The privileges drop is done after all actions that require the superuser status are done (chroot, setrlimit). Here's a list of all actions that are taken before the privileges drop:

Privileges drop means changing uid/gid to a user/group which does only have permissions required to run iacd.

$ iacd -u irc -g irc

Will run iacd with uid=irc gid=irc. In case of an exploitable overrun the attacker only gets limited privileges on your system.

4.1.4  Chroot (-c)

Chroot is yet another way to reduce risc in case of an attack. It does change root directory to another path after all file descriptors and libraries have been loaded. This means you can REHASH your configuration placed outside the chroot directory while iacd is running.

$ iacd -c /chroot/iacd/

Note: The chroot option is very useful but makes using scripts quite difficult, because you have to copy the perl interpreter into the chroot if you're using perl scripts etc.

4.1.5  Verbose output (-v)

Verbose output prints debug and other messages to stdout or syslog. Note that iacd will not print any messages except error and warning messages if -v <level> is not specified. See table 4.1 for a list of message levels.


1Verbose messages
2Debug messages
3Raw I/O
Table 4.1: Verbose message levels

Note: Most RAW I/O messages are protected with a #ifdef DEBUG to save a few cpu cycles, this means you need to compile iacd with --enable-debug to get this messages.

4.2  Administrator's interface

4.2.1  Stats Reports

/STATS returns information about the status of the irc server. See table 4.2 for a list of available modes.

Example:

> stats u
-!- Server Up 4 days 13:58:13
-!- u End of STATS report.

Some of the stat reports required IRCOP privileges.


llist connected server links
mcommand usage, nr of calls
olist configured operator lines
uuptime
clist configured server links
Table 4.2: stats modes

4.2.2  Dump

DUMP is an extensions not described in the RFCs but might be useful to an administrator.

4.2.2.1  Dumping User Information

Syntax:

DUMP USER <nick>

Example:

> dump user reeler
!kirika Dumping user: reeler!tgr@kirika
!kirika Nick: reeler
!kirika User: tgr
!kirika Hostname: kirika
!kirika Ircname: Thomas Graf
!kirika IP: 127.0.0.1
!kirika Port: 33182
!kirika Hopcount: 0
!kirika Away Message: blah
!kirika Server: kirika
!kirika Server info: my irc server ;)
!kirika Quit message: none set
!kirika Signon: 1026652023 [Sun Jul 14 15:07:03 2002]
!kirika Idle: 1026652068 [9 seconds]
!kirika Flags: 4bf
!kirika  - IAC_NICKSENT
!kirika  - IAC_USERSENT
!kirika  - IAC_OK
!kirika  - IAC_LOCAL
!kirika  - IAC_LOG
!kirika  - IAC_PONG
!kirika  - IAC_OPERATOR
!kirika  - IAC_INVISIBLE
!kirika Joined channels:
!kirika  - #42

4.2.2.2  Dumping Channel Information

Syntax:

DUMP CHANNEL <channel>

Example:

> dump channel #42
!kirika Dumping channel: #42
!kirika Flags (0):
!kirika Owner: reeler
!kirika Logfile: (NULL)
!kirika Topic 00: (none:0) none
!kirika Topic 01: (reeler:1026652379) this is a test topic
!kirika Topic 02: (reeler:1026652385) this is a newer topic
!kirika Topic 99: (reeler:1026652392) this is the newest topic
!kirika Topic 04: (none:0) none
!kirika Topic 05: (none:0) none
!kirika Topic 06: (none:0) none
!kirika Topic 07: (none:0) none
!kirika Topic 08: (none:0) none
!kirika Topic 09: (none:0) none

4.2.2.3  Dumping Server Information

Syntax:

DUMP SERVER <servername>

Example:

> dump server kirika
!kirika Dumping server: kirika
!kirika Info: my irc server ;)
!kirika Numeric: 1
!kirika Hopcount: 0
!kirika Flags: 0

4.2.2.4  Dumping Block Information

Syntax:

DUMP BLOCK <mask>

Example:

> dump block
!kirika Dumping block *!*@207.46*
!kirika Reason: Don't abuse the network
!kirika #Matches: 0
!kirika Next pointer: (NULL)

4.2.2.5  Dumping Link Information

Syntax:

DUMP LINK <remote host>

Example:

> dump link
!kirika Dumping link: 0
!kirika Host: localhost
!kirika Port: 7002
!kirika Password: secret
!kirika Options: m
!kirika Mask: *
!kirika Flags: 0
!kirika Next pointer: (NULL)

4.2.2.6  Dumping Script Information

Syntax:

> dump script mail
!kirika Dumping script mail
!kirika Nick: mail
!kirika Command: scripts/mail
!kirika Char Regex: -
!kirika Next Pointer: (nil)

4.2.2.7  Dumping Server Connection Information

Syntax:

DUMP SERVER_CONN <remote hostname>

Example:

> dump server_conn test2
!kirika Dumping server connection test2
!kirika Numeric: 2
!kirika Info: test server 2
!kirika IP: 127.0.0.1
!kirika Init time: Sun Jul 14 15:29:06 2002
!kirika Hopcount: 0
!kirika Ping (seconds): 0
!kirika Port: 7002
!kirika Socket: 6
!kirika Queue length: 0
!kirika Bytes sent: 238
!kirika Messages sent: 8
!kirika Bytes received: 127
!kirika Messages received: 5
!kirika Flags: b5
!kirika  - IAC_PASSSENT
!kirika  - IAC_OK
!kirika  - IAC_MASTER
!kirika  - IAC_PONG
!kirika  - IAC_USEMSGID
!kirika Current message being sent: 

4.2.3  Server Linking

iacd has it's own server linking interface for the administrator, the way suggested by the RFC is also supported though.

4.2.3.1  List of Configured Links

> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected

4.2.3.2  Adding Links

Syntax:

LINK ADD <autoconnect> <mask> <host> <port> <password> [<options>]

Example:

> LINK ADD 0 * 42.42.42.42 1337 leet m
!kirika Added 42.42.42.42:1337 (*) to link table
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 42.42.42.42  1337   *          leet       0 Disconnected
!kirika 127.0.0.1    7002   *          secret     0 Disconnected

4.2.3.3  Removing Links

Example:

> LINK REMOVE 42.42.42.42
!kirika Removed link entry 42.42.42.42
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected

4.2.3.4  Connecting

Example:

> LINK CONNECT 127.0.0.1
!kirika Now linked to 127.0.0.1:7002
!kirika New server connection (127.0.0.1:7002)
!kirika New server test2 (2) 127.0.0.1:7002 [test server 2]
> LINK
!kirika 127.0.0.1    7002   *          secret     0 Connected, Master

Or if something goes wrong:

> LINK CONNECT 127.0.0.1
!kirika While linking to (127.0.0.1:7002): Could not connect to
        server 127.0.0.1: Connection refused
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected,
                                                    Failed, Retry

iacd will retry to connect to the server.

4.2.3.5  Stop Retrying

Example:

> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected,
                                                    Failed, Retry
> LINK STOP 127.0.0.1
!kirika Link 127.0.0.1 no longer being retried
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected, Failed

4.2.3.6  Closing a Server Link

Example:

> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Connected, Master
> LINK CLOSE 127.0.0.1
!kirika Closing server link to test2
!kirika Lost server connection (127.0.0.1:7002)

4.3  Client Blocking

iacd has support to block clients from connecting to the server.

Syntax:

BLOCK [<mask> [<reason>]

mask is compared each time a user is connecting to the server, this is done after nick and username has been sent. The string being compared has the format: nick!username@ip:port[realname]. If no mask is given all configured block lines are printed out. reason is the string sent to the user before he gets disconnected, default value is "You are banned".

Example:

> BLOCK reeler*
!kirika reeler* now being blocked (You are banned)
> BLOCK
!kirika Being blocked:
!kirika reeler* -> You are banned (0)
> UNBLOCK reeler*
!kirika Removing block reeler* (You are banned)

4.4  Lastlog

The lastlog replaces WHOWAS and shows who has logged in at what time.

> LASTLOG
!kirika Jul 14 15:59:37 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33361)
!kirika Jul 14 15:59:34 hans!tgr@kirika [Thomas Graf] (127.0.0.1:33359)
!kirika Jul 14 15:59:27 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33357)
!kirika Jul 14 15:59:26 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33356)

This document was translated from LATEX by HEVEA.