iacd Administrator's GuideThomas Graf |
This document gives step by step instructions to install and run iacd from an administrator's viewpoint.
Thanks to all who helped develop iacd with code or social support.
This document is distributed WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
This document may be distributed only subject to the terms and conditions set forth in the Open Publication License, v1.0 or later (the latest version is presently available at http://www.opencontent.org/openpub/).
The following requirements need to be fulfilled to successfully compile and install iacd:
I would be pleased if you drop me a line if you successfully compile and run iacd on a platform not listed here.
Download the latest stable version of iacd from http://trash.net/~reeler/iacd/. I recommend to also download the .md5sum and .sig file besides the source tarball.
Check the MD5 sum, check if the source was not modified by a third party and finally unpack the source:
$ md5sum -c iacd-<version>.tar.gz.md5sum $ gpg --verify iacd-<version>.tar.gz.sig gpg: Signature made <date> using DSA key ID 4E663A79 gpg: Good signature from "Thomas Graf <tgr@reeler.org>" $ tar xzvf iacd-<version>.tar.gz iacd-<version>/ iacd-<version>/doc/ ... $ cd iacd-<version>
All compile time options entail a recompliation before taking effect. Therefore you need to restart the server after changing the settings. If you need to change the same option over and over you can contact me and I'll make a configuration option out of it.
The configure script is generated by autoconf and thus supports --prefix and --sysconfdir etc. Besides that, table 2.1 contains a list of all options recognized by the iacd configure script.
--enable-ipv6 Enables the IPv6 code. --disable-client-hacks Disables all the hacks needed to support buggy clients like mIRC. --enable-debug Compiles iacd with debug symbols. --enable-static Enables static linking. --enable-scripts Enables script support (see XXX)
Table 2.1: list of configure options
Table 2.2 lists the most important compile time options which can be changed in config.h with your favourite text editor. Most of this options define upper limits of values and are not implemented as configuration option because of performance issues or more likely because I was too lazy.
MAX_SOCK_CONNECTS Max. sockets created, setrlimit(2) will be called if the value exceeds 1024 and thus needs root privileges MAX_CLONES Nr. of connections allowed from the same host MAX_CHANNELS Nr. of channels allowed on the server MAX_CHANNEL_JOINS Nr. of channels a user may have joined at the same time MAX_SERVER_CONNECTIONS Nr. of server connections MAX_MODE_CHANGES Length of mode change string per mode change MAX_WAITING Max. Nr. of clients connected but not registed yet (no NICK or USER sent) MAX_LASTLOG Size of lastlog1 list PROTECT_COMMAND Used to protect commands i.e. they need ircop to be executed AUTOAWWAY Enable server side autoway feature AUTOAWAY_DEFAULT Default auto away value before being marked as being away. AUTOAWAY_CHECK Interval to check for users that should be marked as away CMD_USAGE Make statistics about usage of each command COUNT_IDLETIME Calculate idle time for each user TLIST_MAX Max. topics to keep for each channel PING_TIMEOUT Time in seconds before a user gets killed because of ping timeout.
Table 2.2: config.h Options
Table 2.3 contains a list of all text limits. I separated them because each IRC network administrator has other ideas about maximum nickname etc.
MSGLEN Max. size of messages being sent out. PARSELEN All messages are cuted to this length before being parsed. NICKLEN Max. size of a nick. USERLEN Max. size of a username. IRCNAMELEN Max. size of a real name. QUITMSGLEN Max. size of a quit message. AWAYLEN Max. size of a away message. SERVERINFOLEN Max. size of the server info line. PINGLEN All PING sequences are shortened to this size. CHANNAMELEN Max. size of a channel name. TOPICLEN Max. size of a topic. SERV_OPTIONSLEN Max. size of server options. PASSWORDLEN Max. size of a password.
Table 2.3: config.h Limits
So, you finally finished to configure iacd and are ready to compile it.
$ make
This will compile and link iacd like you requested in the configure options.
You can recompile iacd anytime with:
$ make clean all
The normal installation procedure will install iacd into the directory you specified with --prefix (default is /usr/local). Run
$ make install
to install iacd. The default permissions allow everyone to start the server.
iacd has support to chroot() at runtime since version 0.0.23 and therefore no special installation is required.
See chapter 2.6.1 for further instructions to install iacd.
iacd can be configured through a configuration file which is read at start time or if SIGHUP is received.
client_port is the port used to listen for new client connections. server_port is the port used to listen for new server connections. server_numeric must be unique in the network and is used to identify server nodes. server_info is a short description about the server shown in WHOIS replies. server_name overwrites gethostname().getdomainname() results. lastlog enables LASTLOG command. motd points to the motd file. interface is the interface iacd will listen on. timestamps Print timestamps per line in verbose output.
Table 3.1: Configuration Identifiers
Type iacd -h to get a list of all suported command line options.
$ iacd -h -d run in background -f <file> configuration file -u <user> drop privs and change to this user -g <group> drop privs and change to this group -c <path> chroot() to this path -v <level> verbose output
The -d flag will fork iacd into the background and force all log messages to be sent to syslog. You should use this flag instead of using the shell's builtin job background control mechanism.
$ iacd -d $
Alternative path to configurtion file, default is SYSCONFDIR/iacd.conf where SYSCONFDIR is the value you've given with –sysconfdir=.
$ iacd -f /d1/iacd/etc/iacd.conf
iacd is able to drop it's privileges. The privileges drop is done after all actions that require the superuser status are done (chroot, setrlimit). Here's a list of all actions that are taken before the privileges drop:
Privileges drop means changing uid/gid to a user/group which does only have permissions required to run iacd.
$ iacd -u irc -g irc
Will run iacd with uid=irc gid=irc. In case of an exploitable overrun the attacker only gets limited privileges on your system.
Chroot is yet another way to reduce risc in case of an attack. It does change root directory to another path after all file descriptors and libraries have been loaded. This means you can REHASH your configuration placed outside the chroot directory while iacd is running.
$ iacd -c /chroot/iacd/
Note: The chroot option is very useful but makes using scripts quite difficult, because you have to copy the perl interpreter into the chroot if you're using perl scripts etc.
Verbose output prints debug and other messages to stdout or syslog. Note that iacd will not print any messages except error and warning messages if -v <level> is not specified. See table 4.1 for a list of message levels.
1 Verbose messages 2 Debug messages 3 Raw I/O
Table 4.1: Verbose message levels
Note: Most RAW I/O messages are protected with a #ifdef DEBUG to save a few cpu cycles, this means you need to compile iacd with --enable-debug to get this messages.
/STATS returns information about the status of the irc server. See table 4.2 for a list of available modes.
Example:
> stats u -!- Server Up 4 days 13:58:13 -!- u End of STATS report.
Some of the stat reports required IRCOP privileges.
l list connected server links m command usage, nr of calls o list configured operator lines u uptime c list configured server links
Table 4.2: stats modes
DUMP is an extensions not described in the RFCs but might be useful to an administrator.
Syntax:
DUMP USER <nick>
Example:
> dump user reeler !kirika Dumping user: reeler!tgr@kirika !kirika Nick: reeler !kirika User: tgr !kirika Hostname: kirika !kirika Ircname: Thomas Graf !kirika IP: 127.0.0.1 !kirika Port: 33182 !kirika Hopcount: 0 !kirika Away Message: blah !kirika Server: kirika !kirika Server info: my irc server ;) !kirika Quit message: none set !kirika Signon: 1026652023 [Sun Jul 14 15:07:03 2002] !kirika Idle: 1026652068 [9 seconds] !kirika Flags: 4bf !kirika - IAC_NICKSENT !kirika - IAC_USERSENT !kirika - IAC_OK !kirika - IAC_LOCAL !kirika - IAC_LOG !kirika - IAC_PONG !kirika - IAC_OPERATOR !kirika - IAC_INVISIBLE !kirika Joined channels: !kirika - #42
Syntax:
DUMP CHANNEL <channel>
Example:
> dump channel #42 !kirika Dumping channel: #42 !kirika Flags (0): !kirika Owner: reeler !kirika Logfile: (NULL) !kirika Topic 00: (none:0) none !kirika Topic 01: (reeler:1026652379) this is a test topic !kirika Topic 02: (reeler:1026652385) this is a newer topic !kirika Topic 99: (reeler:1026652392) this is the newest topic !kirika Topic 04: (none:0) none !kirika Topic 05: (none:0) none !kirika Topic 06: (none:0) none !kirika Topic 07: (none:0) none !kirika Topic 08: (none:0) none !kirika Topic 09: (none:0) none
Syntax:
DUMP SERVER <servername>
Example:
> dump server kirika !kirika Dumping server: kirika !kirika Info: my irc server ;) !kirika Numeric: 1 !kirika Hopcount: 0 !kirika Flags: 0
Syntax:
DUMP BLOCK <mask>
Example:
> dump block !kirika Dumping block *!*@207.46* !kirika Reason: Don't abuse the network !kirika #Matches: 0 !kirika Next pointer: (NULL)
Syntax:
DUMP LINK <remote host>
Example:
> dump link !kirika Dumping link: 0 !kirika Host: localhost !kirika Port: 7002 !kirika Password: secret !kirika Options: m !kirika Mask: * !kirika Flags: 0 !kirika Next pointer: (NULL)
Syntax:
> dump script mail !kirika Dumping script mail !kirika Nick: mail !kirika Command: scripts/mail !kirika Char Regex: - !kirika Next Pointer: (nil)
Syntax:
DUMP SERVER_CONN <remote hostname>
Example:
> dump server_conn test2 !kirika Dumping server connection test2 !kirika Numeric: 2 !kirika Info: test server 2 !kirika IP: 127.0.0.1 !kirika Init time: Sun Jul 14 15:29:06 2002 !kirika Hopcount: 0 !kirika Ping (seconds): 0 !kirika Port: 7002 !kirika Socket: 6 !kirika Queue length: 0 !kirika Bytes sent: 238 !kirika Messages sent: 8 !kirika Bytes received: 127 !kirika Messages received: 5 !kirika Flags: b5 !kirika - IAC_PASSSENT !kirika - IAC_OK !kirika - IAC_MASTER !kirika - IAC_PONG !kirika - IAC_USEMSGID !kirika Current message being sent:
iacd has it's own server linking interface for the administrator, the way suggested by the RFC is also supported though.
> LINK !kirika Host Port Mask Password A Flags !kirika 127.0.0.1 7002 * secret 0 Disconnected
Syntax:
LINK ADD <autoconnect> <mask> <host> <port> <password> [<options>]
Example:
> LINK ADD 0 * 42.42.42.42 1337 leet m !kirika Added 42.42.42.42:1337 (*) to link table > LINK !kirika Host Port Mask Password A Flags !kirika 42.42.42.42 1337 * leet 0 Disconnected !kirika 127.0.0.1 7002 * secret 0 Disconnected
Example:
> LINK REMOVE 42.42.42.42 !kirika Removed link entry 42.42.42.42 > LINK !kirika Host Port Mask Password A Flags !kirika 127.0.0.1 7002 * secret 0 Disconnected
Example:
> LINK CONNECT 127.0.0.1 !kirika Now linked to 127.0.0.1:7002 !kirika New server connection (127.0.0.1:7002) !kirika New server test2 (2) 127.0.0.1:7002 [test server 2] > LINK !kirika 127.0.0.1 7002 * secret 0 Connected, Master
Or if something goes wrong:
> LINK CONNECT 127.0.0.1 !kirika While linking to (127.0.0.1:7002): Could not connect to server 127.0.0.1: Connection refused > LINK !kirika Host Port Mask Password A Flags !kirika 127.0.0.1 7002 * secret 0 Disconnected, Failed, Retry
iacd will retry to connect to the server.
Example:
> LINK !kirika Host Port Mask Password A Flags !kirika 127.0.0.1 7002 * secret 0 Disconnected, Failed, Retry > LINK STOP 127.0.0.1 !kirika Link 127.0.0.1 no longer being retried > LINK !kirika Host Port Mask Password A Flags !kirika 127.0.0.1 7002 * secret 0 Disconnected, Failed
Example:
> LINK !kirika Host Port Mask Password A Flags !kirika 127.0.0.1 7002 * secret 0 Connected, Master > LINK CLOSE 127.0.0.1 !kirika Closing server link to test2 !kirika Lost server connection (127.0.0.1:7002)
iacd has support to block clients from connecting to the server.
Syntax:
BLOCK [<mask> [<reason>]
mask is compared each time a user is connecting to the server, this is done after nick and username has been sent. The string being compared has the format: nick!username@ip:port[realname]. If no mask is given all configured block lines are printed out. reason is the string sent to the user before he gets disconnected, default value is "You are banned".
Example:
> BLOCK reeler* !kirika reeler* now being blocked (You are banned) > BLOCK !kirika Being blocked: !kirika reeler* -> You are banned (0) > UNBLOCK reeler* !kirika Removing block reeler* (You are banned)
The lastlog replaces WHOWAS and shows who has logged in at what time.
> LASTLOG !kirika Jul 14 15:59:37 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33361) !kirika Jul 14 15:59:34 hans!tgr@kirika [Thomas Graf] (127.0.0.1:33359) !kirika Jul 14 15:59:27 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33357) !kirika Jul 14 15:59:26 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33356)
This document was translated from LATEX by HEVEA.