diff options
Diffstat (limited to 'network/elemental-ircd/slackware.conf')
| -rw-r--r-- | network/elemental-ircd/slackware.conf | 609 |
1 files changed, 609 insertions, 0 deletions
diff --git a/network/elemental-ircd/slackware.conf b/network/elemental-ircd/slackware.conf new file mode 100644 index 0000000000..fc9d8401ba --- /dev/null +++ b/network/elemental-ircd/slackware.conf @@ -0,0 +1,609 @@ +/* /etc/elemental-ircd/slackware.conf - brief example configuration file + * + * Copyright (C) 2000-2002 Hybrid Development Team + * Copyright (C) 2002-2005 ircd-ratbox development team + * Copyright (C) 2005-2006 charybdis development team + * Copyright (C) 2014 Elemental-IRCd development team + * + * $Id: example.conf 3582 2007-11-17 21:55:48Z jilles $ + * + * See reference.conf for more information. + */ + +/* Extensions */ +#loadmodule "extensions/chm_adminonly.so"; +loadmodule "extensions/chm_operonly.so"; +#loadmodule "extensions/chm_sslonly.so"; +#loadmodule "extensions/chm_operonly_compat.so"; +#loadmodule "extensions/chm_quietunreg_compat.so"; +#loadmodule "extensions/chm_sslonly_compat.so"; +#loadmodule "extensions/createauthonly.so"; +loadmodule "extensions/extb_account.so"; +loadmodule "extensions/extb_canjoin.so"; +loadmodule "extensions/extb_channel.so"; +loadmodule "extensions/extb_extgecos.so"; +loadmodule "extensions/extb_oper.so"; +loadmodule "extensions/extb_realname.so"; +#loadmodule "extensions/extb_server.so"; +#loadmodule "extensions/extb_ssl.so"; +#loadmodule "extensions/hurt.so"; +loadmodule "extensions/ip_cloaking.so"; +#loadmodule "extensions/m_findforwards.so"; +loadmodule "extensions/m_identify.so"; +loadmodule "extensions/m_mkpasswd.so"; +loadmodule "extensions/m_webirc.so"; +#loadmodule "extensions/m_cycle.so"; +#loadmodule "extensions/m_oaccept.so"; +#loadmodule "extensions/m_opme.so"; +#loadmodule "extensions/m_ojoin.so"; +#loadmodule "extensions/m_omode.so"; +#loadmodule "extensions/m_olist.so"; +#loadmodule "extensions/m_okick.so"; +#loadmodule "extensions/m_force.so"; +#loadmodule "extensions/m_roleplay.so"; +#loadmodule "extensions/no_oper_invis.so"; +loadmodule "extensions/sno_farconnect.so"; +loadmodule "extensions/sno_globalkline.so"; +loadmodule "extensions/sno_globaloper.so"; +#loadmodule "extensions/sno_whois.so"; + +serverinfo { + name = "hostname.domain.tld"; + sid = "42X"; + description = "elemental-ircd test server"; + network_name = "ShadowNET"; + network_desc = "Your IRC network."; + helpchan = "#help"; + helpurl = "http://www.mynet.net/help"; + hub = yes; + + /* On multi-homed hosts you may need the following. These define + * the addresses we connect from to other servers. */ + /* for IPv4 */ + #vhost = "192.169.0.1"; + /* for IPv6 */ + #vhost6 = "3ffe:80e8:546::2"; + + /* ssl_private_key: our ssl private key */ + ssl_private_key = "etc/ssl.key"; + + /* ssl_cert: certificate for our ssl server */ + ssl_cert = "etc/ssl.cert"; + + /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */ + ssl_dh_params = "etc/dh.pem"; + + /* ssld_count: number of ssld processes you want to start, if you + * have a really busy server, using N-1 where N is the number of + * cpu/cpu cores you have might be useful. A number greater than one + * can also be useful in case of bugs in ssld and because ssld needs + * two file descriptors per SSL connection. + */ + ssld_count = 1; + + /* default max clients: the default maximum number of clients + * allowed to connect. This can be changed once ircd has started by + * issuing: + * /quote set maxclients <limit> + */ + default_max_clients = 1024; +}; + +admin { + name = "Lazy admin (lazya)"; + description = "ShadowNET client server"; + email = "nobody@127.0.0.1"; +}; + +log { + fname_userlog = "/var/log/elemental-ircd/userlog"; + #fname_fuserlog = "/var/log/elemental-ircd/fuserlog"; + fname_operlog = "/var/log/elemental-ircd/operlog"; + #fname_foperlog = "/var/log/elemental-ircd/foperlog"; + fname_serverlog = "/var/log/elemental-ircd/serverlog"; + #fname_klinelog = "/var/log/elemental-ircd/klinelog"; + fname_killlog = "/var/log/elemental-ircd/killlog"; + fname_operspylog = "/var/log/elemental-ircd/operspylog"; + #fname_ioerrorlog = "/var/log/elemental-ircd/ioerror"; +}; + +/* class {} blocks MUST be specified before anything that uses them. That + * means they must be defined before auth {} and before connect {}. + */ +class "users" { + ping_time = 2 minutes; + number_per_ident = 10; + number_per_ip = 10; + number_per_ip_global = 50; + cidr_ipv4_bitlen = 24; + cidr_ipv6_bitlen = 64; + number_per_cidr = 200; + max_number = 3000; + sendq = 400 kbytes; +}; + +class "opers" { + ping_time = 5 minutes; + number_per_ip = 10; + max_number = 1000; + sendq = 1 megabyte; +}; + +class "server" { + ping_time = 5 minutes; + connectfreq = 5 minutes; + max_number = 1; + sendq = 4 megabytes; +}; + +listen { + /* defer_accept: wait for clients to send IRC handshake data before + * accepting them. if you intend to use software which depends on the + * server replying first, such as BOPM, you should disable this feature. + * otherwise, you probably want to leave it on. Disabling this will not + * update on a rehash. + */ + defer_accept = yes; + + /* If you want to listen on a specific IP only, specify host. + * host definitions apply only to the following port line. + */ + #host = "192.169.0.1"; + port = 5000, 6665 .. 6669; + sslport = 6697; + + /* Listen on IPv6 (if you used host= above). */ + #host = "3ffe:1234:a:b:c::d"; + #port = 5000, 6665 .. 6669; + #sslport = 9999; +}; + +/* auth {}: allow users to connect to the ircd (OLD I:) + * auth {} blocks MUST be specified in order of precedence. The first one + * that matches a user will be used. So place spoofs first, then specials, + * then general access, then restricted. + */ +auth { + /* user: the user@host allowed to connect. Multiple IPv4/IPv6 user + * lines are permitted per auth block. This is matched against the + * hostname and IP address (using :: shortening for IPv6 and + * prepending a 0 if it starts with a colon) and can also use CIDR + * masks. + */ + user = "*@172.16.0.0/12"; + user = "*test@123D:B567:*"; + + /* auth_user: The username (authenticated via SASL or PASS) allowed + * to connect. You are able to put multiple auth_user lines. If people + * are authenticating via SASL in this way, it is recommended to comment + * out the password option below. You will also *NEED* to specify a user + * line above auth_user, this can safely be "*@*", however. + */ + auth_user = "jilles"; + auth_user = "jdhore"; + + /* password: an optional password that is required to use this block. + * By default this is not encrypted, specify the flag "encrypted" in + * flags = ...; below if it is. + */ + password = "letmein"; + + /* spoof: fake the users user@host to be be this. You may either + * specify a host or a user@host to spoof to. This is free-form, + * just do everyone a favour and dont abuse it. (OLD I: = flag) + */ + spoof = "I.still.hate.packets"; + + /* autojoin: Channel (or channels, comma-seperated) to join users + * in this auth block to on connect. Note that this won't join + * the user through any bans or otherwise restrictive chmodes. + */ + autojoin = "#shadowircd,#test"; + + /* Possible flags in auth: + * + * encrypted | password is encrypted with mkpasswd + * spoof_notice | give a notice when spoofing hosts + * exceed_limit (old > flag) | allow user to exceed class user limits + * kline_exempt (old ^ flag) | exempt this user from k/g/xlines&dnsbls + * dnsbl_exempt | exempt this user from dnsbls + * spambot_exempt | exempt this user from spambot checks + * shide_exempt | exempt this user from serverhiding + * jupe_exempt | exempt this user from generating + * warnings joining juped channels + * resv_exempt | exempt this user from resvs + * flood_exempt | exempt this user from flood limits + * USE WITH CAUTION. + * no_tilde (old - flag) | don't prefix ~ to username if no ident + * need_ident (old + flag) | require ident for user in this class + * need_ssl | require SSL/TLS for user in this class + * need_sasl | require SASL id for user in this class + */ + flags = kline_exempt, exceed_limit; + + /* class: the class the user is placed in */ + class = "opers"; +}; + +/* Example WEBIRC authblock */ +auth { + /* user: webirc@IP.OF.YOUR.WEBIRC . the webirc@ part is required */ + user = "webirc@192.168.1.1"; + + /* password: password the webirc client sends in the WEBIRC command. + * You can use a encrypted password here (see above auth block). + */ + password = "<password>"; + + /* spoof: This is required to keep it what it is currently if you + * want the webirc client to show the users' real host as their + * host on IRC. + */ + spoof = "webirc."; + class = "users"; +}; + +auth { + user = "*@*"; + class = "users"; + flags = no_tilde; +}; + +/* privset {} blocks MUST be specified before anything that uses them. That + * means they must be defined before operator {}. + */ +privset "local_op" { + privs = oper:local_kill, oper:operwall; +}; + +privset "server_bot" { + extends = "local_op"; + privs = oper:kline, oper:remoteban, snomask:nick_changes; +}; + +privset "global_op" { + extends = "local_op"; + privs = oper:global_kill, oper:routing, oper:kline, oper:unkline, oper:xline, + oper:resv, oper:mass_notice, oper:remoteban; +}; + +privset "admin" { + extends = "global_op"; + privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:override; +}; + +operator "god" { + /* name: the name of the oper must go above */ + + /* user: the user@host required for this operator. CIDR *is* + * supported now. auth{} spoofs work here, other spoofs do not. + * multiple user="" lines are supported. + */ + user = "*god@127.0.0.1"; + + /* password: the password required to oper. Unless ~encrypted is + * contained in flags = ...; this will need to be encrypted using + * mkpasswd, MD5 is supported + */ + password = "etcnjl8juSU1E"; + + /* rsa key: the public key for this oper when using Challenge. + * A password should not be defined when this is used, see + * doc/challenge.txt for more information. + */ + #rsa_public_key_file = "/usr/local/ircd/etc/oper.pub"; + + /* umodes: the specific umodes this oper gets when they oper. + * If this is specified an oper will not be given oper_umodes + * These are described above oper_only_umodes in general {}; + */ + #umodes = locops, servnotice, operwall, wallop; + + /* fingerprint: if specified, the oper's client certificate + * fingerprint will be checked against the specified fingerprint + * below. + */ + #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b"; + + /* snomask: specific server notice mask on oper up. + * If this is specified an oper will not be given oper_snomask. + */ + snomask = "+Zbfkrsuy"; + + /* vhost: defines the vhost that this oper will get on oper up. + * this must be a valid hostmask. If this is specified the oper + * will not be given default_operhost. + */ + vhost = "is.an.oper"; + + /* swhois: defines an additional line that will be displayed + * whenever someone does /whois on the oper in question. + */ + swhois = "is wearing pants."; + + /* operstring: defines a custom operstring for this oper, + * which will be shown in whois instead of default_operstring + * or default_adminstring. + */ + operstring = "is a lazy IRC Operator"; + + /* flags: misc options for the operator. You may prefix an option + * with ~ to disable it, e.g. ~encrypted. + * + * Default flags are encrypted. + * + * Available options: + * + * encrypted: the password above is encrypted [DEFAULT] + * need_ssl: must be using SSL/TLS to oper up + */ + flags = encrypted; + + /* privset: privileges set to grant */ + privset = "admin"; +}; + +connect "irc.uplink.com" { + host = "192.168.0.1"; + send_password = "password"; + accept_password = "anotherpassword"; + port = 6666; + hub_mask = "*"; + class = "server"; + flags = compressed, topicburst; + + #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b"; + + /* If the connection is IPv6, uncomment below. + * Use 0::1, not ::1, for IPv6 localhost. */ + #aftype = ipv6; +}; + +connect "ssl.uplink.com" { + host = "192.168.0.1"; + send_password = "password"; + accept_password = "anotherpassword"; + port = 9999; + hub_mask = "*"; + class = "server"; + flags = ssl, topicburst; +}; + +service { + name = "services.int"; +}; + +cluster { + name = "*"; + flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv; +}; + +shared { + oper = "*@*", "*"; + flags = all; +}; + +/* exempt {}: IPs that are exempt from Dlines and rejectcache. (OLD d:) */ +exempt { + ip = "127.0.0.1"; +}; + +channel { + #disabledmodes = "ME"; + autochanmodes = "nt"; + admin_on_channel_create = no; + exemptchanops = "NT"; + use_halfop = yes; + use_admin = yes; + use_owner = yes; + use_knock = yes; + use_local_channels = yes; + knock_delay = 5 minutes; + knock_delay_channel = 1 minute; + max_chans_per_user = 15; + max_bans = 100; + max_bans_large = 500; + default_split_user_count = 0; + default_split_server_count = 0; + no_create_on_split = no; + no_join_on_split = no; + burst_topicwho = yes; + kick_on_split_riding = no; + only_ascii_channels = no; + cycle_host_change = yes; + host_in_topic = yes; + resv_forcepart = yes; + channel_target_change = yes; +}; + +serverhide { + flatten_links = yes; + links_delay = 5 minutes; + hidden = no; + disable_hidden = no; +}; + +/* These are the blacklist settings. + * You can have multiple combinations of host and rejection reasons. + * They are used in pairs of one host/rejection reason. + * + * These settings should be adequate for most networks, and are (presently) + * required for use on ShadowNet. + * + * Word to the wise: Do not use blacklists like SPEWS for blocking IRC + * connections. + * + * As of charybdis 2.1.3, you can do some keyword substitution on the rejection + * reason. The available keyword substitutions are: + * + * ${ip} - the user's IP + * ${host} - the user's canonical hostname + * ${dnsbl-host} - the dnsbl hostname the lookup was done against + * ${nick} - the user's nickname + * ${network-name} - the name of the network + * + */ +blacklist { + host = "rbl.efnetrbl.org"; + reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}"; + + host = "dnsbl.dronebl.org"; + reject_reason = "${nick}, your IP (${ip}) is listed in DroneBL. For assistance, see http://dronebl.org/lookup_branded.do?ip=${ip}&network=${network-name}"; + + host = "torexit.dan.me.uk"; + reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from TOR-based abuse, we are not allowing TOR exit nodes to connect to our network."; +}; + +alias "NickServ" { + target = "NickServ"; +}; + +alias "ChanServ" { + target = "ChanServ"; +}; + +alias "OperServ" { + target = "OperServ"; +}; + +alias "MemoServ" { + target = "MemoServ"; +}; + +alias "HostServ" { + target = "HostServ"; +}; + +alias "BotServ" { + target = "BotServ"; +}; + +alias "InfoServ" { + target = "InfoServ"; +}; + +alias "GroupServ" { + target = "GroupServ"; +}; + +alias "NS" { + target = "NickServ"; +}; + +alias "CS" { + target = "ChanServ"; +}; + +alias "OS" { + target = "OperServ"; +}; + +alias "MS" { + target = "MemoServ"; +}; + +alias "HS" { + target = "HostServ"; +}; + +alias "BS" { + target = "BotServ"; +}; + +alias "IS" { + target = "InfoServ"; +}; + +alias "GS" { + target = "GroupServ"; +}; + +general { + hide_error_messages = opers; + hide_spoof_ips = yes; + + /* + * default umodes: umodes to set upon connection + * If you have enabled the ip_cloaking extension, and you wish for + * incoming clients to be cloaked upon connection, +x must be in + * the umode string below. + */ + default_umodes = "+ix"; + + default_operstring = "is an IRC Operator"; + default_adminstring = "is a Server Administrator"; + #default_operhost = "staff.testnet.net"; + #static_quit = "I like turtles!"; + servicestring = "is a Network Service"; + disable_fake_channels = no; + hide_channel_below_users = 3; + tkline_expire_notices = no; + default_floodcount = 10; + failed_oper_notice = yes; + dots_in_ident=2; + min_nonwildcard = 4; + min_nonwildcard_simple = 3; + max_accept = 100; + max_monitor = 100; + anti_nick_flood = yes; + max_nick_time = 20 seconds; + max_nick_changes = 5; + anti_spam_exit_message_time = 5 minutes; + use_part_messages = yes; + ts_warn_delta = 30 seconds; + ts_max_delta = 5 minutes; + client_exit = yes; + collision_fnc = yes; + global_snotices = yes; + dline_with_reason = yes; + kline_delay = 0 seconds; + kline_with_reason = yes; + kline_reason = "K-Lined"; + identify_service = "NickServ@services.int"; + identify_command = "IDENTIFY"; + non_redundant_klines = yes; + warn_no_nline = yes; + use_propagated_bans = yes; + stats_e_disabled = no; + stats_c_oper_only=no; + stats_h_oper_only=no; + stats_y_oper_only=no; + stats_o_oper_only=yes; + stats_P_oper_only=no; + stats_i_oper_only=masked; + stats_k_oper_only=masked; + map_oper_only = no; + operspy_admin_only = no; + operspy_dont_care_user_info = no; + secret_channels_in_whois = no; + caller_id_wait = 1 minute; + pace_wait_simple = 1 second; + pace_wait = 10 seconds; + short_motd = no; + ping_cookie = no; + connect_timeout = 30 seconds; + default_ident_timeout = 5; + disable_auth = no; + no_oper_flood = yes; + true_no_oper_flood = no; + max_targets = 4; + client_flood = 20; + use_whois_actually = no; + oper_only_umodes = operwall, locops, servnotice; + oper_umodes = locops, servnotice, operwall, wallop; + oper_snomask = "+s"; + burst_away = yes; + nick_delay = 0 seconds; # 15 minutes if you want to enable this + reject_ban_time = 1 minute; + reject_after_count = 3; + reject_duration = 5 minutes; + throttle_duration = 60; + throttle_count = 4; + expire_override_time = 5 minutes; + away_interval = 30; +}; + +modules { + path = "/usr/lib@LIBDIRSUFFIX@/elemental-ircd/modules"; + path = "/usr/lib@LIBDIRSUFFIX@/elemental-ircd/modules/autoload"; +}; |