ngIRCd Users

ngircd@lists.barton.de

424 Diskussionen

ngircd on OS X 10.9
by Götz Hoffart 24 Okt '13

24 Okt '13

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R See --------------------------- ------------ ---------- -------- ------ - - - - --- x86_64/apple/darwin13.0.0 gcc Apple LLVM version 5.0 (clang-500.2.79) (based on LLVM 3.3svn) 20.3 13-10-24 gh Y Y Y Y (3) Yay. Not that I expected another result, but keep on’ hacking :-) Grüße Götz

1 0

21~rc2 platformtest on openbsd 5.3/i386
by Darren Spruell 23 Okt '13

23 Okt '13

$ ./contrib/platformtest.sh platformtest.sh: Checking ngIRCd base source directory ... platformtest.sh: Checking for GIT tree ... platformtest.sh: Checking for "./configure" script ... platformtest.sh: Running "./configure" script ... platformtest.sh: Running "make" ... platformtest.sh: Running "make check" ... portabtest.c: In function 'main': portabtest.c:43: warning: the address of 'snprintf' will always evaluate as 'true' portabtest.c:44: warning: the address of 'vsnprintf' will always evaluate as 'true' portabtest.c:45: warning: the address of 'strlcpy' will always evaluate as 'true' portabtest.c:46: warning: the address of 'strlcat' will always evaluate as 'true' the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R See --------------------------- ------------ ---------- -------- ------ - - - - --- i386/unknown/openbsd5.3 gcc 4.2.1 21~rc2 13-10-21 dspruell Y Y Y Y (3) I did want to ask about path changes in the configuration. Under v20 the use of './configure --sysconfdir=/etc/ngircd' set the paths for many parameters in the config to /etc/ngircd. I notice the new configuration has these defaulting to /usr/local/etc/ even with --sysconfdir set to /etc/ngircd. $ egrep '\./configure' config.log $ ./configure --sysconfdir=/etc/ngircd --with-openssl --- ngircd.conf-v20 Sat Dec 29 23:49:41 2012 +++ ngircd.conf Mon Oct 21 23:41:32 2013 - ;MotdFile = /etc/ngircd/ngircd.motd + ;MotdFile = /usr/local/etc/ngircd.motd + ;IncludeDir = /usr/local/etc/conf.d - ;CertFile = /etc/ngircd/ssl/server-cert.pem + ;CertFile = /usr/local/etc/ssl/server-cert.pem - ;DHFile = /etc/ngircd/ssl/dhparams.pem + ;DHFile = /usr/local/etc/ssl/dhparams.pem - ;KeyFile = /etc/ngircd/ssl/server-key.pem + ;KeyFile = /usr/local/etc/ssl/server-key.pem - ;KeyFile = /etc/ngircd/#chan.key + ;KeyFile = /usr/local/etc/#chan.key Shouldn't the path in the config for all these be /etc/ngircd/ with --sysconfdir set as shown? The compiled in defaults appear to be correct: $ ngircd --configtest ... Reading configuration from "/etc/ngircd/ngircd.conf" ... ... MotdFile = /etc/ngircd/ngircd.motd IncludeDir = /etc/ngircd/ngircd.conf.d -- Darren Spruell phatbuckett(a)gmail.com

2 2

ngIRCd 21~rc2
by Alexander Barton 21 Okt '13

21 Okt '13

Hello! Yesterday I prepared and uploaded the second release candidate for our upcoming release, ngIRCd 21~rc2 -- but I obviously forgot to write a proper release announcement ... sorry! So here we go: There haven't been a lot of changes since the first release candidate a few weeks ago, mostly small bug fixes and documentation updates: • Report the correct configuration file name on configuration errors, support longer configuration lines, and warn when lines are truncated. • Use arc4random() function to generate "random" numbers, when available. • platformtest.sh: Detect clang compiler, and clean up GIT source tree before building (when possible). • Update (date of) manual pages. • Update "Upgrade Information" in INSTALL file, add more systems to doc/Platforms.txt, and fix spelling in NEWS and ChangeLog files =:) • Fix remaining compiler warnings on OpenBSD. Please have a look at the NEWS and ChangeLog files for the complete list of all changes and new features since ngIRCd 20: • http://ngircd.barton.de/doc/NEWS • http://ngircd.barton.de/doc/ChangeLog And please (PLEASE!) test this release candidate, I hope to be able to create the final release very soon. A good way to check it is by using the included ./contrib/platformtest.sh shell script, which will build ngIRCd, test it, and create a nice summary line suitable for inclusion into ./doc/Platforms.txt -- and contributions are highly appreciated, but you don't need to send thousands of lines for "mainstream" systems, distributions, and CPUs like Linux on i386 or amd64 ;-) • Homepage: <http://ngircd.barton.de/> (<http://ngircd.berlios.de/>) • Bug tracker: <http://ngircd.barton.de/bugzilla/> • Downloads: - FTP: <ftp://ftp.berlios.de/pub/ngircd/> - HTTP: <http://ngircd.barton.de/pub/ngircd/> Thanks to all testers and contributors! Have fun! Alex

1 0

Invitation to connect on LinkedIn
by Damon Talbot 17 Okt '13

17 Okt '13

LinkedIn ------------ I'd like to add you to my professional network on LinkedIn. - Damon Damon Talbot Telecommunications Professional Greater Grand Rapids, Michigan Area Confirm that you know Damon Talbot: https://www.linkedin.com/e/-r4hlba-hmw665jk-4w/isd/17376217269/dTxMQL_d/?hs… -- You are receiving Invitation to Connect emails. Click to unsubscribe: http://www.linkedin.com/e/-r4hlba-hmw665jk-4w/OfeCvxcCu9XOXuAOHc3quzZkzOgmm… (c) 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

1 0

ngIRCd 21~rc1
by Alexander Barton 07 Okt '13

07 Okt '13

Hi All! Last weekend I created the first release candidate for our next major feature release: ngIRCd 21~rc1. There have been more than 220 individual commits since our last "feature release" ngIRCd 20 last December, and the NEWS file lists 17 new features, including new configuration options, new commands, better help, and enhanced support for SSL -- among others: • Actually KILL clients on GLINE/KLINE. (Closes bug #156) • Add support to show all user links using the "STATS L" (uppercase) command (restricted to IRC Operators). • Implement configurable SSL cipher list selection for GnuTLS and OpenSSL using the new configuration option "CipherList". In addition, this changes the defaults to more secure values: "HIGH:!aNULL:@STRENGTH" for OpenSSL, and "SECURE128" for GnuTLS. • Show connection flag "s" (SSL) in RPL_TRACE{LINK|SERVER} messages: now you can check if a server-to-server link is SSL-encrypted or not using the IRC "TRACE" command. • Implement the new configuration option "DefaultUserModes" which lists user modes that become automatically set on new local clients right after login. Please note that only modes can be set that the client could set on itself, so you can't set "a" (away) or "o" (IRC Op), for example! User modes "i" (invisible) or "x" (cloaked) etc. are "interesting", though. (Closes bug #160) • Add support for the new METADATA "account" property, which allows services to automatically identify users after netsplits and across service restarts. • Implement a new configuration option "AllowedChannelTypes" that lists all allowed channel types (channel prefixes) for newly created channels on the local server. By default, all supported channel types are allowed. If set to the empty string, local clients can't create new channels at all, which equals the old "PredefChannelsOnly = yes" setting. This change deprecates the "PredefChannelsOnly" variable, too, but it is still supported and translated to the appropriate "AllowedChannelTypes" setting. When the old "PredefChannelsOnly" variable is processed, a warning message is logged. (Closes bug #152) • Add support for "client certificate fingerprinting". When a client passes an SSL certificate to the server, the "fingerprint" will be forwarded in the network which enables IRC services to identify the user using this certificate and not using passwords. • Implement a new configuration option "IncludeDir" in the "[Options]" section that can be used to specify a directory which can contain further configuration files and configuration file snippets matching the pattern "*.conf". These files are read in after the main server configuration file ("ngircd.conf" by default) has been read in and parsed. The default is "$SYSCONFDIR/ngircd.conf.d", so that it is possible to adjust the configuration only by placing additional files into this directory. (Closes bug #157) • Add Travis-CI configuration file (".travis.yml") to project. • ngIRCd now accepts user names including "@" characters, saves the unmodified name for authentication but stores only the part in front of the "@" character as "IRC user name". And the latter is how ircd2.11, Bahamut, and irc-seven behave as well. (Closes bug #155) • Lots of IRC "information functions" like ADMIN, INFO, ... now accept server masks and names of connected users (in addition to server names) for specifying the target server of the command. (Closes bug #153) • Implement a new configuration option "IdleTimeout" in the "[Limits]" section of the configuration file which can be used to set a timeout in seconds after which the whole daemon will shutdown when no more connections are left active after handling at least one client. The default is 0, "never". This can be useful for testing or when ngIRCd is started using "socket activation" with systemd(8), for example. • Implement support for systemd(8) "socket activation". • Enable WHOIS to display information about IRC Services using the new numeric 310(RPL_WHOISSERVICE) This numeric is used for this purpose by InspIRCd, for example -- but as usual, other numerics are in use, too, like 613 in UltimateIRCd ... Please note that neither the Operator (+o) not the "bot status" (+B) of an IRC service id displayed in the output. • Update systemd(8) example configuration files in ./contrib/ directory: the "ngircd.service" file now uses the "forking" service type which enhances the log messages shown by "systemctl status ngircd.service", and the new "ngircd.socket" file configures a systemd socket that configures a socket for ngIRCd and launches the daemon on demand. • Enhance help system and the HELP command: now a "help text file" can be set using the new configuration option "HelpFile" ("global" section), which is read in and parsed on server startup and configuration reload, and then is used to output individual help texts to specific topics. Please see the file ./doc/Commands.txt for details. Please test this release candidate and report all problems, errors, and regressions you encounter! Best is to file bugs and feature requests here: ngIRCd Bug Tracker: <http://ngircd.barton.de/bugzilla/> You can find more information on our homepage at <http://ngircd.barton.de/> and its mirror <http://ngircd.berlios.de/>. The primary download locations are: • <ftp://ftp.berlios.de/pub/ngircd/> • <http://ngircd.barton.de/pub/ngircd/> Thanks to all people contributing code, ideas, and bug reports! Most probably there will be a second release candidate, and afterwards a new stable release. Have fun! Alex

1 0

TLS and authentication patches
by Matt Pepe 19 Sep '13

19 Sep '13

Hello, On a related note, I have patches for the GNUTLS side of things that allows for client certificate support (including CRLs). I also have ngircd connected to a an OTP solution, which obviously causes issues with the numerous client re-connects. I ended up implementing an authentication cache to solve that problem as well. Any interest in both/either? - Matt

2 1

Re: [ngIRCd-ML] Support fir OpenSSL CipherList
by lists＠packetmail.net 07 Sep '13

07 Sep '13

On 09/07/2013 05:00 AM, ngircd-ml-request(a)arthur.barton.de wrote: > Hi, > > I attached a fix for the last patch. > - important: verifying CipherLists are applied successfully > - if SSL initialization failes, daemon should exit and not run without SSL > > Q: Is it welcome to provide patches on the ML? I certainly appreciate you taking the time to write the patch, correct it, and share it again. This is a feature that I am very happy to see implemented and I thank you for taking the time to do this and share with the community. It seems I still have the same issue with the latest patch on ngircd-20.3 -- # patch -p0 < ../ngircd_ssl_cipherlist.patch patching file ./doc/sample-ngircd.conf.tmpl Hunk #1 succeeded at 237 (offset -23 lines). patching file ./src/ngircd/conf.c Hunk #1 succeeded at 106 (offset -11 lines). Hunk #2 succeeded at 431 (offset -15 lines). Hunk #3 succeeded at 1842 with fuzz 2 (offset -32 lines). patching file ./src/ngircd/conf.h patching file ./src/ngircd/conn-ssl.c Hunk #1 succeeded at 275 with fuzz 1 (offset -28 lines). patching file ./src/ngircd/ngircd.c Hunk #1 succeeded at 671 (offset -2 lines). # Log Sep 7 11:15:47 localhost ngircd[27467]: /usr/local/etc/ngircd.conf, line 166 (section "SSL"): Unknown variable "CipherList"! Sep 7 11:15:47 localhost ngircd[27467]: ngIRCd 20.3-IPv6+IRCPLUS+SSL+SYSLOG+ZLIB-i686/pc/linux-gnu started. Sep 7 11:15:47 localhost ngircd[27467]: Using configuration file "/usr/local/etc/ngircd.conf" ... Sep 7 11:15:47 localhost ngircd[27467]: Configuration option "DHFile" not set! Sep 7 11:15:47 localhost ngircd[27467]: SSL using default CipherList Sep 7 11:15:47 localhost ngircd[27467]: OpenSSL 1.0.1 14 Mar 2012 initialized. # grep -B 10 "CipherList" /usr/local/etc/ngircd.conf # password to decrypt SSLKeyFile (OpenSSL only) ;KeyFilePassword = secret # SSL Server Key Certificate CertFile = /etc/apache2/ssl/ssl.crt # Diffie-Hellman parameters ;DHFile = /usr/local/etc/ngircd/ssl/dhparams.pem # SSL_CipherList.patch, Sep 06 2013 CipherList = ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM Thanks, Nathan Fowler

3 2

Re: [ngIRCd-ML] Support fir OpenSSL CipherList
by lists＠packetmail.net 06 Sep '13

06 Sep '13

On 09/06/2013 05:00 AM, ngircd-ml-request(a)arthur.barton.de wrote: > The patch attached is now in proper order. Question -- I'm very happy to see this patch but it doesn't appear to work against ngircd 20.3 -- am I doing something incorrectly? Apologies if I'm doing something stupid/obvious, I've reviewed the patch/code and it looks sound, including conf.c but based on the log message it looks like it's an issue with conf.c # gpg --verify ngircd-20.3.tar.gz.sig ngircd-20.3.tar.gz gpg: Signature made Fri 23 Aug 2013 03:25:37 PM CDT using RSA key ID EAA15A24 gpg: Good signature from "Alexander Barton <alex(a)barton.de>" gpg: aka "Alexander Barton <alex(a)barton-it.de>" gpg: aka "Alexander Barton <alex(a)arthur.ath.cx>" gpg: aka "[jpeg image of size 1488]" gpg: aka "[jpeg image of size 1718]" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: F5B9 F52E D909 20D2 5203 76A2 C24A 0F63 7E36 4856 Subkey fingerprint: 47EC B2F6 D427 3737 30E9 0113 8A45 9AD2 EAA1 5A24 # patch -p0 < SSL_Ciphers.patch patching file ./doc/sample-ngircd.conf.tmpl Hunk #1 succeeded at 237 (offset -23 lines). patching file ./src/ngircd/conf.c Hunk #1 succeeded at 106 (offset -11 lines). Hunk #2 succeeded at 431 (offset -15 lines). Hunk #3 succeeded at 1842 with fuzz 2 (offset -32 lines). patching file ./src/ngircd/conf.h patching file ./src/ngircd/conn-ssl.c Hunk #1 succeeded at 275 with fuzz 1 (offset -28 lines). # ./configure --enable-ipv6 --with-openssl CFLAGS='-Wall -D_FORTIFY_SOURCE=2 -O2 -fPIE -pie -fstack-protector' checking build system type... i686-pc-linux-gnu .... ngIRCd 20.3 has been configured with the following options: Host: i686-pc-linux-gnu Compiler: gcc -std=gnu99 Compiler flags: -Wall -D_FORTIFY_SOURCE=2 -O2 -fPIE -pie -fstack-protector -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' Libraries: -lssl -lcrypto -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: yes I/O backend: "epoll(), select()" PAM support: no SSL support: openssl libiconv support: no # grep CipherList /etc/ngircd.conf -B 12 # SSL Server Key KeyFile = /etc/apache2/ssl/ssl.key # password to decrypt SSLKeyFile (OpenSSL only) ;KeyFilePassword = secret # SSL Server Key Certificate CertFile = /etc/apache2/ssl/ssl.crt # Diffie-Hellman parameters ;DHFile = /usr/local/etc/ngircd/ssl/dhparams.pem # SSL_CipherList.patch, Sep 06 2013 CipherList = ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM # grep/tail log Sep 6 15:39:24 localhost ngircd[4153]: /usr/local/etc/ngircd.conf, line 166 (section "SSL"): Unknown variable "CipherList"! Sep 6 15:39:24 localhost ngircd[4153]: ngIRCd 20.3-IPv6+IRCPLUS+SSL+SYSLOG+ZLIB-i686/pc/linux-gnu started. Sep 6 15:39:24 localhost ngircd[4153]: Using configuration file "/usr/local/etc/ngircd.conf" ... Sep 6 15:39:24 localhost ngircd[4153]: Configuration option "DHFile" not set! Sep 6 15:39:24 localhost ngircd[4153]: SSL using default CipherList Sep 6 15:39:24 localhost ngircd[4153]: OpenSSL 1.0.1 14 Mar 2012 initialized. # diff -u conf.c conf.c.orig --- conf.c 2013-09-06 15:36:00.000000000 -0500 +++ conf.c.orig 2013-08-23 14:43:02.000000000 -0500 @@ -106,9 +106,6 @@ array_free_wipe(&Conf_SSLOptions.KeyFilePassword); array_free(&Conf_SSLOptions.ListenPorts); - - free(Conf_SSLOptions.CipherList); - Conf_SSLOptions.CipherList = NULL; } /** @@ -431,8 +428,6 @@ array_free_wipe(&Conf_SSLOptions.KeyFilePassword); printf(" Ports = "); ports_puts(&Conf_SSLOptions.ListenPorts); - printf(" CipherList = %s\n", Conf_SSLOptions.CipherList - ? Conf_SSLOptions.CipherList : ""); puts(""); #endif @@ -1842,11 +1837,6 @@ Config_Error_TooLong(Line, Var); return; } - if (strcasecmp(Var, "CipherList") == 0) { - assert(Conf_SSLOptions.CipherList == NULL); - Conf_SSLOptions.CipherList = strdup_warn(Arg); - return; - } Config_Error_Section(Line, Var, "Server"); } Thanks, Nathan Fowler

1 0

Support fir OpenSSL CipherList
by Bastian 06 Sep '13

06 Sep '13

Hi all, find attached a patch which enables a configuration option CipherList. This can be used to select/deselect ciphers used for tls/ssl connections. This became significant to me, because my network ops detected my ngIRCd would allow low and already known to be broken ciphers. Sorry, this is only for OpenSSL, gnutls is not included. Please also mind, that this was the first time for me looking into ngIRCd code. I hope I got all the meanings about config reading and checking properly. Hope this helps. Bastian

2 3

Re: [ngIRCd-ML] ngIRCd-ML Digest, Vol 95, Issue 1
by lists＠packetmail.net 02 Sep '13

02 Sep '13

On 09/02/2013 05:00 AM, ngircd-ml-request(a)arthur.barton.de wrote: > I am using OpenSSL (1.*) with Ngircd to enforce SSL connections. > Is there a possibility that I can enforce certain ciphers or disable > certain weak ciphers? Perhaps use the 'stunnel' method for serving ngircd over SSL and disable weak ciphers through stunnel's configuration, see http://ngircd.barton.de/doc/SSL.txt options = NO_SSLv2 ciphers = ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP If you're using RHEL-derived distribution, perhaps enable FIPS mode to disable weak ciphers system-wide see section 7.2.1 in the below URL: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… Cheers, Nathan

2 1

Springe zur Seite:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

ngIRCd Users