- ngIRCd Users - lists.barton.de

question about strong ciphers
by Michiel van Es 01 Sep '13

01 Sep '13

Hello, I am using OpenSSL (1.*) with Ngircd to enforce SSL connections. Is there a possibility that I can enforce certain ciphers or disable certain weak ciphers? The default config allow 56 bits ciphers: SSLv3:RC4-MD5 - ENABLED - STRONG 128 bits SSLv3:DES-CBC3-SHA - ENABLED - STRONG 168 bits SSLv3:CAMELLIA128-SHA - ENABLED - STRONG 128 bits SSLv3:RC4-SHA - ENABLED - STRONG 128 bits SSLv3:SEED-SHA - ENABLED - STRONG 128 bits SSLv3:CAMELLIA256-SHA - ENABLED - STRONG 256 bits ** SSLv3:DES-CBC-SHA - ENABLED - WEAK 56 bits ** SSLv3:AES128-SHA - ENABLED - STRONG 128 bits SSLv3:AES256-SHA - ENABLED - STRONG 256 bits Error 20: unable to get local issuer certificate TLSv1:RC4-MD5 - ENABLED - STRONG 128 bits TLSv1:DES-CBC3-SHA - ENABLED - STRONG 168 bits TLSv1:CAMELLIA128-SHA - ENABLED - STRONG 128 bits TLSv1:RC4-SHA - ENABLED - STRONG 128 bits TLSv1:SEED-SHA - ENABLED - STRONG 128 bits TLSv1:CAMELLIA256-SHA - ENABLED - STRONG 256 bits ** TLSv1:DES-CBC-SHA - ENABLED - WEAK 56 bits ** TLSv1:AES128-SHA - ENABLED - STRONG 128 bits TLSv1:AES256-SHA - ENABLED - STRONG 256 bits Regards, Michiel

1 0

question about Ngircd and PAM setup
by Michiel van Es 26 Aug '13

26 Aug '13

Hello, I am using the latest Ngircd on an Ubuntu 64 bit vps. I am trying to setup Ngircd with PAM. I've read the documentation for PAM here: http://ngircd.barton.de/doc/PAM.txt but I am having a few questions and issues: - I've set up /etc/pam.d/ngircd as follows: #%PAM-1.0 auth required pam_userdb.so db=/etc/ngircd/ngircd-vuser.db account required pam_userdb.so db=/etc/ngircd/ngircd-vuser.db session required pam_loginuid.so Ngircd is running under the user irc but I am not sure if the user has permissions to use this pam file as specified in the PAM.txt file? - I see the following message in /var/log/syslog: ==> /var/log/auth.log <== Aug 23 10:41:12 mail ngircd[8733]: PAM _pam_init_handlers: could not open /etc/pam.conf Aug 23 10:41:12 mail ngircd[8733]: PAM pam_start: failed to initialize handlers ==> /var/log/syslog <== Aug 23 10:41:12 mail ngircd[8733]: PAM: Failed to create authenticator! (26) Why is it looking in the empty file /etc/pam.conf and not /etc/pam.d/ngircd ? My relevant config sniplet: # Use PAM if ngIRCd has been compiled with support for it. PAM = yes PAMIsOptional = no Can I force Ngircd to look for /etc/pam.d/ngricd (world readable) ? I am using this berkley vuser setup the same way with vsftpd. Regards, Michiel

2 7

ngIRCd 20.3
by Alexander Barton 24 Aug '13

24 Aug '13

Hello! A severe bug in ngIRCd 18 up to and including 20.2 has been discovered which will crash the daemon (denial of service) and can happen when the daemon fails to send the optional "notice auth" message to new clients connecting to the server (CVE-2013-5580). So here it is, our next release: ngIRCd 20.3. Please note that only setups having the configuration option "NoticeAuth" enabled are affected, which is not the default. The only change in ngIRCd 20.3 is the fix for the above bug, all installations should upgrade. But please stay tuned, ngIRCd 21 including new features like SSL fingerprints, and include directory for configuration files, better systemd(8) support etc. is the the works, too, and I hope that we can soon release a beta version for testing. I'll keep you informed! Changes in ngIRCd 20.3: • Security: Fix a denial of service bug (server crash) which could happen when the configuration option "NoticeAuth" is enabled (which is NOT the default) and ngIRCd failed to send the "notice auth" messages to new clients connecting to the server (CVE-2013-5580). More information can be found on the homepage <http://ngircd.barton.de/> and its mirror <http://ngircd.berlios.de/>. The primary download locations are: • <ftp://ftp.berlios.de/pub/ngircd/> • <http://ngircd.barton.de/pub/ngircd/> Regards Alex

1 2

Reporting 1.2K crashes
by Götz Hoffart 28 Jun '13

28 Jun '13

http://lists.debian.org/debian-devel/2013/06/msg00720.html ngircd doesn’t seem to be on the list, congrats :-) Grüße Götz

1 0

listen on port 443
by Xenophod 07 Jun '13

07 Jun '13

How can I get ngircd to listen on port 443? I don't need SSL, I just need a port that won't ever be blocked by ISPs/Wifi-hotspots/work networks I tried adding 443 to the listening ports, but I get a Permission denied message. Jun 6 11:18:08 ngircd[4605]: Can't bind socket to address 0.0.0.0:443 - Permission denied Jun 6 11:18:08 ngircd[4605]: Now listening on [0.0.0.0]:6666 (socket 8). Jun 6 11:18:08 ngircd[4605]: Now listening on [0.0.0.0]:6667 (socket 9). Jun 6 11:18:08 ngircd[4605]: Now listening on [0.0.0.0]:6668 (socket 10). Jun 6 11:18:08 ngircd[4605]: Now listening on [0.0.0.0]:6669 (socket 11). Nothing else is using port 443 on my machine either. The command below returns nothing. sudo netstat -lntup | grep 443 Can this be done with ngircd? Thanks

6 6

gource - software version control visualization - Google Project Hosting
by Götz Hoffart 27 Apr '13

27 Apr '13

http://code.google.com/p/gource/ Maybe for the ngircd-source-tree? Does anyone know some fancy CC music? Regards Götz

1 0

Set Topic
by Michiel van Es 18 Apr '13

18 Apr '13

Hello, I know how you can set the PredefChannelsOnly = yes to ensure only those channels are created and available but can I do the same with the Topic? Yes I can set the Topic option in the channel but people are still able to change the Topic to something else. I also want to disable that option so that people can only chat and not change the topic of the room. Any help is appreciated. Michiel

1 0

question about ngircd
by Michiel van Es 29 Mär '13

29 Mär '13

Hello, I am using the latest ngircd on a raspberry pi (armhf) with Debian Wheezy. I was wondering if I can restrict the creation of rooms/channels in Ngircd? I've created 2 rooms/channels which I want to be the only one available and that other people can only use those 2 rooms and can not create their own. Is that possible? Thanks for any help. Michiel

2 2

fcntl.h: present but cannot be compiled
by Aaron Walker 20 Mär '13

20 Mär '13

Hello, I'm trying to configure/build ngircd on AIX 6.1, and got the following error. Reporting it because it asked me nicely. root@r59s2h4:/twiki/ngircd/ngircd-20.2 # ./configure checking build system type... powerpc-ibm-aix6.1.0.0 checking host system type... powerpc-ibm-aix6.1.0.0 checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... ./install-sh -c -d checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ISO C99... -std=gnu99 checking for gcc -std=gnu99 option to accept ISO Standard C... (cached) -std=gnu99 checking for gawk... (cached) nawk checking whether ln -s works... yes checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking for an ANSI C-conforming const... yes checking for inline... inline checking for function prototypes... yes checking how to run the C preprocessor... gcc -std=gnu99 -E checking for grep that handles long lines and -e... /opt/freeware/bin/grep checking for egrep... /opt/freeware/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... no checking for string.h... (cached) yes checking whether gcc -std=gnu99 accepts -fstack-protector... no checking for ANSI C header files... (cached) yes checking for sys/wait.h that is POSIX.1 compatible... yes checking whether time.h and sys/time.h may both be included... yes checking fcntl.h usability... no checking fcntl.h presence... yes configure: WARNING: fcntl.h: present but cannot be compiled configure: WARNING: fcntl.h: check for missing prerequisite headers? configure: WARNING: fcntl.h: see the Autoconf documentation configure: WARNING: fcntl.h: section "Present But Cannot Be Compiled" configure: WARNING: fcntl.h: proceeding with the compiler's result configure: WARNING: ## ----------------------------------------- ## configure: WARNING: ## Report this to ngircd-ml(a)ngircd.barton.de ## configure: WARNING: ## ----------------------------------------- ## checking for fcntl.h... no configure: error: required C header missing! Merci, Aaron

1 0

A little pam help?
by Doug 06 Mär '13

06 Mär '13

Hi, I was wondering if someone could shed some light on how to use PAM with ngircd? I've set PAM = yes, and PAMIsOptional = no, but I'm kind of fuzzy on how this is supposed to work. The client connects with a nick and username, (in this case my username for both, douglasl). The server rejects the connection, and logs: [18632:6 5] Accepted connection 7 from 127.0.0.1:59814 on socket 6. [18906:3 5] PAM: Error on "douglasl" (douglasl!~douglasl@localhost): Authentication failure [18632:3 5] User "douglasl!~douglasl@localhost" rejected (connection 7): Bad password! [18632:6 5] Shutting down connection 7 (Bad password) with localhost:59814 ... [18632:5 5] Client "douglasl" unregistered (connection 7): Bad password [18632:6 5] Connection 7 with localhost:59814 closed (in: 0.1k, out: 0.0k). Riiight. I'm pretty sure I've got pam working, because I can use pamtester well enough: ~/ngircd/pamtester-0.1.2/src# ./pamtester login douglasl authenticate Password: pamtester: successfully authenticated So, the question is, how the irc client supposed to be supplying the password for the user? The raw commands to the server after connect are PASS / NICK / USER, which sound like they should be all I need. :/ Any ideas? ~ Doug.

2 2