We had a couple of other requirements, especially if we were going to expose the port on an externally-accessible address.  The first was to allow only authorized connections from clients who presented a valid SSL certificate.  This is the first half of the patch.  If linked with GNUTLS, the patch will allow the admin to limit connections to clients that present a valid cert, signed by a valid CA in the server cert's chain of trust. It also supports revocation lists.

Second is the addition of a new caching process called authcache.  We wire up authentication through PAM and on to an one-time password infrastructure.  We chose to do this since IRC clients don't bother trying to keep that password protected... at all.. It is even written to the client's history files in many cases. To shorten the window of opportunity for exposed credentials, the user enters an OTP when authenticating.   Naturally, with the manner and frequency in which IRC clients disconnect and reconnect, entering credentials repeatedly would be infuriating (and impossible with most clients.)    Authcache will create a token from the hash of the original IRC name, source connection hostname/address, and if SSL is enabled, the client certificate's hash, and store it in a table for a user-configurable amount of time. This table is consulted when a new connection is made and bypasses the internal authentication step if a record is found.  A user or admin directed logoff will clear the connection's entry.