# ircd.conf configuration file for ircd version ircu2.9.mu and ircu2.10 # # Last Updated: 26, June 2001. # # Written by Niels , based on the original example.conf, # server code and some real-life (ahem) experience. # # Updated and heavily modified by Braden . # # Thanks and credits to: Run, Trillian, Cym, Morrissey, Chaos, Flynn, # Xorath, WildThang, Mmmm, SeKs, Ghostwolf and # all other Undernet IRC Admins and Operators, # and programmers working on the Undernet ircd. # # This is an example of the configuration file used by the Undernet ircd. # # This document is based on a (fictious) server in Europe with a # connection to the Undernet IRC network. It is primarily a leaf server, # but if all the other hubs in Europe aren't in service, it can connect # to one in the US by itself. # # All configuration options start with a letter identifying the option, # and a colon separated list of options. Unused fields should be left # blank. # # Please note that when ircd puts the configuration lines into practice, # it parses them exactly the other way round than they are listed here. # It reads the lines in reverse order. # # This means that you should start your I: lines with the "fall through", # most vanilla one and end with the most detailed. # # There is a difference between the "hostname" and the "server name" # of the machine that the server is run on. For example, the host can # have "veer.cs.vu.nl" as FQDN, and "Amsterdam.NL.EU.undernet.org" as # server name. # A "server mask" is something like "*.EU.UnderNet.org", which is # matched by "Amsterdam.NL.EU.undernet.org" but not by # "Manhattan.KS.US.undernet.org". # # Please do NOT just rename the example.conf to ircd.conf and expect # it to work. # [INCLUDES] # # include: # # If you find your ircd.conf is getting too large or wish to seperate it # out into files, you can with includes. Below are some examples. The path # to the file is optional. But if you dont include the path then the ircd # will check the dir where ircd.conf is for the file. # # include:extra.conf # include:/path/to/extra.conf # # Currently if you use linesync then it will not check or know about file # includes. # [M:line] # # First some information about the server. # M::::: # # must contain either a * or a valid IPv4 address in # dotted quad notation. (127.0.0.1) The address MUST be the address # of a physical interface on the host. This address is used for outgoing # connections only, see P:lines for listener virtual hosting. # If in doubt put a * or the IP of your primary interface here. # The server must be compiled with virtual hosting turned on to get this # to work correctly. # # Note that has to be unique on the network your server # is running on, must be between 0 and 4095, and is not updated on a rehash. M:London.UK.Eu.UnderNet.org::University of London, England::1 # [A:line] # # This sets information that can be retrieved with the /ADMIN command. # It should contain at least an admin Email contact address. # A::: A:The University of London:Undernet IRC server:IRC Admins # [Y:lines] # # All connections to the server are associated with a certain "connection # class", be they incoming or outgoing (initiated by the server), be they # clients, servers or Martians. (Note that ircd doesn't have direct support # for Martians (yet?); they will have to register as normal users. ;-) # Take the following Y: lines only as a guide. # Y::::: # # applies only to servers, and specifies the frequency # that the server tries to autoconnect. setting this to 0 will cause # the server to attempt to connect repeatedly with no delay until the # condition is satisfied. This is a Bad Thing(tm). # # should be set at either 0 or 1. # # Server classes: 90 = all your uplinks for who you do not wish to hub; # 80 = leaf servers (only used if your server is a hub) Y:90:90:300:1:9000000 Y:80:90:300:0:9000000 # Client classes. 10 = locals; 2 = for all .net and .com that are not # in Europe; 1 = for everybody. Y:10:90:0:100:160000 Y:2:90:0:5:80000 Y:1:90:0:400:160000 # [I:lines] # # To allow clients to connect, they need authorization. This can be # done based on hostmask, address mask, and/or with a password. # With intelligent use of classes and the maxconnections field in the # Y: lines, you can let in a specific domain, but get rid of all other # domains in the same toplevel, thus setting up some sort of "reverse # K: line". # I::::: # # Technical description (for examples, see below): # For every connecting client, the IP address is known. A reverse lookup # on this IP-number is done to get the (/all) hostname(s). # Each hostname that belongs to this IP-number is matched to , # and the I: line is used when any matches; the client will then show # with this particular hostname. If none of the hostnames match, then # the IP-number is matched against the field, if this matches # then the I: line is used nevertheless and the client will show with the # first (main) hostname if any; if the IP-number did not resolve then the # client will show with the dot notation of the IP-number. # There is a special case for the UNIX domain sockets and localhost connections # though; in this case the field is compared with the # name of the server (thus not with any IP-number representation). The name # of the server is the one returned in the numeric 002 reply, for example: # 002 Your host is 2.undernet.org[jolan.ppro], running version ... # Then the "jolan.ppro" is the name used for matching. # Therefore, unix domain sockets, and connections to localhost would # match this I: line: # I:jolan.ppro::foobar::1 # Finally, I: lines with empty or fields are skipped. # # This is the "fallback" entry. All .uk, .nl, and all unresolved are # in these two lines. # By using two different lines, multiple connections from a single IP # are only allowed from hostnames which have both valid forward and # reverse DNS mappings. I:*@*:1:Unresolved::1 I:Resolved::*@*::1 # If you don't want unresolved dudes to be able to connect to your # server, use just: # I:NotMatchingCrap::*@*::1 # # Here, take care of all American ISPs. I:Resolved::*@*.com::2 I:Resolved::*@*.net::2 # Now list all the .com / .net domains that you wish to have access... # actually it's less work to do it this way than to do it the other # way around - K: lining every single ISP in the US. # I wish people in Holland just got a .nl domain, and not try to be # cool and use .com... I:Resolved::*@*.wirehub.net::1 I:Resolved::*@*.planete.net::1 I:Resolved::*@*.ivg.com::1 I:Resolved::*@*.ib.com::1 I:Resolved::*@*.ibm.net::1 I:Resolved::*@*.hydro.com::1 I:Resolved::*@*.NL.net::1 # You can request a more complete listing, including the "list of standard # K-lines" from the Routing Committee; it will also be sent to you if # you apply for a server and get accepted. # # Ourselves - this makes sure that we can get in, no matter how full # the server is (hopefully). I:*@193.37.*::*@*.london.ac.uk::10 # You can put a digit (0..9) in the password field, which will make ircd # only accept a client when the total number of connections to the network # from the same IP number doesn't exceed this number. # The following example would accept at most one connection per IP number # from "*.swipnet.se" and at most two connections from dial up accounts # that have "dial??.*" as host mask: # I:Resolved:1:*@*.swipnet.se::1 # I:Resolved:2:*@dial??.*::1 # # If you are not worried about who connects, this line will allow everyone # to connect. I:*::*::1 # [T:lines] # # It is possible to show a different Message of the Day to a connecting # client depending on its origin. # T:: # or: # T:: # # DPATH/net_com.motd contains a special MOTD where users are encouraged # to register their domains and get their own I: lines if they're in # Europe, or move to US.UnderNet.org if they're in the USA. T:*.net:net_com.motd T:*.com:net_com.motd T:2:net_com.motd # A different MOTD for ourselves, where we point out that the helpdesk # better not be bothered with questions regarding irc... T:*.london.ac.uk:london.motd # [U:lines] # # One of the many nice features of Undernet is "Uworld", a program # connected to the net as a server. This allows it to broadcast any mode # change, thus allowing opers to, for example, "unlock" a channel that # has been taken over. # There is only one slight problem: the TimeStamp protocol prevents this. # So there is a configuration option to allow them anyway from a certain # server. # U:::* # # Note: (1) These lines are agreed on by every server admin on Undernet; # (2) These lines must be the same on every single server, or results # will be disasterous; (3) This is a useful feature, not something that # is a liability and abused regularly (well... :-) # If you're on Undernet, you MUST have these lines. I cannnot stress # this enough. If all of the servers don't have the same lines, the # servers will try to undo the mode hacks that Uworld does. Make SURE that # all of the servers have the EXACT same Ulines. # # As of ircu2.10.05 is it possible to Jupe nicks. Juped nicks need to be # added to U: lines. As per CFV-0095, the following nicks must be juped, # it is not allowed to jupe others as well. U:Uworld.EU.undernet.org:EuWorld,E,StatServ,NoteServ:* U:Uworld2.undernet.org:UWorld2,ChanSvr,ChanSaver,ChanServ:* U:Uworld.undernet.org:Uworld,NickSvr,NickSaver,NickServ:* U:channels.undernet.org:LPT1,X,login:* U:channels2.undernet.org:LPT2,W,Undernet:* U:channels3.undernet.org:COM1,V,protocol:* U:channels4.undernet.org:COM2,U,pass:* U:channels5.undernet.org:COM3,Y,AUX:* U:channels6.undernet.org:COM4,Z,newpass:* # [K:lines] # # While running your server, you will most probably encounter individuals # or groups of persons that you do not wish to have access to your server. # # For this purpose, the ircd understands "kill lines". # K::"": # # It is possible to use a file as comment for the ban. # K::!: # # The default reason is: "You are banned from this server" # Note that K: lines are local to the server; if you ban a person or a # whole domain from your server, they can get on IRC via any other server # that doesn't have them K: lined (yet). # # With a simple comment, using quotes: K:*.au:"Please use a nearer server":* K:*.edu:"Please use a nearer server":* # With a file, prepending a '!' before the filename. # The file can contain for example, a reason, a link to the # server rules and a contact address. K:unixbox.flooder.co.uk:!kline/youflooded.txt:*luser # # IP-based kill lines are designated with a lowercase 'k'. These lines # use the same format as normal K: lines, except they apply to all hosts, # even if an IP address has a properly resolving host name. k:192.168.*:!klines/martians:* # Additionally, you may specify a hostmask prefixed with $R to indicate # a match should be performed against the "real-name" / "info" field # instead of the host/IP. K:$R*sub7*:"You are infected with a Trojan":* # [C:lines] # # You probably want your server connected to other servers, so your users # have other users to chat with. # IRC servers connect to other servers forming a network with a star or # tree topology. Loops are not allowed. # In this network, two servers can be distinguished: "hub" and "leaf" # servers. Leaf servers connect to hubs; hubs connect to each other. # Of course, many servers can't be directly classified in one of these # categories. Both a fixed and a rule-based decision making system for # server links is provided for ircd to decide what links to allow, what # to let humans do themselves, and what links to (forcefully) disallow. # # The Connection lines (also known as C lines) # define what servers the server connect to, and which servers are # allowed to connect. # C::::: # # The "port" field defines the default port the server tries to connect # to if an operator uses /connect without specifying a port. This is also # the port used when the server attempts to auto-connect to the remote # server. (See Y:lines for more informationa about auto-connects). # # Our primary uplink. C:1.2.3.4:passwd:Amsterdam.NL.Eu.UnderNet.org:4400:90 # [H:lines] # # If your server starts on a bit larger network, you'll probably get # assigned one or two uplinks to which your server can connect. # If your uplink(s) also connect to other servers than yours (which is # probable), you need to define your uplink as being allowed to "hub". # H:::: H:*.*::Amsterdam.NL.Eu.UnderNet.org # [L:lines] # # Of course, the opposite is also possible: forcing a server to be # a leaf. L: lines follow Murphy's Law: if you use them, there's a big # chance that routing will be screwed up afterwards. # L:::: # [D:lines] # # For an advanced, real-time rule-based routing decision making system # you can use Disallow lines. For more information, see doc/readme.crules. # D::: # d::: # D:*.US.UnderNet.org::connected(*.US.UnderNet.org) # d:*.EU.UnderNet.org::connected(Amsterdam.NL.EU.*) # # The following line is recommended for leaf servers: # d:*::directcon(*) # [O:lines] # # Inevitably, you have reached the part about "IRC Operators". Oper status # grants some special privileges to a user, like the power to make the # server break or (try to) establish a connection with another server, # and to "kill" users off IRC. # I can write many pages about this; I will restrict myself to saying that # if you want to appoint somebody as IRC Operator on your server, that # person should be aware of his/her responsibilities, and that you, being # the admin, will be held accountable for their actions. # # There are two sorts of IRC Operators: "local" and "global". Local opers # can squit, connect and kill - but only locally: their +o user mode # is not not passed along to other servers. On Undernet, this prevents # them from using Uworld as well. # Depending on some defines in include/config.h, local operators are also # not allowed to /DIE and /RESTART the server. # Local operators are designated with a lowercase 'o' # O::::: # o::::: # # There are 2 types of flags currently which will only work if the OPERFLAGS # is enabled. When the feature is disabled, the flags are ignored. # # O - Global Operator # A - IRC Administrator # # The encrypted password is optional. If you wish to encrypt your password, # there is a utility in the ircd. Please read the file tools/README. O:*@*.cs.vu.nl:VRKLKuGKn0jLs:Niels::10 o:*@*.uu.net:noncryptedpass:Braden::10 # Note that the is optional, but leaving it away # puts the O: lines in class 0, which usually only accepts one connection # at a time. If you want users to Oper up more then once per O: line, # then use a connection class that allows more then one connection, # for example (using class 10 as in the example above): # # Once you OPER your connection class changes no matter where you are or # your previous connection classes. If the defined connection class is 10 # for the O:line, then your new connection class is 10. # Y:10:90:0:100:160000 # [S:lines] # # S:::<*.host.cc|a.b.c.*|CIDR>: # A hostname to be spoofed # A password for this spoof host. Used if SETHOST_USER is enabled. # A hostmask for matching against users that are to be auto # spoofed. Used if SETHOST_AUTO is enabled. Can be of form: # host.domain.cc, 127.0.0.1 or 127.0.0.0/24, supports wildcards # for non-CIDR. # A mask for matching against the user's ident reply. # # Oper sethost for 'moo.fish.moo' #S:moo.fish.moo::: # User & Oper sethost for 'moo.fish.moo' #S:moo.fish.moo:elitepassword:: # Oper sethost for 'moo.fish.moo' with auto on 'ident@*.example.com" #S:moo.fish.moo::*.example.com:ident # Oper sethost for 'moo.fish.moo' with auto on 'user*@*.example.com" #S:moo.fish.moo::*.example.com:user* # [B:lines] # These are lines intended to improve the generic irc users ability to # use network services. Each line sets up a / alias so that # users may type that instead of a full /msg command. # # for example.. adding: ## B:X2:X2@X2.AfterNET.Services:* # would result in commands like this being possible ## /X2 HELP # # B::: # # B:X2:X2@X2.AfterNET.Services:* # B:AUTH:AuthServ@OperServ.AfterNET.Services:"AUTH" # [b:lines] # Note lowercase b. These lines will enable the server to forward any # messages which are prefixed and specific with a b:line. This will # allow users to use the services without the services being in channel. # # b:: # # b:!:services.network.org # b:?:services.network.org # # Any channel messages prefixed with a ? or a ! would be sent to # services.network.org in the above examples. # [P:lines] # When your server gets more full, you will notice delays when trying to # connect to your server's primary listening port. It is possible via the # Port lines to specify additional ports for the ircd to listen to. # De facto ports are: 6667 - standard; 6660-6669 - additional client # ports; # Undernet uses 4400 for server listener ports. # These are just hints, they are in no way official IANA or IETF policies. # IANA says we should use port 194, but that requires us to run as root, so # we don't do that. # # P:::<[CES][H]>: # # The hostmask setting allows you to specify a range of IP addresses that # you will allow connections from. This should only contain IP addresses # and '*' if used. This field only uses IP addresses. This does not use # DNS in any way so you can't use it to allow *.nl or *.uk. Attempting # to specify anything other than numbers, dots and stars [0-9.*] will result # in the port allowing connections from anyone. # # The interface setting allows multiply homed hosts to specify which # interface to use on a port by port basis, if an interface is not specified # the default interface will be used. The interface MUST be the complete # IP address for a real hardware interface on the machine running ircd. # If you want to use virtual hosting *YOU* *MUST* *USE* *THIS* otherwise it # WILL bind to all interfaces - not what most people seem to expect. # # The [CES][H] field is an optional field to specify that a port is a # server port or a client port and whether it's hidden or not. # If used the first character MUST be either a C, E, or S. # If you want to hide a port from /stats p from non-opers follow the C # or S with an H # # C = Client (Ports 6660-6669) # E = Encrypted SSL (Port 7000) # S = Server (Port 4400) # # Encrypted SSL connections are for client connections ONLY! # # P:::<[CES][H]>: # # This is a normal server port, you need to have at least one server # port defined if you want to connect your server to other servers. P:::S:4400 # This is a Server port that is Hidden #P:::SH:4401 # The following are normal client ports P:::C:6667 P::::6668 P:192.168.*:::6666 # This is an Encrypted SSL client port #P:::E:7000 # This is a hidden client port, listening on the interface associated # with the IP address 168.8.21.107 #P:*:168.8.21.107:CH:7000 # [R:lines] # # These are redirection lines, when a client connects and his/her host # matches a q:line then a 010 reply is sent with the redir server and # port. Currently only epic supports a autoredirection when it gets a # 010 reply (ie it will automatically connect to the server said in the # 010 reply. Other clients will get a message saying what server and # port to connect to. Aswell as a unauthorised connection quit. # # R::: # # R:*.aol.com:irc.aol.com:6667 # R:*.us:us.undernet.org:6667 # R:*.nz:nz.undernet.org:6667 # [Q:lines] # # This allows you (the admin) to disallow the usage of /OPMODE and # /CLEARMODE on certain sensitive channels. Opers trying to do that # will receive a short notice. Depending on the setting of # OPER_FORCE_OPMODE, OPER_FORCE_LOPMODE and LOCOP_FORCE_LOPMODE, # global/local opers may override these lines by prefixing the # channel name with an exclamation mark ('!') # # Q:: # # Note that since the hash mark ('#') is used to start a comment, # you will have to escape it in the channel name (see below). # Q:\#shells:"Thou shalt not support the h4><0rz" # Q:&kiddies:"They can take care of themselves" # [X:lines] # # This allows you (the admin) to prevent clients connecting who are listed # on DNS blacklists. Their connection will be rejected during the connection # process along with the name and url you give for the DNSBL they have # been matched on. # # X::"":::"": # # # Flags: # # Bitmask DNSBL: b - See your DNSBL provider as to if you should use this or not. # Reply DNSBL: r - See your DNSBL provider as to if you should use this or not, this # type is normally the default type for most DNSBL's. # Allow Connect: a - Allow the client to connect anyway. This could be used with a # DNSBL whitelist. This could also be used to allow people in but # mark their hosts so that channel ops can choose weather they want # them in thier channel or not. # Deny Connect: d - If the user is found on this dnsbl then they cant connect, even if # they are allowed on another X:Line. # Mark Hostname: m - Mark the hostname of a skipped client. # # # The name option is used for the Mark hostname flag, this must contain hostname # valid characters only, ie NO spaces. With REPLY DNSBL's you need to list the # replies in a comma seperate list. See below for an example. With BITMASK DNSBL's # just again specify the replies you need to match against. The server will sum # them up and match them against the DNSBL reply. It is highly recomended that # you place the rejection message in "quotes". Rejection messages are limited # in length, currently they cant be all that long but that is being worked on. The # rejected users nick, username, ip, and host can be placed into the rejection # message by using these codes: # # %n - Nickname # %u - Username # %h - Hostname # %i - IP Address # # The rank number must be unique over all X:Lines, the higher the number- the more # rank it has. The highest ranking X:Line which is matched against a user will # get its name marked in the hostname. # # Example: # # X:dnsbl.sorbs.net:"sorbs.net":r:1,3,4:"%n!%u@%h Found On Sorbs DNSBL http://www.dnsbl.us.sorbs.net/cgi-bin/lookup?IP=%i":1 # # This will reject clients who get a return addresses of 1,3 and 4 off # dnsbl.sorbs.net. Sample rejection message: # # "bloggs!someident@google.com Found On Sorbs DNSBL http://www.dnsbl.us.sorbs.net/cgi-bin/lookup?IP=111.222.111.222" # # BITMASK Example: # # X:dnsbl.dnsbl.net:"dnsbl.net":b:1,3,5:"%n!%u@%h Found On DNSBL":2 # # I reccomend you take advantage of ircd.conf includes and list your X:Lines in # a seperate file as it could be quite a large list. # # Notes: MAKE SURE you read the DNSBL website before you go ahead and use it # as they may have rules for large sites/servers who use them. If you do not # wish to use DNSBL checking then simply do not set any X:lines. I only # reccomend that you use one DNSBL, due to the amount of time it will take to # connect with multiple DNSBL's. # [F:lines] # # IRC servers have a large number of options and features. Most of these # are set at compile time through the use of #define's--see "make config" # for more details--but we are working to move many of these into the # configuration file. Feature lines are the hook we're using for this. # F: