iacd Administrator's Guide

Thomas Graf


Contents

Introduction

This document gives step by step instructions to install and run iacd from an administrator's viewpoint.

Thanks to all who helped develop iacd with code or social support.

Disclaimer & License

This document is distributed WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This document may be distributed only subject to the terms and conditions set forth in the Open Publication License, v1.0 or later (the latest version is presently available at http://www.opencontent.org/openpub/).

Installing iacd

Requirements

The following requirements need to be fulfilled to successfully compile and install iacd:

Supported Platforms

I would be pleased if you drop me a line if you successfully compile and run iacd on a platform not listed here.

Getting the Source Code

Download the latest stable version of iacd from http://trash.net/~reeler/iacd/. I recommend to also download the .md5sum and .sig file besides the source tarball.

Check the MD5 sum, check if the source was not modified by a third party and finally unpack the source:

$ md5sum -c iacd-<version>.tar.gz.md5sum
$ gpg --verify iacd-<version>.tar.gz.sig 
gpg: Signature made <date> using DSA key ID 4E663A79
gpg: Good signature from "Thomas Graf <tgr@reeler.org>"
$ tar xzvf iacd-<version>.tar.gz
iacd-<version>/
iacd-<version>/doc/
...
$ cd iacd-<version>

Compile Time Options

All compile time options entail a recompliation before taking effect. Therefore you need to restart the server after changing the settings. If you need to change the same option over and over you can contact me and I'll make a configuration option out of it.

The configure script is generated by autoconf and thus supports -prefix and -sysconfdir etc. Besides that, table [*] contains a list of all options recognized by the iacd configure script.


Table: list of configure options


Table [*] lists the most important compile time options which can be changed in config.h with your favourite text editor. Most of this options define upper limits of values and are not implemented as configuration option because of performance issues or more likely because I was too lazy.


Table: config.h Options


Table [*] contains a list of all text limits. I separated them because each IRC network administrator has other ideas about maximum nickname etc.


Table: config.h Limits


Compiling

So, you finally finished to configure iacd and are ready to compile it.

$ make

This will compile and link iacd like you requested in the configure options.

You can recompile iacd anytime with:

$ make clean all

Installing


Normal Installation

The normal installation procedure will install iacd into the directory you specified with -prefix (default is /usr/local). Run

$ make install

to install iacd. The default permissions allow everyone to start the server.

Chroot Installation

iacd has support to chroot() at runtime since version 0.0.23 and therefore no special installation is required.

See chapter [*] for further instructions to install iacd.

Configuring iacd

iacd can be configured through a configuration file which is read at start time or if SIGHUP is received.


Table: Configuration Identifiers


Running iacd

Arguments

Type iacd -h to get a list of all suported command line options.

$ iacd -h
-d          run in background
-f <file>   configuration file
-u <user>   drop privs and change to this user
-g <group>  drop privs and change to this group
-c <path>   chroot() to this path
-v <level>  verbose output

Daemon mode (-d)

The -d flag will fork iacd into the background and force all log messages to be sent to syslog. You should use this flag instead of using the shell's builtin job background control mechanism.

$ iacd -d
$

Configuration file path (-f)

Alternative path to configurtion file, default is SYSCONFDIR/iacd.conf where SYSCONFDIR is the value you've given with -sysconfdir=.

$ iacd -f /d1/iacd/etc/iacd.conf

Privileges drop (-u -g)

iacd is able to drop it's privileges. The privileges drop is done after all actions that require the superuser status are done (chroot, setrlimit). Here's a list of all actions that are taken before the privileges drop:

Privileges drop means changing uid/gid to a user/group which does only have permissions required to run iacd.

$ iacd -u irc -g irc

Will run iacd with uid=irc gid=irc. In case of an exploitable overrun the attacker only gets limited privileges on your system.

Chroot (-c)

Chroot is yet another way to reduce risc in case of an attack. It does change root directory to another path after all file descriptors and libraries have been loaded. This means you can REHASH your configuration placed outside the chroot directory while iacd is running.

$ iacd -c /chroot/iacd/

Note: The chroot option is very useful but makes using scripts quite difficult, because you have to copy the perl interpreter into the chroot if you're using perl scripts etc.

Verbose output (-v)

Verbose output prints debug and other messages to stdout or syslog. Note that iacd will not print any messages except error and warning messages if -v <level> is not specified. See table [*] for a list of message levels.


Table: Verbose message levels


Note: Most RAW I/O messages are protected with a #ifdef DEBUG to save a few cpu cycles, this means you need to compile iacd with -enable-debug to get this messages.

Administrator's interface

Stats Reports

/STATS returns information about the status of the irc server. See table [*] for a list of available modes.

Example:

> stats u
-!- Server Up 4 days 13:58:13
-!- u End of STATS report.

Some of the stat reports required IRCOP privileges.


Table: stats modes


Dump

DUMP is an extensions not described in the RFCs but might be useful to an administrator.

Dumping User Information

Syntax:

DUMP USER <nick>

Example:

> dump user reeler
!kirika Dumping user: reeler!tgr@kirika
!kirika Nick: reeler
!kirika User: tgr
!kirika Hostname: kirika
!kirika Ircname: Thomas Graf
!kirika IP: 127.0.0.1
!kirika Port: 33182
!kirika Hopcount: 0
!kirika Away Message: blah
!kirika Server: kirika
!kirika Server info: my irc server ;)
!kirika Quit message: none set
!kirika Signon: 1026652023 [Sun Jul 14 15:07:03 2002]
!kirika Idle: 1026652068 [9 seconds]
!kirika Flags: 4bf
!kirika  - IAC_NICKSENT
!kirika  - IAC_USERSENT
!kirika  - IAC_OK
!kirika  - IAC_LOCAL
!kirika  - IAC_LOG
!kirika  - IAC_PONG
!kirika  - IAC_OPERATOR
!kirika  - IAC_INVISIBLE
!kirika Joined channels:
!kirika  - #42

Dumping Channel Information

Syntax:

DUMP CHANNEL <channel>

Example:

> dump channel #42
!kirika Dumping channel: #42
!kirika Flags (0):
!kirika Owner: reeler
!kirika Logfile: (NULL)
!kirika Topic 00: (none:0) none
!kirika Topic 01: (reeler:1026652379) this is a test topic
!kirika Topic 02: (reeler:1026652385) this is a newer topic
!kirika Topic 99: (reeler:1026652392) this is the newest topic
!kirika Topic 04: (none:0) none
!kirika Topic 05: (none:0) none
!kirika Topic 06: (none:0) none
!kirika Topic 07: (none:0) none
!kirika Topic 08: (none:0) none
!kirika Topic 09: (none:0) none

Dumping Server Information

Syntax:

DUMP SERVER <servername>

Example:

> dump server kirika
!kirika Dumping server: kirika
!kirika Info: my irc server ;)
!kirika Numeric: 1
!kirika Hopcount: 0
!kirika Flags: 0

Dumping Block Information

Syntax:

DUMP BLOCK <mask>

Example:

> dump block
!kirika Dumping block *!*@207.46*
!kirika Reason: Don't abuse the network
!kirika #Matches: 0
!kirika Next pointer: (NULL)

Dumping Link Information

Syntax:

DUMP LINK <remote host>

Example:

> dump link
!kirika Dumping link: 0
!kirika Host: localhost
!kirika Port: 7002
!kirika Password: secret
!kirika Options: m
!kirika Mask: *
!kirika Flags: 0
!kirika Next pointer: (NULL)

Dumping Script Information

Syntax:

> dump script mail
!kirika Dumping script mail
!kirika Nick: mail
!kirika Command: scripts/mail
!kirika Char Regex: -
!kirika Next Pointer: (nil)

Dumping Server Connection Information

Syntax:

DUMP SERVER_CONN <remote hostname>

Example:

> dump server_conn test2
!kirika Dumping server connection test2
!kirika Numeric: 2
!kirika Info: test server 2
!kirika IP: 127.0.0.1
!kirika Init time: Sun Jul 14 15:29:06 2002
!kirika Hopcount: 0
!kirika Ping (seconds): 0
!kirika Port: 7002
!kirika Socket: 6
!kirika Queue length: 0
!kirika Bytes sent: 238
!kirika Messages sent: 8
!kirika Bytes received: 127
!kirika Messages received: 5
!kirika Flags: b5
!kirika  - IAC_PASSSENT
!kirika  - IAC_OK
!kirika  - IAC_MASTER
!kirika  - IAC_PONG
!kirika  - IAC_USEMSGID
!kirika Current message being sent:

Server Linking

iacd has it's own server linking interface for the administrator, the way suggested by the RFC is also supported though.

List of Configured Links

> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected

Adding Links

Syntax:

LINK ADD <autoconnect> <mask> <host> <port> <password> [<options>]

Example:

> LINK ADD 0 * 42.42.42.42 1337 leet m
!kirika Added 42.42.42.42:1337 (*) to link table
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 42.42.42.42  1337   *          leet       0 Disconnected
!kirika 127.0.0.1    7002   *          secret     0 Disconnected

Removing Links

Example:

> LINK REMOVE 42.42.42.42
!kirika Removed link entry 42.42.42.42
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected

Connecting

Example:

> LINK CONNECT 127.0.0.1
!kirika Now linked to 127.0.0.1:7002
!kirika New server connection (127.0.0.1:7002)
!kirika New server test2 (2) 127.0.0.1:7002 [test server 2]
> LINK
!kirika 127.0.0.1    7002   *          secret     0 Connected, Master

Or if something goes wrong:

> LINK CONNECT 127.0.0.1
!kirika While linking to (127.0.0.1:7002): Could not connect to
        server 127.0.0.1: Connection refused
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected,
                                                    Failed, Retry

iacd will retry to connect to the server.

Stop Retrying

Example:

> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected,
                                                    Failed, Retry
> LINK STOP 127.0.0.1
!kirika Link 127.0.0.1 no longer being retried
> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Disconnected, Failed

Closing a Server Link

Example:

> LINK
!kirika Host         Port   Mask       Password   A Flags
!kirika 127.0.0.1    7002   *          secret     0 Connected, Master
> LINK CLOSE 127.0.0.1
!kirika Closing server link to test2
!kirika Lost server connection (127.0.0.1:7002)

Client Blocking

iacd has support to block clients from connecting to the server.

Syntax:

BLOCK [<mask> [<reason>]

mask is compared each time a user is connecting to the server, this is done after nick and username has been sent. The string being compared has the format: nick!username@ip:port[realname]. If no mask is given all configured block lines are printed out. reason is the string sent to the user before he gets disconnected, default value is "You are banned".

Example:

> BLOCK reeler*
!kirika reeler* now being blocked (You are banned)
> BLOCK
!kirika Being blocked:
!kirika reeler* -> You are banned (0)
> UNBLOCK reeler*
!kirika Removing block reeler* (You are banned)

Lastlog

The lastlog replaces WHOWAS and shows who has logged in at what time.

> LASTLOG
!kirika Jul 14 15:59:37 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33361)
!kirika Jul 14 15:59:34 hans!tgr@kirika [Thomas Graf] (127.0.0.1:33359)
!kirika Jul 14 15:59:27 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33357)
!kirika Jul 14 15:59:26 reeler!tgr@kirika [Thomas Graf] (127.0.0.1:33356)

About this document ...

iacd Administrator's Guide

This document was generated using the LaTeX2HTML translator Version 2K.1beta (1.48)

Copyright © 1993, 1994, 1995, 1996, Nikos Drakos, Computer Based Learning Unit, University of Leeds.
Copyright © 1997, 1998, 1999, Ross Moore, Mathematics Department, Macquarie University, Sydney.

The command line arguments were:
latex2html -split 0 -no_navigation -no_auto_link -mkdir -dir doc/admin.html/ doc/admin.tex

The translation was initiated by root on 2003-10-30


Footnotes

...2.1
list containing nick!user@host of the last new connections


root 2003-10-30