trunk/doc/serverhide.txt

                             Server Hide Reference

   $Id$

   Copyright (c) 2001-2015 ircd-hybrid development team

     ----------------------------------------------------------------------

   Due to pressures from abusers, the Hybrid developers have created a set of
   options to limit what users can and cannot do on the server. Each option
   can be enabled or disabled at runtime.

   This document describes the ircd-hybrid implementation of the server hiding
   ideas originated by (and credited to) numerous people.

     * LINKS as a file: This option is always enabled. It will generate a
       file at a certain interval, defined by the flatten_links_delay in
       ircd.conf, that contains the current LINKS data. This data is sent
       to users whenever a LINKS is requested. Opers will always see the
       current server structure.

       The file that the LINKS data is stored in is by default var/lib/links.txt.

       The benefits of this are that transient splits will not be seen by
       users issuing LINKS commands, and if a server is split, users can
       still see what other servers are normally available.

     * Flattened LINKS: This option forces every server to look as if it is
       connected to the local server. Users will see a flat LINKS tree.

       The benefit to using LINKS flattening is that users cannot get
       information on how servers are routed.

       The flatten_links in the serverhide {} block in the ircd.conf controls
       this feature.

       As a side effect, all netsplit quit messages will appear to originate
       from the local server.

       +--------------------------------------------------------------------+
       | Flattened LINKS is needed for any network that uses the hidden hub |
       | option. See below for more details.                                |
       +--------------------------------------------------------------------+

     * Hidden server option: This option will hide the server from a
       flattened LINKS list on other servers. Opers will of course see the
       true routing of the network.

       This is controlled by the hidden option in ircd.conf.

       +--------------------------------------------------------------------+
       | Technically, this code is a hack. With this option enabled, the    |
       | server will prepend '(H) ' to the server info field when           |
       | connecting to other servers. Other servers must understand that    |
       | the (H) means hidden.                                              |
       +--------------------------------------------------------------------+

     * The hide_servers option forces the server to not be shown when a user
       issues WHOIS and other commands which may show what server a user is
       on.

       Local user counts, as normally displayed in LUSERS, and the 255
       numeric, will be shown with the same values as the global counts.
       Displaying it this way will help protect servers and avoid breaking
       scripts that depend on the 265 and 266 numerics on connect.

       To be effective, this option must be used network wide.

     * The disable_remote_commands option takes care of most of the remaining
       issues. These include, for example, "ADMIN some.hub.server", "VERSION
       someuser", and similar commands. A server with this option enabled will
       only prevent local users from issuing remote commands. Remote users
       will not be affected.

       Remote WHOIS is not blocked. It is, however, restricted to only
       querying WHOIS nick nick. The ircd will disregard the server parameter
       and always use queried nick.

     * All server modes appear to originate from the server you are using.
       This feature is not tunable; and opers also do not see the real server
       setting the mode.

   Each item is briefly described in the serverhide {} block in reference.conf.

     ----------------------------------------------------------------------

Using Non-QS Compliant Hubs

   The flattened LINKS option will, as a side effect, display all user QUITs
   due to network splits in the following format:

   :user QUIT :*.net *.split

   This works extremely well as long as all servers on your network are
   compliant with the QS capability, which sends a single SQUIT to the
   network when a server (or tree of servers) splits. All quit messages are
   generated on the local server. Certain older servers do not have this
   ability, and as such will generate their own quit messages for users who
   left because of the split. This can cause leaks in the hub server names
   and the structure of the network.

   A quick example is the following network structure:

   servA(Hyb7) --- hubA(nonQS) --- servB(not-important)

   When servB splits from hubA, hubA will generate a QUIT command for every
   user on servB (and anything behind servB). Since the QUIT message was not
   created on your server, with server hiding enabled, the QUIT message will
   contain the real server names.

   The only way to prevent this leak on a network is to only use hubs
   supporting the QS capability. Hybrid 6 (and above) and csircd all are
   currently running daemons that support QS. Hybrid 5 and 2.8.21+CSr servers
   do not support QS, and will leak server names (and therefore routing
   information) on splits.
Revision:	6599
Committed:	Thu Oct 22 17:52:15 2015 UTC (10 years, 9 months ago) by michael
Content type:	text/plain
File size:	5392 byte(s)
Log Message:	- Added serverhide::flatten_links_file configuration option and get rid of LIPATH
#	User	Rev	Content
1	adx	30	Server Hide Reference
2
3	knight	31	$Id$
4	adx	30
5	michael	5347	Copyright (c) 2001-2015 ircd-hybrid development team
6	adx	30
7			----------------------------------------------------------------------
8
9			Due to pressures from abusers, the Hybrid developers have created a set of
10			options to limit what users can and cannot do on the server. Each option
11			can be enabled or disabled at runtime.
12
13	michael	1337	This document describes the ircd-hybrid implementation of the server hiding
14	adx	30	ideas originated by (and credited to) numerous people.
15
16			* LINKS as a file: This option is always enabled. It will generate a
17	michael	6597	file at a certain interval, defined by the flatten_links_delay in
18			ircd.conf, that contains the current LINKS data. This data is sent
19			to users whenever a LINKS is requested. Opers will always see the
20			current server structure.
21	adx	30
22	michael	6599	The file that the LINKS data is stored in is by default var/lib/links.txt.
23	adx	30
24			The benefits of this are that transient splits will not be seen by
25			users issuing LINKS commands, and if a server is split, users can
26			still see what other servers are normally available.
27
28			* Flattened LINKS: This option forces every server to look as if it is
29			connected to the local server. Users will see a flat LINKS tree.
30
31			The benefit to using LINKS flattening is that users cannot get
32			information on how servers are routed.
33
34			The flatten_links in the serverhide {} block in the ircd.conf controls
35			this feature.
36
37			As a side effect, all netsplit quit messages will appear to originate
38			from the local server.
39
40			+--------------------------------------------------------------------+
41			\| Flattened LINKS is needed for any network that uses the hidden hub \|
42			\| option. See below for more details. \|
43			+--------------------------------------------------------------------+
44	michael	2355
45	adx	30	* Hidden server option: This option will hide the server from a
46			flattened LINKS list on other servers. Opers will of course see the
47			true routing of the network.
48
49			This is controlled by the hidden option in ircd.conf.
50
51			+--------------------------------------------------------------------+
52			\| Technically, this code is a hack. With this option enabled, the \|
53			\| server will prepend '(H) ' to the server info field when \|
54			\| connecting to other servers. Other servers must understand that \|
55			\| the (H) means hidden. \|
56			+--------------------------------------------------------------------+
57
58			* The hide_servers option forces the server to not be shown when a user
59			issues WHOIS and other commands which may show what server a user is
60			on.
61
62	michael	3550	Local user counts, as normally displayed in LUSERS, and the 255
63	adx	30	numeric, will be shown with the same values as the global counts.
64			Displaying it this way will help protect servers and avoid breaking
65			scripts that depend on the 265 and 266 numerics on connect.
66
67			To be effective, this option must be used network wide.
68
69			* The disable_remote_commands option takes care of most of the remaining
70	michael	1933	issues. These include, for example, "ADMIN some.hub.server", "VERSION
71			someuser", and similar commands. A server with this option enabled will
72	adx	30	only prevent local users from issuing remote commands. Remote users
73			will not be affected.
74
75			Remote WHOIS is not blocked. It is, however, restricted to only
76			querying WHOIS nick nick. The ircd will disregard the server parameter
77			and always use queried nick.
78
79			* All server modes appear to originate from the server you are using.
80			This feature is not tunable; and opers also do not see the real server
81			setting the mode.
82
83	michael	2200	Each item is briefly described in the serverhide {} block in reference.conf.
84	adx	30
85			----------------------------------------------------------------------
86
87			Using Non-QS Compliant Hubs
88
89	michael	1337	The flattened LINKS option will, as a side effect, display all user QUITs
90	adx	30	due to network splits in the following format:
91
92			:user QUIT :.net .split
93
94			This works extremely well as long as all servers on your network are
95			compliant with the QS capability, which sends a single SQUIT to the
96			network when a server (or tree of servers) splits. All quit messages are
97			generated on the local server. Certain older servers do not have this
98			ability, and as such will generate their own quit messages for users who
99			left because of the split. This can cause leaks in the hub server names
100			and the structure of the network.
101
102			A quick example is the following network structure:
103
104			servA(Hyb7) --- hubA(nonQS) --- servB(not-important)
105
106			When servB splits from hubA, hubA will generate a QUIT command for every
107			user on servB (and anything behind servB). Since the QUIT message was not
108			created on your server, with server hiding enabled, the QUIT message will
109			contain the real server names.
110
111			The only way to prevent this leak on a network is to only use hubs
112	michael	2200	supporting the QS capability. Hybrid 6 (and above) and csircd all are
113	adx	30	currently running daemons that support QS. Hybrid 5 and 2.8.21+CSr servers
114			do not support QS, and will leak server names (and therefore routing
115			information) on splits.