Can UnRealIRCD log all user commands?

MrBugSir · Post by **MrBugSir** » Fri Mar 18, 2005 12:18 am

I read the docs and searched for forums, so please forgive me if this is an easy answer to find.

I would like to log all IRC commands users issue. Our server is low traffic so log file size isn't really an issue. Is the possible, either through server config or a module (if one exists)?

codemastr · Post by **codemastr** » Fri Mar 18, 2005 12:40 am

Of course not. This would be spying on the users, and that is not something we support or condone. In some countries it may even be illegal.

MrBugSir · Post by **MrBugSir** » Fri Mar 18, 2005 1:04 am

Why would that be spying? Corporations monitor all network traffic, they even claim to own the email on their servers, and go out of their way not to use the word "private" in any published materials. I don't see how logging what commands users have issued is spying. Logging personal conversations would obviously be spying, but we're not interested in that for many reasons, such as it would be spying. We don't want to spy on any one, we do want to know if some one is poking around and we do have the right to perform a threat analysis based on the commands users issue.

Anyway, I got my answer. Thanks for responding.

Solutech · Post by **Solutech** » Fri Mar 18, 2005 4:09 am

Try this module Commandsno This will let you choose what commands you have sent to ircops . I use it as a precaution so that I know when people are probing . Just add the commands you want to see being used . I have stuff like /stats flagged and /map . Its not a logfile per-se more a visual heads up. Gives the admins and ircops that little bit more of a warning that someone is up to something . The log every command idea is a bit extreme . Just put the commands you feel are abusable in there .

w00t · Post by **w00t** » Fri Mar 18, 2005 5:33 am

Stuff that would probably be useful to check on,

/stats
/map [personally, i use it to get other servers to connect to, but it CAN be abused]
/links [same]
/os
/operserv
/oper [but does it send passwords? never used cmdsno]
/gline
/kline
etc etc.

Solutech · Post by **Solutech** » Fri Mar 18, 2005 6:21 am

Code: Select all

[06:16] -irc.Our-chat.tk- Solutech ([email protected]) used command STATS (params: g)

Thats what pops up when you use /stats I imagine the /oper would show the password.

w00t · Post by **w00t** » Fri Mar 18, 2005 7:12 am

Just btw, go the sig solutech

So it probably wouldn't be a good idea to place a commandsno on oper :p

Solutech · Post by **Solutech** » Fri Mar 18, 2005 8:20 am

I would say that using it on /oper would be akin to abuse . I get visitors that have scripts set to auto /oper . So it giving you the password would be rather unethical .

As for the sig I pilfered it from another forum lol . Made me laugh

Matridom · Post by **Matridom** » Fri Mar 18, 2005 1:23 pm

There are modules available that will give you more information in regards to /oper. Personaly, for server logging, I have all the standard server logs outputed into an SQL server. I'm not worried about users abusing commands that are part of unreal that don't already generate notices. But I do want to keep track of Override usage, kills, glines and other administrative commands. My IRCop's know I log this information and even have access to it themselves.

For users?

stats usage get's broadcasted
oper get's broadcasted (Only if the oper matches an existing O block)
glines - Those get posted on my webpage, so i don't care if they look them up on the server or not.

Angrywolf however has a module that will allow the logging of failed oper username/passwords. I've considered installing it for it's kill mechanism on too many failed attempts. I would never enable the snomask, cause in all honesty, i don't want to see my oper's passwords.

Snomask +O: lets you see login names and passwords used in failed OPER attempts. It also has a feature that kills users after a specified number of failed oper-ups.

I'm more concerned with services getting broken into. hence why i use the logchannels and routinly look in the log file for "oditites"

Solutech · Post by **Solutech** » Fri Mar 18, 2005 4:47 pm

Pretty hard not to see the passwords when you have to set the oper block for them

. I think the killing of bad oper attempts could be a good thing and would be nice to see it as a feature maybe .

Matridom · Post by **Matridom** » Fri Mar 18, 2005 4:55 pm

Solutech wrote:Pretty hard not to see the passwords when you have to set the oper block for them . I think the killing of bad oper attempts could be a good thing and would be nice to see it as a feature maybe .

md5 encryption.

I get my opers to encrypt it,and i put the encrypted password into the file. I never see the pass

UnrealIRCd Forums

Can UnRealIRCD log all user commands?

Can UnRealIRCD log all user commands?

Re: Can UnRealIRCD log all user commands?