SSL for /oper
Posted: Sat Mar 13, 2004 9:13 am
Hello everyone.
FIrst of, i just wanted to say that the unreal team is making an excellent job in everything. So, well done unreal team.
Now then, i was wondering if someone could make a module that will let people /oper only if they are on an SSL connection. Maybe in the listen block have something like:
// Listen Block REQUIRED (Previously known as the P:Line)
listen 64.246.34.221:6667-6668 {
options {
clientsonly;
};
};
listen 64.246.34.221:6090 {
options {
clientsonly;
ssl;
opers; // <---- this addon!
};
};
So if someone connects on the normal ports, not using an SSL connection, the IRCD would deny that person to /oper.
Maybe let it open up a special ports, like opersonly;
Some of the reasons that led to this idea are:
1: Many shell providers have very unsecure boxes, leading to logging features which may be or not be known to the owners of the shell providers or the shell users themselves.
2: To avoid opers using public computers, or other computers which they do not own when using /oper. (keyloggers in webcafes for example). An example for here would be, operator1 goes to his friends house, to show off about his new oline. Friend has a keylogger installed. Due that the friend (by default) will most probably not have stunnel or any other ssl client at hand, the operator1 might just leave it, and not /oper up from that current location.
3: Users computer is infected with a backdoor, trojan, keylogger, or other means of monitoring.
Offcourse you would now say, its a matter of trust... but admit it... how many of you opers have used your /oper account from another location... just once or twice...!
Well, once is enough to jepordize the sanity of your chat server.
Anyways... i would love to hear you ideas about this.
Cheers everyone.
FIrst of, i just wanted to say that the unreal team is making an excellent job in everything. So, well done unreal team.
Now then, i was wondering if someone could make a module that will let people /oper only if they are on an SSL connection. Maybe in the listen block have something like:
// Listen Block REQUIRED (Previously known as the P:Line)
listen 64.246.34.221:6667-6668 {
options {
clientsonly;
};
};
listen 64.246.34.221:6090 {
options {
clientsonly;
ssl;
opers; // <---- this addon!
};
};
So if someone connects on the normal ports, not using an SSL connection, the IRCD would deny that person to /oper.
Maybe let it open up a special ports, like opersonly;
Some of the reasons that led to this idea are:
1: Many shell providers have very unsecure boxes, leading to logging features which may be or not be known to the owners of the shell providers or the shell users themselves.
2: To avoid opers using public computers, or other computers which they do not own when using /oper. (keyloggers in webcafes for example). An example for here would be, operator1 goes to his friends house, to show off about his new oline. Friend has a keylogger installed. Due that the friend (by default) will most probably not have stunnel or any other ssl client at hand, the operator1 might just leave it, and not /oper up from that current location.
3: Users computer is infected with a backdoor, trojan, keylogger, or other means of monitoring.
Offcourse you would now say, its a matter of trust... but admit it... how many of you opers have used your /oper account from another location... just once or twice...!
Well, once is enough to jepordize the sanity of your chat server.
Anyways... i would love to hear you ideas about this.
Cheers everyone.
