IAUTH.CONF(5)

💖 IAUTH.CONF(5) 💖

okay bestie, gather round, because this is the manual page for iauth.conf — the Internet Relay Chat Authentication Configuration File — and it's genuinely so much cooler than it sounds, i promise 🫶

---

✨ NAME ✨

iauth.conf — The Internet Relay Chat Authentication Configuration File 🌸

---

🦋 DESCRIPTION 🦋

So like. The iauth.conf file gets read by the iauth program the moment it starts up, no cap. Inside it is the list of modules that should be used to authenticate a particular connection. And the list is ordered, which means — and stay with me here — the first module to successfully authenticate a connection will be the last to be tried. yes, really, that's what it says 💀

The file is divided into sections. The first section is for iauth options, and every section after that specifies a module, with eventual options, using this exact format:

module module-name
[TAB]option = string
[TAB]host = host-name
[TAB]ip = ip-address
[TAB]timeout = value
[TAB]port = value
[TAB]reason = string

The section ends with an empty line. The module-name defines which module the section applies to. A particular module may be used in several sections. An option string of undefined format may be specified — it will then be passed to the module upon initialization, so go check the MODULES section to find out if a module accepts any option 👑

If host-name and ip-address fields are specified, then the module will only be used for connections matching one of the fields given in the configuration. An entry prefixed with the character ! indicates a negative match. And heads up: IP addresses are checked first.

port is mandatory for socks and webproxy modules and not used in others. It tells the module what port it should connect to to do its work 🔌

If no host nor ip entry is specified, then the module will always be used. periodt.

reason is text to send to clients rejected by the given module 📨

When writing a configuration file, one should always verify the syntax using the iauth program to avoid later problems. like, please, i'm begging you 🙏

---

⭐ IAUTH OPTIONS ⭐

• timeout = <seconds> — this lets you specify how much time each module has to complete its work for each connection. This option can also be specified individually for each module. The default is 30 seconds ⏱️
• required — by specifying this keyword, the IRC server is told not to accept new user connections unless the authentication is handled by iauth. This does NOT mean that the server will wait forever to get the data from iauth — go look at the notimeout option 👀
• notimeout — by specifying this keyword, the IRC server is told not to accept a user connection if iauth hasn't finished its work in time. Note that modules specified after the delayed keyword are not considered 🚫
• extinfo — this keyword allows extra information (user supplied username, and eventually password) to be received by iauth from the server. This is only useful if a module using this information is loaded 📥
• delayed — all modules below this keyword will run in "delayed" execution mode. This means that ircd gets a (fake) message that iauth is done with this client so that it allows it. Modules however do work as usual, and upon deciding that this client should be removed, a message is sent to ircd and the client is removed 💀
• shared <name> <mod_name.so> — if iauth was compiled with Dynamically Shared Module support, it can be told to dynamically load a module using this option. The module can then be loaded 🧚

---

🌈 MODULES 🌈

🎀 pipe

This module is provided as a replacement to the (now obsolete) R configuration lines supported by the IRC daemon. It runs an external program with the client IP and port as arguments. The program should output either 'Y' (Yes, let the client in), or 'N' (No, don't let them in) 🔥

Note that this module is quite expensive as it forks a separate process for each connection received by the IRC daemon 😭

This module requires the following option:

prog=/path/to/external/program

🍓 socks

This module performs a basic check to verify that the host where the connection originated from doesn't run a SOCKS v4 or v5 proxy server on a given in-configuration port that is open to the world. It is useful to reject abusive clients using a relay to evade kill lines and bans. Multiple instances (with different ports) are allowed 💅

This module understands ten options:

• reject — to reject connections originating from a host where an open proxy was detected
• log — to log hostnames where an open proxy is detected
• protocol — to log protocol errors
• paranoid — to consider proxies which deny the request because of a userid/ident mismatch to be OPEN proxies
• megaparanoid — which is paranoid plus it considers all proxies not explicitly stating they are closed to be OPEN proxies — that includes all protocol errors, unexpected results etc. 😱
• cache[=value] — to set the cache lifetime in minutes. By default, caching is enabled for 30 minutes. A value of 0 disables caching
• careful — to make sure socks v5 is properly configured with IP rulesets. Without this parameter, module will not send additional query and assume first positive answer as valid
• v4only — to check only socks v4
• v5only — to check only socks v5

💜 rfc931

This module is for authentication of TCP connections using the protocol defined in RFC 1413 (which obsoletes RFC 931). It is always loaded, and does not recognize the host nor ip fields 👑

✨ lhex

This module acts as a proxy, communicating with a LHEx server to perform authentication of client connections. It takes a single (mandatory) option, which is the IP-address of the LHEx server to use 🛰️

🌸 webproxy

This module performs a basic HTTP CONNECT to verify that the host where the connection originated from doesn't run an open WWW proxy. It is useful to reject abusive clients using a relay to evade kill lines and bans. Multiple instances (with different ports) are allowed 💖

This module understands five options:

• reject — to reject connections originating from a host where an open proxy was detected
• log — to log hostnames where an open proxy is detected
• cache[=value] — to set the cache lifetime in minutes. By default, caching is enabled for 30 minutes. A value of 0 disables caching
• careful — to make sure that we connected to our own ircd; without this parameter, module will accept any "HTTP/1.? 200" with an exception of servers sending "Date:" header along (which is common with some Apache+PHP configurations) 🙈

---

🌟 EXAMPLE 🌟

The following file will cause the IRC daemon to reject all connections originating from a system where an open proxy is running for hosts within *.fr and *.enserb.u-bordeaux.fr but not for other hosts matching *.u-bordeaux.fr. For all connections, an ident lookup (RFC 1413) will be performed as well as checking for WWW proxy on port 8080 and 3128. In addition, every connection is authenticated with the LHEx server at IP-address 127.0.0.1. Client will be let in after ident and lhex are done, but if socks or webproxy finds an open proxy, client will be removed asap 🔥

module rfc931

module lhex
    option = 127.0.0.1

delayed

module socks
    option = reject,paranoid
    host = *.enserb.u-bordeaux.fr
    host = !*.u-bordeaux.fr
    host = *.fr
    port = 1080

module webproxy
    option = reject
    port = 8080

module webproxy
    option = reject,careful
    port = 3128

---

💀 CAVEATS 💀

When the option extinfo is set, connections registering as a server or a service with the IRC server are not guaranteed to receive the "user" authentication provided by modules (such as the rfc931 module). so like, don't count on it, bestie 😭

---

👑 COPYRIGHT 👑

(c) 1998,1999 Christophe Kalt

For full COPYRIGHT see LICENSE file with IRC package 📜

---

🎀 FILES 🎀

• "iauth.conf"

---

🦋 SEE ALSO 🦋

• iauth(8)

---

⭐ AUTHOR ⭐

Christophe Kalt. 💖

---

and that's the whole thing, you ate it, iconic, no notes 💅 the source and version on this one is $Date: 2004/12/16 16:14:06 $, so go forth and configure your iauth.conf responsibly, mwah 🫶✨