View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001659 | unreal | ircd | public | 2004-03-16 19:33 | 2004-03-17 18:55 |
| Reporter | aquanight | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | N/A |
| Status | closed | Resolution | open | ||
| Product Version | 3.2-RC1 | ||||
| Summary | 0001659: Restricted connections | ||||
| Description | Basically something like this snip of an example ircd.conf: allow { userhost *@*; userip *@*; max-per-ip 2; }; allow { userhost *@*.ipt.aol.com; userip *@172.192.0.0; max-per-ip 500; // Needs to be high for a reason. options { restrict; }; }; // Or alternatively allow ban <x>::action restrict. An AOL user connects: -irc.blah.net- *** Looking up your hostname... -irc.blah.net- *** Found your hostname! -irc.blah-net- *** Checking Ident... -irc.blah.net- *** Received Ident response. -irc.blah.net- *** Notice - You are using a restricted address. AOLUser sets mode: +X (or other mode char) /nick AOLUser123 -irc.blah.net- *** You can't change nicks because you are using a restricted connection. /oper NetAdmin pass123 (Assume this is a valid oper login) No O-Lines for your host. -irc.blah.net- *** You can't OPER with a restricted connection. -irc.blah.net- *** Notice - OPER login failed ([email protected], trying NetAdmin) [restricted] /join #Blah #Blah @AOLUser #Blah End of /NAMES -irc.blah.net- *** You cannot hold channel operator status with a restricted connection. irc.blah.net sets mode: -o AOLUser /join #FriendsChan #FriendsChan @Bob AOLUser #FriendsChan End of /NAMES list. Bob sets mode: +o AOLUser (-> Bob) -irc.blah.net- *** Notice - you cannot op AOLUser because AOLUser is using a restricted connection. (-> AOLUser) -irc.blah.net- *** Notice - Bob tried to op you on #FriendsChan. You cannot hold operator status with a restricted connection. irc.blah.net sets mode: -o AOLUser Error :Closing link: AOLUser[172.192.0.0] (Quit: I'm getting off AOL...) * Disconnected /end (Not even half-op or admin/owner will work. Voice will.) Then a channelmode could be added to deny restricted users, and a usermode for ignoring restricted users. There are probably several other restrictions you could impose, such as no VHost, Host Mask, and no DCC (ever). (Especially no Host Mask for AOL, everyone _knows_ the hostname for AOL...) | ||||
| 3rd party modules | |||||
|
|
And the purpose of this would be... ? |
|
|
Only to annoy users... This is completely useless. IRCnet have this. But they have this only, because they had so much overtakes, because of no services :) |
|
|
I figured it could be useful to help lay the smackdown on certain ISPs that are being abused (*coughaolcough*). By enabling restrictions like this, it can help to increase the sanity level on networks, whether or not they have services (since not necessarily *all* services have secureops). The /oper bit probably isn't really necessary, since a decent oper block doesn't have from { userhost *@*; };, but with the right level of restrictions (maybe even customizable restrictions on a per-ISP basis?) it can help offset the abusibility of proxies, AOL, virtual hosts, AOL, certain JIRCs, AOL, maybe cloning (if one added the ability to skip an allow block if max-per-ip is exceeded), and did I mention AOL :D ? It would be funny to see someone connect with a registered nick, get nickserv'd, and can't switch off Guest1234567 because they're restricted! |
|
|
It would be funny to see someone connect with a registered nick, get nickserv'd, and can't switch off Guest1234567 because they're restricted! You say funny, I say "waste of time." I doubt something like this will be coming to Unreal anytime soon. This is probably the 5th time it has been suggested, I've still yet to see anyone give a reason why it is useful and one that can't already be accomplished with other features. |
|
|
One was already mentioned: to limit takeovers when services are down or nonexistant. Another use is for servers that only accept nearby connections. You could put a normal I-Line (allow block) on IPs within the same state, then put a restricted I-Line for neighbooring states, or for certain counties and cities within the state. Another use of it is as a form of half-ban. You could deny certain normally-available privileges without denying access altogether. Somewhat like the intention behind tempshun. And it's very easy to make exceptions to a restricted allow block, with a broader allow block that doesn't have restriction. Another possibility is to restrict normal access to users that know a special password (like what is possible when combining allow::options::badpasscont with multiple Y-Lines/class blocks). |
|
|
I'll just close this one... I come originally from ircnet and I've always seen people having problems with it. I too find this a waste of time (and code, and..), and I too think it's not very useful due to services / services related problems it creates. So... ;). |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2004-03-16 19:33 | aquanight | New Issue | |
| 2004-03-16 19:40 |
|
Note Added: 0005512 | |
| 2004-03-17 09:50 | Rocko | Note Added: 0005514 | |
| 2004-03-17 13:36 | aquanight | Note Added: 0005516 | |
| 2004-03-17 16:30 |
|
Note Added: 0005518 | |
| 2004-03-17 18:18 | aquanight | Note Added: 0005519 | |
| 2004-03-17 18:55 | syzop | Status | new => closed |
| 2004-03-17 18:55 | syzop | Note Added: 0005523 |
