mirror of
https://github.com/mikaela/mikaela.github.io/
synced 2024-11-15 08:29:26 +01:00
135 lines
9.7 KiB
HTML
135 lines
9.7 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="UTF-8" /> <!-- <meta http-equiv="refresh" content="60" /> --> <meta name="description" content="Instructions for identifying to services on various IRC networks." /> <meta name="author" content="Mikaela Suomalainen" /> <link rel="canonical" href="https://mkaysi.github.io/pages/external/identifying.html">
|
|
<title>
|
|
How to identify to services automatically
|
|
</title>
|
|
<link rel="stylesheet" type="text/css" href="../../css.css" />
|
|
</head>
|
|
<body>
|
|
|
|
<p><strong>NOTE: This might be heavily freenode-specific, but these things should work with other networks too, at least SASL and CertFP.</strong></p>
|
|
<p>I will document the four different methods to identify to services which I use by myself. <strong>I use all of these at the same time.</strong></p>
|
|
<h2 id="sasl">SASL</h2>
|
|
<p>There isn't much to say about SASL as it's easy to configure as long as your IRC client supports it. SASL identifies you before logging in, but it won't help you in case services are down. The easiest way to check does the network where you are support SASL is probably to whois or message or both to the SaslServ.</p>
|
|
<pre><code>/whois SaslServ SaslServ
|
|
/msg SaslServ help</code></pre>
|
|
<p>If the network does support SASL, you should see something like this which freenode gives:</p>
|
|
<pre><code>XX:XX:XX -- [SaslServ] (SaslServ@services.): SASL Authentication Agent
|
|
XX:XX:XX -- [SaslServ] services. (Atheme IRC Services)
|
|
XX:XX:XX -- [SaslServ] is a Network Service
|
|
XX:XX:XX -- [saslserv] End of WHOIS
|
|
XX:XX:XX -- SaslServ: This service exists to identify connecting clients to the network. It has no public interface.</code></pre>
|
|
<p>There are different mechanisms for use with SASL. I personally use them in this order with ZNC: <code>PLAIN DH-AES DH-BLOWFISH and EXTERNAL</code>.</p>
|
|
<p>This is what ZNC 1.5-git-3b01efc says about them:</p>
|
|
<pre><code>XX:XX:XX < *sasl> +-------------+----------------------------------------------------+
|
|
XX:XX:XX < *sasl> | Mechanism | Description |
|
|
XX:XX:XX < *sasl> +-------------+----------------------------------------------------+
|
|
XX:XX:XX < *sasl> | EXTERNAL | TLS certificate, for use with the *cert module |
|
|
XX:XX:XX < *sasl> | DH-BLOWFISH | Secure negotiation using the DH-BLOWFISH mechanism |
|
|
XX:XX:XX < *sasl> | DH-AES | More secure negotiation using the DH-AES mechanism |
|
|
XX:XX:XX < *sasl> | PLAIN | Plain text negotiation |
|
|
XX:XX:XX < *sasl> +-------------+----------------------------------------------------+</code></pre>
|
|
<p>Some notes:</p>
|
|
<ul class="incremental">
|
|
<li>PLAIN is plain text as it says, so if you use it like I do, you should use SSL.</li>
|
|
<li>EXTERNAL is supposed to be used together with CertFP, but it doesn't work with most of networks.
|
|
<ul class="incremental">
|
|
<li>It's not supported even by freenode.</li>
|
|
<li>I don't know any network that supports it.</li>
|
|
</ul></li>
|
|
<li>This won't help you if services go down.</li>
|
|
</ul>
|
|
<h2 id="certfp">CertFP</h2>
|
|
<p>CertFP identifies you using SSL certificate which you must generate and add to your NickServ account.</p>
|
|
<p>You can use this command at IRC to check if the network supports certfp.</p>
|
|
<pre><code>/msg NickServ help cert</code></pre>
|
|
<p>I am not sure how this happens on Windows, so you might need to look for that information elsewhere unless someone decides to help me and tell how does it happen. I am going to tell about OpenSSL.</p>
|
|
<h3 id="generating-the-certificate">Generating the certificate</h3>
|
|
<p>Open terminal and run this command and replae YOURNICKNAMEHERE.pem with your nickname or something else which makes you know what it is (<strong>DO NOT SET PASSWORD FOR IT OR YOUR CLIENT MIGHT NOT BE ABLE TO USE IT</strong>):</p>
|
|
<pre><code>openssl req -nodes -newkey rsa:4096 -keyout YOURNICKNAMEHERE.pem -x509 -days 24855 -out YOURNICKNAMEHERE.pem -subj "/CN=Your Nickname"</code></pre>
|
|
<p>This gives us file <code>YOURNICKNAMEHERE.pem</code> which you must give to your IRC client.</p>
|
|
<p><strong>NOTE: This certificate is valid for 24855 days which is the maximum on 32-bit systems. This might not be very wise, but as we only use this cert in IRC and we don't want to worry about regenerating it too often so we have a very long time when it's valid. You should regenerate your cert as often as you change your password or more even more often…</strong></p>
|
|
<p>Oh, and <strong>don't close your terminal yet</strong> as you will need it for HexChat.</p>
|
|
<h3 id="telling-your-client-or-bouncer-to-use-the-cert.">Telling your client (or bouncer to use the cert).</h3>
|
|
<h4 id="hexchat">HexChat</h4>
|
|
<p>Create a folder "certs" to your HexChat config and copy the .pem file there and copy and rename it as <code>client.pem</code>.</p>
|
|
<pre><code>mkdir -p ~/.config/hexchat/certs/
|
|
cp YOURNICKNAMEHERE.pem ~/.config/hexchat/certs/client.pem</code></pre>
|
|
<p>Now open your HexChat and press <code>CTRL + S</code> or go to <code>HexChat --> Network list</code> and check the settings for the networks that you use.</p>
|
|
<ul class="incremental">
|
|
<li>Use SSL for all the servers on this network.</li>
|
|
<li>Acccept invalid SSL certificates.</li>
|
|
<li>Make sure that the login method <strong>IS NOT</strong> <code>SASL EXTERNAL (cert)</code>, as said previously, it won't work.
|
|
<ul class="incremental">
|
|
<li>It appears that HexChat started to want to use it when I added the certificate.</li>
|
|
<li>If you use something that wants username, uncheck the <code>Use global user informtion</code> or you must specify the username in the Network List and ZNC won't like it.</li>
|
|
</ul></li>
|
|
</ul>
|
|
<h4 id="limnoria">Limnoria</h4>
|
|
<p>Insert your .pem file somewhere where the bot can read it and tell your bot to read use it while connecting with</p>
|
|
<pre><code>config networks.<network>.certfile /full/path/to/pem.file</code></pre>
|
|
<p><strong>NOTE: This is server specific</strong>. <a href="https://github.com/ProgVal/Limnoria/issues/612">ProgVal/Limnoria#612 is feature request for global certfiles.</a></p>
|
|
<h4 id="weechat">WeeChat</h4>
|
|
<h4 id="znc">ZNC</h4>
|
|
<h3 id="telling-nickserv-about-your-key">Telling NickServ about your key</h3>
|
|
<p>NickServ wants to know the fingerprint which you can get with the following command:</p>
|
|
<pre><code>openssl x509 -sha1 -noout -fingerprint -in YOURNICKNAMEHERE.pem | sed -e 's/^.*=//;s/://g;y/ABCDEF/abcdef/'</code></pre>
|
|
<p>which returns your fingerprint (<strong>WHICH YOU MUST NOT SHARE WITH ANYONE</strong>)</p>
|
|
<pre><code>05dd01fedc1b821b796d0d785160f03e32f53fa8</code></pre>
|
|
<p>Now you can tell to NickServ about it.</p>
|
|
<pre><code>/msg NickServ CERT ADD 05dd01fedc1b821b796d0d785160f03e32f53fa8</code></pre>
|
|
<p>(replace that with your own fingerprint!) And nickerv replies to you</p>
|
|
<pre><code>14:13:39 -- NickServ: Added fingerprint 05dd01fedc1b821b796d0d785160f03e32f53fa8 to your fingerprint list.</code></pre>
|
|
<h3 id="testing">Testing</h3>
|
|
<p>Now when you connect to freenode and have configured your IRC client to use your new certificate, you should get identified automatically and you should see your certificate by whoising yourself and running cert list with NickServ.</p>
|
|
<pre><code>/WHOIS YOURNICK YOURNICK
|
|
/MSG NickServ CERT LIST</code></pre>
|
|
<p>replies</p>
|
|
<pre><code><...>
|
|
XX:XX:XX -- [YOURNICK] has client certificate fingerprint 05dd01fedc1b821b796d0d785160f03e32f53fa8
|
|
<...>
|
|
XX:XX:XX -- NickServ: Fingerprint list for YOURNICK:
|
|
XX:XX:XX -- NickServ: - 05dd01fedc1b821b796d0d785160f03e32f53fa8$$
|
|
XX:XX:XX -- NickServ: End of YOURNICK fingerprint list.</code></pre>
|
|
<h3 id="notes">Notes</h3>
|
|
<ul class="incremental">
|
|
<li>You must recreate your certificate yearly.</li>
|
|
<li>This will identify you with immediately so you are still visible to /monitor.</li>
|
|
<li>This will identify you after services return unlike other methods if you happen to be on splitted server without services.</li>
|
|
<li>Supported networks which I am on:
|
|
<ul class="incremental">
|
|
<li>freenode</li>
|
|
<li>oftc</li>
|
|
<li>piratenet</li>
|
|
</ul></li>
|
|
</ul>
|
|
<h2 id="server-password">Server password</h2>
|
|
<p>This might not work with some networks, but this works with freenode. All IRC clients should support settng password which to use while connecting to server. Set it as <code>username:password</code> for freenode and you are automatically identified when you connect.</p>
|
|
<p>Some notes:</p>
|
|
<ul class="incremental">
|
|
<li>This is only known to work with freenode.</li>
|
|
<li>You aren't identified immediately so as shown in the embedded gist, your real host is visible for people who have you on <code>/monitor</code>.</li>
|
|
<li>This won't help you if services go down.</li>
|
|
</ul>
|
|
<h2 id="automatic-command">Automatic command</h2>
|
|
<p>This works with probably every client. They support setting commands that are automatically run as you connect and you can set the command</p>
|
|
<pre><code>/msg NickServ identify username password</code></pre>
|
|
<p>or whatever syntax the services on your network use.</p>
|
|
<p>Some notes:</p>
|
|
<ul class="incremental">
|
|
<li>Your real host is still visible for /monitor ing people.</li>
|
|
<li>Your client might send that command too late to prevent you from getting to redirect channels for unidentified users and show your real host to everyone.</li>
|
|
<li>You might annoy people by joining twice and quitting once with "Changing host".</li>
|
|
</ul>
|
|
<hr/>
|
|
For corrections above this line, please contact <a href="../irc.html">me at IRC</a> or fix them by yourself <a href="https://github.com/Mkaysi/mkaysi.github.io/blob/master/pages/external/identifying.html.md">here</a>. What is below that line is embedded GitHub gist which reads where to contact with issues with it.
|
|
<hr/>
|
|
<script src="https://gist.github.com/maxanton/1e2cf7ada079c271bd3c.js"></script>
|
|
</body>
|
|
</html>
|
|
<!-- vim : set ft=markdown-->
|
|
|
|
|