INDEX / TABLE OF CONTENTS

This document was written for exclusive use with UnrealIRCd. Use of thisdocument with another software package, or distribution of this document withanother software package is strictly prohibited without the written permissionof the UnrealIRCd Development Team. This document may be copied/printed/reproduced/publishedas many times as you like, provided it is for use with UnrealIRCd and it is notmodified in anyway. – Copyright UnrealIRCd Development Team 2002-2004

Please read this manual before asking for help, you also REALLY want to take a look at theFAQ since over 80% of your questions/problems are answered in it. If you stillneed help you can ask for support at irc.ircsystems.net (port 6667) channel #unreal-support (notethat we REQUIRE you to read the docs and faq and we only help with UnrealIRCd, not with services!).If you have a real bug (like a crash) then report it athttp://bugs.unrealircd.org.

In case you are upgrading from Unreal3.1.x to Unreal3.2 you'll notice the whole config file has changed,you may find it hard at first, but once you've switched you'll find it much better!

Also don't forget to read section 3 about features, although you know already some of them which are in 3.1.x there are several new features too!

It's best not to mix/link 3.1.x with 3.2, but if you really want to, you need at least 3.1.4, but 3.1.5.1 is strongly recommended.

The recommended way to upgrade is:
Linux:

• Rename your old UnrealIRCd directory (or otherwise you'll overwrite it in the next step)
• Extract the new UnrealIRCd version and run ./Config and make
• Copy your old configuration files to the new directory (unrealircd.conf, motd, rules, server.* [SSL certs], network file, etc)

• Copy all of your configuration files to a temporary location.
• Run the uninstaller for any previous versions of Unreal you have installed.
• Run the installer for the new version of Unreal.
• Copy your old configuration files to the new folder.

Please also check .RELEASE.NOTES to see what has been changed.If you notice any changes (or bugs) between version, BE SURE TO READ THE RELEASE NOTES FIRST before reporting it as a bug!.

• *NIX versions:
  • Linux 2.2.x
  • Linux 2.4.x
  • FreeBSD 4.6-STABLE
  • FreeBSD 4.5-STABLE
  • Solaris 2.x
• Windows version:
  • WindowsXP Home
  • WindowsXP Pro
  • Windows 2000 Pro
  • Windows 2000 Server
  • Windows 2000 Advanced Server
  • Windows 98
  • Windows Me

Installation Instructions
Linux:

1. gunzip -d Unreal3.2.2.tar.gz
2. tar xvf Unreal3.2.2.tar
3. cd Unreal3.2
4. ./Config
5. Answer these questions to the best of your knowledge. Generally if your notsure, the default will work just fine!
6. make
7. Now create your unrealircd.conf and other configuration files, see section 4.

Windows:

1. Run the Unreal installer
2. Now create your unrealircd.conf and other configuration files, see section 4.

Some major/nice features are explained in this section. It provides a general overview,and sometimes refers to the config file (something which you might know nothing about yet).

You can skip this section, however it's suggested to read it before/after installing.

Cloaking is a way to hide the real hostname of users, for example if your real host is d5142341.cable.wanadoo.nl,it will be shown (in join, part, whois, etc) as rox-2DCA3201.cable.wanadoo.nl.This feature is useful to prevent users flooding each other since they can't see the real host/IP.

This is controlled by usermode +x (like: /mode yournick +x), admins can also force +x to be enabledby default, or make it so users can never do -x.

A cloaked host is generated by a cloaking module (you are required to have one loaded), currently there's only 1 module included:
cloak: This is the official cloaking module since 3.2.1, it is much more secure than the oldalgorithm, it uses md5 internally and requires you to have 3 set::cloak-keys:: consisting of mixed lowercase (a-z),uppercase (A-Z) and digit (0-9) charachters [eg: "AopAS6WQH2Os6hfosh4SFJHs"]. See example.conf for an example.

Cloak keys MUST be the same on ALL SERVERS in a network. Also cloak keys should be kept SECRETbecause it's possible to decode the original host if you know the keys (which makes umode +x useless).

UnrealIRCd supports modules which is nice because:
- You can load/reload/unload them while the ircd is running (by /rehash). This allows some bugs to be fixed or new features to be added without requiring a restart!
- Other people can create (3rd party) modules with new commands, usermodes and even channelmodes.
UnrealIRCd only comes with a few modules. Take a look at www.unrealircd.com -> modulesor use google to find 3rd party modules.

You need to load at least 2 modules or else you won't be able to boot!:
- the commands module: commands.so (commands.dll on windows)
- a cloaking module: usually cloak.so (cloak.dll on windows).

Snomasks are server notice masks, it's a special type of usermode that controls whichserver notices you will receive (mostly used by opers)

It can be set by: /mode yournick +s SNOMASK, for example: /mode yournick +s +cF
To remove certain snomasks, use something like: /mode yournick +s -c
Or you can remove all snomasks by simply doing: /mode yournick -s

The current available snomasks are:
c - local connects
F - far connects (except from U-lined servers)
f - flood notices
k - kill notices [*]
e - 'eyes' notices
j - 'junk' notices
v - vhost notices
G - gline/shun notices
n - local nick change notices
N - remote nick change notices
q - deny nick (Q:line) rejection notices
s - receives server notices [*]
S - receives spamfilter notices
o - receives oper-up notices
[*: this snomask is also allowed to non-ircops]

You can control which snomasks you automatically get (set::snomask-on-connect) and which you geton oper (set::snomask-on-oper, oper::snomask)

By default, if a user simply sets mode +s, certain snomasks are set. For non-opers, snomasks +ks, and for opers, snomasks +kscfvGqo.

With aliases you can configure server-side alias commands.You can for example let "/ns identify blah" be forwarded to nickserv (it will betranslated to: privmsg nickserv identify blah). You can even make more complex aliases such as /register can forward toChanServ if the first parameter begins with a # and forwarded to NickServ if it doesn't.

Aliases are configured by alias blocks in the configuration file, and you can also includea file with default aliases for most commonly used services.

UnrealIRCd has a built-in help system accessible by /helpop. The /helpop command is completely user configurable viathe help block in the configuration file. Additionally, a help.conf is included which contains some basic help forall commands.
For example /helpop chmodes gives you a overview of all channel modes UnrealIRCd has.
Remember that if you are an ircop (helpop) you will have to prefix the keyword with a '?' character,so /helpop becomes /helpop ? and/helpop chmodes becomes /helpop ?chmodes etc..

There are several oper levels in UnrealIRCd and you can add additional rights (like to use /gline) toeach of them, that way you can give each oper the privileges they need.

This is controlled by the oper flags in the oper block, see the oper block for more information.

UnrealIRCd has a lot of powerful oper commands which are explained in User & Oper Commands,you probably want to read those after installing :).

SSL stands for Secure Socket Layer, with SSL you can make secure encrypted connections.It can be used to encrypt server<->server traffic, but client<->server traffic can also be encrypted.You usually use SSL to protect against sniffing and for authentication.

You need to have your IRC server compiled with SSL support. To setup an SSL port you need to set listen::options::ssl.

You cannot connect normally to a SSL port (so don't make port 6667 ssl!), you need a client or a tunnelthat understands the SSL protocol.

Clients that support SSL: XChat,irssi,mIRC (6.14 and up,also requires some additional steps)

For clients which do not support SSL you can use a tunnel likestunnel, here's a stunnel.conf example (for stunnel 4.x):

client = yes[irc]accept = 127.0.0.1:6667connect = irc.myserv.com:6697

You should also validate certificates when you connect to servers and not blindly accept them (like in the stunnel example)else you are still vulnerable to "active sniffing" attacks (ssl redirects), that's however too offtopicto explain here (learn about SSL, don't ask us). [mIRC and xchat pop up a window asking you to allow/reject a certificate,so that's good].

UnrealIRCd supports IPv6, since beta15 it seems to be stable.
Your OS needs to have IPv6 support and you need to enable IPv6 support in UnrealIRCd during ./Config as well.

Although microsoft has an experimental IPv6 implementation for w2k/XP it is not (yet) supported by UnrealIRCd.

Zip links can be turned on for server<->server links, it compresses the data by using zlib.It can save 60-80% bandwidth... So it's quite useful for low-bandwidth links or links withmany users, it can help a lot when you are linking since a lot of data is sent about every user/channel/etc.

To compile with zip links support, you need to answer Yes to the zlib question in ./Config and set it in link::options::zip(on both sides)

UnrealIRCd has some (new) nice features which helps dynamic IP users using dynamic DNS (like blah.dyndns.org).If you are linking two dynamic DNS hosts, then set link::options::nodnscache and link::options::nohostcheck.

Throttling
Throttling is a method that allows you to limit how fast a user can disconnect and then reconnect to your server.You can config it in your set::throttle block to allow X connections in YY seconds from the same IP.
Channel modes
There are also some channel modes which can be very effective against floods. To name a few:
K = no /knock, N = no nickchanges, C = no CTCPs, M = only registered users can talk, j = join throttling (per-user basis)
As of beta18 there's also a much more advanced channelmode +f...
Channel mode f
Instead of using scripts and bots to protect against channel floods it is now build into the ircd.
An example +f mode is: *** Blah sets mode: +f [10j]:15
This means 10 joins per 15 seconds are allowed in the channel, if the limit is hit, the channel will be set +i automatically.
The following floodtypes are available:

 Example:

*** ChanOp sets mode: +f [20j,50m,7n]:15<ChanOp> lalala*** Evil1 (~fdsdsfddf@Clk-17B4D84B.blah.net) has joined #test*** Evil2 (~jcvibhcih@Clk-3472A942.xx.someispcom) has joined #test*** Evil3 (~toijhlihs@Clk-38D374A3.aol.com) has joined #test*** Evil4 (~eihjifihi@Clk-5387B42F.dfdfd.blablalba.be) has joined #test-- snip XX lines --*** Evil21 (~jiovoihew@Clk-48D826C3.e.something.org) has joined #test-server1.test.net:#test *** Channel joinflood detected (limit is 20 per 15 seconds), putting +i*** server1.test.net sets mode: +i<Evil2> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl<Evil12> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl<Evil15> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl<Evil10> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl<Evil8> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl-- snip XX lines ---server1.test.net:#test *** Channel msg/noticeflood detected (limit is 50 per 15 seconds), putting +m*** server1.test.net sets mode: +m*** Evil1 is now known as Hmmm1*** Evil2 is now known as Hmmm2*** Evil3 is now known as Hmmm3*** Evil4 is now known as Hmmm4*** Evil5 is now known as Hmmm5*** Evil6 is now known as Hmmm6*** Evil7 is now known as Hmmm7*** Evil8 is now known as Hmmm8-server1.test.net:#test *** Channel nickflood detected (limit is 7 per 15 seconds), putting +N*** server1.test.net sets mode: +N

Basic bantypes and cloaked hosts
UnrealIRCd supports the basic bantypes like +b nick!user@host.
Also, if a masked host of someone is 'rox-ACB17294.isp.com' and you place a ban *!*@rox-ACB17294.isp.com,then if the user sets himself -x (and his hosts becomes for example 'dial-123.isp.com) then the banwill still match. Bans are always checked against real hosts AND masked hosts.
IP bans are also available (eg: *!*@128.*) and are also always checked.

Bans on cloaked IPs require some explanation:
If a user has the IP 1.2.3.4 his cloaked host could be 341C6CEC.8FC6128B.303AEBC6.IP.
If you ban *!*@341C6CEC.8FC6128B.303AEBC6.IP you would ban *!*@1.2.3.4 (obvious...)
If you ban *!*@*.8FC6128B.303AEBC6.IP you ban *!*@1.2.3.*
If you ban *!*@*.303AEBC6.IP you ban *!*@1.2.*
This information might be helpful to you when deciding how broad a ban should be.

Extended bantypes
Extended bans look like ~[!]<type>:<stuff>. Currently the following types are available:

Spamfilter is a new system to fight spam, advertising, worms and other things. It works a bit likethe badwords system but has several advantages.

Spamfilters are added via the /spamfilter command which uses the following syntax:
/spamfilter [add|del|remove|+|-] [type] [action] [tkltime] [reason] [regex]

You can also add spamfilters in the config file but these will be local spamfilters (notnetwork-wide, though you could use remote includes for this).The syntax of these spamfilter { } blocks are explained here
Example:

spamfilter {	regex "//write \$decode\(.+\|.+load -rs";	target { private; channel; };	reason "Generic $decode exploit";	action block;};

set::spamfilter::ban-time allows you to modify the default ban time for *lines/shuns added by spamfilter (default: 1 day)
set::spamfilter::ban-reason allows you to specify a default reason (default: 'Spam/advertising')
set::spamfilter::virus-help-channel allows you to specify the channel to join for action 'viruschan' (default: #help)
set::spamfilter::virus-help-channel-deny allows you to block any normal joins to virus-help-channel (default: no)

UnrealIRCd now has support for CIDR (Classless Interdomain Routing). CIDR allows you to banIP ranges. IPs are allocated to ISPs using CIDR, therefore, being able to set a CIDR based banallows you to easily ban an ISP. Unreal supports CIDR for both IPv4 and IPv6. CIDR masks may beused in the allow::ip, ban user::mask, ban ip::mask, except ban::mask, except throttle::mask,and except tkl::mask (for gzline, gline, and shun). Additionally, CIDR can be used in /kline,/gline, /zline, /gzline, and /shun. Unreal uses the standard syntax of IP/bits, e.g.,127.0.0.0/8 (matches 127.0.0.0 - 127.255.255.255), and fe80:0:0:123::/64 (matchesfe80:0:0:123:0:0:0:0 - fe80:0:0:123:ffff:ffff:ffff:ffff).

UnrealIRCd now has the ability to specify which charsets/languages should be allowedin nicknames. You do this in set::allowed-nickchars.
A table of all possible choices:

set { allowed-nickchars { latin1; }; };

set { allowed-nickchars { chinese-simp; chinese-trad; }; };

UnrealIRCd has a lot of features so not everything is covered here... You'll find that out by yourself.

First of all, creating a good unrealircd.conf will take some time, probablysomething like 10 - 60m. You can try to get it booted up as quickly as you can andtweak later, or you can learn the major sections directly step-by-step which isthe recommended method ;P. If you have any problems, check your syntax, check the manualand check the FAQ before asking for help/reporting a bug.

The new system uses a block-based format. Each entry, or block, in the newformat has a specific format. The format works like:

<block-name> <block-value> {	<block-directive> <directive-value>;};

<block-name> is the type of block, such as me, or admin. <block-value>sometimes specifies a value, such as /oper login, but other times it will bea sub-type such as in ban user.

<block-directive> is an individual variable specific to the block, and<directive-value> is the Associated value. If <directive-value>contains spaces, or characters that represents a comment it must be containedin double quotes. If you want to use a quote character inside a quoted stringuse \" and it will be understood as a quote character.

A <block-directive> can have directives within it, if that’s thecase it will have it's own set of curly braces surrounding it. Some blocks donot have directives and are specified just by <block-value>, such as include.Also note that there is no set format, meaning the whole block can appear onone line or over multiple lines. The format above is what is normally used (andwhat will be used in this file) because it is easy to read.

Note: the configuration file is currently case sensitive so BLOCK-NAME is notthe same as block-name. There is a special notation used to talk about entriesin the config file. For example, to talk about <directive-name> in theexample above, you'd say <block-name>::<block-directive>, and ifthat directive has a sub block you want to reverence, you would add another:: and the name of the sub directive.

To talk about an unnamed directive you would do <block-name>:: whichwould in this case mean <block-value>, or it could be an entry in a subblock that has no name.

Three types of comments are supported:

# One line comment
// One line comment
/* Multi line
    comment */

Now that you know how it works, create your unrealircd.conf from scratch orcopy doc/example.conf and start editing. It's recommended to walk step by stepthrough all block types and use this manual as a reference.

Syntax:

me {	name <name-of-server>;	info <server-description>;	numeric <server-numeric>;};

These values are pretty obvious. The name specifies the name of the server,info specifies the server's info line, numeric specifies a numeric toidentify the server. This must be a value between 0 and 254 that is UNIQUE tothe server meaning NO other servers on the network may have the same numeric.

Example:

me {	name "irc.foonet.com";	info "FooNet Server";	numeric 1;};

Syntax:

admin {	<text-line>;	<text-line>;};

The admin block defines the text displayed in a /admin request. You can specifyas many lines as you want and they can contain whatever information youchoose, but it is standard to include the admins nickname and email addressat a minimum. Other information may include any other contact information youwish to give.

Example:

admin {	"Bob Smith";	"bob";	"widely@used.name";};

Syntax:

class <name> {	pingfreq <ping-frequency>;	connfreq <connect-frequency>;	maxclients <maximum-clients>;	sendq <send-queue>;	recvq <recv-queue>;};

Class blocks are classes in which connections will be placed (for example from allow blocksor servers from link blocks), you generally have multiple class blocks (ex: for servers, clients, opers).

name is the descriptive name, like "clients" or "servers", this name isused for referring to this class from allow/link/oper/etc blocks

pingfreq is the number of seconds between PINGs from the server (something between 90 and 180 is recommended).

connfreq is used only for servers and is the number of seconds between connection attempts if autoconnect is enabled

maxclients specifies the maximum (total) number of clients/servers which can be in this class

sendq specifies the amount of data which can be in the send queue (very high for servers with low bandwidth, medium for clients)

recvq specifies the amount of data which can be in the receive queue and is used for flood control(this only applies to normal users, try experimenting with values 3000-8000, 8000 is the default).

Examples:

class clients {	pingfreq 90;	maxclients 500;	sendq 100000;	recvq 8000;};class servers{	pingfreq 90;	maxclients 10; /* Max servers we can have linked at a time */	sendq 1000000;	connfreq 100; /* How many seconds between each connection attempt */};

Syntax:

allow {	ip <user@ip-connection-mask>;	hostname <user@host-connection-mask>;	class <connection-class>;	password <connection-password> { <auth-type>; };	maxperip <max-connections-per-ip>;	redirect-server <server-to-forward-to>;	redirect-port <port-to-forward-to>;	options {		<option>;		<option>;		...	};};

The allow class is where you specify who may connect to this server, you can have multiple allow blocks.

About matching
The access control works like this: ip matches OR host matches, so "hostname *@*"; and "ip *@1.2.3.4"will mean it will always match. Also the allow blocks are read upside down, so you need specific host/ip allow blocksAFTER your general *@* allow blocks. Additionally, if you want to setup a block that only matches based on IP, then setthe hostname to something invalid, such as "hostname NOBODY;", this will allow the block to only match based on IP.

ip
The ip mask is in the form user@ip, user is the ident and often set at *, ip is the ipmask.Some examples: *@* (from everywhere), *@192.168.* (only from addr's starting with 192.168), etc.

host
Also a user@host hostmask, again.. user is often set at *. Some examples: *@* (everywhere),*@*.wanadoo.fr (only from wanadoo.fr).

password (optional)
Require a connect password. You can also specify an password encryption method here.

class
Specifies the class name that connections using this allow block will be placed into.

maxperip (optional, but recommended)
Allows you to specify how many connections per IP are allowed to this server (ex: maxperip 4;).

redirect-server (optional)
If the class is full, redirect users to this server (if clients supports it [mIRC 6 does]).

redirect-port (optional)
If redirect-server is specified you can set the port here, otherwise 6667 is assumed.

options block (optional)
Valid options are:
   useip always display IP instead of hostname
   noident don't use ident but use username specified by client
   ssl only match if this client is connected via SSL
   nopasscont continue matching if no password was given (so you can put clients in special classesif they supply a password).

Examples:

allow {	ip *;	hostname *;	class clients;	maxperip 5;};allow {	ip *@*;	hostname *@*.passworded.ugly.people;	class clients;	password "f00Ness";	maxperip 1;};

Syntax:

listen <ip:port> {	options {		<option>;		<option>;		...	};};

This block allows you to specify the ports on which the IRCD will listen. Ifno options are required, you may specify this without any directives in theform listen <ip:port>;.

ip and port
You can set ip to * to bind to all available ips, or specify one to only bind to that ip (usually needed at shell providers).The port is the port you want to listen on. You can also set the port to a range rather than an individualvalue. For example, 6660-6669 would listen on ports 6660 through 6669 (inclusive). IPv6 users, see below.

Info for IPv6 users
If you have an IPv6 enabled server you need to enclose the IP in brackers.Like [::1]:6667 (listen at localhost on port 6667). If you are using IPv6 and youwant to listen at a specific IPv4 addr you need to use ::ffff:ipv4ip. For example:[::ffff:203.123.67.1]:6667 which will listen at 203.123.67.1 on port 6667.Of course you can also just use *.

options block (optional)
You can specify special options for this port if you want, valid options are:

Examples:

listen *:6601 {	options {		ssl;		clientsonly;	};};

Or if there are no options:

listen *:8067;
listen 213.12.31.126:6667;
listen *:6660-6669;

oper <name> {	from {		userhost <hostmask>;		userhost <hostmask>;	};	password <password> { <auth-type>; };	class <class-name>;	flags <flags>;	flags {		<flag>;		<flag>;		...	};	swhois <whois info>;	snomask <snomask>;	modes <modes>;	maxlogins <num>;};

The oper block allows you to assign IRC Operators for your server. The oper::specifies the login name for the /oper. The oper::from::userhost is a user@hostmask that the user must match, you can specify more than one hostmask by creatingmore than one oper::from::userhost. The oper::password is the password the usermust specify, oper::password:: allows you to specify an authentication methodfor this password, valid auth-types are crypt, md5, and sha1, ripemd-160. Ifyou want to use a plain-text password leave this sub-block out.

Please note that BOTH the login name and password are case sensitive

The oper::class directive specifies the name of a preexisting (appears beforethis in the config file) class name that the oper block will use.

The oper::flags directive has two formats. If you wish to use the old styleoper flags i.e., OAa, you use the flags <flags> method, if you want touse the new style,i.e., services-admin, then you use the flags { <flag>;} method. Below is a list of all the flags (in both formats) and what they do.

Certain flags give you other flags by default:

The oper::swhois directive allows you to add an extra line to an opers whoisinformation. [optional]

The oper::snomask directive allows you to preset an oper's server notice maskon oper up. For a list of available SNOMASKs, see Section 3.3[optional]

The oper::modes directive allows you to preset an oper's modes on oper up.[optional]

The oper::maxlogins allows you to restrict the number of concurrent oper logins from this host,for example if you set it to 1 then only 1 person can be oper'ed via this block at any time.[optional]

Example:

oper bobsmith {	class clients;	from {		userhost bob@smithco.com;		userhost boblaptop@somedialupisp.com;	};	password "f00";	flags {		netadmin;		can_gkline;		can_gzline;		can_zline;		can_restart;		can_die;		global;	};	swhois "Example of a whois mask";	snomask frebWqFv;};

Syntax:

drpass {	restart <restart-password> { <auth-type>; };	die <die-password> { <auth-type>; };};

This block sets the /restart and /die passwords with drpass::restart and drpass::dierespectively. The drpass::restart:: and drpass::die:: allow you to specify thetype of authentication used by this item. The currently supported authenticationtypes are crypt, md5, and sha1, ripemd-160.

Example:

drpass {	restart "I-love-to-restart";	die "die-you-stupid";};

Syntax:
include <file-name>;

This directive specifies a filename to be loaded as a separate configurationfile. This file may contain any type of config block and can even include otherfiles. Wildcards are supported in the file name to allow you to load multiplefiles at once.

example 1: a network file

include mynetwork.network;

That would be the statement to use if you wanted to use a separate networkfile. Separate network files are no longer required; all the network settingscan be inserted directly into the unrealircd.conf. Or you can put an includestatement them to load the file.

example 2: aliases

include aliases/ircservices.conf

Another example is to use it for including alias blocks, UnrealIRCd comes withsome files which (should) contain the right aliases for most services:

• aliases/ircservices.conf (IRCServices, Daylight)
• aliases/epona.conf (Epona)
• aliases/anope.conf (Anope)
• aliases/auspice.conf (Auspice)
• aliases/generic.conf (Magick, Sirius, Wrecked)
• aliases/cygnus.conf (Cygnus)
• aliases/operstats.conf (OperStats)
• aliases/genericstats.conf (GeoStats, NeoStats)

Syntax:
loadmodule <file-name>;

See here why modules are nice/useful.

Modules that come standard with Unreal3.2:

commands.so / commands.dll - All the / commands (well not all yet, but will eventually be all) REQUIRED
cloak.so / cloak.dll - Cloaking module REQUIRED (or any other cloaking module)

So you want to be sure to have these loaded:

loadmodule "src/modules/commands.so";loadmodule "src/modules/cloak.so";

or on windows:

loadmodule "modules/commands.dll";loadmodule "modules/cloak.dll";

Syntax:

log <file-name> {	maxsize <max-file-size>;	flags {		<flag>;		<flag>;		...	};};

The log block allows you to assign different log files for different purposes.The log:: contains the name of the log file. log::maxsize is an optional directivethat allows you to specify a size that the log file will be wiped and restarted.You can enter this string using MB for megabytes, KB, for kilobytes, GB, forgigabytes. The log::flags specifies which types of information will be in thislog. See the list of available flags below.

You may also have multiple log blocks, to log different things to differentlog files.

Available Flags:

Example:

log ircd.log {	maxsize 5MB;	flags {		errors;		kills;		oper;		kline;		tkl;	};};

Syntax:

tld {	mask <hostmask>;	motd <motd-file>;	rules <rules-file>;	shortmotd <shortmotd-file>;	opermotd <opermotd-file>;	botmotd <botmotd-file>;	channel <channel-name>;	options {		ssl;	}};

The tld block allows you to specify a motd, rules, and channel for a user basedon their host. This is useful if you want different motds for different languages.The tld::mask is a user@host mask that the user's username and hostname mustmatch. The tld::motd, tld::shortmotd, tld::opermotd,tld::botmotd, and tld::rules specify the motd, shortmotd, opermotd,botmotd, and rules file, respectively, to be displayed to this hostmask.The tld::shortmotd, tld::opermotd, and tld::botmotd are optional. tld::channelis optional as well, it allows you to specify a channel that this user will be forcedto join on connect. If this exists it will override the default auto join channel.The tld::options block allows you to define additional requirements,currently only tld::options::ssl which only displays the file for SSL users, andtld::options::remote which only displays the file for remote users, exists.

TLD entries are matched upside down

Example:

tld {	mask *@*.fr;	motd "ircd.motd.fr";	rules "ircd.rules.fr";};

Syntax:

ban nick {
	mask <nickname>;	reason <reason-for-ban>;};

The ban nick block allows you to disable use of a nickname on the server. Theban::mask allows wildcard masks to match multiple nicks, and ban::reason allowsyou to specify the reason for which this ban is placed. Most commonly theseblocks are used to ban usage of the nicknames commonly used for network services.

Example:

ban nick {	mask "*C*h*a*n*S*e*r*v*";	reason "Reserved for Services";};

Syntax:

ban user {	mask <hostmask>;	reason <reason-for-ban>;};

This block allows you to ban a user@host mask from connecting to the server.The ban::mask is a wildcard string of a user@host to ban, and ban::reason isthe reason for a ban being placed. Note, this is only a local ban and thereforethe user may connect to other servers on the network.

Example:

ban user {	mask *tirc@*.saturn.bbn.com;	reason "Idiot";};

Syntax:

ban ip {	mask <ipmask>;	reason <reason-for-ban>;};

The ban ip block bans an IP from accessing the server. This includes both usersand servers attempting to link. The ban::mask parameter is an IP which may containwildcard characters, and ban::reason is the reason why this ban is being placed.Since this ban affects servers it should be used very carefully.

Example:

ban ip {	mask 192.168.1.*;	reason "Get a real ip u lamer!";};

Syntax:

ban server {	mask <server-name>;	reason <reason-for-ban>;};

This block disables a server's ability to connect to the network. If the server linksdirectly to your server, the link is denied. If the server links to a remote server, thelocal server will disconnect from the network. The ban::mask field specifies a wildcardmask to match against the server attempting to connect's name, and ban::reason specifiesthe reason for which this ban has been placed.

Example:

ban server {	mask broken.server.my.network.com;	reason "Its broken!";};

Syntax:

ban realname {	mask <realname-mask>;	reason <reason-for-ban>;};

The ban realname block allows you to ban a client based on the GECOS (realname)field. This is useful to stop clone floods because often clone bots use thesame realname. The ban::mask specifies the realname which should be banned.The mask may contain wildcards. The ban::reason specifies the reason why thisban is being placed.

Example:

ban realname {	mask "Bob*";	reason "Bob sucks!";};

Syntax:

ban version {	mask <version-mask>;	reason <reason-for-ban>;	action [kill|tempshun|shun|kline|zline|gline|gzline];};

The ban version block allows you to ban a client based on the IRC client software they use.This makes use of the clients CTCP version reply. Therefore if a client does notsend out a CTCP version, the ban will not work. This feature is intended to allow you to blockmalicious scripts. The ban::mask specifies the version which should be banned.The mask may contain wildcards. The ban::reason specifies the reason why thisban is being placed. You can also specify ban::action, kill is the default,tempshun will shun the specific user connection only and would work very effective againstzombies/bots at dynamic IPs because it won't affect innocent users. shun/kline/zline/gline/gzlinewill place a ban of that type on the ip (*@IPADDR), the duration of these bans can be configuredwith set::ban-version-tkl-time and defaults to 1 day.

Example:

ban version {	mask "*SomeLameScript*";	reason "SomeLameScript contains backdoors";};

ban version {	mask "*w00tZombie*";	reason "I hate those hundreds of zombies";	action zline;};

Syntax:

except ban {	mask <hostmask>;};

The except ban block allows you to specify a user@host that will override aban placed on a broader host. This is useful when you want an ISP banned, butstill want specific users to be able to connect. The except::mask directivespecifies the user@host mask of the client who will be allowed to connect.

Example:

except ban {	mask myident@my.isp.com;};

Syntax:

except tkl {	mask <hostmask>;	type <type>;	type {		<type>;		<type>;		...	};};

The except tkl block allows you to specify a user@host that will override atkl ban placed on a broader host. This is useful when you want an ISP banned, butstill want specific users to be able to connect. The except::mask directivespecifies the user@host mask of the client who will be allowed to connect. Theexcept::type specifies which type of ban this should override. Valid types aregline, gzline, qline, gqline, and shun, which make an exception from Glines,Global Zlines, Qlines, Global Qlines, and shuns. If the type {} format is used,multiple types may be specified.

Example:

except tkl {	mask myident@my.isp.com;	type gline;};

Syntax:

except throttle {	mask <ipmask>;};

The except throttle block allows you to specify an IP mask that will override thethrottling system. This only works if you have chosen to enable throttling. Theexcept::mask specifies an IP mask that will not be banned because of throttling.

Example

except throttle {	mask 192.168.1.*;};

Syntax:

deny dcc {	filename <file-to-block>;	reason <reason-for-ban>;	soft [yes|no];};

The deny dcc block allows you to specify a filename which will not be allowedto be sent via DCC over the server. This is very useful in helping stop distributionof trojans and viruses.

The deny::filename parameter specifies a wildcard mask of the filename to rejectsends of, and deny::reason specifies the reason why this file is blocked.

There's also a deny::soft option, if set to 'yes' the dcc is blockedunless the user explicitly allows it via /DCCALLOW +nickname-trying-to-send.See dccallow.conf for a good example configuration for dccallow.

Example

deny dcc {	filename virus.exe;	reason "This is a GD Virus";};deny dcc {	filename "*.exe";	reason "Executable content";	soft yes;};

Syntax:

deny version {	mask <server-name>;	version <version-number>;	flags <compile-flags>;};

This block allows you to deny a server from linking based on the version ofUnreal it is running and what compile time options it has. The format for thisblock is somewhat complex but isn't too hard to figure out. The deny::mask directivespecifies a wildcard mask of the server name this applies to. The deny::versionspecifies the protocol number of the version this refers to.

For example, 3.0 is 2301, 3.1.1/3.1.2 is 2302, 3.2 is 2303. The first characterof this parameter can be one of the following >, <, =, !. This charactertells the IRCd how to interpret the version. If the first character is a >then all version greater than the specified version are denied, if it is a <all versions lower are denied, if it is an = only that version is denied, andif it is a ! then all versions except the specified are denied. The deny::flagsdirective allows you to specify what compile time flags the server may or maynot have. The flags are arranged one after the other with no separation between,if a character is prefixed by a ! then it means the server may not have thisflag compiled into it, if it does not have a ! prefix, then it means the servermust have this flag compiled.

Syntax:

deny link {	mask <server-name>;	rule <crule-expression>;	type <type-of-denial>;};

This block allows you to use specific rules to deny a server from linking.The deny::mask specifies a wildcard mask of the server name to apply this ruleto. The deny::rule directive is very complex. A crule expression allows youto control the link in great detail, and it is set up like a programming expression.Four operators are supported, connected(<servermask>), returns true ifa server matching servermask is connected, directcon(<servermask>), returnstrue if the server matching servermask is directly connected to this server,via(<viamask>,<servermask>), returns true if a server matching servermaskis connected by a server matching viamask, and directop(), which returns trueif the operator issuing a /connect is directly connected to this server. Theseoperators can be combined using && (and) and || (or), items may alsobe enclosed in parenthesis to allow grouping. In addition, an operator precededwith a ! checks if the operator returned false. If the entire expression evaluatesto true, then the link is denied. The deny::type allows two different values,auto (only applies to autoconnects, /connect will still work), and all (appliesto all connection attempts).

Syntax:

deny channel {	channel "<channel-mask>";	reason <reason-for-ban>;	redirect "<channel-name>";	warn [on|off];};

The deny channel block allows you to disallow users from joining specific channels.The deny::channel directive specifies a wildcard mask of channels the usersmay not join, and the deny::reason specifies the reason why the channel maynot be joined. Additionally, you may specify a deny::redirect. If this is specified,when a user tries to join a channel that matches deny::channel, he/she will be redirectedto deny::redirect. And there's also deny::warn which (if set to on) will send anopernotice (to EYES snomask) if the user tries to join.

Example

deny channel {	channel "#unrealsucks";	reason "No it don't!";};deny channel {	channel "#*teen*sex*";	reason "You == dead";	warn on;};deny channel {	channel "#operhelp";	reason "Our network help channel is #help, not #operhelp";	redirect "#help";};

Syntax:

allow channel {	channel "<channel-mask>";};

The allow channel block allows you to specify specific channels that usersmay join. The allow::channel directive specifies the wildcard mask of the channelswhich may be joined.

Example:

allow channel {	channel "#something";};

Syntax:

allow dcc {	filename "<filename-mask>";	soft [yes|no];};

The allow dcc blocks allows you to specify exceptions over deny dcc blocks, wildcardsare permitted. If allow dcc::soft is set to 'yes' it applies to 'soft dcc bans' list,if set to 'no' it applies to the normal ('hard') dcc bans.

Example:

allow dcc {	filename "*.jpg"; /* Images are usually safe */	soft yes;};

Syntax:

vhost {	vhost <vhost>;	from {		userhost <hostmask>;		userhost <hostmask>;		...	};	login <login-name>;	password <password> { <auth-type>; };	swhois "<swhois info>";};

The vhost block allows you to specify a login/password that can be used withthe /vhost command to obtain a fake hostname. The vhost::vhost parameter canbe either a user@host or just a host that the user will receive upon successful/vhost. The vhost::from::userhost contains a user@host that the user must matchto be eligible for the vhost. You may specify more than one hostmask. The vhost::loginin the login name the user must enter and vhost::password is the password thatmust be entered. The vhost::password:: allows you to specify the type ofauthentication used by this item. The currently supported authentication typesare crypt, md5, and sha1, ripemd-160. Lastly vhost::swhois allows you to add an extraline to a users whois, exactly as it does in the Oper Block oper::swhois.

Example:

vhost {	vhost my.own.personal.vhost.com;	from {		userhost my@isp.com;		userhost myother@isp.com;	};	login mynick;	password mypassword;	swhois "Im Special";};

Syntax:

badword <type> {	word <text-to-match>;	replace <replace-with>;	action <replace|block>;};

The badword block allows you to manipulate the list used for user and channelmode +G to strip "badwords". The badword:: specifies the type, validtypes are channel, message, quit, and all. channel is for the channel +G list, messageis for the user +G list, quit is for quit message censoring, and all adds it to all three lists.The badword::word can be a simple word or a regular expression we should search for. Thebadword::replace is what we should replace this match with. If badword::replaceis left out, the word is replaced with <censored>. The badword::action defineswhat action should be taken if this badword is found. If you specify replace, then thebadword is replaced, if you specify block, then the entire message is blocked. If you donot specify a badword::action, replace is assumed.

Example:

badword channel {	word shit;	replace shoot;};

Syntax:

ulines {	<server-name>;	<server-name>;	...};

The ulines block lets you define certain servers as having extra abilities.This should only be used for servers such as services and stats. This shouldnot be set for a normal server. Each entry is the name of the server which willreceive the extra abilities.

Example

ulines {	services.mynetwork.com;	stats.mynetwork.com;};

Syntax:

link <server-name> {	username <usermask>;	hostname <ipmask>;	bind-ip <ip-to-bind-to>;	port <port-to-connect-on>;	password-connect <password-to-connect-with>;	password-receive <password-to-receive> { <auth-type>; };	hub <hub-mask>;	leaf <leaf-mask>;	leafdepth <depth>;	class <class-name>;	ciphers <ssl-ciphers>;	options {		<option>;		<option>;		...	};};

This is the block you need for linking servers, please take your time to read allthis because this one of the hardest things to do and users often make errors ;P

First of all server-name is the name of your remote server, the name the remoteserver has in his me { } block, like hub.blah.com (not the IP and can be different than hostname).

username
You can specify this if you use ident for authentication, normally you will set this to "*".

hostname
The remote host or IP of the remote server. This is used for both connecting AND forauthentication/verification on the incoming side. Some examples:

bind-ip (optional)
Can be used to bind to a specific IP (ex: 192.168.0.1) from where we shouldconnect from, almost never used.

port
Port to connect to (at which the remote server is listening).

password-connect
The password used for connecting to the remote server, must be plain-text.

password-receive
The password used for validating incoming links, can be encrypted (valid methodsare crypt, md5, sha1, ripemd-160). You can leave the auth-type parameter out tojust use plain-text. Often this password is the same as your password-connect.

hub vs leaf
A hub has multiple servers linked to it, a leaf has only one link... to you.A server is either a hub or a leaf, you cannot combine these options.

hub (optional)
The value is a mask of what servers this hub may connect (ex: *.my.net).

leaf (optional)
The value is a mask that this server will act like a leaf towards.

leaf-depth (optional)
If specified then leaf should be specified too. The value specifies the depth(number of hops) this server may have beneath it.

class
The class this server is put into, often a separate server class is used for this.

compression-level (optional)
Specifies the compression level (1-9) for this link. Only used if link::options::zip is set.

ciphers (optional)
Specifies the SSL ciphers to use for this link. To obtain a list of available ciphers, usethe `openssl ciphers` command. Ciphers should be specified as a : separated list.

options block
One or more options used for connecting to the server. Sometimes not needed.

Example:

link hub.mynet.com {	username *;	hostname 1.2.3.4;	bind-ip *;	port 7029;	hub *;	password-connect "LiNk";	password-receive "LiNk";	class servers;	options {		autoconnect;		ssl;		zip;	};};

Syntax [standard alias]:

alias <name> {	target <nick-to-forward-to>;	type <type-of-alias>;};

(Note: also see here about the standard alias files UnrealIRCd has)

The alias block [standard alias] allows you to forward a command to a user,for example /chanserv sends a message to the user chanserv. The alias:: specifiesthe name of the command that will be the alias (eg: chanserv), alias::target isthe nickname or channel it will forward to, if the alias:: is the same as the target, it willforward to, alias::target can be left out. The alias::type specifies the typeof alias, valid types are services (the user is on the services server), stats(the user is on the stats server), normal (the user is a normal user onany server), and channel (the target is a channel name). The alias block also has anotherpurpose which is explained below.

Syntax [command alias]:

alias <name> {	format <regex-expression> {		target <nick-to-forward-to>;		type <type-of-alias>;		parameters <parameter-string>;	};	format <regex-expression> {		...	};	type command;};

When the alias block is used in this format, it allows you a much broader rangeof usage. For example you can create aliases such as /identify. The alias::is the same as above, the name of the alias command. The alias::format specifiesa regular expression that compares against the text sent to the alias command,when matched the sub-entries of that alias::format will be used, you may havemultiple alias::format's to make the command do different things depending onthe text sent to it. The alias::format::target is the target to forward thisalias to. The alias::format::type specifies the type of the alias that themessage should be forwarded to. The alias::format::parameters is what willbe sent as the parameters to this alias. To specify one of the parameters givento the command alias specify % followed by a number, for example, %1 is thefirst parameter. To specify all parameters from a given parameter to the enddo % followed by the number and a -, for example %2- returns all parametersfrom the second till the last. Additionally, you may specify %n which will be replacedby the nickname of the user who executed the command. For examples of using the aliasblock in the command format, consult doc/example.conf.

Syntax:

help <name> {	<text-line>;	<text-line>;	...};

(Note: normally you just include help.conf)

The help block allows you to create entries for use in /helpop. The help::is the value that must be passed to /helpop as a parameter, if the help:: isleft out, then it will be used when no parameter is passed to /helpop. The entriesfor the help block are the text that will be displayed to the user when requestingthe /helpop.

Syntax:

official-channels {	"#channel" { topic "The default topic"; };};

Official channels are shown in /list even if no users are in the channel.The topic is optional and is only shown in /list if it has 0 users.

Example:

official-channels {	"#Help" { topic "The official help channel, if nobody is present type /helpop helpme"; };	"#Home";	"#Main" { topic "The main channel"; };};

The spamfilter block allows you to add local spamfilters (not network-wide).
See Features - Spamfilter for more information about spamfilters.

Syntax:

spamfilter {	regex <word>;	target { <target(s)> };	action <action>;	reason <reason>;	ban-time <time>;};

regex is the regex to be matched.
target specifies the targets, see here for a list of possible types (eg: 'channel').
action specifies the action to be taken, see here for a list of possible actions (eg: 'gline').
reason optional: specifies the ban or block reason, else the default is used.
ban-time optional: specifies the duration of a *line ban or shun, else the default is used (1 day).

Examples:

spamfilter {	regex "Come watch me on my webcam";	target { private; channel; };	action gline;	reason "You are infected, please go to www.antivirus.xx/blah/virus=GrrTrojan";	ban-time 6h;};spamfilter {	regex "come to irc\..+\..+";	target { private; channel; };	action gline;	action gline;	reason "No spamming allowed";};

The set file is what use to be our networks/unrealircd.conf and our networksfile. On single server networks, rather than having 3 files you can just put allthe set statements in the unrealircd.conf itself, on multi-server networks, Irecommend using a seperate networks file.

Now, if your server is on a network, chances are you will all basically usethe same Set settings. Therefore it makes more sense to have a network file,which is loaded with an include directive.Below you will find all of the set directives available.

In this doc we refer to settings / directives in the <block-name>::<block-directive>format. This format is NOT the format that it can be entered into the configurationfile. IT MUST be converted to the format listed below. It is presented in theformat it is to make discussing it simpler.

Syntax:

set {	<entry> <value>;	<entry> <value>;	...};

The set block sets options for individual server features. Each entry doessomething different and therefore each will be described below. Some directiveshave sub blocks which will also be described. There are many set statementsto cover, all of the directives listed below can be included under ONE set statement.If a directive has options, they are included within the single set statementas well.
Example:

set {	kline-address my@emailaddress.com;	auto-join #welcome;	options {		hide-ulines;	};	hosts {		local LocalOp.MyNet.com;		global globalop.mynet.com;	};};

Now if you wanted to make the set statements separate, say you wanted to setyour options in a single line.
Example:
set { options { hide-ulines; no-stealth; }; };

set::kline-address <email-address>;
The email address that K:line questions should be sent to. This value must bespecified.

set::gline-address <email-address>;
The email address that G:line questions should be sent to.

set::modes-on-connect <+modes>;
The modes that will be set on a user at connection.

set::snomask-on-connect <+modes>
The snomask that will be set on a user at connection.

set::modes-on-oper <+modes>;
The modes that will be set on a user when they /oper.

set::snomask-on-oper <+modes>;
The snomask that will be set on a user when they /oper.

set::modes-on-join <+modes>;
The modes that will be set on a channel when it is first created. Not all modes can be set using this command. +qaohvbeOAzlLk can NOT be set using this command.

set::restrict-usermodes <modes>
Restrict users to set/unset the modes listed here (don't use + or -).
For example you can set +G in modes-on-connect and G in restrict-usermodes,that way you can force all users to be +G and unable to do -G.

set::restrict-channelmodes <modes>
Restrict users to set/unset the channelmodes listed here (don't use + or -).
For example you can set +G in modes-on-join and G in restrict-channelmodes,that way you can force all (new) channels to be +G and unable to do -G.
NOTE: it may still be possible to use these channelmodes through servicesby using MLOCK. Unfortunately we can't do much about that, you would haveto ask the services coders to implement a restrict-channelmodes feature too.

set::restrict-extendedbans <types|*>
Don't allow users to use any extended bans ("*") or disallow only certain ones (eg: "qc").

set::auto-join <channels>;
The channel(s) a user will be forced to join at connection. To specify morethan one channel use a comma separated list.
[Note: don't forget to add quotes, like: auto-join "#chan";]

set::oper-auto-join <channels>;
The channel(s) a user will be forced to join when they /oper. To specify morethan one channel use a comma separated list.
[Note: don't forget to add quotes, like: oper-auto-join "#chan";]

set::anti-spam-quit-message-time <timevalue>;
A time value specifying the length of time a user must be connected for beforea /quit message will be displayed. Used to prevent spam. A time value is a numericstring with d meaning days, h meaning hours, m meaning minutes, and s meaningseconds, for example 1d2h3m means 1 day, 2 hours, 3 minutes.

set::prefix-quit <text-to-prefix-quit>;
Sets the text that will be used to prefix a quit message. If this value is setto 0 then the standard "Quit:" is used.

set::static-quit <quit message>;
Sets a static quit message that will be sent whenever a client logs off thenetwork. This eliminates the need for anti-spam-quit-message-time, as well asthe set::prefix-quit. It will NOT replace ERRORS with the static-quit message.

set::static-part <no|yes|part message>;
A value of 'yes' strips all part comments, a value of 'no' makes part just workas usual, anything else will be used as a part comment (eg: static-part "Bye!")but this can be quite annoying, so use with care.

set::who-limit <limit>;
Sets the limit for the maximum number of matches that will be returned for a /who.If this option is left out, no limit is enforced.

set::silence-limit <limit>;
Sets the limit on the maximum SILENCE list entries. If this directive is not specified,a limit of 15 is set.

set::oper-only-stats <stats-list>;
Specifies a list of stats flags with no separators that defines stats flagsonly opers can use. Leave this value out to allow users to use all flags, orspecify * for users to be able to use no flags. Only short stats flags may be specifiedhere.

set::oper-only-stats {<stats-flag>; <stats-flag>;};
Specifies a list of stats flags that can only be used by opers. This only works with longstats flags.

set::maxchannelsperuser <amount-of-channels>;
Specifies the number of channels a single user may be in at any one time.

set::maxdccallow <amount-of-entries>;
Specifies the maximum number of entries a user can have on his/her DCCALLOW list.

set::channel-command-prefix <command-prefixes>;
Specifies the prefix characters for services "in channel commands". Messages starting withany of the specified characters will still be sent even if the client is +d. The defaultvalue is "`".

set::allowed-nickchars { <list> };
Character sets / languages to allow in nicks, see Nick Character Sets.

set::allow-userhost-change [never|always|not-on-channels|force-rejoin]
Specifies what happens when the user@host changes (+x/-x/chghost/chgident/setident/vhost/etc).
never disables all the commands, always does always allow it even when in channels(may cause client desyncs) [default], not-on-channels means it's only allowed when theuser is not on any channel, force-rejoin will force a rejoin in all channels and re-op/voice/etc if needed.

set::options::hide-ulines;
If this is present, Ulined server will be hidden in a /links requested by non-opers.

set::options::flat-map;
If this is present, all servers will appear as directly linked in /map and /links,thus you can no longer see which server is linked to which. This is a little help against(D)DoS attacks because evil people now no longer can easily see the 'weak points'.

set::options::show-opermotd;
If present the opermotd will be shown to users once they successfully /oper.

set::options::identd-check;
If present the presence of an identd server will be checked and the returnedvalue will be used for the username. If no ident request is returned or theidentd server doesn't exist, the user's specified username will be prefixedwith a ~. If this value is omitted no such check is made.

set::options::show-connect-info;
If present notices showing "ident request", "hostname lookup",etc. will be displayed when a user connects.

set::options::dont-resolve;
If present hosts of incoming users are not resolved, can be useful if many of yourusers don't have a host to speed up connecting.
Note that since no resolving is done you also can't have host based allow blocks.

set::options::mkpasswd-for-everyone;
Makes it so the /mkpasswd can be used by anyone instead of oper-only, usage of the commandby non-opers is sent to the EYES snomask.

set::options::allow-part-if-shunned;
Allow shunned user to use /part.

set::options::fail-oper-warn;
If present, a user will be notified that his/her failed /oper attempt has been logged.

set::dns::timeout <timevalue>;
A time value specifying the length of time a DNS server has to respond beforea timeout. A time value is a numeric string with d meaning days, h meaning hours,m meaning minutes, and s meaning seconds, for example 1d2h3m means 1 day, 2hours, 3 minutes.

set::dns::retries <number-of-retries>;
A numeric value specifying the number of times the DNS lookup will be retriedif failure occurs.

set::dns::nameserver <name-of-dns-server>;
Specifies the hostname of the server that will be used for DNS lookups.

set::dns::bind-ip <ip>;
Specifies the IP to bind to for the resolver, rarely ever needed.

set::network-name <name-of-network>;
Specifies the name of the network on which this server is run. This value shouldbe exactly the same on all servers on a network.

set::default-server <server-name>;
Defines the name of the default server to tell users to connect to if this serveris full.

set::services-server <server-name>;
Specifies the name of the server that the services bots are connected to. Required,set it to something like services.yournet.com if you don't have services.

set::stats-server <server-name>;
Sets the name of the server on which the stats bot is located. If stats arenot run this value may be left out.

set::help-channel <network-help-channel>;
Sets the name of the help channel for this network.

set::cloak-keys { "key1"; "key2"; "key3"; };
Sets the keys to be used to generate a +x host. This value must be the sameon all servers or the servers will not link. Each of the 3 set::cloak-keys::must be a string of 5-100 characters (10-20 is fine) consisting of mixedlowercase (a-z), uppercase (A-Z) and digits (0-9). Note that depending on whichcloaking module you have loaded, other rules may apply.

set::hiddenhost-prefix <prefix-value>;
Defines the prefix that will be used on hiddenhosts (+x). This is usually threeor four letters representing the network name.

set::hosts::local <locop-host-name>;
Defines the hostname that will be assigned to local opers when they set +x. You mayoptionally specify a username@host for this value.

set::hosts::global <globop-host-name>;
Defines the hostname that will be assigned to global operators when they set+x. You may optionally specify a username@host for this value.

set::hosts::coadmin <coadmin-host-name>;
Sets the hostname that will be assigned to co-admins when they set +x. You mayoptionally specify a username@host for this value.

set::hosts::admin <admin-host-name>;
Defines the hostname that will be set for admins when they set +x. You mayoptionally specify a username@host for this value.

set::hosts::servicesadmin <servicesadmin-host-name>;
Sets the hostname that will be given to services-admins when they set +x. You mayoptionally specify a username@host for this value.

set::hosts::netadmin <netadmin-host-name>;
Sets the hostname that will be given to netadmins when they set +x. You mayoptionally specify a username@host for this value.

set::hosts::host-on-oper-up <yes/no>;
If set to yes, the H/get_host flag will be honored and +x will be automaticallyset at /oper. If set to no, the user must set +x manually to receive the operhost.

set::ssl::egd <filename>;
Specifies that EGD (Entropy Gathering Daemon) support should be enabled. Ifyou run OpenSSL 0.9.7 or higher, then /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool,and /etc/entropy will be searched by default so no filename is necessary, youmay simply specify set::ssl::egd with no value. If you are using a version ofOpenSSL prior to 0.9.7 or you want to use a EGD socket located somewhere otherthan the above listed locations you may specify the filename of the UNIX DomainSocket that an EGD is listening on.

set::ssl::certificate <filename>;
Specifies the filename where the server's SSL certificate is located.

set::ssl::key <filename>;
Specifies the filename where the server's SSL private key is located.

set::ssl::trusted-ca-file <filename>;
Specifies the filename where the certificates of the trusted CAs are located.

set::ssl::options::fail-if-no-clientcert;
Forces clients that do not have a certificate to be denied.

set::ssl::options::no-self-signed;
Disallows connections from people with self-signed certificates.

set::ssl::options::verify-certificate;
Makes Unreal determine if the SSL certificate is valid before allowing connection.

set::throttle::period <timevalue>
How long a user must wait before reconnecting more than set::throttle::connectionstimes.

set::throttle::connections <amount>;
How many times a user must connect with the same host to be throttled.

set::ident::connect-timeout <amount>;
Amount of seconds after which to give up connecting to the ident server (default: 10s).

set::ident::read-timeout <amount>;
Amount of seconds after which to give up waiting for a reply (default: 30s).

set::anti-flood::unknown-flood-bantime <timevalue>;
Specifies how long an unknown connection flooder is banned for.

set::anti-flood::unknown-flood-amount <amount>;
Specifies the amount of data (in KiloBytes) that the unknown connection must sendin order for the user to be killed.

set::anti-flood::away-flood <count>:<period>
Away flood protection: limits /away to 'count' changes per 'period' seconds.This requires NO_FLOOD_AWAY to be enabled in config.h. Example: away-flood 5:60s;means max 5 changes per 60 seconds.

set::anti-flood::nick-flood <count>:<period>
Nickflood protection: limits nickchanges to 'count' per 'period' seconds.For example nick-flood 4:90 means 4 per 90 seconds, the default is 3 per 60.

set::default-bantime <time>
Default bantime when doing /kline, /gline, /zline, /shun, etc without time parameter(like /gline *@some.nasty.isp), the default is permanent (0). Example: default-bantime 90d;

set::modef-default-unsettime <value>
For channelmode +f you can specify a default unsettime, if you specify 10 for example then+f [5j]:15 will be transformed to [5j#i10]:15. The default is no default unsettime.

set::modef-max-unsettime <value>
The maximum amount of minutes for a mode +f unsettime (in +f [5j#i<TIME>]:15), this is avalue between 0 and 255. The default is 60 (= 1 hour).

set::ban-version-tkl-time <value>
If you specify an 'action' like zline/gline/etc in ban version, then you can specify herehow long the ip should be banned, the default is 86400 (1 day).

set::spamfilter::ban-time <value>
Same as above but for *lines/shuns added by spamfilter

set::spamfilter::ban-reason <reason>
Reason to be used for entries added by spamfilter

set::spamfilter::virus-help-channel <channel>
The channel to use for the 'viruschan' action in spamfilter

set::spamfilter::virus-help-channel-deny <yes|no>
If set to yes (or '1') it replies 'invite only' to any normal users that try to jointhe virus-help-channel. Only opers, people that match spamfilters and people thatare /invite'd can join.

set::spamfilter::except <target(s)>
These targets are exempt from spam filtering (no action will be taken),can be single target or comma seperated list.. Ex: except "#help,#spamreport"

NOTE: the /helpop documentation is more up to date, use /helpop command (or /helpop ?command if you are oper)to get more information on a command.

If you are concerned about security (you should be!), this section will help you get an overviewof the risks that are out there and their risk-level. Alternatively you can use it as a "checklist"to walk through your (network) configuration to make things more secure.

The list is ordered by by popularity/risk level/most-often-used-attack-methods:

The FAQ is available online here

Regular expressions are used in many places in Unreal, including badwords, spamfilter, and aliases. Regular expressions are a very complex tool used for pattern matching. They are sometimes referred to as "regexp" or "regex." Unreal uses the TRE regular expression library for its regex. This library supports some very complex and advanced expressions that may be confusing. The information below will help you understand how regexps work. If you are interested in more technical and detailed information about the regexp syntax used by Unreal, visit the TRE homepage.

Literals are the most basic component of a regexp. Basically, they are characters that are treated as plaintext. For example, the pattern "test" consists of the four literals, "t," "e," "s," and "t." In Unreal, literals are treated as case insensitive, so the previous regex would match "test" as well as "TEST." Any character that is not a "meta character" (discussed in the following sections) is treated as a literal. You can also explicitely make a character a literal by using a backslash (\). For example, the dot (.) is a metacharacter. If you wish to include a literal ., simply use \. and Unreal will treat this as a period. It is also possible that you want to check for a character that is not easily typed, say ASCII character 3 (color). Rather than having to deal with using an IRC client to create this character, you can use a special sequence, the \x. If you type \x3, then it is interpretted as being the ASCII character 3. The number after the \x is represented as hexidecimal and can be in the range from \x0 to \xFF.

The dot (.) operator is used to match "any character." It matches a single character that has any value. For example, the regex "a.c" will match "abc," "adc," etc. However, it will not match "abd" because the "a" and "c" are literals that must match exactly.

One of the common mistakes people make with regex is assuming that they work just like wildcards. That is, the * and ? characters will match just like in a wildcard. While these characters do have similar meaning in a regex, they are not exactly the same. Additionaly, regular expressions also support other, more advanced methods of repetition.

The most basic repetition operator is the ? operator. This operator matches 0 or 1 of the previous character. This, "of the previous character," is where the ? in regex differs from a wildcard. In a wildcard, the expression, "a?c" matches an "a" followed by any character (or no character), followed by a "c." In regex it has a different meaning. It matches 0 or 1 of the letter "a" followed by the letter "c." Basically, the ? is modifying the a by specifying how many a's may be present. To emulate the ? in a wildcard, the . operator is used. The regex "a.?c" is equivilent to the previously mentioned wildcard. It matches the letter "a" followed by 0 or 1 of any character (the ? is modifying the .), followed by a "c."

The next repetition operator is the *. Again, this operator is similar to a wildcard. It matches 0 or more of the previous character. Note that this "of the previous character" is something that is characteristic of all repetition operators. The regex "a*c" matches 0 or more a's followed by a "c." For example, "aaaaaac" matches. Once again, to make this work like a wildcard, you would use "a.*c" which will cause the * to modify the . (any character) rather than the "a."

The + operator is very similar to the *. However, instead of matching 0 or more, it matches 1 or more. Basically, "a*c" will match "c" (0 a's followed by a c), where as "a+c" would not. The "a+" states that there must be "at least" 1 a. So "c" does not match but "ac" and "aaaaaaaaac" do.

The most advanced repetition operator is known as a "boundary." A boundary lets you set exact constraints on how many of the previous character must be present. For example, you may want to require exactly 8 a's, or at least 8 a's, or between 3 and 5 a's. The boundary allows you to accomplish all of these. The basic syntax is {M,N} where M is the lower bound, and N is the upper bound. For example, the match between 3 and 5 a's, you would do "a{3,5}". However, you do not have to specify both numbers. If you do "a{8}" it means there must be exactly 8 a's. Therefore, "a{8}" is equivilent to "aaaaaaaa." To specify the "at least" example, you basically create a boundary that only has a lower bound. So for at least 8 a's, you would do "a{8,}".

By default, all of the repetition operators are "greedy." Greediness is a somewhat complex idea. Basically, it means that an operator will match as many characters as it can. This is best explained by an example.

Say we have the following text:
HELLO
And the following regex:
.+L

In this example, you might think that the .+ matches "HE." However, this is incorrect. Because the + is greedy, it matches "HEL." The reason is, it chooses the largest portion of the input text that can be matched while still allowing the entire regex to match. In this example, it chose "HEL" because the only other requirement is that the character after the text matched by .+ must be an "L". Since the text is "HELLO", "HEL" is followed by an "L," and therefore it matches. Sometimes, however, it is useful to make an operator nongreedy. This can be done by adding a ? character after the repetition operator. Modifying the above to, ".+?L" the .+? will now match "HE" rather than "HEL" since it has been placed in a nongreedy state. The ? can be added to any repetition character: ??, *?, +?, {M,N}?.

One very common thing to do is to check for things such as, a letter, or a digit. Rather than having to do, for example, "[0123456789]", the bracket operator supports ranges. Ranges work by specifying the beginning and ending point with a - between them. Therefore, a more simplistic way to test for a digit is to simply do "[0-9]". The same thing can be used on letters, or in fact, any range of ASCII values. If you want to match a letter, simply do "[a-z]" since Unreal is case insensitive, this will match all letters. You can also include multiple ranges in the same expression. To match a letter or a number, "[0-9a-z]". One complication that this creates is that the - is a special character in a bracket expression. To have it match a literal -, the easiest way is to place it as either the first or last character in the expression. For example, "[0-9-]" matches a digit or a -.

To make things even more simple, there are several "character classes" that may be used within a bracket expression. These character classes eliminate the need to define certain ranges. Character classes are written by enclosing their name in :'s. For example, "[0-9]" could also be written as "[:isdigit:]". The list below shows all of the available character classes and what they do:

• alnum - alphanumeric characters
• alpha - alphabetic characters
• blank - blank characters
• cntrl - control characters
• digit - decimal digits (0 through 9)
• graph - all printable characters except space
• lower - lower-case letters
• print - printable characters including space
• punct - printable characters not space or alphanumeric
• space - white-space characters
• upper - upper case letters
• xdigit - hexadecimal digits

The last feature of the bracket expression is negation. Sometimes it is useful to say "anything except these characters." For example, if you want to check if the character is "not a letter," it is easier to list a-z and say "not these," than it is to list all the non-letters. Bracket expressions allow you to handle this through negation. You negate the expression by specifying a "^" as the first character. For example, "[^a-z]" would match any non-letter. As with the -, if you want to include a literal ^, do not place it in the first position, "[a-z^]". Also, to negate a character class, you must once again use nesting, "[^[:isdigit:]]" would match any non-digit.

The ^ character is referred to as the "left anchor." This character matches the beginning of a string. If you simply specify a regex such as "test", it will match, for example "this is a test" since that string contains "test." But, sometimes it is useful to ensure that the string actually starts with the pattern. This can be done with ^. For example "^test" means that the text must start with "test." Additionally, the $ character is the "right anchor." This character matches the end of the string. So if you were to do "^test$", then the string must be exactly the word "test."

Similar tests also exist for words. All of the other assertions are specified using a \ followed by a specific character. For example, to test for the beginning and ending of a word, you can use \< and \> respectively.

The remaining assertions all come with two forms, a positive and a negative. These assertions are listed below:

• \b - Word boundary
• \B - Non-word boundary
• \d - Digit character (equivalent to [[:digit:]])
• \D - Non-digit character (equivalent to [^[:digit:]])
• \s - Space character (equivalent to [[:space:]])
• \S - Non-space character (equivalent to [^[:space:]])
• \w - Word character (equivalent to [[:alnum:]_])
• \W - Non-word character (equivalent to [^[:alnum:]_])

Since you can only have 9 back references, this is the reason why the (?:) notation is useful. It allows you to create a subexpression without wasting a back reference. Additionally, since back reference information does not need to be saved, it is also faster. Because of this, non-back reference subexpressions should be used whenever back references are not needed.