1 /* This is an example configuration for Services.

     2  *

     3  * All statements end in semi-colons (';').

     4  * Shell style, C style, and C++ style comments may be used.

     5  *

     6  * Items marked with "(*)" are reconfigurable at runtime via REHASH.

     7  */

     8 

     9 /******************************************************************************

    10  * MODULES SECTION.                                                           *

    11  ******************************************************************************/

    12 

    13 /*

    14  * These are the modules included with the core distribution of Services.

    15  *

    16  * You may be interested in the atheme community modules distribution as

    17  * well, which adds additional features that may or may not be compatible

    18  * with the project paradigms intended for maintainance of the core of

    19  * atheme-services.

    20  *

    21  * Visit the atheme-services website for more information and to download them.

    22  *

    23  * Modules marked [experimental] will taint your atheme-services instance. Do

    24  * not file any bug reports with us about using Services with those modules;

    25  * they will be ignored.

    26  */

    27 

    28 /* Dynamic security modules.

    29  *

    30  * WARNING: If you select one of these modules, the default security policy included

    31  * with Atheme may break.  These modules are intended for people who know what they

    32  * are doing and understand the implications of what they do.  Security modules which

    33  * are likely to break the default policy are prefixed with [!], if you are new to

    34  * Atheme, you should avoid enabling them.

    35  *

    36  * If you find your security policy is broken, you may debug it while allowing normal

    37  * operation of your IRC network by putting Atheme into "permissive mode".  To do this,

    38  * enable general::permissive_mode.

    39  *

    40  * [!] Infer "command:" namespace permissions   modules/security/cmdperm

    41  */

    42 #loadmodule "modules/security/cmdperm";

    43 

    44 /* Protocol module.

    45  *

    46  * Please select a protocol module. Different servers use different protocols.

    47  * Below is a listing of ircd's known to work with the various protocol modules

    48  * available.

    49  *

    50  * Asuka 1.2.1 or later                         modules/protocol/asuka

    51  * Bahamut 2.1.x                                modules/protocol/bahamut

    52  * Charybdis IRCd                               modules/protocol/charybdis

    53  * ChatIRCd                                     modules/protocol/chatircd1.1

    54  * DreamForge 4.6.7 or later                    modules/protocol/dreamforge

    55  * InspIRCd 2.0                                 modules/protocol/inspircd

    56  * ircd-ratbox 2.0 and later                    modules/protocol/ratbox

    57  * IRCNet ircd (ircd 2.11)                      modules/protocol/ircnet

    58  * ircd-seven                                   modules/protocol/ircd-seven

    59  * Nefarious IRCu 0.4.0 or later                modules/protocol/nefarious

    60  * ngIRCd 19 or later [experimental]            modules/protocol/ngircd

    61  * UnrealIRCd 3.2.*                             modules/protocol/unreal

    62  * UnrealIRCd 4 or later                        modules/protocol/unreal4

    63  *

    64  * If your IRCd vendor has supplied a module file, build it and load it here

    65  * instead of one above.

    66  */

    67 loadmodule "modules/protocol/ngircd";

    68 

    69 /* Protocol mixins.

    70  *

    71  * These should be used if you do not have/want certain features on your

    72  * network that your ircd normally has. If you do not know what this means,

    73  * you do not need any of them.

    74  *

    75  * Disable halfops                              modules/protocol/mixin_nohalfops

    76  * Disable holdnick (use enforcer clients)      modules/protocol/mixin_noholdnick

    77  * Disable "protect" mode on channels           modules/protocol/mixin_noprotect

    78  * Disable "owner" mode on channels             modules/protocol/mixin_noowner

    79  */

    80 #loadmodule "modules/protocol/mixin_nohalfops";

    81 #loadmodule "modules/protocol/mixin_noholdnick";

    82 #loadmodule "modules/protocol/mixin_noprotect";

    83 #loadmodule "modules/protocol/mixin_noowner";

    84 

    85 /* Database backend module.

    86  *

    87  * Please select a database backend module. Different backends allow for

    88  * different ways in which the services data can be manipulated. YOU MAY

    89  * ONLY HAVE ONE OF THESE BACKENDS LOADED.

    90  *

    91  * The following backends are available:

    92  *

    93  * Atheme 0.1 flatfile database format          modules/backend/flatfile

    94  * Open Services Exchange database format       modules/backend/opensex

    95  *

    96  * Most networks will want opensex.

    97  */

    98 loadmodule "modules/backend/opensex";

    99 

   100 /* Password hashing modules.

   101  *

   102  * If you would like encryption for your services passwords, or to migrate

   103  * from another IRC services package which used encryption for its passwords,

   104  * please select a module here.

   105  *

   106  * The following encryption-capable crypto modules are available:

   107  *

   108  *   Argon2 (Password Hashing Competition 2015)    modules/crypto/argon2

   109  *   scrypt (Tarsnap Online Backup Service)        modules/crypto/scrypt

   110  *   PBKDF2 (Including support for SASL SCRAM-SHA) modules/crypto/pbkdf2v2

   111  *   bcrypt (EksBlowfish; from Niels Provos etc.)  modules/crypto/bcrypt

   112  *   SHA2-512 crypt(3) a la '$6$...'               modules/crypto/crypt3-sha2-512

   113  *   SHA2-256 crypt(3) a la '$5$...'               modules/crypto/crypt3-sha2-256

   114  *

   115  * If you do not load an encryption-capable crypto module, some features will

   116  * not work correctly, and errors will be logged on e.g. user registration

   117  * that it was not possible to encrypt their password. Support for running

   118  * without an encryption-capable crypto module will be removed in a later

   119  * version of this software; for now it is just *HIGHLY* discouraged.

   120  *

   121  * Note, that upon starting with an encryption-capable crypto module, YOUR

   122  * UNENCRYPTED PASSWORDS ARE IMMEDIATELY AND *IRREVERSIBLY* CONVERTED. Make

   123  * at least TWO backups of your database before experimenting with this. If

   124  * you have several thousand accounts, this conversion may take a long time.

   125  *

   126  * The following modules can only be used to /verify/ existing encrypted

   127  * passwords, for example when upgrading from an older version of this

   128  * software, or migrating from something else:

   129  *

   130  *   PBKDF2 v1 (Atheme <= 7.2 compatibility)       modules/crypto/pbkdf2

   131  *   Raw SHA2-512                                  modules/crypto/rawsha2-512

   132  *   Raw SHA2-256                                  modules/crypto/rawsha2-256

   133  *   Anope SHA2-256 (Anope 2.0 compatibility)      modules/crypto/anope-enc-sha256

   134  *   Raw SHA1 (Anope ~1.8 compatibility)           modules/crypto/rawsha1

   135  *   Raw MD5 (Anope ~1.8 compatibility)            modules/crypto/rawmd5

   136  *   IRCServices (+ Anope) compatibility           modules/crypto/ircservices

   137  *   MD5 crypt(3) (Atheme Linux compatibility)     modules/crypto/crypt3-md5

   138  *   DES crypt(3) (Atheme OS X compatibility)      modules/crypto/crypt3-des

   139  *   Base64 (Anope ~1.8 compatibility)             modules/crypto/base64

   140  *

   141  * To transition between crypto schemes, load the preferred scheme first,

   142  * and as users login or set new passwords, they will be migrated to the new

   143  * preferred scheme. Like so:

   144  *

   145  * loadmodule "modules/crypto/argon2";

   146  * loadmodule "modules/crypto/scrypt";

   147  * loadmodule "modules/crypto/pbkdf2v2";

   148  * loadmodule "modules/crypto/pbkdf2";

   149  * loadmodule "modules/crypto/crypt3-md5";

   150  *

   151  * The Argon2 module requires the argon2 reference library (./configure

   152  * --with-argon2) and is *NOT* available in Atheme v7.2 or earlier. If you

   153  * wish to use this module while retaining the possibility to downgrade to

   154  * v7.2, please see the crypto {} documentation below.

   155  *

   156  * The Scrypt module requires libsodium (./configure --with-libsodium) and is

   157  * *NOT* available in Atheme v7.2 or earlier. This module may also require a

   158  * 64-bit Operating System to function correctly.

   159  *

   160  * The PBKDF2v2 module has no dependencies and is recommended. If you were

   161  * previously using the PBKDF2 v1 module on v7.2, you must still keep it in

   162  * the configuration here; the PBKDF2 v2 module cannot verify its password

   163  * hashes. However, you should also load PBKDF2 v2 (if you don't decide to use

   164  * anything else), because the PBKDF2 v1 module is now verify-only.

   165  *

   166  * The bcrypt module will truncate passwords greater than 72 characters. It is

   167  * also capable of verifying the older $2a$ digests that contain an integer

   168  * wrap-around bug, as used on e.g. Anope. It is not capable of verifying the

   169  * PHP-bcrypt $2x$ and $2y$ digests; but $2y$ can simply be changed to $2b$.

   170  * All successfully-verified passwords not using $2b$ will be converted to it.

   171  * This is an encryption-capable module, but its use is discouraged unless you

   172  * need to use it for interoperability with some other piece of software.

   173  *

   174  * The crypt3-* modules depend on your platform crypt(3) supporting the

   175  * respective algorithms. This is not guaranteed to be the case. If you used

   176  * modules/crypto/posix on Linux, you need crypt3-md5. If you used

   177  * modules/crypto/posix on OS X, you need crypt3-des. These modules issue

   178  * informational messages when loaded to the effect that they might break in

   179  * the future. They also run selftests on load to verify that they will work.

   180  *

   181  * All available modules are listed below, in the preferred load order. The

   182  * modules that are commented out are not available by default (please see

   183  * the v7.3 release notes in NEWS.md) or may require a third-party library to

   184  * use. If you know that you do not need a specific module, it is better to

   185  * not load it, so comment it out. Do not change the order of the modules

   186  * below unless you need to migrate from one to the other (as described

   187  * above); in particular, putting verify-only modules above encryption-

   188  * capable modules would be a waste of CPU time every time password

   189  * verification for a user whose password was not encrypted by them is

   190  * attempted.

   191  *

   192  * Comments that start with -- describe the ./configure option necessary to

   193  * have this module built.

   194  */

   195 #loadmodule "modules/crypto/argon2";            /* --with-argon2 */

   196 #loadmodule "modules/crypto/scrypt";            /* --with-sodium */

   197 loadmodule "modules/crypto/pbkdf2v2";

   198 #loadmodule "modules/crypto/bcrypt";            /* See notes above */

   199 loadmodule "modules/crypto/pbkdf2";             /* Verify-only, see prev. */

   200 #loadmodule "modules/crypto/crypt3-sha2-512";   /* Needs crypt(3) support */

   201 #loadmodule "modules/crypto/crypt3-sha2-256";   /* Needs crypt(3) support */

   202 #loadmodule "modules/crypto/crypt3-md5";        /* --enable-legacy-pwcrypto */

   203 #loadmodule "modules/crypto/rawsha2-512";       /* --enable-legacy-pwcrypto */

   204 #loadmodule "modules/crypto/rawsha2-256";       /* --enable-legacy-pwcrypto */

   205 #loadmodule "modules/crypto/anope-enc-sha256";  /* --enable-legacy-pwcrypto */

   206 #loadmodule "modules/crypto/rawsha1";           /* --enable-legacy-pwcrypto */

   207 #loadmodule "modules/crypto/rawmd5";            /* --enable-legacy-pwcrypto */

   208 #loadmodule "modules/crypto/ircservices";       /* --enable-legacy-pwcrypto */

   209 #loadmodule "modules/crypto/crypt3-des";        /* --enable-legacy-pwcrypto */

   210 #loadmodule "modules/crypto/base64";            /* --enable-legacy-pwcrypto */

   211 

   212 /* Authentication module.

   213  *

   214  * These allow using passwords from an external system. The password given

   215  * when registering a new account is also checked against the external

   216  * system.

   217  *

   218  * The following authentication modules are available:

   219  *

   220  * LDAP                                         modules/auth/ldap

   221  *

   222  * The LDAP module requires OpenLDAP client libraries. It uses them in a

   223  * synchronous manner, which means that an unresponsive LDAP server can

   224  * freeze services.

   225  */

   226 #loadmodule "modules/auth/ldap";

   227 

   228 /* NickServ modules.

   229  *

   230  * Here you can disable or enable certain features of NickServ, by

   231  * defining which modules are loaded. You can even disable NickServ

   232  * entirely. Please note however, that an authentication service

   233  * (either NickServ, or UserServ) is required for proper functionality.

   234  *

   235  * Core components                              modules/nickserv/main

   236  * Nickname access lists                        modules/nickserv/access

   237  * Bad email address blocking                   modules/nickserv/badmail

   238  * CertFP fingerprint managment                 modules/nickserv/cert

   239  * DROP command                                 modules/nickserv/drop

   240  * Nickname enforcement                         modules/nickserv/enforce

   241  * GHOST command                                modules/nickserv/ghost

   242  * GROUP and UNGROUP commands                   modules/nickserv/group

   243  * HELP command                                 modules/nickserv/help

   244  * Nickname expiry override (HOLD command)      modules/nickserv/hold

   245  * IDENTIFY command                             modules/nickserv/identify

   246  * INFO command                                 modules/nickserv/info

   247  * Last quit message in INFO                    modules/nickserv/info_lastquit

   248  * LIST command                                 modules/nickserv/list

   249  * LISTLOGINS command                           modules/nickserv/listlogins

   250  * LISTMAIL command                             modules/nickserv/listmail

   251  * LISTOWNMAIL command                          modules/nickserv/listownmail

   252  * LOGIN command (for no_nick_ownership)        modules/nickserv/login

   253  * LOGOUT command                               modules/nickserv/logout

   254  * MARK command                                 modules/nickserv/mark

   255  * Password quality validation                  modules/nickserv/pwquality

   256  * FREEZE command                               modules/nickserv/freeze

   257  * LISTCHANS command                            modules/nickserv/listchans

   258  * LISTGROUPS command                           modules/nickserv/listgroups

   259  * REGISTER command                             modules/nickserv/register

   260  * Bypass registration limits (REGNOLIMIT)      modules/nickserv/regnolimit

   261  * Password reset (RESETPASS command)           modules/nickserv/resetpass

   262  * RESTRICT command                             modules/nickserv/restrict

   263  * Password return (RETURN command)             modules/nickserv/return

   264  * Password retrieval (SENDPASS command)        modules/nickserv/sendpass

   265  * Password retrieval allowed to normal users   modules/nickserv/sendpass_user

   266  * Change primary nickname (SET ACCOUNTNAME)    modules/nickserv/set_accountname

   267  * SET EMAIL command                            modules/nickserv/set_email

   268  * SET EMAILMEMOS command                       modules/nickserv/set_emailmemos

   269  * SET ENFORCETIME command                      modules/nickserv/set_enforcetime

   270  * SET HIDEMAIL command                         modules/nickserv/set_hidemail

   271  * SET LANGUAGE command                         modules/nickserv/set_language

   272  * SET NEVERGROUP command                       modules/nickserv/set_nevergroup

   273  * SET NEVEROP command                          modules/nickserv/set_neverop

   274  * SET NOGREET command                          modules/nickserv/set_nogreet

   275  * SET NOMEMO command                           modules/nickserv/set_nomemo

   276  * SET NOOP command                             modules/nickserv/set_noop

   277  * SET NOPASSWORD command                       modules/nickserv/set_nopassword

   278  * SET PASSWORD command                         modules/nickserv/set_password

   279  * PRIVMSG instead of NOTICE (SET PRIVMSG cmd)  modules/nickserv/set_privmsg

   280  * Account info hiding (SET PRIVATE command)    modules/nickserv/set_private

   281  * SET PROPERTY command                         modules/nickserv/set_property

   282  * SET PUBKEY command                           modules/nickserv/set_pubkey

   283  * SET QUIETCHG command                         modules/nickserv/set_quietchg

   284  * Password retrieval uses code (SETPASS cmd)   modules/nickserv/setpass

   285  * STATUS command                               modules/nickserv/status

   286  * Nickname metadata viewer (TAXONOMY command)  modules/nickserv/taxonomy

   287  * VACATION command                             modules/nickserv/vacation

   288  * VERIFY command                               modules/nickserv/verify

   289  * VHOST command                                modules/nickserv/vhost

   290  * Delay services account registrations         modules/nickserv/waitreg

   291  */

   292 loadmodule "modules/nickserv/main";

   293 #loadmodule "modules/nickserv/access";

   294 loadmodule "modules/nickserv/badmail";

   295 #loadmodule "modules/nickserv/cert";

   296 loadmodule "modules/nickserv/drop";

   297 #loadmodule "modules/nickserv/enforce";

   298 loadmodule "modules/nickserv/ghost";

   299 loadmodule "modules/nickserv/group";

   300 loadmodule "modules/nickserv/help";

   301 loadmodule "modules/nickserv/hold";

   302 loadmodule "modules/nickserv/identify";

   303 loadmodule "modules/nickserv/info";

   304 #loadmodule "modules/nickserv/info_lastquit";

   305 loadmodule "modules/nickserv/list";

   306 #loadmodule "modules/nickserv/listlogins";

   307 loadmodule "modules/nickserv/listmail";

   308 #loadmodule "modules/nickserv/listownmail";

   309 #loadmodule "modules/nickserv/login";

   310 loadmodule "modules/nickserv/logout";

   311 loadmodule "modules/nickserv/mark";

   312 #loadmodule "modules/nickserv/pwquality";

   313 loadmodule "modules/nickserv/freeze";

   314 loadmodule "modules/nickserv/listchans";

   315 loadmodule "modules/nickserv/listgroups";

   316 loadmodule "modules/nickserv/register";

   317 loadmodule "modules/nickserv/regnolimit";

   318 loadmodule "modules/nickserv/resetpass";

   319 loadmodule "modules/nickserv/restrict";

   320 loadmodule "modules/nickserv/return";

   321 loadmodule "modules/nickserv/setpass";

   322 #loadmodule "modules/nickserv/sendpass";

   323 loadmodule "modules/nickserv/sendpass_user";

   324 loadmodule "modules/nickserv/set_accountname";

   325 loadmodule "modules/nickserv/set_email";

   326 loadmodule "modules/nickserv/set_emailmemos";

   327 #loadmodule "modules/nickserv/set_enforcetime";

   328 loadmodule "modules/nickserv/set_hidemail";

   329 loadmodule "modules/nickserv/set_language";

   330 loadmodule "modules/nickserv/set_nevergroup";

   331 loadmodule "modules/nickserv/set_neverop";

   332 loadmodule "modules/nickserv/set_nogreet";

   333 loadmodule "modules/nickserv/set_nomemo";

   334 loadmodule "modules/nickserv/set_noop";

   335 #loadmodule "modules/nickserv/set_nopassword";

   336 loadmodule "modules/nickserv/set_password";

   337 #loadmodule "modules/nickserv/set_privmsg";

   338 #loadmodule "modules/nickserv/set_private";

   339 loadmodule "modules/nickserv/set_property";

   340 loadmodule "modules/nickserv/set_pubkey";

   341 loadmodule "modules/nickserv/set_quietchg";

   342 loadmodule "modules/nickserv/status";

   343 loadmodule "modules/nickserv/taxonomy";

   344 loadmodule "modules/nickserv/vacation";

   345 loadmodule "modules/nickserv/verify";

   346 loadmodule "modules/nickserv/vhost";

   347 #loadmodule "modules/nickserv/waitreg";

   348 

   349 /* ChanServ modules.

   350  *

   351  * Here you can disable or enable certain features of ChanServ, by

   352  * defining which modules are loaded. You can even disable ChanServ

   353  * entirely. Please note that ChanServ requires an authentication

   354  * service, either NickServ or UserServ will do.

   355  *

   356  * Core components                              modules/chanserv/main

   357  * ACCESS command (simplified ACL editing)      modules/chanserv/access

   358  * AKICK command                                modules/chanserv/akick

   359  * BAN/UNBAN commands                           modules/chanserv/ban

   360  * UNBAN self only (load ban or this not both)  modules/chanserv/unban_self

   361  * BANSEARCH command                            modules/chanserv/bansearch

   362  * CLOSE command                                modules/chanserv/close

   363  * CLONE command                                modules/chanserv/clone

   364  * CLEAR command                                modules/chanserv/clear

   365  * CLEAR AKICKS command                         modules/chanserv/clear_akicks

   366  * CLEAR BANS command                           modules/chanserv/clear_bans

   367  * CLEAR FLAGS command                          modules/chanserv/clear_flags

   368  * CLEAR USERS command                          modules/chanserv/clear_users

   369  * COUNT command                                modules/chanserv/count

   370  * DROP command                                 modules/chanserv/drop

   371  * Forced flags changes                         modules/chanserv/fflags

   372  * FLAGS command                                modules/chanserv/flags

   373  * Forced foundership transfers                 modules/chanserv/ftransfer

   374  * GETKEY command                               modules/chanserv/getkey

   375  * HALFOP/DEHALFOP commands                     modules/chanserv/halfop

   376  * HELP command                                 modules/chanserv/help

   377  * Channel expiry override (HOLD command)       modules/chanserv/hold

   378  * INFO command                                 modules/chanserv/info

   379  * INVITE command                               modules/chanserv/invite

   380  * KICK/KICKBAN commands                        modules/chanserv/kick

   381  * LIST command                                 modules/chanserv/list

   382  * MARK command                                 modules/chanserv/mark

   383  * Moderated channel registrations              modules/chanserv/moderate

   384  * OP/DEOP commands                             modules/chanserv/op

   385  * OWNER/DEOWNER commands                       modules/chanserv/owner

   386  * PROTECT/DEPROTECT commands                   modules/chanserv/protect

   387  * QUIET command (+q support)                   modules/chanserv/quiet

   388  * Channel takeover recovery (RECOVER command)  modules/chanserv/recover

   389  * REGISTER command                             modules/chanserv/register

   390  * SET EMAIL command                            modules/chanserv/set_email

   391  * SET ENTRYMSG command                         modules/chanserv/set_entrymsg

   392  * SET FANTASY command                          modules/chanserv/set_fantasy

   393  * SET GAMESERV command                         modules/chanserv/set_gameserv

   394  * SET GUARD command                            modules/chanserv/set_guard

   395  * SET KEEPTOPIC command                        modules/chanserv/set_keeptopic

   396  * SET LIMITFLAGS command                       modules/chanserv/set_limitflags

   397  * SET MLOCK command                            modules/chanserv/set_mlock

   398  * SET PREFIX command                           modules/chanserv/set_prefix

   399  * Channel info hiding (SET PRIVATE command)    modules/chanserv/set_private

   400  * SET PROPERTY command                         modules/chanserv/set_property

   401  * SET PUBACL command                           modules/chanserv/set_pubacl

   402  * SET RESTRICTED command                       modules/chanserv/set_restricted

   403  * SET SECURE command                           modules/chanserv/set_secure

   404  * SET TOPICLOCK command                        modules/chanserv/set_topiclock

   405  * SET URL command                              modules/chanserv/set_url

   406  * SET VERBOSE command                          modules/chanserv/set_verbose

   407  * STATUS command                               modules/chanserv/status

   408  * SYNC command (and automatic ACL syncing)     modules/chanserv/sync

   409  * Named Successor ACL flag                     modules/chanserv/successor_acl

   410  * Channel metadata viewer (TAXONOMY command)   modules/chanserv/taxonomy

   411  * TEMPLATE command                             modules/chanserv/template

   412  * TOPIC/TOPICAPPEND commands                   modules/chanserv/topic

   413  * VOICE/DEVOICE commands                       modules/chanserv/voice

   414  * WHY command                                  modules/chanserv/why

   415  * VOP/HOP/AOP/SOP commands                     modules/chanserv/xop

   416  *  This module provides emulation of the ircservices XOP scheme ONLY.

   417  *  Do not report discrepencies when using native commands to edit channel

   418  *  ACLs. This is intentional.

   419  * Flood protection                             modules/chanserv/antiflood

   420  *  This module should be loaded after at least chanserv/quiet if you want

   421  *  the autoquiet feature to work.

   422  */

   423 loadmodule "modules/chanserv/main";

   424 loadmodule "modules/chanserv/access";

   425 loadmodule "modules/chanserv/akick";

   426 loadmodule "modules/chanserv/ban";

   427 #loadmodule "modules/chanserv/unban_self";

   428 loadmodule "modules/chanserv/bansearch";

   429 loadmodule "modules/chanserv/clone";

   430 loadmodule "modules/chanserv/close";

   431 loadmodule "modules/chanserv/clear";

   432 loadmodule "modules/chanserv/clear_akicks";

   433 loadmodule "modules/chanserv/clear_bans";

   434 loadmodule "modules/chanserv/clear_flags";

   435 loadmodule "modules/chanserv/clear_users";

   436 loadmodule "modules/chanserv/count";

   437 loadmodule "modules/chanserv/drop";

   438 #loadmodule "modules/chanserv/fflags";

   439 loadmodule "modules/chanserv/flags";

   440 loadmodule "modules/chanserv/ftransfer";

   441 loadmodule "modules/chanserv/getkey";

   442 #loadmodule "modules/chanserv/halfop";

   443 loadmodule "modules/chanserv/help";

   444 loadmodule "modules/chanserv/hold";

   445 loadmodule "modules/chanserv/info";

   446 loadmodule "modules/chanserv/invite";

   447 loadmodule "modules/chanserv/kick";

   448 loadmodule "modules/chanserv/list";

   449 loadmodule "modules/chanserv/mark";

   450 #loadmodule "modules/chanserv/moderate";

   451 loadmodule "modules/chanserv/op";

   452 #loadmodule "modules/chanserv/owner";

   453 #loadmodule "modules/chanserv/protect";

   454 #loadmodule "modules/chanserv/quiet";

   455 loadmodule "modules/chanserv/recover";

   456 loadmodule "modules/chanserv/register";

   457 loadmodule "modules/chanserv/set_email";

   458 loadmodule "modules/chanserv/set_entrymsg";

   459 loadmodule "modules/chanserv/set_fantasy";

   460 #loadmodule "modules/chanserv/set_gameserv";

   461 loadmodule "modules/chanserv/set_guard";

   462 loadmodule "modules/chanserv/set_keeptopic";

   463 #loadmodule "modules/chanserv/set_limitflags";

   464 loadmodule "modules/chanserv/set_mlock";

   465 loadmodule "modules/chanserv/set_prefix";

   466 #loadmodule "modules/chanserv/set_private";

   467 loadmodule "modules/chanserv/set_property";

   468 #loadmodule "modules/chanserv/set_pubacl";

   469 loadmodule "modules/chanserv/set_restricted";

   470 loadmodule "modules/chanserv/set_secure";

   471 loadmodule "modules/chanserv/set_topiclock";

   472 loadmodule "modules/chanserv/set_url";

   473 loadmodule "modules/chanserv/set_verbose";

   474 loadmodule "modules/chanserv/status";

   475 loadmodule "modules/chanserv/sync";

   476 #loadmodule "modules/chanserv/successor_acl";

   477 loadmodule "modules/chanserv/taxonomy";

   478 loadmodule "modules/chanserv/template";

   479 loadmodule "modules/chanserv/topic";

   480 loadmodule "modules/chanserv/voice";

   481 loadmodule "modules/chanserv/why";

   482 #loadmodule "modules/chanserv/xop";

   483 loadmodule "modules/chanserv/antiflood";

   484 

   485 /* CHANFIX module.

   486  *

   487  * Here you can disable or enable certain features of CHANFIX, by

   488  * defining which modules are loaded.

   489  *

   490  * Core components                              modules/chanfix/main

   491  */

   492 #loadmodule "modules/chanfix/main";

   493 

   494 /* OperServ modules.

   495  *

   496  * Here you can disable or enable certain features of OperServ, by

   497  * defining which modules are loaded.

   498  *

   499  * Core components                              modules/operserv/main

   500  * AKILL system                                 modules/operserv/akill

   501  * CLEARCHAN command                            modules/operserv/clearchan

   502  * CLONES system                                modules/operserv/clones

   503  * COMPARE command                              modules/operserv/compare

   504  * GENHASH command                              modules/operserv/genhash

   505  * GREPLOG command                              modules/operserv/greplog

   506  * HELP command                                 modules/operserv/help

   507  * IGNORE system                                modules/operserv/ignore

   508  * IDENTIFY command                             modules/operserv/identify

   509  * INFO command                                 modules/operserv/info

   510  * INJECT command                               modules/operserv/inject

   511  * JUPE command                                 modules/operserv/jupe

   512  * MODE command                                 modules/operserv/mode

   513  * MODINSPECT command                           modules/operserv/modinspect

   514  * MODLIST command                              modules/operserv/modlist

   515  * MODLOAD command                              modules/operserv/modload

   516  * MODRELOAD command                            modules/operserv/modreload

   517  * MODUNLOAD command                            modules/operserv/modunload

   518  * NOOP system                                  modules/operserv/noop

   519  * Regex mass akill (RAKILL command)            modules/operserv/rakill

   520  * RAW command                                  modules/operserv/raw

   521  * READONLY command                             modules/operserv/readonly

   522  * REHASH command                               modules/operserv/rehash

   523  * RESTART command                              modules/operserv/restart

   524  * Display regex matching (RMATCH command)      modules/operserv/rmatch

   525  * Most common realnames (RNC command)          modules/operserv/rnc

   526  * RWATCH system                                modules/operserv/rwatch

   527  *

   528  * Note that ALL of these SET commands only apply until the next rehash!

   529  *

   530  * ALL of the below SET commands (deprecated)   modules/operserv/set

   531  * SET AKICKTIME subcommand (temporarily)       modules/operserv/set_akicktime

   532  * SET CHANEXPIRE subcommand (temporarily)      modules/operserv/set_chanexpire

   533  * SET COMMITINTERVAL subcommand (temporarily)  modules/operserv/set_commitinterval

   534  * SET ENFORCEPREFIX subcommand (temporarily)   modules/operserv/set_enforceprefix

   535  * SET KLINETIME subcommand (temporarily)       modules/operserv/set_klinetime

   536  * SET MAXCHANACS subcommand (temporarily)      modules/operserv/set_maxchanacs

   537  * SET MAXCHANS subcommand (temporarily)        modules/operserv/set_maxchans

   538  * SET MAXFOUNDERS subcommand (temporarily)     modules/operserv/set_maxfounders

   539  * SET MAXLOGINS subcommand (temporarily)       modules/operserv/set_maxlogins

   540  * SET MAXNICKS subcommand (temporarily)        modules/operserv/set_maxnicks

   541  * SET MAXUSERS subcommand (temporarily)        modules/operserv/set_maxusers

   542  * SET MDLIMIT subcommand (temporarily)         modules/operserv/set_mdlimit

   543  * SET NICKEXPIRE subcommand (temporarily)      modules/operserv/set_nickexpire

   544  * SET RECONTIME subcommand (temporarily)       modules/operserv/set_recontime

   545  * SET SPAM subcommand (temporarily)            modules/operserv/set_spam

   546  *

   547  * SGLINE system                                modules/operserv/sgline

   548  * SHUTDOWN command                             modules/operserv/shutdown

   549  * Non-config oper privileges (SOPER command)   modules/operserv/soper

   550  * Oper privilege display (SPECS command)       modules/operserv/specs

   551  * SQLINE system                                modules/operserv/sqline

   552  * UPDATE command                               modules/operserv/update

   553  * UPTIME command                               modules/operserv/uptime

   554  */

   555 loadmodule "modules/operserv/main";

   556 loadmodule "modules/operserv/akill";

   557 #loadmodule "modules/operserv/clearchan";

   558 #loadmodule "modules/operserv/clones";

   559 loadmodule "modules/operserv/compare";

   560 #loadmodule "modules/operserv/genhash";

   561 #loadmodule "modules/operserv/greplog";

   562 loadmodule "modules/operserv/help";

   563 loadmodule "modules/operserv/identify";

   564 loadmodule "modules/operserv/ignore";

   565 loadmodule "modules/operserv/info";

   566 loadmodule "modules/operserv/jupe";

   567 loadmodule "modules/operserv/mode";

   568 loadmodule "modules/operserv/modinspect";

   569 loadmodule "modules/operserv/modlist";

   570 loadmodule "modules/operserv/modload";

   571 loadmodule "modules/operserv/modunload";

   572 loadmodule "modules/operserv/modreload";

   573 loadmodule "modules/operserv/noop";

   574 #loadmodule "modules/operserv/rakill";

   575 loadmodule "modules/operserv/readonly";

   576 loadmodule "modules/operserv/rehash";

   577 loadmodule "modules/operserv/restart";

   578 loadmodule "modules/operserv/rmatch";

   579 loadmodule "modules/operserv/rnc";

   580 loadmodule "modules/operserv/rwatch";

   581 loadmodule "modules/operserv/set";

   582 loadmodule "modules/operserv/sgline";

   583 loadmodule "modules/operserv/shutdown";

   584 #loadmodule "modules/operserv/soper";

   585 loadmodule "modules/operserv/specs";

   586 #loadmodule "modules/operserv/sqline";

   587 loadmodule "modules/operserv/update";

   588 loadmodule "modules/operserv/uptime";

   589 

   590 /* MemoServ modules.

   591  *

   592  * Here you can disable or enable certain features of MemoServ, by

   593  * defining which modules are loaded. You can even disable MemoServ

   594  * entirely.

   595  *

   596  * Core components                              modules/memoserv/main

   597  * HELP command                                 modules/memoserv/help

   598  * SEND command                                 modules/memoserv/send

   599  * Channel memos (SENDOPS command)              modules/memoserv/sendops

   600  * Group memos (SENDGROUP command)              modules/memoserv/sendgroup

   601  * LIST command                                 modules/memoserv/list

   602  * READ command                                 modules/memoserv/read

   603  * FORWARD command                              modules/memoserv/forward

   604  * DELETE command                               modules/memoserv/delete

   605  * IGNORE command                               modules/memoserv/ignore

   606  */

   607 loadmodule "modules/memoserv/main";

   608 loadmodule "modules/memoserv/help";

   609 loadmodule "modules/memoserv/send";

   610 loadmodule "modules/memoserv/sendops";

   611 loadmodule "modules/memoserv/sendgroup";

   612 loadmodule "modules/memoserv/list";

   613 loadmodule "modules/memoserv/read";

   614 loadmodule "modules/memoserv/forward";

   615 loadmodule "modules/memoserv/delete";

   616 loadmodule "modules/memoserv/ignore";

   617 

   618 /* Global module.

   619  *

   620  * Like the other services, the Global noticer is a module. You can

   621  * disable or enable it to your liking below. Please note that the

   622  * Global noticer is dependent on OperServ for full functionality.

   623  */

   624 loadmodule "modules/global/main";

   625 

   626 /* InfoServ module.

   627  *

   628  * Like the other services, InfoServ is a module. You can disable or

   629  * enable it to your liking below.

   630  */

   631 loadmodule "modules/infoserv/main";

   632 

   633 /* SASL agent module.

   634  *

   635  * Allows clients to authenticate to services via SASL with an appropriate

   636  * ircd. You need the core components and at least one mechanism.

   637  *

   638  * Core components                      modules/saslserv/main

   639  * AUTHCOOKIE mechanism (for IRIS)      modules/saslserv/authcookie

   640  * ECDH-X25519-CHALLENGE mechanism      modules/saslserv/ecdh-x25519-challenge

   641  * ECDSA-NIST256P-CHALLENGE mechanism   modules/saslserv/ecdsa-nist256p-challenge

   642  * EXTERNAL mechanism (IRCv3.1+)        modules/saslserv/external

   643  * PLAIN mechanism                      modules/saslserv/plain

   644  * SCRAM-SHA-* mechanisms               modules/saslserv/scram

   645  *

   646  * ECDH-X25519-CHALLENGE support requires that Atheme be compiled against a

   647  * cryptographic library that provides X25519 ECDH support (BoringSSL,

   648  * LibreSSL, ARM mbedTLS, Nettle, Sodium). This will be checked while running

   649  * ./configure.

   650  *

   651  * ECDSA-NIST256P-CHALLENGE support requires that Atheme be compiled against

   652  * an OpenSSL with ECDSA support (not RHEL etc. unless you compile your own).

   653  * This will be checked while running ./configure.

   654  *

   655  * You MUST read doc/SASL-SCRAM before loading modules/saslserv/scram!

   656  */

   657 loadmodule "modules/saslserv/main";

   658 loadmodule "modules/saslserv/authcookie";

   659 #loadmodule "modules/saslserv/ecdh-x25519-challenge";

   660 #loadmodule "modules/saslserv/ecdsa-nist256p-challenge";

   661 #loadmodule "modules/saslserv/external";

   662 loadmodule "modules/saslserv/plain";

   663 #loadmodule "modules/saslserv/scram";   /* READ doc/SASL-SCRAM FIRST! */

   664 

   665 /* GameServ modules.

   666  *

   667  * Here you can disable or enable certain features of GameServ, by

   668  * defining which modules are loaded. You can even disable GameServ

   669  * entirely.

   670  *

   671  * Core components                              modules/gameserv/main

   672  * DICE/WOD commands                            modules/gameserv/dice

   673  * EIGHTBALL command                            modules/gameserv/eightball

   674  * Game-specific dice calculators               modules/gameserv/gamecalc

   675  * HELP commands                                modules/gameserv/help

   676  * LOTTERY command                              modules/gameserv/lottery

   677  * NAMEGEN command                              modules/gameserv/namegen

   678  * RPS command                                  modules/gameserv/rps

   679  */

   680 #loadmodule "modules/gameserv/main";

   681 #loadmodule "modules/gameserv/dice";

   682 #loadmodule "modules/gameserv/eightball";

   683 #loadmodule "modules/gameserv/gamecalc";

   684 #loadmodule "modules/gameserv/help";

   685 #loadmodule "modules/gameserv/lottery";

   686 #loadmodule "modules/gameserv/namegen";

   687 #loadmodule "modules/gameserv/rps";

   688 

   689 /* RPGServ modules.

   690  *

   691  * Here you can disable or enable certain features of RPGServ, by

   692  * defining which modules are loaded. You can even disable RPGServ

   693  * entirely.

   694  *

   695  * Core components                              modules/rpgserv/main

   696  * ENABLE/DISABLE commands                      modules/rpgserv/enable

   697  * HELP command                                 modules/rpgserv/help

   698  * INFO command                                 modules/rpgserv/info

   699  * LIST command                                 modules/rpgserv/list

   700  * SEARCH command                               modules/rpgserv/search

   701  * SET commands                                 modules/rpgserv/set

   702  */

   703 #loadmodule "modules/rpgserv/main";

   704 #loadmodule "modules/rpgserv/enable";

   705 #loadmodule "modules/rpgserv/help";

   706 #loadmodule "modules/rpgserv/info";

   707 #loadmodule "modules/rpgserv/list";

   708 #loadmodule "modules/rpgserv/search";

   709 #loadmodule "modules/rpgserv/set";

   710 

   711 /* BotServ modules.

   712  *

   713  * Here you can disable or enable certain features of BotServ, by

   714  * defining which modules are loaded. You can even disable BotServ

   715  * entirely.

   716  *

   717  * Core components                              modules/botserv/main

   718  * HELP command                                 modules/botserv/help

   719  * INFO command                                 modules/botserv/info

   720  * NPC commands (SAY, ACT)                      modules/botserv/bottalk

   721  * SET FANTASY command                          modules/botserv/set_fantasy

   722  * SET NOBOT command                            modules/botserv/set_nobot

   723  * SET PRIVATE command                          modules/botserv/set_private

   724  * SET SAYCALLER command                        modules/botserv/set_saycaller

   725  */

   726 #loadmodule "modules/botserv/main";

   727 #loadmodule "modules/botserv/help";

   728 #loadmodule "modules/botserv/info";

   729 #loadmodule "modules/botserv/bottalk";

   730 #loadmodule "modules/botserv/set_fantasy";

   731 #loadmodule "modules/botserv/set_nobot";

   732 #loadmodule "modules/botserv/set_private";

   733 #loadmodule "modules/botserv/set_saycaller";

   734 

   735 /* HostServ modules.

   736  *

   737  * Here you can disable or enable certain features of HostServ, by

   738  * defining which modules are loaded. You can even disable HostServ

   739  * entirely.

   740  *

   741  * HostServ is a more complex, and optional virtual host management service.

   742  * Users wishing only to set vhosts need not use it (they can use the builtin

   743  * vhost management of NickServ instead).

   744  *

   745  * Core components                              modules/hostserv/main

   746  * HELP command                                 modules/hostserv/help

   747  * OFFER system                                 modules/hostserv/offer

   748  * ON and OFF commands                          modules/hostserv/onoff

   749  * REQUEST system                               modules/hostserv/request

   750  * VHOST and LISTVHOST commands                 modules/hostserv/vhost

   751  * VHOSTNICK command                            modules/hostserv/vhostnick

   752  * GROUP command                                modules/hostserv/group

   753  * DROP command                                 modules/hostserv/drop

   754  */

   755 #loadmodule "modules/hostserv/main";

   756 #loadmodule "modules/hostserv/help";

   757 #loadmodule "modules/hostserv/onoff";

   758 #loadmodule "modules/hostserv/offer";

   759 #loadmodule "modules/hostserv/request";

   760 #loadmodule "modules/hostserv/vhost";

   761 #loadmodule "modules/hostserv/vhostnick";

   762 #loadmodule "modules/hostserv/group";

   763 #loadmodule "modules/hostserv/drop";

   764 

   765 /* HelpServ modules.

   766  * HelpServ allows users to request help from network staff in a few different ways.

   767  *

   768  * Core components                              modules/helpserv/main

   769  * HELPME command                               modules/helpserv/helpme

   770  * Help Ticket system                           modules/helpserv/ticket

   771  * Service List                                 modules/helpserv/services

   772  *

   773  * The ticket system works like a bugtracker ot helpdesk ticket system, HELPME

   774  * works like a one-time alert. You should probably only load one of the two systems.

   775  */

   776 #loadmodule "modules/helpserv/main";

   777 #loadmodule "modules/helpserv/helpme";

   778 #loadmodule "modules/helpserv/ticket";

   779 #loadmodule "modules/helpserv/services";

   780 

   781 /* Channel listing service.

   782  *

   783  * Allows users to list channels with more flexibility than the /list

   784  * command.

   785  *

   786  * Core components                              modules/alis/main

   787  */

   788 #loadmodule "modules/alis/main";

   789 

   790 /* StatServ module.

   791  * StatServ provides basic statistics and split tracking.

   792  *

   793  * Core components                              modules/statserv/main

   794  * CHANNEL command                              modules/statserv/channel

   795  * NETSPLIT command                             modules/statserv/netsplit

   796  * SERVER command                               modules/statserv/server

   797  */

   798 loadmodule "modules/statserv/main";

   799 #loadmodule "modules/statserv/channel";

   800 loadmodule "modules/statserv/netsplit";

   801 loadmodule "modules/statserv/server";

   802 

   803 /* GroupServ module.

   804  * GroupServ allows users to create groups to easily mass-manage channel

   805  * access and more.

   806  *

   807  * Core components                              modules/groupserv/main

   808  * ACSNOLIMIT command                           modules/groupserv/acsnolimit

   809  * DROP command                                 modules/groupserv/drop

   810  * FFLAGS command                               modules/groupserv/fflags

   811  * FLAGS command                                modules/groupserv/flags

   812  * HELP command                                 modules/groupserv/help

   813  * INFO command                                 modules/groupserv/info

   814  * JOIN command                                 modules/groupserv/join

   815  * LIST command                                 modules/groupserv/list

   816  * LISTCHANS command                            modules/groupserv/listchans

   817  * REGISTER command                             modules/groupserv/register

   818  * REGNOLIMIT command                           modules/groupserv/regnolimit

   819  * INVITE command                               modules/groupserv/invite

   820  * SET command                                  modules/groupserv/set

   821  * SET CHANNEL command                          modules/groupserv/set_channel

   822  * SET DESCRIPTION command                      modules/groupserv/set_description

   823  * SET EMAIL command                            modules/groupserv/set_email

   824  * SET GROUPNAME command                        modules/groupserv/set_groupname

   825  * SET JOINFLAGS command                        modules/groupserv/set_joinflags

   826  * SET OPEN command                             modules/groupserv/set_open

   827  * SET PUBLIC command                           modules/groupserv/set_public

   828  * SET URL command                              modules/groupserv/set_url

   829  *

   830  */

   831 loadmodule "modules/groupserv/main";

   832 loadmodule "modules/groupserv/acsnolimit";

   833 loadmodule "modules/groupserv/drop";

   834 loadmodule "modules/groupserv/fflags";

   835 loadmodule "modules/groupserv/flags";

   836 loadmodule "modules/groupserv/help";

   837 loadmodule "modules/groupserv/info";

   838 loadmodule "modules/groupserv/join";

   839 loadmodule "modules/groupserv/list";

   840 loadmodule "modules/groupserv/listchans";

   841 loadmodule "modules/groupserv/register";

   842 loadmodule "modules/groupserv/regnolimit";

   843 #loadmodule "modules/groupserv/invite";

   844 loadmodule "modules/groupserv/set";

   845 loadmodule "modules/groupserv/set_channel";

   846 loadmodule "modules/groupserv/set_description";

   847 loadmodule "modules/groupserv/set_email";

   848 loadmodule "modules/groupserv/set_groupname";

   849 loadmodule "modules/groupserv/set_joinflags";

   850 loadmodule "modules/groupserv/set_open";

   851 loadmodule "modules/groupserv/set_public";

   852 loadmodule "modules/groupserv/set_url";

   853 

   854 /*

   855  * Various modules.

   856  *

   857  * Atheme includes an optional HTTP server that can be used for integration

   858  * with portal software and other useful things. To enable it, load this

   859  * module, and uncomment the httpd { } block towards the bottom of the config.

   860  *

   861  * HTTP Server                                  modules/misc/httpd

   862  */

   863 #loadmodule "modules/misc/httpd";

   864 

   865 /* XMLRPC server module.

   866  *

   867  * The XML-RPC handler requires modules/misc/httpd to be loaded as it merely

   868  * registers a path handler for XML-RPC. The path used for XML-RPC is /xmlrpc.

   869  *

   870  * XMLRPC handler for the httpd                 modules/transport/xmlrpc

   871  */

   872 #loadmodule "modules/transport/xmlrpc";

   873 

   874 /* Extended target entity types. [EXPERIMENTAL]

   875  *

   876  * Atheme can set up special target mapping entities which match multiple

   877  * users in channel access entries.  These target mapping entity types are

   878  * defined through the 'exttarget' modules listed below.

   879  *

   880  * Exttarget handling core                      modules/exttarget/main

   881  * $oper exttarget match type                   modules/exttarget/oper

   882  * $registered exttarget match type             modules/exttarget/registered

   883  * $channel exttarget match type                modules/exttarget/channel

   884  * $chanacs exttarget match type                modules/exttarget/chanacs

   885  * $server exttarget match type                 modules/exttarget/server

   886  */

   887 #loadmodule "modules/exttarget/main";

   888 #loadmodule "modules/exttarget/oper";

   889 #loadmodule "modules/exttarget/registered";

   890 #loadmodule "modules/exttarget/channel";

   891 #loadmodule "modules/exttarget/chanacs";

   892 #loadmodule "modules/exttarget/server";

   893 

   894 /* Proxyscan (DNSBL) modules.

   895  *

   896  * Atheme can also check set DNS Blacklists for matches and respond

   897  * as set.  Activate modules here and customize further down under Proxyscan

   898  * section.

   899  */

   900 #loadmodule "modules/proxyscan/main";

   901 #loadmodule "modules/proxyscan/dnsbl";

   902 

   903 /* Other modules.

   904  *

   905  * Put any other modules you want to load on startup here. The path

   906  * is relative to PREFIX or PREFIX/lib/atheme, depending on how Atheme

   907  * was compiled.

   908  */

   909 #loadmodule "modules/contrib/backtrace";

   910 

   911 /******************************************************************************

   912  * SERVICES RUNTIME CONFIGURATION SECTION.                                    *

   913  ******************************************************************************/

   914 

   915 /*

   916  * This block controls the configuration options for crypto modules.

   917  *

   918  * It is recommended to either leave the values at their defaults, or

   919  * experiment with them so that it takes approximately 0.2-0.4 seconds

   920  * for users to identify. Services blocks while the password is being

   921  * encrypted or verified, so don't set these too large, or people can

   922  * hang services by trying many password attempts at once.

   923  *

   924  * A benchmark program for the Argon2, scrypt & PBKDF2 crypto code is

   925  * available to assist with tuning these parameters:

   926  *

   927  *     - ./configure --prefix=foo ...

   928  *     - make

   929  *     - make install

   930  *     - ${foo}/bin/atheme-crypto-benchmark -o

   931  *

   932  * If you wish to deploy SASL SCRAM support, please read 'doc/SASL-SCRAM' and

   933  * pass the '-i' flag to the included cryptographic benchmarking utility too.

   934  *

   935  * If you are using the PBKDF2 module, its performance will be significantly

   936  * affected by your choice of cryptographic digest library. This software can

   937  * currently interface with 3 libraries; in decreasing order of performance:

   938  *

   939  *     - OpenSSL (libcrypto)

   940  *     - GnuPG (libgcrypt)

   941  *     - ARM mbedTLS (libmbedcrypto)

   942  *

   943  * If you have one of these libraries available at configure-time, the PBKDF2

   944  * module will perform significantly better, allowing you to raise its

   945  * iteration count without affecting the computation time. This is indicated

   946  * by the output of the configure script; "Digest Frontend". The benchmark

   947  * program will also inform you what cryptographic digest library it is using,

   948  * if any.

   949  *

   950  *

   951  *

   952  * If you are migrating from crypto/argon2d (v7.2) to crypto/argon2, and you

   953  * wish to use the same parameters as the older module's defaults, configure

   954  * it like so:

   955  *

   956  *     crypto {

   957  *         argon2_type = "argon2d";

   958  *         argon2_memcost = 14;

   959  *         argon2_timecost = 32;

   960  *         argon2_threads = 1;

   961  *         argon2_saltlen = 32;

   962  *         argon2_hashlen = 64;

   963  *     };

   964  *

   965  *

   966  *

   967  * If you are migrating from crypto/pbkdf2 (v7.2) to crypto/pbkdf2v2, and you

   968  * wish to use the same parameters as the older module, configure it like so:

   969  *

   970  *     crypto {

   971  *         pbkdf2v2_digest = "SHA512";

   972  *         pbkdf2v2_rounds = 128000;

   973  *     };

   974  *

   975  * Note that this will still result in passwords being re-encrypted with the

   976  * newer module (as the older module successfully verifies them); another new

   977  * PBKDF2 computation with a new salt will occur, but this is still no worse

   978  * than an invocation of NickServ's "SET PASSWORD" command. You will still

   979  * need to keep the old module in your loadmodule configuration above, as the

   980  * new module cannot verify digests produced by the old one.

   981  *

   982  * If you wish to deploy SASL SCRAM support, please read 'doc/SASL-SCRAM'.

   983  * Its advice regarding parameter choice takes precedence over this!

   984  */

   985 crypto {

   986 

   987         /* (*) argon2_type

   988          *

   989          * The algorithm type to use for new passwords.

   990          *

   991          * Argon2d is suitable for use on a dedicated machine that has

   992          * limited access. It provides the most resistance to GPU and ASIC

   993          * cracking attacks, but its operation is data-dependent; that is,

   994          * during its operation, keying material derived from the password

   995          * itself is indirectly affecting the execution choices made by the

   996          * algorithm. This creates a side-channel that can leak information

   997          * about the password to other software running on the same physical

   998          * machine.

   999          *

  1000          * Argon2i avoids this by being data-independent. The order of memory

  1001          * accesses, conditional execution, etc. does not depend on the

  1002          * password, or any material derived from the password, so no side-

  1003          * channel that can reveal any information about the password is

  1004          * created. However, this means that it is easier to bruteforce by a

  1005          * password cracker, which does not have to account for execution

  1006          * differences in its implementation. This is the most suitable

  1007          * choice for running on a virtual machine that is co-located with

  1008          * other, untrusted, virtual machines, or on a dedicated machine that

  1009          * runs other, untrusted, software, or has untrusted user access.

  1010          *

  1011          * Argon2id is a blend of both, limiting the exploitability of any

  1012          * side-channels while retaining excellent resistance to GPU and ASIC

  1013          * cracking. This is suitable for all but the most sensitive of

  1014          * deployments.

  1015          *

  1016          * All algorithm types perform about equally as well as each other;

  1017          * changing this will not significantly affect the computation time.

  1018          *

  1019          * The "argon2id" type requires a more recent libargon2 library. This

  1020          * is indicated in your ./configure output ("checking if libargon2

  1021          * algorithm type Argon2id appears to be usable...").

  1022          *

  1023          * Valid values are "argon2d", "argon2i", and "argon2id"

  1024          * The default is "argon2id"; unless unsupported, then "argon2d".

  1025          */

  1026         #argon2_type = "argon2id";

  1027 

  1028         /* (*) argon2_memcost

  1029          *

  1030          * Memory cost (as a power of 2, in KiB) to use for new passwords.

  1031          *

  1032          * You should set this as high as is reasonable for the machine you

  1033          * will be running this software on. If this results in too slow a

  1034          * computation time, reset the time cost below to its minimum value.

  1035          * If it is still too slow, decrement this value (halving the memory

  1036          * usage) until it is fast enough. Alternatively, if it is still too

  1037          * fast after setting this to its highest reasonable value, raise the

  1038          * time cost below until it is not. A benchmark program is available

  1039          * alongside this software to aid in this process.

  1040          *

  1041          * WARNING: Do *NOT* set this to more than 20 (1 GiB RAM) on a 32-bit

  1042          *          machine or a 32-bit Operating System!

  1043          *

  1044          * Valid values are 3 (8 KiB RAM) to 30 (1 TiB RAM) (inclusive)

  1045          * The default is 16 (64 MiB RAM)

  1046          */

  1047         #argon2_memcost = 16;

  1048 

  1049         /* (*) argon2_timecost

  1050          *

  1051          * Time cost (iterations over the memory pool).

  1052          *

  1053          * Valid values are 3 to 1,048,576 (inclusive)

  1054          * The default is 3

  1055          */

  1056         #argon2_timecost = 3;

  1057 

  1058         /* (*) argon2_threads

  1059          *

  1060          * Number of processor threads to use for new passwords.

  1061          *

  1062          * If you want to increase the amount of computation effort required,

  1063          * while not increasing the real ("wall clock") time required, raise

  1064          * this setting to its maximum reasonable value for the machine you

  1065          * will be running this software on.

  1066          *

  1067          * This software is not multi-threaded, so only one password will be

  1068          * verified at a time. Therefore, you do NOT need to divide this by

  1069          * the expected maximum number of simultaneous logins.

  1070          *

  1071          * It is pointless to set this higher than the number of hardware

  1072          * processing threads you have; increase the time cost above instead

  1073          * if you want to make it arbitrarily slower. Diminishing returns are

  1074          * to be expected once you exceed the number of hardware processing

  1075          * /cores/ you have; hyperthreading does NOT provide much (if any) of

  1076          * a boost for this workload.

  1077          *

  1078          * Increasing this value will *decrease* the real time required, so

  1079          * you may have to subsequently increase the time cost above again to

  1080          * make it "just slow enough" once more. A benchmark program is

  1081          * available alongside this software to aid in this process.

  1082          *

  1083          * WARNING: The (size of the) memory pool configured above is split

  1084          * between the threads, which can result in too small a memory area

  1085          * per-thread if many threads are used. If you set this value, it is

  1086          * HIGHLY RECOMMENDED that you run the included benchmarking program

  1087          * with the same configuration options, to confirm that it works!

  1088          *

  1089          * WARNING: This feature is experimental. Some of the code in this

  1090          * software is not thread-safe, and although every effort has been

  1091          * made to ensure that this feature will not interfere with the

  1092          * operation of this software, this cannot be guaranteed.

  1093          *

  1094          * Valid values are 1 to 255 (inclusive)

  1095          * The default is 1 (do not use any computation parallelism)

  1096          */

  1097         #argon2_threads = 1;

  1098 

  1099         /* (*) argon2_saltlen

  1100          *

  1101          * Salt length (in bytes) to use for new passwords. You should only

  1102          * change this if absolutely necessary; for example, to interoperate

  1103          * with other software. Its value doesn't significantly affect the

  1104          * computation time.

  1105          *

  1106          * Valid values are 4 to 48 (inclusive)

  1107          * The default is 16

  1108          */

  1109         #argon2_saltlen = 16;

  1110 

  1111         /* (*) argon2_hashlen

  1112          *

  1113          * Digest length (in bytes) to use for new passwords. You should only

  1114          * change this if absolutely necessary; for example, to interoperate

  1115          * with other software. Its value doesn't significantly affect the

  1116          * computation time.

  1117          *

  1118          * Valid values are 16 to 128 (inclusive)

  1119          * The default is 64

  1120          */

  1121         #argon2_hashlen = 64;

  1122 

  1123         /* (*) scrypt_memlimit

  1124          *

  1125          * Memory limit (as a power of 2, in KiB) to use for new passwords.

  1126          *

  1127          * You should set this as high as is reasonable for the machine you

  1128          * will be running this software on. If this results in too slow a

  1129          * computation time, reset the opslimit below to its default value.

  1130          * If it is still too slow, decrement this value (halving the memory

  1131          * usage) until it is fast enough. Alternatively, if it is still too

  1132          * fast after setting this to its highest reasonable value, raise the

  1133          * opslimit below until it is not. A benchmark program is available

  1134          * alongside this software to aid in this process.

  1135          *