IRC Proxy

Hi Everyone,

I'm hoping that someone might have some insite into what I'm trying to accomplish. I need to allow some folks to use IRC, however I don't want to open up that port for everyone. I'd also like to restrict the channels that the could access. I've tinkered around with a couple of different IRC proxies (IRCProxy 1.2.41 and psyBNC 2.3.2-7) and while I've had luck connecting and getting the proxies to work, they don't seem to assist in the limitations. Example, using psyBNC, I've set the limitations, however I'm still able to connect. I've verified from a couple of 3rd party sources that I'm indeed doing this correctly. Does anyone have any other ideas about how I could administer the IRC connections? At this point, I'm honestly just considering telling these folks that I'm not going to open that port up. Thanks again for your time.

Is this an idea for work ?
or is it just for friends ?


if it IS for work, go with your instincts, and tell 'em no .......
they would have to have pretty good reasons for IRC in work time .......
I assume it IS work related as I don't see the issue if it is a friends thing .............

This is for work.... unfortunately. ;-)

That's where I'm at at this point. There just doens't seem to be a way to properly secure that type of connection and mean while keep my network safe from anything that could potentially *happen*. Thank you for your reply.

I believe there are a couple variables in the psybnc.conf file that may help you. you can have
USER1.USER.USER=some-username
USER1.USER.PASS==Some-password
USER2.USER.USER=some-different-username
USER2.USER.PASS==Some-password

and so on, I also believe you can use
PSYBNC.HOSTALLOWS.ENTRY0=some-IP
PSYBNC.HOSTALLOWS.ENTRY1=some-other-IP
and so on

It should all be in the README file

Hope this helps or at least gets you headed in the right direction

Hi Opus,

Thank you for your response. I do actually certain settings statically listed in the conf file.

USER1.BAN.ENTRY1= no access;#AllNiteCafe reason
USER1.BAN.ENTRY0= no access;#Casual reason

I've also statically set the usernames and encrypted passwords. The users are still able to access the banned channels. More than anything, I'm worried about would could come from those IRC connections such as Trojans, and various other nasty viruses etc... In fact the weird thing is, the daemon was rewriting that conf file while it was running. A user would connect and it would show that they connected to that channel after I specifically banned it. I tried to get smart and remove write access for the user the proxy was running as, and it actually changed the permissions of conf file when it restarted and the daemon was able to make new entries allowing users access thus overwriting any config changes I made.

I wonder if it is reading the entire .conf file. I'm trying to find out a way to test that, will try and get back to you soon

Hi Opus,

Thank you again for your reply. Your help is much appreciated.

sorry, left work and headed home, are you running

make menuconfig

??
I don't see an easy way to debug without getting into the code but I am betting the config file is not correct

Looks like you need to add these bans once the bnc is up and running using internal command. Looks like the channel ban must also include a hostmask for the user

ADDBAN [network~][#chan] reason :hostmask

So you may need to add the other restrictions with in the bnc command system. There are a list of commands and their syntax in the psybnc/help directory

foxyloxley

I IRC from work all the time, it is not all that unsafe if you know how it works and what not to do. Such as disabling DCC and not foolishly clicking on links or disclosing information that you would not want others to obtain. I find it a great way of communicating to a like minded group.

Then again, if it is for play and not understood, it isn't recommended from a work environment. But then again, I do only frequent my own IRC network, which helps.

Hi everyone,

OPUS: I did use the make menu config and re-run make after this. I did verify that the changes were made the conf file, however that user is still able to access the banned channels. My main concern is the usage. I'm not sure, what would all be sent over this connection. I'm worried about folks trusting and untrusted resource and possibly accepting something that shouldn't be accepted. Thank you again for your response.

From my reading, that ban you are trying to set needs a mask plus the channel name, and it is not for what you think it is, it is setting a ban on a user for that channel. So in other words, you must have the authority to set a ban on that channel, such as channel ops for it to even be of any good, I don't believe this is the variable you are needing.

You might want to look into using something other type proxy such as squid and content filter to stop any string containing the channel name to pass thru the connection. Have a look at this Here

Never tried this module, so I'm not 100% sure (I have tried squid and it is quite effective)

One last thing to bring up, bouncers for the most part are written and used to help mask the actual host you are coming from, a form of protection and deceit, not written to proxy users for filtering and monitoring purposes.

Ah, good idea. I'll look into that. Thank you very much for your help. I agree, I was probably misunderstanding what that variable was being used for.

Thank you again everyone. Opus, you're the man. Definitely above and beyond. Thanks again. ;-)