From 33d7e019d7a8c195e9dc28ce0b7d021299ac21cf Mon Sep 17 00:00:00 2001 From: Shivaram Lingamneni Date: Thu, 7 Nov 2019 13:38:13 -0500 Subject: [PATCH 1/2] add manual entry for private channels --- docs/MANUAL.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/MANUAL.md b/docs/MANUAL.md index 51784fa0..f6764c56 100644 --- a/docs/MANUAL.md +++ b/docs/MANUAL.md @@ -343,6 +343,16 @@ If you're familiar with getting this output through your client (e.g. in weechat Otherwise, in the Oragono config file, you'll want to enable raw line logging by removing `-userinput -useroutput` under the `logging` section. Once you start up your server, connect, fail to oper and get disconnected, you'll see a bunch of input/output lines in Ora's log file. Remove your password from those logs and pass them our way. +## How do I make a private channel? + +More complete support for account-based private channels is [planned](https://github.com/oragono/oragono/issues/69). In the meantime, here's a workaround: + +1. Register your channel (`/msg ChanServ register #example`) +1. Set it to be invite-only (`/mode #example +i`) +1. Grant persistent half-operator status to the desired account names (`/msg ChanServ amode #example +h alice`) + +Anyone with persistent half-operator privileges or higher will be able to join without an invite. + ------------------------------------------------------------------------------------------- From 74ab52d6e4783ecbf09dbbeb1c29fa79491474a8 Mon Sep 17 00:00:00 2001 From: Shivaram Lingamneni Date: Thu, 7 Nov 2019 14:05:35 -0500 Subject: [PATCH 2/2] update tor guidelines --- docs/MANUAL.md | 8 ++++---- oragono.yaml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/MANUAL.md b/docs/MANUAL.md index f6764c56..642df8eb 100644 --- a/docs/MANUAL.md +++ b/docs/MANUAL.md @@ -706,9 +706,9 @@ kline = "DLINE ANDKILL 2h %i :Open proxy found on your host."; ## Tor -Oragono has code support for adding an .onion address to an IRC server, or operating an IRC server as a Tor hidden service. This is subtle, so you should be familiar with the [Tor Project](https://www.torproject.org/) and the concept of a [hidden service](https://www.torproject.org/docs/tor-onion-service.html.en). +Oragono has code support for adding an .onion address to an IRC server, or operating an IRC server as a Tor onion service ("hidden service"). This is subtle, so you should be familiar with the [Tor Project](https://www.torproject.org/) and the concept of an [onion service](https://www.torproject.org/docs/tor-onion-service.html.en). -There are two possible ways to serve Oragono over Tor. One is to add a .onion address to a server that also serves non-Tor clients, and whose IP address is public information. This is relatively straightforward. Add a separate listener, for example `127.0.0.2:6668`, to Oragono's `server.listen`, then add it to `server.tor-listeners.listeners`. Then configure Tor like this: +There are two possible ways to serve Oragono over Tor. One is to add a .onion address to a server that also serves non-Tor clients, and whose IP address is public information. This is relatively straightforward. Add a separate listener, for example `127.0.0.2:6668`, to Oragono's `server.listeners`, then configure it with `tor: true`. Then configure Tor like this: ```` HiddenServiceDir /var/lib/tor/oragono_hidden_service @@ -720,13 +720,13 @@ HiddenServiceNonAnonymousMode 1 HiddenServiceSingleHopMode 1 ```` -Tor provides end-to-end encryption for hidden services, so there's no need to enable TLS in Oragono for the listener (`127.0.0.2:6668` in this example). Doing so is not recommended, given the difficulty in obtaining a TLS certificate valid for an .onion address. +Tor provides end-to-end encryption for onion services, so there's no need to enable TLS in Oragono for the listener (`127.0.0.2:6668` in this example). Doing so is not recommended, given the difficulty in obtaining a TLS certificate valid for an .onion address. The second way is to run Oragono as a true hidden service, where the server's actual IP address is a secret. This requires hardening measures on the Oragono side: * Oragono should not accept any connections on its public interfaces. You should remove any listener that starts with the address of a public interface, or with `:`, which means "listen on all available interfaces". You should listen only on `127.0.0.1:6667` and a Unix domain socket such as `/hidden_service_sockets/oragono.sock`. * In this mode, it is especially important that all operator passwords are strong and all operators are trusted (operators have a larger attack surface to deanonymize the server). -* Tor hidden services are at risk of being deanonymized if a client can trick the server into performing a non-Tor network request. Oragono should not perform any such requests (such as hostname resolution or ident lookups) in response to input received over a correctly configured Tor listener. However, Oragono has not been thoroughly audited against such deanonymization attacks --- therefore, Oragono should be deployed with additional sandboxing to protect against this: +* Onion services are at risk of being deanonymized if a client can trick the server into performing a non-Tor network request. Oragono should not perform any such requests (such as hostname resolution or ident lookups) in response to input received over a correctly configured Tor listener. However, Oragono has not been thoroughly audited against such deanonymization attacks --- therefore, Oragono should be deployed with additional sandboxing to protect against this: * Oragono should run with no direct network connectivity, e.g., by running in its own Linux network namespace. systemd implements this with the [PrivateNetwork](https://www.freedesktop.org/software/systemd/man/systemd.exec.html) configuration option: add `PrivateNetwork=true` to Oragono's systemd unit file. * Since the loopback adapters are local to a specific network namespace, and the Tor daemon will run in the root namespace, Tor will be unable to connect to Oragono over loopback TCP. Instead, Oragono must listen on a named Unix domain socket that the Tor daemon can connect to. However, distributions typically package Tor with its own hardening profiles, which restrict which sockets it can access. Below is a recipe for configuring this with the official Tor packages for Debian: diff --git a/oragono.yaml b/oragono.yaml index 4133c500..d6716738 100644 --- a/oragono.yaml +++ b/oragono.yaml @@ -37,7 +37,7 @@ server: # Example of a Tor listener: any connection that comes in on this listener will # be considered a Tor connection. It is strongly recommended that this listener # *not* be on a public interface --- it should be on 127.0.0.0/8 or unix domain: - # "/tmp/oragono_tor_sock": + # "/hidden_service_sockets/oragono_tor_sock": # tor: true # sets the permissions for Unix listen sockets. on a typical Linux system,