Version: 3.2
Current Version: 3.2
Last doc update: 2004-04-24

Head Coders: Stskeeps / codemastr / Syzop / Luke
Contributors: McSkaf / Zogg / NiQuiL / assyrian / chasm / DrBin / llthangel / Griever / nighthawk
Documentation: CKnight^ / Syzop

Due to the increasing complexity of UnrealIRCd3.2 We have switched to an easier to navigate, more inclusive documentation set. To view this documentation you must have a compatible browser, which are listed below. Up to date docs are available at http://www.vulnscan.org/UnrealIrcd/unreal32docs.html and a FAQ at http://www.vulnscan.org/UnrealIrcd/faq/.

Compatible Browsers:

1. Introduction & Notes
---1.1. Notes on upgrading/mixing 3.1.x -> 3.2
---1.2. Notes on upgrading between 3.2 versions
2. Installation
3. Features
-- 3.1. Cloaking
-- 3.2. Modules
-- 3.3. Snomasks
-- 3.4. Aliases
-- 3.5. Helpop
-- 3.6. Oper access levels
-- 3.7. Oper commands
-- 3.8. SSL
-- 3.9. IPv6
-- 3.10. Zip links
-- 3.11. Dynamic DNS/IP linking support
-- 3.12. Anti-flood features
-- 3.13. Ban types
-- 3.14. Spamfilter
-- 3.15. Other features
4. Configuring your unrealircd.conf file
---4.1. Configuration file explained
---4.2. Me Block -=- (M:Line)
---4.3. Admin Block -=- (A:Line)
---4.4. Class Block -=- (Y:Line)
---4.5. Allow Block -=- (I:Line)
---4.6. Listen Block -=- (P:Line)
---4.7. Oper Block -=- (O:Line)
---4.8. DRpass Block -=-(X:Line)
---4.9. Include Directive
---4.10. Loadmodule Directive
---4.11. Log Block
---4.12. TLD Block -=- (T:Line)
---4.13. Ban Nick Block -=- (Q:Line)
---4.14. Ban User Block -=- (K:Line)
---4.15. Ban IP Block -=- (Z:Line)
---4.16. Ban Server Block -=-(q:Line)
---4.17. Ban Realname Block -=- (n:Line)
---4.18. Ban Version Block
---4.19. Ban Exception Block -=- (E:Line)
---4.20. TKL Exception Block
---4.21. Throttle Exception Block
---4.22. Deny DCC Block -=- (dccdeny.conf)
---4.23. Deny Version Block -=- (V:Line)
---4.24. Deny Link Block -=- (D:Line / d:Line)
---4.25. Deny Channel Block -=- (chrestrict.conf)
---4.26. Allow Channel Block
---4.27. Vhost Block -=- (vhost.conf)
---4.28. Badword Block -=- (badwords.conf)
---4.29. Uline Block -=- (U:Line)
---4.30. Link Block -=- (C/N/H:Lines)
---4.31. Alias Block
---4.32. Help Block
---4.33. Official Channels Block
---4.34. Spamfilter Block
---4.35. Set Block -=- (networks/unrealircd.conf)
5. Additional Files
6. User & Channel Modes
7. User & Oper Commands
8. Security tips/checklist
---8.1. Passwords
---8.2. Non-Ircd related vulnerabilities
---8.3. Permissions and the configfile
---8.4. User-related problems
---8.5. SSL/SSH & sniffing
---8.6. Denial of Service attacks (DoS) [or: how to protect my hub]
---8.7. Information disclosure
---8.8. Protecting against exploits
---8.9. Summary
9. Frequently Asked Questions (FAQ)

1.0 – Introduction & Notes

This document was written for exclusive use with UnrealIRCd. Use of this document with another software package, or distribution of this document with another software package is strictly prohibited without the written permission of the UnrealIRCd Development Team. This document may be copied/printed/reproduced/published as many times as you like, provided it is for use with UnrealIRCd and it is not modified in anyway. – Copyright UnrealIRCd Development Team 2002-2003

Please read this manual before asking for help, you also REALLY want to take a look at the FAQ since over 80% of your questions/problems are answered in it. If you still need help you can ask for support at irc.ircsystems.net (port 6667) channel #unreal-support (note that we REQUIRE you to read the docs and faq and we only help with UnrealIRCd, not with services!). If you have a real bug (like a crash) then report it at http://bugs.unrealircd.org.

1.1 – Notes on upgrading/mixing 3.1.x -> 3.2

In case you are upgrading from Unreal3.1.x to Unreal3.2 you'll notice the whole config file has changed, you may find it hard at first, but once you've switched you'll find it much better!

Also don't forget to read section 3 about features, although you know already some of them which are in 3.1.x there are several new features too!

It's best not to mix/link 3.1.x with 3.2, but if you really want to, you need at least 3.1.4, but is strongly recommended.

1.2 – Notes on upgrading between 3.2 versions

The recommended way to upgrade is:


Please also check .RELEASE.NOTES to see what has been changed. If you notice any changes (or bugs) between version, BE SURE TO READ THE RELEASE NOTES FIRST before reporting it as a bug!.

2.0 - Installation

Tested & Supported Operating Systems:

If you have Unreal3.2 working correctly under other operating systems, please send the details to docs@unrealircd.com

Installation Instructions

  1. gunzip -d Unreal3.2.tar.gz
  2. tar xvf Unreal3.2.tar
  3. cd Unreal3.2
  4. ./Config
  5. Answer these questions to the best of your knowledge. Generally if your not sure, the default will work just fine!
  6. make
  7. Now create your unrealircd.conf and other configuration files, see section 4.


  1. Run the Unreal installer
  2. Now create your unrealircd.conf and other configuration files, see section 4.

3.0 - Features

Some major/nice features are explained in this section. It provides a general overview, and sometimes refers to the config file (something which you might know nothing about yet).

You can skip this section, however it's suggested to read it before/after installing.

3.1 - Cloaking

Cloaking is a way to hide the real hostname of users, for example if your real host is d5142341.cable.wanadoo.nl, it will be shown (in join, part, whois, etc) as rox-2DCA3201.cable.wanadoo.nl. This feature is useful to prevent users flooding each other since they can't see the real host/IP.

This is controlled by usermode +x (like: /mode yournick +x), admins can also force +x to be enabled by default, or make it so users can never do -x.

The cloaked host is generated by a formula which uses 3 "cloak keys." You are required to set these 3 keys in your config file, they should be 3 random numbers between 10,000 and 2,147,483,646. If someone else knows these keys they can decode the cloaked host and discover the real one, that's why you have to keep them secret. _The cloak keys must be the same on all servers on the network_.

3.2 - Modules

UnrealIRCd supports modules which is nice because:
- You can load/reload/unload them while the ircd is running (by /rehash). This allows some bugs to be fixed or new features to be added without requiring a restart.
- Other people can create (3rd party) modules with new commands, usermodes and even channelmodes.
UnrealIRCd only comes with a few modules, take a look at www.unrealircd.com -> modules or use google to find 3rd party modules.
NOTE: currently modules are not supported on windows, you can however expect this is in a nearby release

You need to load at least the commands module or else the ircd won't load!

3.3 - Snomasks

Snomasks are server notice masks, it's a special type of usermode that controls which server notices you will receive (mostly used by opers)

It can be set by: /mode yournick +s SNOMASK, for example: /mode yournick +s +cF
To remove certain snomasks, use something like: /mode yournick +s -c
Or you can remove all snomasks by simply doing: /mode yournick -s

The current available snomasks are:
c - local connects
F - far connects (except from U-lined servers)
f - flood notices
k - kill notices [*]
e - 'eyes' notices
j - 'junk' notices
v - vhost notices
G - gline/shun notices
n - local nick change notices
N - remote nick change notices
q - deny nick (Q:line) rejection notices
s - receives server notices [*]
[*: this snomask is also allowed to non-ircops]

You can control which snomasks you automatically get (set::snomask-on-connect) and which you get on oper (set::snomask-on-oper, oper::snomask)

3.4 - Aliases

With aliases you can configure server-side alias commands. You can for example let "/ns identify blah" be forwarded to nickserv (it will be translated to: privmsg nickserv identify blah). You can even make more complex aliases such as /register can forward to ChanServ if the first parameter begins with a # and forwarded to NickServ if it doesn't.

Aliases are configured by alias blocks in the configuration file, and you can also include a file with default aliases for most commonly used services.

3.5 - Helpop

UnrealIRCd has a built-in help system accessible by /helpop. The /helpop command is completely user configurable via the help block in the configuration file. Additionally, a help.conf is included which contains some basic help for all commands.
For example /helpop chmodes gives you a overview of all channel modes UnrealIRCd has.
Remember that if you are an ircop (helpop) you will have to prefix the keyword with a '?' character, so /helpop becomes /helpop ? and /helpop chmodes becomes /helpop ?chmodes etc..

3.6 - Oper access levels

There are several oper levels in UnrealIRCd and you can add additional rights (like to use /gline) to each of them, that way you can give each oper the privileges they need.

This is controlled by the oper flags in the oper block, see the oper block for more information.

3.7 - Oper commands

UnrealIRCd has a lot of powerful oper commands which are explained in User & Oper Commands, you probably want to read those after installing :).

3.8 - SSL

SSL stands for Secure Socket Layer, with SSL you can make secure encrypted connections. It can be used to encrypt server<->server traffic, but client<->server traffic can also be encrypted. You usually use SSL to protect against sniffing and for authentication.

You need to have your IRC server compiled with SSL support. To setup an SSL port you need to set listen::options::ssl.

You cannot connect normally to a SSL port (so don't make port 6667 ssl!), you need a client or a tunnel that understands the SSL protocol.

Clients that support SSL: XChat, irssi, mIRC (6.14 and up, also requires some additional steps)

For clients which do not support SSL you can use a tunnel like stunnel, here's a stunnel.conf example (for stunnel 4.x):

   client = yes
   accept =
   connect = irc.myserv.com:6697
If you then connect to port 6667, your traffic will be encrypted and forwarded to irc.myserv.com port 6697 (an SSL port).

You should also validate certificates when you connect to servers and not blindly accept them (like in the stunnel example) else you are still vulnerable to "active sniffing" attacks (ssl redirects), that's however too offtopic to explain here (learn about SSL, don't ask us). [mIRC and xchat pop up a window asking you to allow/reject a certificate, so that's good].

3.9 - IPv6

UnrealIRCd supports IPv6, since beta15 it seems to be stable.
Your OS needs to have IPv6 support and you need to enable IPv6 support in UnrealIRCd during ./Config as well.

Although microsoft has an experimental IPv6 implementation for w2k/XP it is not (yet) supported by UnrealIRCd.

3.10 - Zip links

Zip links can be turned on for server<->server links, it compresses the data by using zlib. It can save 60-80% bandwidth... So it's quite useful for low-bandwidth links or links with many users, it can help a lot when you are linking since a lot of data is sent about every user/channel/etc.

To compile with zip links support, you need to answer Yes to the zlib question in ./Config and set it in link::options::zip (on both sides)

3.11 - Dynamic DNS/IP linking support

UnrealIRCd has some (new) nice features which helps dynamic IP users using dynamic DNS (like blah.dyndns.org). If you are linking two dynamic DNS hosts, then set link::options::nodnscache and link::options::nohostcheck.

3.12 - Anti-Flood features

Throttling is a method that allows you to limit how fast a user can disconnect and then reconnect to your server. You can config it in your set::throttle block to allow X connections in YY seconds from the same IP.
Channel modes
There are also some channel modes which can be very effective against floods. To name a few:
K = no /knock, N = no nickchanges, C = no CTCPs, M = only registered users can talk.
As of beta18 there's also a much more advanced channelmode +f...
Channel mode f
Instead of using scripts and bots to protect against channel floods it is now build into the ircd.
An example +f mode is: *** Blah sets mode: +f [10j]:15
This means 10 joins per 15 seconds are allowed in the channel, if the limit is hit, the channel will be set +i automatically.
The following floodtypes are available:
type:name:default action:other avail. actions:comments
cCTCPsauto +Cm, M 
jjoinsauto +iR 
kknocksauto +K (counted for local clients only)
mmessages/noticesauto +mM 
nnickchangesauto +N  
ttextkickbper-user messages/notices like the old +f. Will kick or ban the user.


*** ChanOp sets mode: +f [20j,50m,7n]:15
<ChanOp> lalala
*** Evil1 (~fdsdsfddf@Clk-17B4D84B.blah.net) has joined #test
*** Evil2 (~jcvibhcih@Clk-3472A942.xx.someispcom) has joined #test
*** Evil3 (~toijhlihs@Clk-38D374A3.aol.com) has joined #test
*** Evil4 (~eihjifihi@Clk-5387B42F.dfdfd.blablalba.be) has joined #test
-- snip XX lines --
*** Evil21 (~jiovoihew@Clk-48D826C3.e.something.org) has joined #test
-server1.test.net:#test *** Channel joinflood detected (limit is 20 per 15 seconds), putting +i
*** server1.test.net sets mode: +i
<Evil2> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil12> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil15> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil10> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil8> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
-- snip XX lines --
-server1.test.net:#test *** Channel msg/noticeflood detected (limit is 50 per 15 seconds), putting +m
*** server1.test.net sets mode: +m
*** Evil1 is now known as Hmmm1
*** Evil2 is now known as Hmmm2
*** Evil3 is now known as Hmmm3
*** Evil4 is now known as Hmmm4
*** Evil5 is now known as Hmmm5
*** Evil6 is now known as Hmmm6
*** Evil7 is now known as Hmmm7
*** Evil8 is now known as Hmmm8
-server1.test.net:#test *** Channel nickflood detected (limit is 7 per 15 seconds), putting +N
*** server1.test.net sets mode: +N
In fact, it can get even more advanced/complicated:
Instead of the default action, you can for some floodtypes specify another one, for example: +f [20j#R,50m#M]:15
This will set the channel +R if the joinlimit is reached (>20 joins in 15 seconds), and will set the channel +M if the msg limit is reached (>50 messages in 15 seconds).

There's also a "remove mode after X minutes" feature: +f [20j#R5]:15 will set the channel +R if the limit is reached and will set -R after 5 minutes.
A server can have a default unsettime (set::modef-default-unsettime), so if you type +f [20j]:15 it could get transformed into +f [20j#i10]:15, it's just a default, you can still set [20j#i2]:15 or something like that, and you can also disable the remove-chanmode completely by doing a +f [20j#i0]:15 (an explicit 0).

The old +f mode (msgflood per-user) is also still available as 't', +f 10:6 is now called +f [10t]:6 and +f *20:10 is now +f [20t#b]:10. Currently the ircd will automatically convert old +f mode types to new ones. Note that there's no unsettime feature available for 't' bans ([20t#b30]:15 does not work).

What the best +f mode is heavily depends on the channel... how many users does it have? do you have a game that makes users msg a lot (eg: trivia) or do users often use popups? is it some kind of mainchannel or in auto-join? etc..
There's no perfect channelmode +f that is good for all channels, but to get you started have a look at the next example and modify it to suit your needs:
+f [30j#i10,40m#m10,7c#C15,10n#N15,30k#K10]:15
30 joins per 15 seconds, if limit is reached set channel +i for 10 minutes
40 messages per 15 seconds, if limit is reached set channel +m for 10 minutes
7 ctcps per 15 seconds, if limit is reached set channel +C for 15 minutes
10 nickchanges per 15 seconds, if limit is reached set channel +N for 15 minutes
30 knocks per 15 seconds, if limit is reached set channel +K for 10 minutes
If it's some kind of large user channel (>75 users?) you will want to increase the join sensitivity (to eg: 50) and the message limit as well (to eg: 60 or 75).
Especially the remove-mode times are a matter of taste.. you should think like.. what if no op is available to handle the situation, do I want to have the channel locked for like 15 minutes (=not nice for users) or 5 minutes (=likely the flooders will just wait 5m and flood again). It also depends on the floodtype, users unable to join (+i) or speak (+m) is worse than having them unable to change their nick (+N) or send ctcps to the channel (+C) so you might want to use different removal times.

3.13 - Ban types

Basic bantypes and cloaked hosts
UnrealIRCd supports the basic bantypes like +b nick!user@host.
Also, if a masked host of someone is 'rox-ACB17294.isp.com' and you place a ban *!*@rox-ACB17294.isp.com, then if the user sets himself -x (and his hosts becomes for example 'dial-123.isp.com) then the ban will still match. Bans are always checked against real hosts AND masked hosts.
IP bans are also available (eg: *!*@128.*) and are also always checked.

Bans on cloaked IPs require some explanation:
If a user has the IP his cloaked host could be 341C6CEC.8FC6128B.303AEBC6.IP.
If you ban *!*@341C6CEC.8FC6128B.303AEBC6.IP you would ban *!*@ (obvious...)
If you ban *!*@*.8FC6128B.303AEBC6.IP you ban *!*@1.2.3.*
If you ban *!*@*.303AEBC6.IP you ban *!*@1.2.*
This information might be helpful to you when deciding how broad a ban should be.

Extended bantypes
Extended bans look like ~[!]<type>:<stuff>. Currently the following types are available:
~qquietPeople matching these bans can join but are unable to speak, unless they have +v or higher. Ex: ~q:*!*@blah.blah.com
~cchannelIf the user is in this channel then (s)he is unable to join. Ex: ~c:#lamers
~rrealnameIf the realname of a user matches this then (s)he is unable to join.
Ex: ~r:*Stupid_bot_script*
NOTE: an underscore ('_') matches both a space (' ') and an underscore ('_'), so this ban would match 'Stupid bot script v1.4'.
These bantypes are also supported in the channel exception list (+e).
Modules can also add other extended ban types.

3.14 - Spamfilter

Spamfilter is a new system to fight spam, advertising, worms and other things. It works a bit like the badwords system but has several advantages.

Spamfilters are added via the /spamfilter command which uses the following syntax:
/spamfilter [add|del|remove|+|-] [type] [action] [tkltime] [reason] [regex]
[type] specifies the target type, you can specify multiple targets: 'c' channel msg, 'p' private msg, 'n' private notice, 'N' channel notice, 'P' part msg, 'q' quit msg, 'd' dcc
[action] specifies the action to be taken (only 1 action can be specified)
killkills the user
tempshunshuns the current session of the user (if [s]he reconnects the shun is gone)
shunputs a shun on the host
klineputs a kline on the host
glineputs a gline on the host
zlineputs a zline on the host
gzlineputs a gzline (global zline) on the host
blockblock the message only
dccblockmark the user so (s)he's unable to send any DCCs
viruschanpart all channels, join set::spamfilter::virus-help-channel, disables all commands except PONG, ADMIN, and msg/notices to set::spamfilter::virus-help-channel
[tkltime] The duration of the *line added by the filter, use '-' to use the default or to skip (eg: if action = 'block')
[reason] Block or *line reason.. you CANNOT use spaces in this, but underscores ('_') will be translated into spaces at runtime. And double underscore ('__') gets an underscore ('_'). Again, use '-' to use the default reason.
[regex] this is the actual regex or 'bad word' where we should block on and perform the action at

Here's an example: /spamfilter add pc gline - - Come watch me on my webcam
If the text come watch me on my webcam is found in either a private msg or a channel msg then the message will be blocked and a gline will be added immediately.
Another example: /spamfilter add pc block - - come to irc\..+\..+
This is a regex that will match on Hi, come to irc.blah.net etc....
And an example with specified time/reason:
/spamfilter add p gline 3h Please_go_to_www.viruscan.xx/nicepage/virus=blah Come watch me on my webcam
If come watch me on my webcam is found in a private msg then the user is glined for 3 hours with the reason Please go to www.viruscan.xx/nicepage/virus=blah.

Spamfilters added with /spamfilter are network-wide. They work regardless of whether the user/channel has mode +G set, only opers and ulines (services) are exempted from filtering.

You can also add spamfilters in the config file but these will be local spamfilters (not network-wide, though you could use remote includes for this). The syntax of these spamfilter { } blocks are explained here

set::spamfilter::ban-time allows you to modify the default ban time for *lines added by spamfilter (default: 1 day)
set::spamfilter::ban-reason allows you to specify a default reason for the *lines (default: 'Spam/advertising')
set::spamfilter::virus-help-channel allows you to specify the channel to join for action 'viruschan' (default: #help)

3.15 - Other features

UnrealIRCd has a lot of features so not everything is covered here... You'll find that out by yourself.

4.0 - Configuring your unrealircd.conf

First of all, creating a good unrealircd.conf will take some time, probably something like 10 - 60m. You can try to get it booted up as quickly as you can and tweak later, or you can learn the major sections directly step-by-step which is the recommended method ;P. If you have any problems, check your syntax, check the manual and check the FAQ before asking for help/reporting a bug.

4.1 Configuration File Explained

The new system uses a block-based format. Each entry, or block, in the new format has a specific format. The format works like:

<block-name> <block-value> {
	<block-directive> <directive-value>;

<block-name> is the type of block, such as me, or admin. <block-value> sometimes specifies a value, such as /oper login, but other times it will be a sub-type such as in ban user.

<block-directive> is an individual variable specific to the block, and <directive-value> is the Associated value. If <directive-value> contains spaces, or characters that represents a comment it must be contained in double quotes. If you want to use a quote character inside a quoted string use \" and it will be understood as a quote character.

A <block-directive> can have directives within it, if that’s the case it will have it's own set of curly braces surrounding it. Some blocks do not have directives and are specified just by <block-value>, such as include. Also note that there is no set format, meaning the whole block can appear on one line or over multiple lines. The format above is what is normally used (and what will be used in this file) because it is easy to read.

Note: the configuration file is currently case sensitive so BLOCK-NAME is not the same as block-name. There is a special notation used to talk about entries in the config file. For example, to talk about <directive-name> in the example above, you'd say <block-name>::<block-directive>, and if that directive has a sub block you want to reverence, you would add another :: and the name of the sub directive.

To talk about an unnamed directive you would do <block-name>:: which would in this case mean <block-value>, or it could be an entry in a sub block that has no name.

Three types of comments are supported:

# One line comment
// One line comment
/* Multi line
    comment */

Now that you know how it works, create your unrealircd.conf from scratch or copy doc/example.conf and start editing. It's recommended to walk step by step trough all block types and use this manual as a reference.

4.2 - Me Block REQUIRED (Previously known as the M:Line)


me {
	name <name-of-server>;
	info <server-description>;
	numeric <server-numeric>;

These values are pretty obvious. The name specifies the name of the server, info specifies the server's info line, numeric specifies a numeric to identify the server. This must be a value between 1 and 255 that is UNIQUE to the server meaning NO other servers on the network may have the same numeric.


me {
	name "irc.foonet.com";
	info "FooNet Server";
	numeric 1;

4.3 - Admin Block REQUIRED (Previously known as the A:Line)


admin {

The admin block defines the text displayed in a /admin request. You can specify as many lines as you want and they can contain whatever information you choose, but it is standard to include the admins nickname and email address at a minimum. Other information may include any other contact information you wish to give.


admin {
	"Bob Smith";

4.4 - Class Block REQUIRED (Previously known as the Y:Line)


class <name> {
	pingfreq <ping-frequency>;
	connfreq <connect-frequency>;
	maxclients <maximum-clients>;
	sendq <send-queue>;
	recvq <recv-queue>;

Class blocks are classes in which connections will be placed (for example from allow blocks or servers from link blocks), you generally have multiple class blocks (ex: for servers, clients, opers).

name is the descriptive name, like "clients" or "servers", this name is used for referring to this class from allow/link/oper/etc blocks

pingfreq is the number of seconds between PINGs from the server (something between 90 and 180 is recommended).

connfreq is used only for servers and is the number of seconds between connection attempts if autoconnect is enabled

maxclients specifies the maximum (total) number of clients/servers which can be in this class

sendq specifies the amount of data which can be in the send queue (very high for servers with low bandwidth, medium for clients)

recvq specifies the amount of data which can be in the receive queue and is used for flood control (this only applies to normal users, try experimenting with values 3000-8000, 8000 is the default).


class clients {
	pingfreq 90;
	maxclients 500;
	sendq 100000;
	recvq 8000;

class servers{
	pingfreq 90;
	maxclients 10; /* Max servers we can have linked at a time */
	sendq 1000000;
	connfreq 100; /* How many seconds between each connection attempt */

4.5 - Allow Block REQUIRED (Previously known as the I:Line)


allow {
	ip <user@ip-connection-mask>;
	hostname <user@host-connection-mask>;
	class <connection-class>;
	password <connection-password> { <auth-type>; };
	maxperip <max-connections-per-ip>;
	redirect-server <server-to-forward-to>;
	redirect-port <port-to-forward-to>;
	options {

The allow class is where you specify who may connect to this server, you can have multiple allow blocks.

About matching
The access control works like this: ip matches OR host matches, so "hostname *@*"; and "ip *@" will mean it will always match. Also the allow blocks are read upside down, so you need specific host/ip allow blocks AFTER your general *@* allow blocks. Additionally, if you want to setup a block that only matches based on IP, then set the hostname to something invalid, such as "hostname NOBODY;", this will allow the block to only match based on IP.

The ip mask is in the form user@ip, user is the ident and often set at *, ip is the ipmask. Some examples: *@* (from everywhere), *@192.168.* (only from addr's starting with 192.168), etc.

Also a user@host hostmask, again.. user is often set at *. Some examples: *@* (everywhere), *@*.wanadoo.fr (only from wanadoo.fr).

password (optional)
Require a connect password. You can also specify an password encryption method here.

Specifies the class name that connections using this allow block will be placed into.

maxperip (optional, but recommended)
Allows you to specify how many connections per IP are allowed to this server (ex: maxperip 4;).

redirect-server (optional)
If the class is full, redirect users to this server (if clients supports it [mIRC 6 does]).

redirect-port (optional)
If redirect-server is specified you can set the port here, otherwise 6667 is assumed.

options block (optional)
Valid options are:
   useip always display IP instead of hostname
   noident don't use ident but use username specified by client
   ssl only match if this client is connected via SSL
   nopasscont continue matching if no password was given (so you can put clients in special classes if they supply a password).


allow {
	ip *;
	hostname *;
	class clients;
	maxperip 5;

allow {
	ip *@*;
	hostname *@*.passworded.ugly.people;
	class clients;
	password "f00Ness";
	maxperip 1;


4.6 - Listen Block REQUIRED (Previously known as the P:Line)


listen <ip:port> {
	options {

This block allows you to specify the ports on which the IRCD will listen. If no options are required, you may specify this without any directives in the form listen <ip:port>;.

ip and port
You can set ip to * to bind to all available ips, or specify one to only bind to that ip (usually needed at shell providers). The port is the port you want to listen on. You can also set the port to a range rather than an individual value. For example, 6660-6669 would listen on ports 6660 through 6669 (inclusive). IPv6 users, see below.

Info for IPv6 users
If you have an IPv6 enabled server you need to enclose the IP in brackers. Like [::1]:6667 (listen at localhost on port 6667). If you are using IPv6 and you want to listen at a specific IPv4 addr you need to use ::ffff:ipv4ip. For example: [::ffff:]:6667 which will listen at on port 6667. Of course you can also just use *.

options block (optional)
You can specify special options for this port if you want, valid options are:
port is only for clients
port is only for servers
CR javachat support
SSL encrypted port


listen *:6601 {
	options {

Or if there are no options:

listen *:8067;
listen *:6660-6669;

4.7 - Oper Block RECOMMENDED (Previously known as the O:Line)

oper <name> {
	from {
		userhost <hostmask>;
		userhost <hostmask>;
	password <password> { <auth-type>; };
	class <class-name>;
	flags <flags>;
	flags {
	swhois <whois info>;
	snomask <snomask>;
	maxlogins <num>;

The oper block allows you to assign IRC Operators for your server. The oper:: specifies the login name for the /oper. The oper::from::userhost is a user@host mask that the user must match, you can specify more than one hostmask by creating more than one oper::from::userhost. The oper::password is the password the user must specify, oper::password:: allows you to specify an authentication method for this password, valid auth-types are crypt, md5, and sha1, ripemd-160. If you want to use a plain-text password leave this sub-block out.

Please note that BOTH the login name and password are case sensitive

The oper::class directive specifies the name of a preexisting (appears before this in the config file) class name that the oper block will use.

The oper::flags directive has two formats. If you wish to use the old style oper flags i.e., OAa, you use the flags <flags> method, if you want to use the new style,i.e., services-admin, then you use the flags { <flag>; } method. Below is a list of all the flags (in both formats) and what they do.

Old Flag
New Flag
Makes you a local operator
Makes you a global operator
Makes you a coadmin
Makes you a admin
Makes you a services admin
Makes you a Network Admin
Oper may use /rehash
Oper may use /die
Oper may use /restart
Oper receives umode +h (helpop)
Oper can send /wallops
Oper can send /globops
Can connect servers locally
Can connect servers globally
Can /kill local users
Can /kill global users
Can use /kline
Can use /kline -u@h
Can send local server notices
Can send global server notices
Can use /zline
Can use /gline, /shun and /spamfilter
Can use /gzline
Sets umode +W when u oper
Sets your host to an oper host
Can use OperOverride
Can use usermode +q
Can use /dccdeny and /undccdeny

Certain flags give you other flags by default:

local global admin/coadmin services-admin netadmin
can_rehash can_rehash can_rehash can_rehash can_rehash
helpop helpop helpop helpop helpop
can_globops can_globops can_globops can_globops can_globops
can_wallops can_wallops can_wallops can_wallops can_wallops
can_localroute can_localroute can_localroute can_localroute can_localroute
can_localkill can_localkill can_localkill can_localkill can_localkill
can_kline can_kline can_kline can_kline can_kline
can_unkline can_unkline can_unkline can_unkline can_unkline
can_localnotice can_localnotice can_localnotice can_localnotice can_localnotice
  can_globalroute can_globalroute can_globalroute can_globalroute
  can_globalkill can_globalkill can_globalkill can_globalkill
  can_globalnotice can_globalnotice can_globalnotice can_globalnotice
    global global global
    can_dccdeny can_dccdeny can_dccdeny
      can_setq can_setq

The oper::swhois directive allows you to add an extra line to an opers whois information. [optional]

The oper::snomask directive allows you to preset an oper's server notice mask on oper up. For a list of available SNOMASKs, see Section 3.3 [optional]

The oper::maxlogins allows you to restrict the number of concurrent oper logins from this host, for example if you set it to 1 then only 1 person can be oper'ed via this block at any time. [optional]


oper bobsmith {
	class clients;
	from {
		userhost bob@smithco.com;
		userhost boblaptop@somedialupisp.com;
	password "f00";
	flags {
	swhois "Example of a whois mask";
	snomask frebWqFv;

Some little info about OperOverride:
OperOverride are things like: joining a +ikl channel and going trough bans (you need to /invite yourself first however), op'ing yourself in a channel, etc.
The can_override operflag was added as an attempt to stop oper abuse. No oper is able to override by default, you would have to give them the can_override flag explicitly.

4.8 - DRpass Block RECOMMENDED (Previously known as the X:Line)


drpass {
	restart <restart-password> { <auth-type>; };
	die <die-password> { <auth-type>; };

This block sets the /restart and /die passwords with drpass::restart and drpass::die respectively. The drpass::restart:: and drpass::die:: allow you to specify the type of authentication used by this item. The currently supported authentication types are crypt, md5, and sha1, ripemd-160.


drpass {
	restart "restart-password";
	die "die-password";

4.9 - Include Directive

include <file-name>;

This directive specifies a filename to be loaded as a separate configuration file. This file may contain any type of config block and can even include other files. Wildcards are supported in the file name to allow you to load multiple files at once.

example 1: a network file

include mynetwork.network;

That would be the statement to use if you wanted to use a separate network file. Separate network files are no longer required; all the network settings can be inserted directly into the unrealircd.conf. Or you can put an include statement them to load the file.

example 2: aliases

include aliases/ircservices.conf

Another example is to use it for including alias blocks, UnrealIRCd comes with some files which (should) contain the right aliases for most services:

4.10 - LoadModule Directive REQUIRED

loadmodule <file-name>;

UnrealIRCd now supports modules (at *NIX). Modules make it easy to write extensions and you can load/unload them while the ircd is running.

Modules that come standard with Unreal3.2:

commands.so - All the / commands (well not all yet, but will eventually be all) REQUIRED

So you want to be sure you have commands.so loaded:

loadmodule "src/modules/commands.so";

4.11 - Log Block OPTIONAL


log <file-name> {
	maxsize <max-file-size>;
	flags {

The log block allows you to assign different log files for different purposes. The log:: contains the name of the log file. log::maxsize is an optional directive that allows you to specify a size that the log file will be wiped and restarted. You can enter this string using MB for megabytes, KB, for kilobytes, GB, for gigabytes. The log::flags specifies which types of information will be in this log. You can specify one or more of the following, errors, kills, tkl (G:lines and Shuns), connects, server-connects, kline, and oper.

You may also have multiple log blocks, to log different things to different log files.

Available Flags:

errors self explanatory
kills logs /kill notices
tkl logs info on glines, shuns, tklines, tzlines, gzlines
connects logs user connects/quits
server-connects logs server connects/squits
kline logs kline and unkline
oper logs oper attempts (both failed and successful)
sadmin-commands logs /sa* (samode, sajoin, sapart, etc.) usage
chg-commands logs /chg* (chghost, chgname, chgident, etc.) usage
oper-override logs operoverride usage


log ircd.log {
	maxsize 5MB;
	flags {

4.12 - TLD Block OPTIONAL (Previously known as the T:Line)


tld {
	mask <hostmask>;
	motd <motd-file>;
	rules <rules-file>;
	shortmotd <shortmotd-file>;
	channel <channel-name>;
	options {

The tld block allows you to specify a motd, rules, and channel for a user based on their host. This is useful if you want different motds for different languages. The tld::mask is a user@host mask that the user's username and hostname must match. The tld::motd, tld::shortmotd, and tld::rules specify the motd, shortmotd, and rules file, respectively, to be displayed to this hostmask. The tld::shortmotd is optional. tld::channel is optional, it allows you to specify a channel that this user will be forced to join on connect. If this exists it will override the default auto join channel. The tld::options block allows you to define additional requirements, currently only tld::options::ssl which only displays the file for SSL users, and tld::options::remote which only displays the file for remote users, exists.

TLD entries are matched upside down


tld {
	mask *@*.fr;<
	motd "ircd.motd.fr";
	rules "ircd.rules.fr";

4.13 - Ban Nick Block OPTIONAL (Previously known as the Q:Line)


ban nick {
mask <nickname>; reason <reason-for-ban>; };

The ban nick block allows you to disable use of a nickname on the server. The ban::mask allows wildcard masks to match multiple nicks, and ban::reason allows you to specify the reason for which this ban is placed. Most commonly these blocks are used to ban usage of the nicknames commonly used for network services.


ban nick {
	mask "*C*h*a*n*S*e*r*v*";
	reason "Reserved for Services";

4.14 - Ban User Block OPTIONAL (Previously known as the K:Line)


ban user {
	mask <hostmask>;
	reason <reason-for-ban>;

This block allows you to ban a user@host mask from connecting to the server. The ban::mask is a wildcard string of a user@host to ban, and ban::reason is the reason for a ban being placed. Note, this is only a local ban and therefore the user may connect to other servers on the network.


ban user {
	mask *tirc@*.saturn.bbn.com;
	reason "Idiot";

4.15 - Ban IP Block OPTIONAL (Previously known as the Z:Line)


ban ip {
	mask <ipmask>;
	reason <reason-for-ban>;

The ban ip block bans an IP from accessing the server. This includes both users and servers attempting to link. The ban::mask parameter is an IP which may contain wildcard characters, and ban::reason is the reason why this ban is being placed. Since this ban affects servers it should be used very carefully.


ban ip {
	mask 192.168.1.*;
	reason "Get a real ip u lamer!";

4.16 - Ban Server Block OPTIONAL (Previously known as the q:Line)


ban server {
	mask <server-name>;
	reason <reason-for-ban>;

This block disables a server's ability to connect to the network. If the server links directly to your server, the link is denied. If the server links to a remote server, the local server will disconnect from the network. The ban::mask field specifies a wildcard mask to match against the server attempting to connect's name, and ban::reason specifies the reason for which this ban has been placed.


ban server {
	mask broken.server.my.network.com;
	reason "Its broken!";

4.17 - Ban RealName Block OPTIONAL (Previously known as the n:Line)


ban realname {
	mask <realname-mask>;
	reason <reason-for-ban>;

The ban realname block allows you to ban a client based on the GECOS (realname) field. This is useful to stop clone floods because often clone bots use the same realname. The ban::mask specifies the realname which should be banned. The mask may contain wildcards. The ban::reason specifies the reason why this ban is being placed.


ban realname {
	mask "Bob*";
	reason "Bob sucks!";

4.18 - Ban Version Block OPTIONAL


ban version {
	mask <version-mask>;
	reason <reason-for-ban>;
	action [kill|tempshun|shun|kline|zline|gline|gzline];

The ban version block allows you to ban a client based on the IRC client software they use. This makes use of the clients CTCP version reply. Therefore if a client does not send out a CTCP version, the ban will not work. This feature is intended to allow you to block malicious scripts. The ban::mask specifies the version which should be banned. The mask may contain wildcards. The ban::reason specifies the reason why this ban is being placed. You can also specify ban::action, kill is the default, tempshun will shun the specific user connection only and would work very effective against zombies/bots at dynamic IPs because it won't affect innocent users. shun/kline/zline/gline/gzline will place a ban of that type on the ip (*@IPADDR), the duration of these bans can be configured with set::ban-version-tkl-time and defaults to 1 day.


ban version {
	mask "*SomeLameScript*";
	reason "SomeLameScript contains backdoors";
ban version {
	mask "*w00tZombie*";
	reason "I hate those hundreds of zombies";
	action zline;

4.19 - Ban Exceptions Block OPTIONAL (Previously known as the E:Line)


except ban {
	mask <hostmask>;

The except ban block allows you to specify a user@host that will override a ban placed on a broader host. This is useful when you want an ISP banned, but still want specific users to be able to connect. The except::mask directive specifies the user@host mask of the client who will be allowed to connect.


except ban {
	mask myident@my.isp.com;

4.20 - TKL Exceptions Block OPTIONAL


except tkl {
	mask <hostmask>;
	type <type>;

The except tkl block allows you to specify a user@host that will override a tkl ban placed on a broader host. This is useful when you want an ISP banned, but still want specific users to be able to connect. The except::mask directive specifies the user@host mask of the client who will be allowed to connect. The except::type specifies which type of ban this should override. Valid types are gline, gzline, qline, gqline, and shun, which make an exception from Glines, Global Zlines, Qlines, Global Qlines, and shuns.


except tkl {
	mask myident@my.isp.com;
	type gline;

4.21 - Throttle Exceptions Block OPTIONAL


except throttle {
	mask <ipmask>;

The except throttle block allows you to specify an IP mask that will override the throttling system. This only works if you have chosen to enable throttling. The except::mask specifies an IP mask that will not be banned because of throttling.


except throttle {
	mask 192.168.1.*;

4.22 - Deny DCC Block OPTIONAL (Previously known as dccdeny.conf)


deny dcc {
	filename <file-to-block>;
	reason <reason-for-ban>;

The deny dcc block allows you to specify a filename which will not be allowed to be sent via DCC over the server. This is very useful in helping stop distribution of trojans and viruses.

The deny::filename parameter specifies a wildcard mask of the filename to reject sends of, and deny::reason specifies the reason why this file is blocked.


deny dcc {
	filename virus.exe;
	reason "This is a GD Virus";

4.23 - Deny Version Block OPTIONAL (Previously known as the V:Line)


deny version {
	mask <server-name>;
	version <version-number>;
	flags <compile-flags>;

This block allows you to deny a server from linking based on the version of Unreal it is running and what compile time options it has. The format for this block is somewhat complex but isn't too hard to figure out. The deny::mask directive specifies a wildcard mask of the server name this applies to. The deny::version specifies the protocol number of the version this refers to.

For example, 3.0 is 2301, 3.1.1/3.1.2 is 2302, 3.2 is 2303. The first character of this parameter can be one of the following >, <, =, !. This character tells the IRCd how to interpret the version. If the first character is a > then all version greater than the specified version are denied, if it is a < all versions lower are denied, if it is an = only that version is denied, and if it is a ! then all versions except the specified are denied. The deny::flags directive allows you to specify what compile time flags the server may or may not have. The flags are arranged one after the other with no separation between, if a character is prefixed by a ! then it means the server may not have this flag compiled into it, if it does not have a ! prefix, then it means the server must have this flag compiled.

4.24 - Deny Link Block OPTIONAL (Previously known as the D/d:Line)


deny link {
	mask <server-name>;
	rule <crule-expression>;
	type <type-of-denial>;

This block allows you to use specific rules to deny a server from linking. The deny::mask specifies a wildcard mask of the server name to apply this rule to. The deny::rule directive is very complex. A crule expression allows you to control the link in great detail, and it is set up like a programming expression. Four operators are supported, connected(<servermask>), returns true if a server matching servermask is connected, directcon(<servermask>), returns true if the server matching servermask is directly connected to this server, via(<viamask>,<servermask>), returns true if a server matching servermask is connected by a server matching viamask, and directop(), which returns true if the operator issuing a /connect is directly connected to this server. These operators can be combined using && (and) and || (or), items may also be enclosed in parenthesis to allow grouping. In addition, an operator preceded with a ! checks if the operator returned false. If the entire expression evaluates to true, then the link is denied. The deny::type allows two different values, auto (only applies to autoconnects, /connect will still work), and all (applies to all connection attempts).

4.25 - Deny Channel Block OPTIONAL (Previously known as chrestrict.conf)


deny channel {
	channel "<channel-mask>";
	reason <reason-for-ban>;
	redirect "<channel-name>";
	warn [on|off];

The deny channel block allows you to disallow users from joining specific channels. The deny::channel directive specifies a wildcard mask of channels the users may not join, and the deny::reason specifies the reason why the channel may not be joined. Additionally, you may specify a deny::redirect. If this is specified, when a user tries to join a channel that matches deny::channel, he/she will be redirected to deny::redirect. And there's also deny::warn which (if set to on) will send an opernotice (to EYES snomask) if the user tries to join.


deny channel {
	channel "#unrealsucks";
	reason "No it don't!";

deny channel {
	channel "#*teen*sex*";
	reason "You == dead";
	warn on;

deny channel {
	channel "#operhelp";
	reason "Our network help channel is #help, not #operhelp";
	redirect "#help";

4.26 - Allow Channel Block OPTIONAL


allow channel {
	channel "<channel-mask>";

The allow channel block allows you to specify specific channels that users may join. The allow::channel directive specifies the wildcard mask of the channels which may be joined.


allow channel {
	channel "#something";

4.27 - Vhost Block OPTIONAL (Previously known as vhosts.conf)


vhost {
	vhost <vhost>;
	from {
		userhost <hostmask>;
		userhost <hostmask>;
	login <login-name>;
	password <password> { <auth-type>; };
	swhois "<swhois info>";

The vhost block allows you to specify a login/password that can be used with the /vhost command to obtain a fake hostname. The vhost::vhost parameter can be either a user@host or just a host that the user will receive upon successful /vhost. The vhost::from::userhost contains a user@host that the user must match to be eligible for the vhost. You may specify more than one hostmask. The vhost::login in the login name the user must enter and vhost::password is the password that must be entered. The vhost::password:: allows you to specify the type of authentication used by this item. The currently supported authentication types are crypt, md5, and sha1, ripemd-160. Lastly vhost::swhois allows you to add an extra line to a users whois, exactly as it does in the Oper Block oper::swhois.


vhost {
	vhost my.own.personal.vhost.com;
	from {
		userhost my@isp.com;
		userhost myother@isp.com;
	login mynick;
	password mypassword;
	swhois "Im Special";

4.28 - Badword Block OPTIONAL (Previously known as badwords.*.conf)


badword <type> {
	word <text-to-match>;
	replace <replace-with>;
	action <replace|block>;

The badword block allows you to manipulate the list used for user and channel mode +G to strip "badwords". The badword:: specifies the type, valid types are channel, message, quit, and all. channel is for the channel +G list, message is for the user +G list, quit is for quit message censoring, and all adds it to all three lists. The badword::word can be a simple word or a regular expression we should search for. The badword::replace is what we should replace this match with. If badword::replace is left out, the word is replaced with <censored>. The badword::action defines what action should be taken if this badword is found. If you specify replace, then the badword is replaced, if you specify block, then the entire message is blocked. If you do not specify a badword::action, replace is assumed.


badword channel {
	word shit;
	replace shoot;

4.29 - ULines Block OPTIONAL (Previously known as the U:Line)


ulines {

The ulines block lets you define certain servers as having extra abilities. This should only be used for servers such as services and stats. This should not be set for a normal server. Each entry is the name of the server which will receive the extra abilities.


ulines {

4.30 - Link Block OPTIONAL (Previously known as C/N/H:Lines)


link <server-name> {
	username <usermask>;
	hostname <ipmask>;
	bind-ip <ip-to-bind-to>;
	port <port-to-connect-on>;
	password-connect <password-to-connect-with>;
	password-receive <password-to-receive> { <auth-type>; };
	hub <hub-mask>;
	leaf <leaf-mask>;
	leafdepth <depth>;
	class <class-name>;
	options {

This is the block you need for linking servers, please take your time to read all this because this one of the hardest things to do and users often make errors ;P

First of all server-name is the name of your remote server, the name the remote server has in his me { } block, like hub.blah.com (not the IP and can be different than hostname).

You can specify this if you use ident for authentication, normally you will set this to "*".

The remote host or IP of the remote server. This is used for both connecting AND for authentication/verification on the incoming side. Some examples: normal IP
hub.blah.com host: only for outgoing, cannot accept _incoming_ connections unless link::options::nohostcheck is present
* cannot connect TO but will allow a server connection (with correct password) from everywhere
::ffff: for linking ipv6 to ipv4.

bind-ip (optional)
Can be used to bind to a specific IP (ex: from where we should connect from, almost never used.

Port to connect to (at which the remote server is listening).

The password used for connecting to the remote server, must be plain-text.

The password used for validating incoming links, can be encrypted (valid methods are crypt, md5, sha1, ripemd-160). You can leave the auth-type parameter out to just use plain-text. Often this password is the same as your password-connect.

hub vs leaf
A hub has multiple servers linked to it, a leaf has only one link... to you. A server is either a hub or a leaf, you cannot combine these options.

hub (optional)
The value is a mask of what servers this hub may connect (ex: *.my.net).

leaf (optional)
The value is a mask that this server will act like a leaf towards.

leaf-depth (optional)
If specified then leaf should be specified too. The value specifies the depth (number of hops) this server may have beneath it.

The class this server is put into, often a separate server class is used for this.

compression-level (optional)
Specifies the compression level (1-9) for this link. Only used if link::options::zip is set.

options block
One or more options used for connecting to the server. Sometimes not needed.
ssl if you are connecting to a SSL port.
autoconnect server will try to autoconnect, time specified in your class::connfreq (it's best to enable this only from one side, like leaf->hub)
zip if you want compressed links, needs to be compiled in + set at both ends
nodnscache don't cache IP for outgoing server connection, use this if it's an often changing host (like dyndns.org)
nohostcheck don't validate the remote host (link::hostname), use this if it's an often changing host (like dyndns.org)
quarantine opers on this server will maintain locop status


link hub.mynet.com {
	username *;
	bind-ip *;
	port 7029;
	hub *;
	password-connect "LiNk";
	password-receive "LiNk";
	class servers;
	options {

4.31 - Alias Block OPTIONAL

Syntax [standard alias]:

alias <name> {
	nick <nick-to-forward-to>;
	type <type-of-alias>;

(Note: also see here about the standard alias files UnrealIRCd has)

The alias block [standard alias] allows you to forward a command to a user, for example /chanserv sends a message to the user chanserv. The alias:: specifies the name of the command that will be the alias, ex /chanserv, alias::nick is the nickname it will forward to, if the alias:: is the same as the nick it will forward to, alias::nick can be left out. The alias::type specifies the type of alias, valid types are services (the user is on the services server), stats (the user is on the stats server), and normal (the user is a normal user on any server). The alias block also has another purpose which is explained below.

Syntax [command alias]:

alias <name> {
	format <regex-expression> {
		nick <nick-to-forward-to>;
		type <type-of-alias>;
		parameters <parameter-string>;
	format <regex-expression> {
	type command;

When the alias block is used in this format, it allows you a much broader range of usage. For example you can create aliases such as /identify. The alias:: is the same as above, the name of the alias command. The alias::format specifies a regular expression that compares against the text sent to the alias command, when matched the sub-entries of that alias::format will be used, you may have multiple alias::format's to make the command do different things depending on the text sent to it. The alias::format::nick is the nickname to forward this alias to. The alias::format::type specifies the type of the alias that the message should be forwarded to. The alias::format::parameters is what will be sent as the parameters to this alias. To specify one of the parameters given to the command alias specify % followed by a number, for example, %1 is the first parameter. To specify all parameters from a given parameter to the end do % followed by the number and a -, for example %2- returns all parameters from the second till the last. For examples of using the alias block in the command format, consult doc/example.conf.

4.32 - Help Block OPTIONAL


help <name> {

(Note: normally you just include help.conf)

The help block allows you to create entries for use in /helpop. The help:: is the value that must be passed to /helpop as a parameter, if the help:: is left out, then it will be used when no parameter is passed to /helpop. The entries for the help block are the text that will be displayed to the user when requesting the /helpop.

4.33 - Official Channels Block OPTIONAL


official-channels {
	"#channel" { topic "The default topic"; };

Official channels are shown in /list even if no users are in the channel. The topic is optional and is only shown in /list if it has 0 users.


official-channels {
	"#Help" { topic "The official help channel, if nobody is present type /helpop helpme"; };
	"#Main" { topic "The main channel"; };

4.34 - Spamfilter Block OPTIONAL

The spamfilter block allows you to add local spamfilters (not network-wide).
See Features - Spamfilter for more information about spamfilters.


spamfilter {
	regex <word>;
	target { <target(s)> };
	action <action>;
	reason <reason>;
	ban-time <time>;

regex is the regex to be matched.
target specifies the targets, possible targets are: channel, private, private-notice, channel-notice, part, quit, dcc.
action specifies the action to be taken, see here for a list of possible actions.
reason optional: specifies the ban or block reason, else the default is used.
ban-time optional: specifies the duration of a *line ban, else the default is used (1 day).


spamfilter {
	regex "Come watch me on my webcam";
	target { private; channel; };
	action gline;
	reason "You are infected, please go to www.antivirus.xx/blah/virus=GrrTrojan";
	ban-time 6h;

spamfilter {
	regex "come to irc\..+\..+";
	target { private; channel; };
	action gline;
	action gline;
	reason "No spamming allowed";

4.35 - Set Block REQUIRED (Previously known as unrealircd.conf/networks file)

The set file is what use to be our networks/unrealircd.conf and our networks file. On single server networks, rather than have 3 files, on single server networks, you can just include the set statements in the unrealircd.conf, on multi-server networks, i recommend still using a networks file.

Now, if your server is on a network, chances are you will all basically use the same Set settings. Therefore it makes more sense to have a network file, which is loaded with a include:: directive. Refer to section 4.9. Below you will find all of the set directives available.

In this doc we refer to settings / directives in the <block-name>::<block-directive> format. This format is NOT the format that it can be entered into the configuration file. IT MUST be converted to the format listed below. It is presented in the format it is to make discussing it simpler.


set {
	<entry> <value>;
	<entry> <value>;

The set block sets options for individual server features. Each entry does something different and therefore each will be described below. Some directives have sub blocks which will also be described. There are many set statements to cover, all of the directives listed below can be included under ONE set statement. If a directive has options, they are included within the single set statement as well.

set {
	kline-address my@emailaddress.com;
	auto-join #welcome;
	options {
	hosts {
		local LocalOp.MyNet.com;
		global globalop.mynet.com;

Now if you wanted to make the set statements separate, say you wanted to set your options in a single line.
set { options { hide-ulines; no-stealth; }; };

set::kline-address <email-address>;
The email address that K:line questions should be sent to. This value must be specified.

set::modes-on-connect <+modes>;
The modes that will be set on a user at connection.

set::snomask-on-connect <+modes>
The snomask that will be set on a user at connection.

set::modes-on-oper <+modes>;
The modes that will be set on a user when they /oper.

set::snomask-on-oper <+modes>;
The snomask that will be set on a user when they /oper.

set::modes-on-join <+modes>;
The modes that will be set on a channel when it is first created. Not all modes can be set using this command. +qaohvbeOAzlLk can NOT be set using this command.

set::restrict-usermodes <modes>
Restrict users to set/unset the modes listed here (don't use + or -).
For example you can set +G in modes-on-connect and G in restrict-usermodes, that way you can force all users to be +G and unable to do -G.

set::restrict-channelmodes <modes>
Restrict users to set/unset the channelmodes listed here (don't use + or -).
For example you can set +G in modes-on-join and G in restrict-channelmodes, that way you can force all (new) channels to be +G and unable to do -G.
NOTE: it may still be possible to use these channelmodes trough services by using MLOCK. Unfortunately we can't do much about that, you would have to ask the services coders to implement a restrict-channelmodes feature too.

set::auto-join <channels>;
The channel(s) a user will be forced to join at connection. To specify more than one channel use a comma separated list.
[Note: don't forget to add quotes, like: auto-join "#chan";]

set::oper-auto-join <channels>;
The channel(s) a user will be forced to join when they /oper. To specify more than one channel use a comma separated list.
[Note: don't forget to add quotes, like: oper-auto-join "#chan";]

set::anti-spam-quit-message-time <timevalue>;
A time value specifying the length of time a user must be connected for before a /quit message will be displayed. Used to prevent spam. A time value is a numeric string with d meaning days, h meaning hours, m meaning minutes, and s meaning seconds, for example 1d2h3m means 1 day, 2 hours, 3 minutes.

set::prefix-quit <text-to-prefix-quit>;
Sets the text that will be used to prefix a quit message. If this value is set to 0 then the standard "Quit:" is used.

set::static-quit <quit message>;
Sets a static quit message that will be sent whenever a client logs off the network. This eliminates the need for anti-spam-quit-message-time, as well as the set::prefix-quit. It will NOT replace ERRORS with the static-quit message.

set::static-part <no|yes|part message>;
A value of 'yes' strips all part comments, a value of 'no' makes part just work as usual, anything else will be used as a part comment (eg: static-part "Bye!") but this can be quite annoying, so use with care.

set::who-limit <limit>;
Sets the limit for the maximum number of matches that will be returned for a /who. If this option is left out, no limit is enforced.

set::silence-limit <limit>; Sets the limit on the maximum SILENCE list entries. If this directive is not specified, a limit of 15 is set.

set::oper-only-stats <stats-list>;
Specifies a list of stats flags with no separators that defines stats flags only opers can use. Leave this value out to allow users to use all flags, or specify * for users to be able to use no flags. Only short operflags may be specified here.

set::oper-only-stats {<stats-flag>; <stats-flag>;};
Specifies a list of stats flags that can only be used by opers. This only works with long stats flags.

set::maxchannelsperuser <amount-of-channels>;
Specifies the number of channels a single user may be in at any one time.

set::channel-command-prefix <command-prefixes>;
Specifies the prefix characters for services "in channel commands". Messages starting with any of the specified characters will still be sent even if the client is +d. The default value is "`".

set::allow-userhost-change [never|always|not-on-channels|force-rejoin]
Specifies what happens when the user@host changes (+x/-x/chghost/chgident/setident/vhost/etc).
never disables all the commands, always does always allow it even when in channels (may cause client desyncs) [default], not-on-channels means it's only allowed when the user is not on any channel, force-rejoin will force a rejoin in all channels and re-op/voice/etc if needed.

If this is present, Ulined server will be hidden in a /links requested by non-opers.

If present the opermotd will be shown to users once they successfully /oper.

If present the presence of an identd server will be checked and the returned value will be used for the username. If no ident request is returned or the identd server doesn't exist, the user's specified username will be prefixed with a ~. If this value is omitted no such check is made.

If present notices showing "ident request", "hostname lookup", etc. will be displayed when a user connects.

If present hosts of incoming users are not resolved, can be useful if many of your users don't have a host to speed up connecting.
Note that since no resolving is done you also can't have host based allow blocks.

Makes it so the /mkpasswd can be used by anyone instead of oper-only, usage of the command by non-opers is sent to the EYES snomask.

Allow shunned user to use /part.

set::dns::timeout <timevalue>;
A time value specifying the length of time a DNS server has to respond before a timeout. A time value is a numeric string with d meaning days, h meaning hours, m meaning minutes, and s meaning seconds, for example 1d2h3m means 1 day, 2 hours, 3 minutes.

set::dns::retries <number-of-retries>;
A numeric value specifying the number of times the DNS lookup will be retried if failure occurs.

set::dns::nameserver <name-of-dns-server>;
Specifies the hostname of the server that will be used for DNS lookups.

set::network-name <name-of-network>;
Specifies the name of the network on which this server is run. This value should be exactly the same on all servers on a network.

set::default-server <server-name>;
Defines the name of the default server to tell users to connect to if this server is full.

set::services-server <server-name>;
Specifies the name of the server that the services bots are connected to. Required, set it to something like services.yournet.com if you don't have services.

set::stats-server <server-name>;
Sets the name of the server on which the stats bot is located. If stats are not run this value may be left out.

set::help-channel <network-help-channel>;
Sets the name of the help channel for this network.

set::cloak-keys { <value>; <value>; <value>; };
Sets the keys to be used to generate a +x host. This value must be the same on all servers or the servers will not link. Each of the set::cloak-keys:: must be a numeric value greater than 10000. You must have exactly three values specified.

set::hiddenhost-prefix <prefix-value>;
Defines the prefix that will be used on hiddenhosts (+x) this is usually three or four letters representing the network name.

set::hosts::local <locop-host-name>;
Defines the hostname that will be assigned to local opers when they set +x.

set::hosts::global <globop-host-name>;
Defines the hostname that will be assigned to global operators when they set +x.

set::hosts::coadmin <coadmin-host-name>;
Sets the hostname that will be assigned to co-admins when they set +x.

set::hosts::admin <admin-host-name>;
Defines the hostname that will be set for admins when they set +x.

set::hosts::servicesadmin <servicesadmin-host-name>;
Sets the hostname that will be given to services-admins when they set +x.

set::hosts::netadmin <netadmin-host-name>;
Sets the hostname that will be given to netadmins when they set +x.

set::hosts::host-on-oper-up <yes/no>;
If set to yes, the H/get_host flag will be honored and +x will be automatically set at /oper. If set to no, the user must set +x manually to receive the oper host.

set::ssl::egd <filename>;
Specifies that EGD (Entropy Gathering Daemon) support should be enabled. If you run OpenSSL 0.9.7 or higher, then /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and /etc/entropy will be searched by default so no filename is necessary, you may simply specify set::ssl::egd with no value. If you are using a version of OpenSSL prior to 0.9.7 or you want to use a EGD socket located somewhere other than the above listed locations you may specify the filename of the UNIX Domain Socket that an EGD is listening on.

set::ssl::certificate <filename>;
Specifies the filename where the server's SSL certificate is located.

set::ssl::key <filename>;
Specifies the filename where the server's SSL private key is located.

set::ssl::trusted-ca-file <filename>;
Specifies the filename where the certificates of the trusted CAs are located.

Forces clients that do not have a certificate to be denied.

Disallows connections from people with self-signed certificates.

Makes Unreal determine if the SSL certificate is valid before allowing connection.

set::throttle::period <timevalue>
How long a user must wait before reconnecting more than set::throttle::connections times.

set::throttle::connections <amount>;
How many times a user must connect with the same host to be throttled.

set::ident::connect-timeout <amount>;
Amount of seconds after which to give up connecting to the ident server (default: 10s).

set::ident::read-timeout <amount>;
Amount of seconds after which to give up waiting for a reply (default: 30s).

set::anti-flood::unknown-flood-bantime <timevalue>;
Specifies how long an unknown connection flooder is banned for.

set::anti-flood::unknown-flood-amount <amount>;
Specifies the amount of data (in KiloBytes) that the unknown connection must send in order for the user to be killed.

set::anti-flood::away-flood <count>:<period>
Away flood protection: limits /away to 'count' changes per 'period' seconds. This requires NO_FLOOD_AWAY to be enabled in config.h. Example: away-flood 5:60s; means max 5 changes per 60 seconds.

set::anti-flood::nick-flood <count>:<period>
Nickflood protection: limits nickchanges to 'count' per 'period' seconds. For example nick-flood 4:90 means 4 per 90 seconds, the default is 3 per 60.

set::default-bantime <time>
Default bantime when doing /kline, /gline, /zline, /shun, etc without time parameter (like /gline *@some.nasty.isp), the default is permanent (0). Example: default-bantime 90d;

set::modef-default-unsettime <value>
For channelmode +f you can specify a default unsettime, if you specify 10 for example then +f [5j]:15 will be transformed to [5j#i10]:15. The default is no default unsettime.

set::modef-max-unsettime <value>
The maximum amount of minutes for a mode +f unsettime (in +f [5j#i<TIME>]:15), this is a value between 0 and 255. The default is 60 (= 1 hour).

set::ban-version-tkl-time <value>
If you specify an 'action' like zline/gline/etc in ban version, then you can specify here how long the ip should be banned, the default is 86400 (1 day).

set::spamfilter::ban-time <value>
Same as above but for *lines added by spamfilter

set::spamfilter::ban-reason <reason>
Reason to be used for *lines added by spamfilter

set::spamfilter::virus-help-channel <channel>
The channel to use for the 'viruschan' action in spamfilter

set::spamfilter::except <target(s)>
These targets are exempt from spam filtering (no action will be taken), can be single target or comma seperated list.. Ex: except "#help,#spamreport"

5 – Additional Files

In addition to the configuration files, Unreal has a few other files, such as MOTD, OperMOTD, BotMOTD, and Rules. Listed below are the names of these files and their uses.
Note that the motd files (all types) and rules files can also be specified in a tld block, these are just the files used by default (and for remote MOTD/RULES's).

ircd.motdDisplayed when a /motd is executed and (if ircd.smotd is not present) when a user connects
ircd.smotdDisplayed on connect only (short MOTD)
ircd.rulesDisplayed when a /rules is executed
oper.motdDisplayed when a /opermotd is executed or when you /oper up
bot.motdDisplayed when a /botmotd is executed

6 – User & Channel Modes

Channel Modes
Only Administrators may join
a <nick>
Makes the user a channel admin
No clients marked as a Bot (Usermode +B)
b <nick!user@host>
Bans the given user from the channel
No ANSI color can be sent to the channel
No CTCP's allowed in the channel
e <nick!user@host>
Exception ban – If someone matches this, they can join a channel even if they match an existing ban
f * <lines:seconds>
Flood protection, if the * is given a user will kick banned when they send <lines:seconds> if no * they are just kicked
Makes channel G rated. Checks for words listed in the Badword Blocks, and replaces them with the words specified
A registered nickname (+r) is required to talk
h <nick>
Gives half-op status to the user
Invite required
/knock is not allowed
k <key>
Sets a key needed to join
l <##>
Sets max number of users
L <Chan>
If the amount set by +l has been reached, users will be sent to this channel
Moderated channel. Only +v/o/h users may speak
No nick name changes permitted
No messages from outside channels
Only IRCops may join
o <nick>
Gives a user channel operator status
Makes channel private
Sets channel owner
Only U:Lined servers can kick users
Requires a registered nickname to join
Strips all incoming colors
Makes channel secret
Only chanops can set topic
No NOTICE's allowed in the channel
Auditorium Makes /names and /who #channel only show channel ops
/invite is not allowed
v <nick>
Gives a voice to users. (May speak in +M Channels
Only clients on a Secure (SSL) Connection may join


User Modes
Identifies the nick as being registered
Can listen to server notices
Receives infected DCC Send Rejection notices
Global IRC Operator (Set in Oper Block)
Local IRC Operator (Set in Oper Block)
Marks you as being a Bot
Invisible (not shown in /who)
Server Admin (Set in Oper Block)
Gives user a hidden hostname
Only U:Lines can kick you (Services Admins Only)
Services Oper (Set by services)
Services Admin (Set in Oper Block)
Services Root (Set by services)
Can send & read globops and locops
Hide IRCop Status (IRCop Only)
Used to protect Services Daemons
Says you are using a /vhost
Co-Admin (Set in Oper Block)
Makes it so you can not receive channel PRIVMSGs
Network Administrator (Set in Oper Block)
Can listen to wallop messages
Available for help (HelpOp) (Set in OperBlock)
Filters out all the bad words per configuration
Lets you see when people do a /whois on you (IRCops Only)
Hides the channels you are in in a /whois reply
Allows you to only receive PRIVMSGs/NOTICEs from registered (+r) users
Marks you as a WebTV user
Indicates that you are an SSL client
Prevents you from receiving CTCPs

7 – User & Oper Commands Table

NOTE: the /helpop documentation is more up to date, use /helpop command (or /helpop ?command if you are oper) to get more information on a command.

nick <newnickname> Changes your online nick name. Alerts others to the change of your nick
whois <nick> Displays information of user requested. Includes Full Name, Host, Channels User is in, and Oper Status
who <mask> Who allows you to search for users. Masks include: nickname, #channel, hostmask (*.attbi.com)
whowas <nick> <maxreplys> Displays information on a nick that has logged off. The <max replies> field is optional, and limits how many records will be returned.
ison <nick1 nick2 nick3 ...> Allows you to check the online status of a user, or a list of users. Simple return, best used for scripts
join <channel1,channel2, ...> Allows you to join channels. Using the /join #channel1, #channel2, channel3 will allow you to join more than one channel at a time. The /join 0 command makes you PART All
cycle <channel1, channel2, ...> Cycles the given channel(s). This command is equivalent to sending a PART then a JOIN command. All
motd <server> Displays the servers motd. Adding a server name allows you to view motd’s on other servers.
rules <server> Displays the ircd.rules of a server. Adding a server name allows you to view rules on other servers All
lusers <server> Displays current & max user loads, both global and local. Adding a server name allows you to view rules on other servers.
map Displays a network map All
quit <reason> Causes you to disconnect from the server. If you include a reason, it will be displayed on all channels as you quit All
ping <user> Sends a PING request to a user. Used for checking connection and lag. Servers issue pings on a timed basis to determine if users are still connected.
version <nick> Sends a CTCP Version request to the user. If configured to do so, their client will respond with the client version.
links Displays a list of all servers linked to the network All
Admin <server> Displays the admin info of a server. If a server name is included it will display the info of that server.
userhost <nick> Displays the userhost of the nick given. Generally used for scripts
topic <channel> <topic> Topic <channel> will display the current topic of the given channel. Topic <channel> <topic> will change the topic of the given channel.
invite <nick> <channel> Invites the given user to the given channel. (Must be a channel Op)
kick <channel, channel> <user, user> <reason> Kicks a user or users out of a channel, or channels. A reason may also be supplied.
away <reason> Marks you as being away. A reason may also be supplied.
Watch +-<nick> +-<nick>
Watch is a new notify-type system in UnrealIRCd which is both faster and uses less network resources than any old-style notify system. The server will send you a message when any nickname in your watch list logs on or off. The watch list DOES NOT REMAIN BETWEEN SESSIONS - you (or your script or client) must add the nicknames to your watch list every time you connect to an IRC server.
helpop ?<topic> or !<topic>
HelpOp is a new system of getting IRC Server help. You type either /HELPOP ? <help system topic> or /HELPOP ! <question> The "?" in /HELPOP means query the help system and if you get no response you can choose '!' to send it to the Help Operators online Using neither ? nor ! will mean the command will be first queried within the help system and if no match if found , it will be forwarded to the help operators All
list <search string> If you don't include a search string, the default is to send you the entire unfiltered list of channels. Below are the options you can use, and what channels LIST will return when you use them.
>number List channels with more than <number> people.
<number List channels with less than <number> people.
C>number List channels created between now and <number> minutes ago.
C<number List channels created earlier than <number> minutes ago.
T>number List channels whose topics are older than <number> minutes (Ie., they have not changed in the last <number> minutes.
T<number List channels whose topics are newer than <number> minutes.

*mask* List channels that match *mask*
!*mask* List channels that do not match *mask*
Knock <channel> <message>
Allows you to ‘knock’ on an invite only channel and ask for access. Will not work if channel has one of the following modes set: +K +V. Will also not work if you are banned
setname Allows users to change their ‘Real Name’ without reconnecting
vhost <login> <password> Hides your host name by using a vhost provided by the server.
mode <chan/nick> <mode>
Lets you set channel and user modes. Refer to section 5 for lists of modes
credits Lists credits for everyone that has helped create UnrealIRCd
license Displays the GNU License All
time <server> Displays the servers date and time. Including a server name allows you to check other servers.
botmotd <server>
Displays the servers bot message of the day. Including a server name allows you to check other servers All
identify <password> Sends your password to the services system to identify to your nick.
identify <channel> <password> Sends your password to the services system to identify as the founder of a channel.
dns <option> Returns information about the IRC server's DNS cache. Note, since most clients have a built-in DNS command, you will most likely need to use /raw DNS to use this. Opers may specify an l as the first parameter to the command to receive a list of entries in the DNS cache. All
oper <userid> <password>
Command to give a user operator status if they match an Oper Block
wallops <message> Sends a message to all users with umode +w IRCop
globops <message> Sends a message to all IRCops IRCop
chatops <message> Send a message to all IRCops with umode +c IRCop
locops <message> Sends a message to all local IRCops IRCop
adchat <message> Sends a message to all Admins IRCop
nachat <message> Sends a message to all Net Admins IRCop
kill <nick> <reason> Kills a user from the network IRCop
kline [+|-]<user@host | nick> [<time to ban> <reason>] Bans the hostmask from the server it is issued on. A kline is not a global ban.
time to ban is either: a) a value in seconds, b) a time value, like '1d' is 1 day or c) '0' for permanent. Time and reason are optional, if unspecified set::default-bantime (default: 0/permanent) and 'no reason' are used.
To remove a kline use /kline -user@host
zline [+|-]<*@ip> [<time to ban> <reason>] Bans an IP Address from the local server it is issued on (not global). See kline for more syntax info. Use /zline -*@ip to remove.
gline [+|-]<user@host | nick> [<time to ban> <reason>]
Adds a global ban to anyone that matches. See kline for more syntax info. Use /gline -user@host to remove.
shun [+|-]<user@host | nick> [<time to shun> <reason>]
Prevents a user from executing ANY commands and prevents them from speaking. Shuns are global (like glines). See kline for more syntax info. Use /shun -user@host to remove a shun.
gzline [+|-]<ip> <time to ban> :<reason>
Adds a global zline. See kline for more syntax info. Use /gzline -*@ip to remove a gzline.
rehash <server> –<flags> Rehashes the servers config file. Including a server name allows you to rehash a remote servers config file. Several flags are also available. They Include
-motd - Only rehash all MOTD and RULES files (including tld {})
-opermotd - Only rehash the OPERMOTD file
-botmotd - Only rehash the BOTMOTD file
-garbage - Force garbage collection
restart <server> <password>
Restarts the IRCD Process. Password is required. You may also include a server name to restart a remote server.
die <password>
Terminates the IRCD Process. Password is required IRCop
lag <server>
This command is like a Sonar or Traceroute for IRC server. You type in /LAG irc.fyremoon.net and it will reply from every server it passes with time and so on Useful for looking where lag is and optional TS future/past travels
sethost <newhost> Lets you change your vhost to what ever you want it to be.
setident <newident>
Lets you set your ident to what ever you want it to be
chghost <nick> <newhost>
Lets you change the host name of a user currently on the system
chgident <nick> <newident>
Lets you set your ident to what ever you want it to be
chgname <nick> <newname>
Lets you change the realname of a user currently on the system
squit <sever>
Disconnects a server from the network
connect <server> <port> <server> If only one server is given, it will attempt to connect the server you are ON to the given server. If 2 servers are given, it will attempt to connect the 2 servers together. Put the leaf server as the first, and the hub server as the second.
dccdeny <filemask> <reason>
Adds a DCCDENY for that filemask. Preventing that file from being sent.
undccdeny <filemask>
Removes a DCCDENY IRCop
sajoin <nick> <channel>, <channel>
Forces a user to join a channel(s). Available to services & network admins only IRCop
sapart <nick> <channel>, <channel>
Forces a user to part a channel(s). Available to services & network admins only.
samode <channel> <mode>
Allows Network & Services admins to change modes of a channel without having ChanOps.
rping <servermask>
Will calculate in milliseconds the lag between servers
trace <servermask>
Will calculate in milliseconds the lag between servers
Displays the servers OperMotd File
addmotd :<text>
Will add the given text to the end of the Motd
addomotd :<text>
Will add the given text to the end of the OperMotd
sdesc <newdescription>
Allows server admins to change the description line of their server without restarting.
addline <text>
Allows you to add lines to the unrealircd.conf
mkpasswd <password>
Will encrypt a clear text password to add it to the unrealircd.conf
tsctl offset +/- <time>
Adjust the IRCD’s Internal clock (Do NOT use if you do not understand EXACTLY what it does)
tsctl time
Will give a TS Report IRCop
tsctl alltime Will give a TS Report of ALL servers IRCop
tsctl svstime <timestamp>
Sets the TS time of all servers (Do NOT use if you do not understand EXACTLY what it does)
htm <option>
Controls settings related to high traffic mode. High Traffic Mode (HTM) basically disables certain user commands such as: list whois who etc in response to extremely high traffic on the server. Options include:
-ON Forces server into HTM
-OFF Forces server out of HTM
-NOISY Sets the server to notify users/admins when in goes in and out of HTM
-QUIET Sets the server to NOT notify when going in and out of HTM
-TO <value> Sets Traffic rate HTM activate
stats <option>
B - banversion - Send the ban version list
b - badword - Send the badwords list
C - link - Send the link block list
d - denylinkauto - Send the deny link (auto) block list
D - denylinkall - Send the deny link (all) block list
e - exceptthrottle - Send the except trottle block list
E - exceptban - Send the except ban block list
f - spamfilter - Send the spamfilter list
F - denydcc - Send the deny dcc block list
G - gline - Send the gline list
  Extended flags: [+/-mrs] [mask] [reason] [setby]
    m Return glines matching/not matching the specified mask
    r Return glines with a reason matching/not matching the specified reason
    s Return glines set by/not set by clients matching the specified name
I - allow - Send the allow block list
j - officialchans - Send the offical channels list
K - kline - Send the ban user/ban ip/except ban block list
l - linkinfo - Send link information
L - linkinfoall - Send all link information
M - command - Send list of how many times each command was used
n - banrealname - Send the ban realname block list
O - oper - Send the oper block list
S - set - Send the set block list
s - shun - Send the shun list
  Extended flags: [+/-mrs] [mask] [reason] [setby]
    m Return shuns matching/not matching the specified mask
    r Return shuns with a reason matching/not matching the specified reason
    s Return shuns set by/not set by clients matching the specified name
P - port - Send information about ports
q - sqline - Send the SQLINE list
Q - bannick - Send the ban nick block list
r - chanrestrict - Send the channel deny/allow block list
R - usage - Send usage information
t - tld - Send the tld block list
T - traffic - Send traffic information
u - uptime - Send the server uptime and connection count
U - uline - Send the ulines block list
v - denyver - Send the deny version block list
V - vhost - Send the vhost block list
X - notlink - Send the list of servers that are not current linked
Y - class - Send the class block list
z - zip - Send compression information about ziplinked servers (if compiled with ziplinks support)
Z - mem - Send memory usage information
Lists all loaded modules All
This command will disconnect all unknown connections from the IRC server. IRCOp

8 – Security tips/checklist

If you are concerned about security (you should be!), this section will help you get an overview of the risks that are out there and their risk-level. Alternatively you can use it as a "checklist" to walk trough your (network) configuration to make things more secure.

The list is ordered by by popularity/risk level/most-often-used-attack-methods:

8.1 Passwords

Choose good oper passwords, link passwords, etc:
- use mixed case and digits ("Whbviwf5") and/or something long ("blaheatsafish", "AlphaBeta555").
- DO NOT use your link/oper passwords for something else like your mail account, bot password, forums, etc...

8.2 Non-Ircd related vulnerabilities

There's a far bigger chance a box will get hacked by a non-irc(d) vulnerability than by some bug in UnrealIRCd. If you for example run http, dns, smtp and ftp servers on the same box you have a much higher risk. Also, if you are on a multi-user box (eg: you bought a shell) there's the risk of local exploits and bad permissions (see next). This risk is quite high so be careful when selecting a shell provider.

8.3 Permissions and the configfile

Always make sure your home directory and UnrealIRCd directory have correct permissions, (group/)other shouldn't have read permissions. Otherwise a local user can simply grab your configfile and look for passwords... In short: chmod -R go-rwx /path/to/Unreal3.2 if you are unsure about this.
Other things related to this: never put your UnrealIRCd inside the webroot or some other kind of shared directory. And for backups, make sure they get the correct permissions too (it happens quite frequently everything is secured fine but there's a backup.tar.gz lying around readable by everyone).

You probably also want to use encrypted passwords were possible. Note however that this is just 'yet another layer of security', a lot 1-8 char passwords can be cracked within a few hours/days, and usually there's other unencrypted interesting information in the configfile anyway (like link::password-connect).

8.4 User-related problems

Just like most of these things, this is not UnrealIRCd-specific, but..
Always choose your opers and admins wisely. And do remember the concept of weakest-link. Even though you are careful and did everything in this doc, maybe your friend which is an oper too did something stupid. Like share his harddrive via netbios/kazaa/morpheus/.., got a trojan, used an obvious password, etc etc.. Unfortunately, it's not always in your control.

8.5 SSL/SSH & sniffing

Use SSL connections between servers and as an oper, this will protect you against "sniffing". Sniffing is possible if an attacker hacked a box somewhere between you and your ircd server, he can then look at ALL network traffic that passes by; watch all conversations, capture all passwords (oper logins, nickserv, etc).. For the same reason, always use ssh instead of telnet.

8.6 Denial of Service attacks (DoS) [or: how to protect my hub]

A lot of networks have experienced how much "fun" a flood or (D)DoS attack is, you can however do some things to reduce the damage caused by it. Most nets have a hub server, what some people seem to forget is that it's quite easy to protect the hub server from getting attacked.
I'll explain it here:
1. Set the name of the hub to a hostname that doesn't exist, eg 'hub.yournet.com', but
    don't add a dns record for it. This way an attacker cannot resolve the host and
    cannot flood it either. Then simply link your servers to the hub by specifying the
    IP or another non-public hostname.
    Example 1: link visibiblename.yournet.com { hostname; [etc] };.
    Example 2: link visibiblename.yournet.com { hostname thehostnamethatworks.yournet.com; [etc] };.
    On a sidenote, for the last example you must be sure your nameservers don't allow zone transfers, but that's way too off-topic ;).
2. Another important step is then to hide '/stats c' and other stats information, otherwise
    attackers can simply list your link blocks. Usually if you are this paranoid (like
    me) you can simply do: set { oper-only-stats "*"; }; to restrict all /stats usage.
    If you don't want that, at least hide "CdDlLXz". More about this in the next section.

Of course those steps are less useful if they are applied afterwards (eg: after a few months)
instead of at the beginning because the IP's might be already known to some evil guys, still.. it's worth to do.
Also note that attackers can still flood all non-hub servers, but that requires more effort
than just attacking 1 or 2 weak points (the hubs), also this way your hubs & services will stay alive :).

8.7 Information disclosure

The /stats command is very informative, you probably want to restrict it's usage as much as possible. A question you should ask yourself is "what do I want my users to see?". Most big networks choose "nothing", while others prefer their clients to be able to do '/stats g' and '/stats k'.
I suggest you to use set { oper-only-stats "*"; }; to deny all /stats for non-opers, but if you don't want that, step trough the '/stats' list (gives an overview of all available options) and block everything except what you want to allow.. (if in doubt, just deny.. why should they really need to know all this?).
To give you a few examples:
- /stats o: gives you the nicks of opers (with correct case) and hostmasks.
- /stats c: gives you an idea about serverlinks and which to use as 'backup', etc..
- /stats g, /stats k: usually used for banning proxies.. so this will simply give attackers a list of proxies they can use.
- /stats E, /stats e: pretty sensitive info, especially if an attacker can use these addresses
- /stats i, /stats y: might aid an attacker in finding hosts which allow lots of connections.
- /stats P: helps him find serveronly ports
etc etc...

Of course all of this is "information hiding", so it's not "true" security. It will however make it more difficult / increase the effort needed to attack/hack.

8.8 Protecting against exploits

There are kernel patches that make it more difficult for stack- and heap-based exploits to work. This should however not be your main focus point, you have a far more bigger risk of getting exploited trough the other points than this... for various reasons.

There's one thing you should do however, which is to ALWAYS USE THE LATEST VERSION, subscribe to the unreal-notify mailinglist right now so you receive the release announcements (unreal-notify is for release announcements only, so only 1 mail per X months). Usually it's explicitly mentioned in the release announcement if the release contains (high risk) security fixes.

8.9 Summary

As you now hopefully understand, you can never be 100% secure. You (and us) have to find&fix every hole out there, while an attacker only needs to find just 1 server with 1 hole. Everything that was explained here DOES however help by minimizing the risks considerably. Do take the time to secure your network and educate your opers. A lot of people don't care about security until they got hacked, try to avoid that :).

9 – Frequently Asked Questions (FAQ)

The FAQ is available online here