50 lines
1.3 KiB
Markdown
50 lines
1.3 KiB
Markdown
# Accounts & SASL
|
|
|
|
Registering a nickname creates an account you can protect, use to found channels, and log in with
|
|
via SASL.
|
|
|
|
## Register
|
|
|
|
Message **NickServ** to register your current nick, then identify:
|
|
|
|
```text
|
|
/msg NickServ REGISTER <password> <email>
|
|
/msg NickServ IDENTIFY <password>
|
|
```
|
|
|
|
## SASL mechanisms
|
|
|
|
SASL logs you in *during* connection, before you join anything. echoIRCd advertises:
|
|
|
|
| Mechanism | How it works |
|
|
| --- | --- |
|
|
| `PLAIN` | account + password |
|
|
| `EXTERNAL` | your TLS client-certificate fingerprint |
|
|
| `SCRAM-SHA-256` | salted challenge / response — no password on the wire |
|
|
| `ECDSA-NIST256P-CHALLENGE` | sign a challenge with a NIST P-256 key |
|
|
|
|
## SASL EXTERNAL (client certificate)
|
|
|
|
Add your certificate fingerprint to your account, then select **EXTERNAL** in your client:
|
|
|
|
```text
|
|
/msg NickServ CERT ADD
|
|
```
|
|
|
|
## Key-based login (ECDSA)
|
|
|
|
Generate a NIST P-256 key and register its public half. At login the server sends a random
|
|
challenge, your client signs it, and the signature is verified against the stored key — nothing
|
|
secret crosses the wire.
|
|
|
|
```sh
|
|
ecdsatool keygen ~/.ecdsa.pem
|
|
ecdsatool pubkey ~/.ecdsa.pem
|
|
```
|
|
|
|
```text
|
|
/msg NickServ SET PUBKEY <printed-public-key>
|
|
```
|
|
|
|
Then point your client's SASL settings at the key file and choose the
|
|
`ECDSA-NIST256P-CHALLENGE` mechanism. See `/msg NickServ HELP SET PUBKEY` for more.
|