90 lines
3.4 KiB
Markdown
90 lines
3.4 KiB
Markdown
# Operators
|
|
|
|
Server operators are defined by `oper` blocks and typed by `opertype` blocks. An oper's power is the
|
|
sum of three allow-lists: the **commands** they may run, the named **privileges** they hold, and the
|
|
user/channel **modes** they may set. `class` blocks bundle those into reusable roles that opertypes
|
|
compose.
|
|
|
|
## Oper accounts
|
|
|
|
An `oper` block ties a login to an `opertype`. Hash the password with `echoircd mkpasswd`. A block
|
|
with neither a password nor a fingerprint is refused.
|
|
|
|
```ini
|
|
oper {
|
|
name "alice";
|
|
password "$2b$11$..."; # from: echoircd mkpasswd
|
|
fingerprint "AA:BB:..."; # optional TLS client-cert (2FA, or alone)
|
|
type "netadmin";
|
|
host "*@192.0.2.0/24";
|
|
}
|
|
```
|
|
|
|
Then, as a client: `/oper alice hunter2`.
|
|
|
|
## Classes and types
|
|
|
|
A `class` is a reusable capability bundle; an `opertype` composes classes into a named WHOIS role.
|
|
|
|
```ini
|
|
class {
|
|
name "ban";
|
|
commands "KILL KLINE GLINE ZLINE";
|
|
privs "users/auspex channels/auspex";
|
|
snomasks "cdkx";
|
|
}
|
|
|
|
opertype {
|
|
name "helper";
|
|
classes "auspex";
|
|
modes "+ih";
|
|
title "Help Operator";
|
|
}
|
|
```
|
|
|
|
Command and privilege lists are space-separated tokens: `*` grants everything, a `-` prefix removes
|
|
one (`* -KILL` = everything except `KILL`). `usermodes` / `chanmodes` on a class limit which oper-only
|
|
modes the type may set.
|
|
|
|
### Built-in classes
|
|
|
|
`announce` · `ban` · `override` · `host` · `services` · `server` · `auspex` — covering broadcast,
|
|
X-lines, SA-overrides, host/identity changes, the SVS commands, server control, and the auspex/bypass
|
|
privileges respectively.
|
|
|
|
### Built-in types
|
|
|
|
Five ship ready to use (only `netadmin` holds every privilege):
|
|
|
|
| Type | Title | Level |
|
|
| --- | --- | --- |
|
|
| `helpop` | Help Operator | 10 |
|
|
| `globop` | GlobOp | 20 |
|
|
| `admin` | Administrator | 50 |
|
|
| `servadmin` | Services Administrator | 70 |
|
|
| `netadmin` | Network Administrator | 100 |
|
|
|
|
## Named privileges
|
|
|
|
Privileges gate individual abilities. Assign them per class/type via `privs`; the daemon enforces
|
|
them everywhere the ability is used.
|
|
|
|
| Privilege | Grants |
|
|
| --- | --- |
|
|
| `users/auspex` | See a user's real host+IP and geo, and `+i` users you share no channel with |
|
|
| `channels/auspex` | See secret/private (`+s`/`+p`) channels in LIST / WHO / WHOIS |
|
|
| `servers/auspex` | See U-lined/services servers otherwise hidden by `hideservices` |
|
|
| `users/flood` | Exempt from message- and join-flood limits |
|
|
| `users/ignore-commonchans` | Message a `+c` user without sharing a common channel |
|
|
| `channels/override` | Join through `+k`/`+b`/`+i`/`+l`/`+z`/`+R`/`+J`, CBAN, and the channel cap |
|
|
| `channels/restricted-create` | Create a channel while `restrictchans` is on |
|
|
| `channels/ignore-nonicks` | Change nick while on a `+N` channel |
|
|
| `users/ignore-callerid` | Message a `+g` user without being on their ACCEPT list |
|
|
| `users/ignore-privdeaf` | Reach a `+D` (deaf) user with channel messages |
|
|
| `users/secret-whois` | WHOIS a `+W` user without notifying them |
|
|
| `users/ignore-restrictmsg` | Private-message anyone while `restrictmsg` is on |
|
|
| `servers/use-disabled-commands` | Use a command turned off by `disabled_commands` |
|
|
| `servers/ignore-securelist` | Bypass the `securelist` LIST hold |
|
|
| `servers/ignore-blockamsg` | Send multi-channel messages that `blockamsg` blocks |
|
|
|
|
An untyped ("legacy") oper — an `oper` block with no `type` — holds every command and privilege.
|