website/content/docs/operators.md

90 lines
3.4 KiB
Markdown

# Operators
Server operators are defined by `oper` blocks and typed by `opertype` blocks. An oper's power is the
sum of three allow-lists: the **commands** they may run, the named **privileges** they hold, and the
user/channel **modes** they may set. `class` blocks bundle those into reusable roles that opertypes
compose.
## Oper accounts
An `oper` block ties a login to an `opertype`. Hash the password with `echoircd mkpasswd`. A block
with neither a password nor a fingerprint is refused.
```ini
oper {
name "alice";
password "$2b$11$..."; # from: echoircd mkpasswd
fingerprint "AA:BB:..."; # optional TLS client-cert (2FA, or alone)
type "netadmin";
host "*@192.0.2.0/24";
}
```
Then, as a client: `/oper alice hunter2`.
## Classes and types
A `class` is a reusable capability bundle; an `opertype` composes classes into a named WHOIS role.
```ini
class {
name "ban";
commands "KILL KLINE GLINE ZLINE";
privs "users/auspex channels/auspex";
snomasks "cdkx";
}
opertype {
name "helper";
classes "auspex";
modes "+ih";
title "Help Operator";
}
```
Command and privilege lists are space-separated tokens: `*` grants everything, a `-` prefix removes
one (`* -KILL` = everything except `KILL`). `usermodes` / `chanmodes` on a class limit which oper-only
modes the type may set.
### Built-in classes
`announce` · `ban` · `override` · `host` · `services` · `server` · `auspex` — covering broadcast,
X-lines, SA-overrides, host/identity changes, the SVS commands, server control, and the auspex/bypass
privileges respectively.
### Built-in types
Five ship ready to use (only `netadmin` holds every privilege):
| Type | Title | Level |
| --- | --- | --- |
| `helpop` | Help Operator | 10 |
| `globop` | GlobOp | 20 |
| `admin` | Administrator | 50 |
| `servadmin` | Services Administrator | 70 |
| `netadmin` | Network Administrator | 100 |
## Named privileges
Privileges gate individual abilities. Assign them per class/type via `privs`; the daemon enforces
them everywhere the ability is used.
| Privilege | Grants |
| --- | --- |
| `users/auspex` | See a user's real host+IP and geo, and `+i` users you share no channel with |
| `channels/auspex` | See secret/private (`+s`/`+p`) channels in LIST / WHO / WHOIS |
| `servers/auspex` | See U-lined/services servers otherwise hidden by `hideservices` |
| `users/flood` | Exempt from message- and join-flood limits |
| `users/ignore-commonchans` | Message a `+c` user without sharing a common channel |
| `channels/override` | Join through `+k`/`+b`/`+i`/`+l`/`+z`/`+R`/`+J`, CBAN, and the channel cap |
| `channels/restricted-create` | Create a channel while `restrictchans` is on |
| `channels/ignore-nonicks` | Change nick while on a `+N` channel |
| `users/ignore-callerid` | Message a `+g` user without being on their ACCEPT list |
| `users/ignore-privdeaf` | Reach a `+D` (deaf) user with channel messages |
| `users/secret-whois` | WHOIS a `+W` user without notifying them |
| `users/ignore-restrictmsg` | Private-message anyone while `restrictmsg` is on |
| `servers/use-disabled-commands` | Use a command turned off by `disabled_commands` |
| `servers/ignore-securelist` | Bypass the `securelist` LIST hold |
| `servers/ignore-blockamsg` | Send multi-channel messages that `blockamsg` blocks |
An untyped ("legacy") oper — an `oper` block with no `type` — holds every command and privilege.