Operators

Server operators are defined by oper blocks and typed by opertype blocks. An oper's power is the sum of three allow-lists: the commands they may run, the named privileges they hold, and the user/channel modes they may set. class blocks bundle those into reusable roles that opertypes compose.

Oper accounts

An oper block ties a login to an opertype. Hash the password with echoircd mkpasswd. A block with neither a password nor a fingerprint is refused.

oper {
    name        "alice";
    password    "$2b$11$...";        # from: echoircd mkpasswd
    fingerprint "AA:BB:...";          # optional TLS client-cert (2FA, or alone)
    type        "netadmin";
    host        "*@192.0.2.0/24";
}

Then, as a client: /oper alice hunter2.

Classes and types

A class is a reusable capability bundle; an opertype composes classes into a named WHOIS role.

class {
    name      "ban";
    commands  "KILL KLINE GLINE ZLINE";
    privs     "users/auspex channels/auspex";
    snomasks  "cdkx";
}

opertype {
    name    "helper";
    classes "auspex";
    modes   "+ih";
    title   "Help Operator";
}

Command and privilege lists are space-separated tokens: * grants everything, a - prefix removes one (* -KILL = everything except KILL). usermodes / chanmodes on a class limit which oper-only modes the type may set.

Built-in classes

announce · ban · override · host · services · server · auspex — covering broadcast, X-lines, SA-overrides, host/identity changes, the SVS commands, server control, and the auspex/bypass privileges respectively.

Built-in types

Five ship ready to use (only netadmin holds every privilege):

Type	Title	Level
`helpop`	Help Operator	10
`globop`	GlobOp	20
`admin`	Administrator	50
`servadmin`	Services Administrator	70
`netadmin`	Network Administrator	100

Named privileges

Privileges gate individual abilities. Assign them per class/type via privs; the daemon enforces them everywhere the ability is used.

Privilege	Grants
`users/auspex`	See a user's real host+IP and geo, and `+i` users you share no channel with
`channels/auspex`	See secret/private (`+s`/`+p`) channels in LIST / WHO / WHOIS
`servers/auspex`	See U-lined/services servers otherwise hidden by `hideservices`
`users/flood`	Exempt from message- and join-flood limits
`users/ignore-commonchans`	Message a `+c` user without sharing a common channel
`channels/override`	Join through `+k`/`+b`/`+i`/`+l`/`+z`/`+R`/`+J`, CBAN, and the channel cap
`channels/restricted-create`	Create a channel while `restrictchans` is on
`channels/ignore-nonicks`	Change nick while on a `+N` channel
`users/ignore-callerid`	Message a `+g` user without being on their ACCEPT list
`users/ignore-privdeaf`	Reach a `+D` (deaf) user with channel messages
`users/secret-whois`	WHOIS a `+W` user without notifying them
`users/ignore-restrictmsg`	Private-message anyone while `restrictmsg` is on
`servers/use-disabled-commands`	Use a command turned off by `disabled_commands`
`servers/ignore-securelist`	Bypass the `securelist` LIST hold
`servers/ignore-blockamsg`	Send multi-channel messages that `blockamsg` blocks

An untyped ("legacy") oper — an oper block with no type — holds every command and privilege.

3.4 KiB Raw Blame History