July 2013 - DALnet-services

RE: [DALnet-src] User hostmasking
by Andreas 20 Jul '13

20 Jul '13

I think this should be two different points to review here; - Hiding the real IP/hostnames of users like it's being done on LinkNet and other networks. This would be a good feature for DALnet and Bahamut. - Spoofing of hostnames for regular users, like done in hybrid and on EFNet/LinkNet. This is a bad idea for many of the reasons mentioned by oldcrow. This is already implemented for the trusted parts of users, namely IRC Operators with the regular oper host masking on connects. Perhaps this could be improved to start hiding your host when you oper up instead of when connecting. Regards, Andreas aka ph0x From: dalnet-src-bounces(a)lists.dal.net [mailto:dalnet-src-bounces@lists.dal.net] On Behalf Of oldcrow Sent: Friday, July 19, 2013 8:23 PM Cc: dalnet-src(a)dal.net; dalnet-services(a)dal.net Subject: Re: [DALnet-src] User hostmasking One concern that I would have is for the potential impersonation of representatives from businesses, like PayPal or (in the case of gaming) XBox Live or whatever. If someone could set their hostmask to CSR(a)paypal.com, or support(a)apple.com, it's not difficult to imagine that some users might be fooled into handing over sensitive account information. oldcrow On Fri, Jul 19, 2013 at 2:47 AM, Holbrook Bunting <holbrook(a)dal.net> wrote: (If any of you got this twice, apologies, sent it from the wrong address the first go) So, the idea of user hostmasking was brought up on the dalnet-src@ mailing list a few weeks ago and since we already have the ability in bahamut (via SVSHOST) to have services change a usershostname at anytime, I am thinking why not do this on a global scale? efnet (and others using the same ircd) have the ability to give specific users their own custom host,on a server level, like handing out I:lines. We already have infrastructure setup for management of things in different areas via services (nickname/channel ownership, akill, etc). On a small network I had running, I built into my services a way to allow users to set a "custom" hostname into NickServ done on the nick level, which worked a little like the /ns set url - command. To create a new host for nick xyz (whilst using that nick), I would use; /ns set host some.random.hostname. To turn off that option: /ns set host - To minimise potential abuse, a list of hostmasks would say no you can't set your hostname to havethe word "dalnet" or "staff" or "*.dal.net <http://dal.net/> " in it. If the user tried to set their host to be the same as another users host or ip, it would deny the request. Finally, once a hostname was set, services would not allow them to change the hostname for that nick again for 1 week (unless it was to turn it off). For any other potential abuse problems that someone might cause, there was a kill switch which a CSOp could use to disallow the user from setting a custom host (kinda like freeze), remove any existing host already set. This automated system looked beneficial in that any user could create their own unique hostname without having a bureaucratic system of having a specific team of opers having to grant or deny any request on a one-by-one basis. So, with my system, when does services issue the SVSHOST command (aside from when using /ns set host)? The answer is it would happen when they /identify to their nickname (or another nickname that they aren't currently using) with a separate NOHOST option at the end for if they don't want the host applied at that time. Does a system like this sound of interest to anyone? Does anyone think something like that would be too open for potential abuse? Does anyone have any differing views on how to best setup a user hostmasking system for the network? Thanks,Holbrook aka zort aka srd _______________________________________________ DALnet-src mailing list DALnet-src(a)lists.dal.net https://lists.dal.net/mailman/listinfo/dalnet-src

1 0

User hostmasking
by Holbrook Bunting 20 Jul '13

20 Jul '13

(If any of you got this twice, apologies, sent it from the wrong address the first go) So, the idea of user hostmasking was brought up on the dalnet-src@ mailing list a few weeks ago and since we already have the ability in bahamut (via SVSHOST) to have services change a users hostname at anytime, I am thinking why not do this on a global scale? efnet (and others using the same ircd) have the ability to give specific users their own custom host, on a server level, like handing out I:lines. We already have infrastructure setup for management of things in different areas via services (nickname/channel ownership, akill, etc). On a small network I had running, I built into my services a way to allow users to set a "custom" hostname into NickServ done on the nick level, which worked a little like the /ns set url - command. To create a new host for nick xyz (whilst using that nick), I would use; /ns set host some.random.hostname. To turn off that option: /ns set host - To minimise potential abuse, a list of hostmasks would say no you can't set your hostname to have the word "dalnet" or "staff" or "*.dal.net" in it. If the user tried to set their host to be the same as another users host or ip, it would deny the request. Finally, once a hostname was set, services would not allow them to change the hostname for that nick again for 1 week (unless it was to turn it off). For any other potential abuse problems that someone might cause, there was a kill switch which a CSOp could use to disallow the user from setting a custom host (kinda like freeze), remove any existing host already set. This automated system looked beneficial in that any user could create their own unique hostname without having a bureaucratic system of having a specific team of opers having to grant or deny any request on a one-by-one basis. So, with my system, when does services issue the SVSHOST command (aside from when using /ns set host)? The answer is it would happen when they /identify to their nickname (or another nickname that they aren't currently using) with a separate NOHOST option at the end for if they don't want the host applied at that time. Does a system like this sound of interest to anyone? Does anyone think something like that would be too open for potential abuse? Does anyone have any differing views on how to best setup a user hostmasking system for the network? Thanks, Holbrook aka zort aka srd

4 9

Re: [DALnet-src] User hostmasking
by Holbrook Bunting 19 Jul '13

19 Jul '13

On 19 July 2013 11:22, oldcrow <oldcrow(a)dal.net> wrote: > **One concern that I would have is for the potential impersonation of > representatives from businesses, like PayPal or (in the case of gaming) > XBox Live or whatever. If someone could set their hostmask to > CSR(a)paypal.com, or support(a)apple.com, it's not difficult to imagine that > some users might be fooled into handing over sensitive account information. > ** > Indeed. Under my system: A file contained a list of hostmasks (line by line) which users couldn't pick for a host, so: apple.com - would disallow apple.com but allow uses.apple.com *dal.net - Would deny anything ending in dal.net and so on. Perhaps make that list dynamic with a separate OperServ autokill like command to place temporary/perm bans of changing to certain hosts. The other issue I had considered was multiple people using the same hostname. Under mine, services would not allow them to use: - Someone elses exact hostname (real or with /ns set host) - ipv6 or ipv4 ip address - hostname matching something in the deny list holbrook / zort / srd

1 0

User hostmasking
by Holbrook Bunting 19 Jul '13

19 Jul '13

So, the idea of user hostmasking was brought up on the dalnet-src@ mailing list a few weeks ago and since we already have the ability in bahamut (via SVSHOST) to have services change a users hostname at anytime, I am thinking why not do this on a global scale? efnet (and others using the same ircd) have the ability to give specific users their own custom host, on a server level, like handing out I:lines. We already have infrastructure setup for management of things in different areas via services (nickname/channel ownership, akill, etc). On a small network I had running, I built into my services a way to allow users to set a "custom" hostname into NickServ done on the nick level, which worked a little like the /ns set url - command. To create a new host for nick xyz (whilst using that nick), I would use; /ns set host some.random.hostname. To turn off that option: /ns set host - To minimise potential abuse, a list of hostmasks would say no you can't set your hostname to have the word "dalnet" or "staff" or "*.dal.net" in it. If the user tried to set their host to be the same as another users host or ip, it would deny the request. Finally, once a hostname was set, services would not allow them to change the hostname for that nick again for 1 week (unless it was to turn it off). For any other potential abuse problems that someone might cause, there was a kill switch which a CSOp could use to disallow the user from setting a custom host (kinda like freeze), remove any existing host already set. This automated system looked beneficial in that any user could create their own unique hostname without having a bureaucratic system of having a specific team of opers having to grant or deny any request on a one-by-one basis. So, with my system, when does services issue the SVSHOST command (aside from when using /ns set host)? The answer is it would happen when they /identify to their nickname (or another nickname that they aren't currently using) with a separate NOHOST option at the end for if they don't want the host applied at that time. Does a system like this sound of interest to anyone? Does anyone think something like that would be too open for potential abuse? Does anyone have any differing views on how to best setup a user hostmasking system for the network? Thanks, Holbrook aka zort aka srd

1 0