Return to SSL.txt CVS log

Up to [local] / ircnowd / doc

Annotation of ircnowd/doc/SSL.txt, Revision 1.1.1.1

1.1       tomglok     1:
                      2:                      ngIRCd - Next Generation IRC Server
                      3:
                      4:                         (c)2001-2008 Alexander Barton,
                      5:                     alex@barton.de, http://www.barton.de/
                      6:
                      7:                ngIRCd is free software and published under the
                      8:                    terms of the GNU General Public License.
                      9:
                     10:                                  -- SSL.txt --
                     11:
                     12:
                     13: ngIRCd supports SSL/TLSv1 encrypted connections using the OpenSSL or GnuTLS
                     14: libraries. Both encrypted server-server links as well as client-server links
                     15: are supported.
                     16:
                     17: SSL is a compile-time option which is disabled by default. Use one of these
                     18: options of the ./configure script to enable it:
                     19:
                     20:   --with-openssl     enable SSL support using OpenSSL
                     21:   --with-gnutls      enable SSL support using GnuTLS
                     22:
                     23: You also need a key/certificate, see below for how to create a self-signed one.
                     24:
                     25: From a feature point of view, ngIRCds support for both libraries is
                     26: comparable. The only major difference (at this time) is that ngircd with gnutls
                     27: does not support password protected private keys.
                     28:
                     29: Configuration
                     30: ~~~~~~~~~~~~~
                     31:
                     32: To enable SSL connections a separate port must be configured: it is NOT
                     33: possible to handle unencrypted and encrypted connections on the same port!
                     34: This is a limitation of the IRC protocol ...
                     35:
                     36: You have to set (at least) the following configuration variables in the
                     37: [SSL] section of ngircd.conf(5): Ports, KeyFile, and CertFile.
                     38:
                     39: Now IRC clients are able to connect using SSL on the configured port(s).
                     40: (Using port 6697 for encrypted connections is common.)
                     41:
                     42: To enable encrypted server-server links, you have to additionally set
                     43: SSLConnect to "yes" in the corresponding [SERVER] section.
                     44:
                     45:
                     46: Creating a self-signed certificate
                     47: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                     48:
                     49: OpenSSL:
                     50:
                     51: Creating a self-signed certificate and key:
                     52:  $ openssl req -newkey rsa:2048 -x509 -keyout server-key.pem -out server-cert.pem -days 1461
                     53: Create DH parameters (optional):
                     54:  $ openssl dhparam -2 -out dhparams.pem 4096
                     55:
                     56: GnuTLS:
                     57:
                     58: Creating a self-signed certificate and key:
                     59:  $ certtool --generate-privkey --bits 2048 --outfile server-key.pem
                     60:  $ certtool --generate-self-signed --load-privkey server-key.pem --outfile server-cert.pem
                     61: Create DH parameters (optional):
                     62:  $ certtool  --generate-dh-params --bits 4096 --outfile dhparams.pem
                     63:
                     64:
                     65: Alternate approach using stunnel(1)
                     66: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                     67:
                     68: Alternatively (or if you are using ngIRCd compiled without support
                     69: for GnuTLS/OpenSSL), you can use external programs/tools like stunnel(1) to
                     70: get SSL encrypted connections:
                     71:
                     72:   <http://stunnel.mirt.net/>
                     73:   <http://www.stunnel.org/>
                     74:
                     75: Stefan Sperling (stefan at binarchy dot net) mailed the following text as a
                     76: short "how-to", thanks Stefan!
                     77:
                     78: === snip ===
                     79:     ! This guide applies to stunnel 4.x !
                     80:
                     81:     Put this in your stunnel.conf:
                     82:
                     83:         [ircs]
                     84:         accept = 6667
                     85:         connect = 6668
                     86:
                     87:     This makes stunnel listen for incoming connections
                     88:     on port 6667 and forward decrypted data to port 6668.
                     89:     We call the connection 'ircs'. Stunnel will use this
                     90:     name when logging connection attempts via syslog.
                     91:     You can also use the name in /etc/hosts.{allow,deny}
                     92:     if you run tcp-wrappers.
                     93:
                     94:     To make sure ngircd is listening on the port where
                     95:     the decrypted data arrives, set
                     96:
                     97:         Ports = 6668
                     98:
                     99:     in your ngircd.conf.
                    100:
                    101:     Start stunnel and restart ngircd.
                    102:
                    103:     That's it.
                    104:     Don't forget to activate ssl support in your irc client ;)
                    105:     The main drawback of this approach compared to using builtin ssl
                    106:     is that from ngIRCds point of view, all ssl-enabled client connections will
                    107:     originate from the host running stunnel.
                    108: === snip ===