Support SSL Connections to IRC Servers about hopm HOT 13 CLOSED

TLS support has just been incorporated via a204d74 by @Adam-. It currently depends on OpenSSL/LibreSSL and is for now considered experimental.

from hopm.

Just to note it here (I'm sure many have thought of this already), an interim solution is to use a SSH tunnel from your HOPM server to the IRCd server and connect via non-ssl localhost there. It at least keeps the remote connection secure. I'd also recommend looking into autossh to simplify the setup.

from hopm.

I'll reference my current setup as an example: autossh started (via a startup script for multiple things) by crontab at boot and a separate sshkey for this purpose.
autossh -M <port> -f -L 6667:<remote IP>:6667 -N user@host
Then connect HOPM to localhost:6667 and it will SSH tunnel to the remote server, then to the non-ssl IRCd port. P.S. You can specify a local bind IP before the local port if needed.

from hopm.

TLS support has been added to master.

from hopm.

👍

from hopm.

+1

from hopm.

+1

from hopm.

+1.

This is becoming a bit of an issue for me, personally as I maintain an instance for DarkMyst.

from hopm.

@genius3000 That's actually not a bad idea. I have mine just connecting locally atm to reduce the possibility of someone trying to sniff the data over the wire remotely, so that's partially mitigated.

But I'll be checking this particular setup out. Got any tips for getting hopm to connect via SSH tunnel?

from hopm.

Is there perhaps an update to be shared on this? We'd very much enjoy being able to have HOPM connect to an SSL port without any hacky workarounds.

from hopm.

unreal v4.2.0 release note:

Future versions (heads up):

We intend to change the default plaintext oper policy from warn to deny later this year.
This will deny /OPER when issued from a non-SSL connection.
For security, IRC Operators should really use SSL/TLS when connecting to an IRC server!

one more reason to implement (i know, the bot could connect via localhost, so it does count as secure, but still)

from hopm.

This is an old thread, but I'd like to mention one little thing.
The most used IRCd, like InspIRCd and UnrealIRCd do have native support for DNSBL. IMHO, I see no point of using HOPM with those.
For the rest of the IRCd, they should keep the pace and implement native support for this feature as it's really very useful/helpful.
But, that's my 2 cents 🤷‍♂️

Cheers

from hopm.

This is an old thread, but I'd like to mention one little thing.
The most used IRCd, like InspIRCd and UnrealIRCd do have native support for DNSBL. IMHO, I see no point of using HOPM with those.
For the rest of the IRCd, they should keep the pace and implement native support for this feature as it's really very useful/helpful.
But, that's my 2 cents 🤷‍♂️

Cheers

just one more thing: anope supports dnsbl as well. (most used services. :))
https://github.com/anope/anope/blob/8f7f4b1593c8fde6144cfd785d589d0c8ef325e8/data/modules.example.conf#L82-L179

from hopm.