IRC-Junkie.org - IRC News » IRCd

UnrealIRCd 3.2.9 – New stable version after 2 years

phrozen77 — Wed, 09 Nov 2011 19:46:45 +0000

UnrealIRCd, the IRCd that still dominates the usage statistics of all IRCds, has seen another stable release and is now at version 3.2.9.

After 2 release candidates and with 212 changes and bugfixes – almost the same amount as the last three stable releases combined – among which is a “substantial amount of new features” as Syzop writes in their announcement.

He thanks everyone that made this release possible but especially mentions binki who did a “considerable amount of work to make this release possible”.

And indeed, there is a large amount of changes – for example:

Extended Bans (new modes introduced, ban stacking behaviour)
Extended Invite Exceptions / Invex
New Channelmode +Z which works in conjunction with +z (SSL only) and is set once every joined user is on SSL which might not be the case during netsplits/-joins
Remote MOTD support
Remote includes caching so that an old version of a remote include is loaded in case the webserver containing the include is down
/rehash -global – rehashes all servers at once
STARTTLS – connect to a “regular” port SSL encrypted
IPv6 clones detection support, defaults to /64

A small excerpt of the bugs that have been fixed:

Low connection frequencies (connfreq) no longer pose a problem due to reworking the corresponding code
IPv6 related fixes
an obscure crash bug that only occured rarely on outgoing connects

Work on UnrealIRCd 3.3 already has begun and is, according to development plans, the replacement for the often retried and ultimately failed rewrite which was to be released as UnrealIRCd 4.

The release announcement can be found here and the full changelog for changes since UnrealIRCd 3.2.8.1 is here (you need to scroll all the way down).

UnrealIRCd 3.2.9 – New stable version after 2 years is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

Hybrid releases 7.3.0

Kottizen — Sun, 14 Aug 2011 10:05:18 +0000

Earlier this week, Jon Lusky released a new version of ircd-hybrid. The version number has now reached 7.3.0. Among the changes you find a new Bulgarian translation, a fixed IPv6 implementation and channel modes O and S for opers-only respective SSL/TLS-only clients. Server administrators now get to choose whether they want to use SSLv3 or TLSv1 to secure connections. All spy-notice modules that previously covered reports for usage of STATS, TRACE, MOTD and ADMIN have been replaced by server-sided notices. The old LazyLinks concept has now been removed, as it was half broken. The WATCH command known from UnrealIRCd and Bahamut has been added. In addition to that, a few minor cleanups and bugs leading to crashes have been fixed.

Hybrid is used together with Ratbox (which is a fork) and CSIRCd on both EFnet and IRCsource. It has been forked many times and it’s known for its stability and quality of code.

By looking at the SVN repository it seems like the developer team behind Hybrid is working towards a 8.0 release, featuring better services support while still keeping simplicity.

Hybrid releases 7.3.0 is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

Some UnrealIRCd 3.2.8.1 downloads trojaned [Update 3]

phrozen77 — Sat, 12 Jun 2010 10:24:23 +0000

Syzop of the UnrealIRCd project just posted an announcement on their mailinglist and forums that some versions of their IRCd have been compromised and had a backdoor added which went unnoticed for quite a while.

The first signs of the compromise have been traced back to November 2009 and Syzop writes that “Any Unreal3.2.8.1.tar.gz downloaded BEFORE November 10 2009 should be safe, but you should really double-check”.

Only the 3.2.8.1 source downloads (.tar.gz) are affected from this hack. Windows users, copies checked out from their CVS as well as users of older versions are safe and don’t need to check – everyone else should ensure they’re running a clean version of UnrealIRCd since the backdoor allows an attacker to issue and execute commands as the user the IRCd is running as, which essentially means your shell could easily compromised despite all other security measures.

Checking if your IRCd is one of those trojanized copies can easily be done either checking with md5sum or grep’ing the source for the backdoored code:

Run ‘md5sum Unreal3.2.8.1.tar.gz’ on it and compare the resulting sum to the checksums below:

Backdoored version (BAD) is: 752e46f2d873c1679fa99de3f52a274d
Official version (GOOD) is: 7b741e94e867c0a7370553fd01506c66

or use the command ‘grep DEBUG3_DOLOG_SYSTEM include/struct.h’ from your Unreal3.2 directory – if this outputs 2 lines you’re running the trojanized version and need to get yourself a fresh and clean copy of the IRCd and recompile it since the compromised section is in the IRCds core and “it is not possible to ‘clean’ UnrealIRCd without a restart or through a module”.

Syzop writes that they have take precautions so such a compromise can never happen again and if it does that it’ll be noticed more quickly. They’re also planning to reimplement PGP/GPG signing of the releases which “in practice (very) few people use” but “still [will] be useful for those people who do”.

Closing his announcement he writes that he’d like to “apologize about this security breach. We simply did not notice, but should have. We did not check the files on all mirrors regularly, but should have. We did not sign releases through PGP/GPG, but should have done so. Hope you’ll all continue to support UnrealIRCd”.

The full announcement can be read here and the advisory can be found here.

[Update]: Servers running the trojanized versions of UnrealIRCd should be updated as soon as possible since HD Moore, the creator of the Metasploit exploitation framework, already released a module for it – but even without that the security hole is really simple to exploit.

Also, here is a .sh script that might help you in the upgrade process – at least one user on the UnrealIRCd forums claimed it worked for him (although no kind of guarantee is given neither by the author nor by me).

[Update 2]: Syzop just posted a follow-up in which he writes that their releases are “from now on signed with GnuPG (PGP) again”.

[Update 3]: In an email to the UnrealIRCd mailinglist, Syzop elaborates on the GPG/PGP signing and says that there will be instructions on how to verify the key when you download the future releases. He also goes into some detail which precautions the team has taken that such an incident “will never ever happen again”. He rightfully criticizes certain news-outlets that claimed it was the fault of the Open Source model and even Linux (*cough*ZDNet*cough*) – some websites even confused the IRCd with EPIC softwares first-person shooter Unreal Tournament.

Some UnrealIRCd 3.2.8.1 downloads trojaned [Update 3] is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

ngIRCd 16 has been released

phrozen77 — Sun, 02 May 2010 22:59:58 +0000

Alexander Barton of the ngIRCd project just announced on their mailing-list the immediate availability of version 16 of their IRC daemon.

After 1 month of testing and 2 release candidates, the final release is available to download and use.

The most notable changes since ngIRCd version 15 according to the announcement are various fixes to the build system and code cleanups, a new numeric (RPL_STATSCONN 250) that displays a few enhanced connection statistics to clients on connect and adding the missing documentation for the “Password” variable.

ngIRCd has gained WEBIRC support that is used for various Webchat-clients such as Mibbit and the limit that previously restricted the number of possible IRCOps has been removed.

Channelmode +z has been introduced as well – with that mode set only clients that are connected over a SSL-encrypted connection can join that channel, clients that already are present on that channel are not checked and therefore are allowed to stay – the same goes for clients joining from a remote server that does not support CMODE +z.

The download for ngIRCd 16 can be found here and the changelog is available here.

ngIRCd 16 has been released is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

ratbox-services updated to v1.2.4

phrozen77 — Thu, 22 Apr 2010 20:29:51 +0000

ratbox-services, the services package for ircd-ratbox, have released version 1.2.4 in their stable tree.

ratbox services logo

Version 1.2.4 is mainly a bugfix release, one feature addition that this new version got is that you now can specify both the UID/GID and the path it chroots to on startup with a parameter.

Other than that, some inconsistencies with ChanServ enforcing topics have been rectified and it now “enforces topics whenever it is in the channel”. The handling of read-errors received from servers has been fixed as well as the configure-options of both MySQL and PostgreSQL which now take a path to a binary that will provide the compiler with information it needs to compile the respective support in.

The complete changelog for ratbox-services 1.2.4 can be found here and the download can be obtained from here.

ratbox-services updated to v1.2.4 is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.