Commit 1b6167a0 authored by TheOuterLinux's avatar TheOuterLinux

...

parent 647429f4
Automatically Identifying Using SSL + CertFP
This page describes how to use SSL with a certificate fingerprint to automatically identify your registered nickname with NickServ on connect. You must have an IRC client that supports SSL with a client certificate.
Creating a Self-signed Certificate
First you need generate a self-signed certificate. We will be using OpenSSL which should be available on most Linux and BSD distributions. There are ports for other platforms including Windows.
Generate the Key and Certificate
We need to generate our certificate and key. We’ll use the openssl command with the ‘req’ option.
% openssl req -nodes -newkey rsa:2048 -keyout nick.key -x509 -days 3650 -out nick.cer
Generating a 2048 bit RSA private key
writing new private key to 'nick.key'
-----
Country Name (2 letter code) [US]:YOURCOUNTRYCODE
State or Province Name (full name) [Texas]:YOURSTATE
Locality Name (eg, city) [San Antonio]:YOURCITY
Organization Name (eg, company) [Stealth3]:YOURTEXTHERE
Organizational Unit Name (eg, section) [ISP]:IRC
Common Name (eg, YOUR name) []:YOUR NAME
Email Address []:YOURMAIL@ADDRESS
The fields you are asked to fill out here do not matter for connecting to OFTC so fill them out however you wish. (You can use other key sizes if you want, but the hash algorithm needs to be SHA-1.) You now have two files, the key in nick.key and the certificate in nick.cer. Remember to protect your key using chmod.
% chmod 400 nick.key
If you are curious, you can have a closer look at your cert. We are mainly interested in the certificate fingerprint (CertFP). (This is not a required step, there are other ways to get the fingerprint.)
% openssl x509 -noout -fingerprint -text < nick.cer
We now combine certificate and key to a single file nick.pem (Remember to also protect this file because it now includes your private key!):
% cat nick.cer nick.key > nick.pem
% chmod 400 nick.pem
Connecting to OFTC with your Cert
Unlisted Clients
If you are using a client that is not listed here feel free to submit a step-by-step howto about it, and we will include it. Either grab a staff member from #oftc or send a mail to our support address support@oftc.net with the information needed. Thank you.
irssi
Move the certificates you created some where safe, for example ~/.irssi/certs.
% mkdir ~/.irssi/certs
% mv nick.{key,cer,pem} ~/.irssi/certs
Now remove the current server and re-add it with the SSL flag, using your newly generated certificate. Note that we use the SSL port 6697 to connect.
/server remove irc.oftc.net
/network add OFTC
/server add -auto -ssl -ssl_cert ~/.irssi/certs/nick.pem -ssl_verify -network OFTC irc.oftc.net 6697
Next we need to disconnect and connect back to the server. (A /reconnect does not read the new settings we added.)
/disconnect OFTC
/connect OFTC
Add your Certificate Fingerprint to your Nick in NickServ
If you did everything right you are now using SSL to connect and should see lines similar to the following in your server window. This will most likely be above the motd so you may have to scroll up a bit to see it.
11:09 !larich.oftc.net *** Connected securely via TLSv1 AES256-SHA-256
11:09 !larich.oftc.net *** Your client certificate fingerprint is: C77106576ABF7F9F90CCA0F63874A60F2E40A64B
This tells us that we are now connected via SSL and that our certificate is working.
To allow NickServ to identify you based on this certificate you need to associate the certificate fingerprint with your nick. To do this issue the command cert add to Nickserv (try /msg nickserv help cert). Please note you must be identified for this command to work (/msg nickserv identify).
/msg nickserv cert add
11:14 -NickServ(services@services.oftc.net)- CERT list entry C77106576ABF7F9F90CCA0F63874A60F2E40A64B added.
Nickserv will message back saying that the CertFP was added. Now the only thing left to do is reconnect to the server to test it out.
/reconnect
11:15 -!- Irssi: Disconnecting from server irc.oftc.net: [Reconnecting]
11:15 -!- Irssi: Connecting to irc.oftc.net [IP ADDRESS] port 6697
11:15 !larich.oftc.net *** Connected securely via TLSv1 AES256-SHA-256
11:15 !larich.oftc.net *** Your client certificate fingerprint is: C77106576ABF7F9F90CCA0F63874A60F2E40A64B
...
11:15 -NickServ(services@services.oftc.net)- You are connected using SSL and have provided a matching client certificate
11:15 -NickServ(services@services.oftc.net)- for nickname jmoocows. You have been automatically identified.
11:15 -!- Mode change [+R] for user jmoocows
Congratulations! You now have automatic identification via SSL and certificate fingerprints!
Benefits
You may ask yourself what this gets you now. Well, the answer is simple - you can drop any nickserv identify script you have run in the past. As you are identified with your certificate fingerprint you don’t need them anymore. And by using SSL, your connection to the irc server is now encrypted.
The servers also use encryption for the server<->server traffic, so if you and those you chat with both use ssl encrypted connections - then the whole traffic between you and them is encrypted.
Questions
Ask on #oftc or mail support@oftc.net .
irssi does not join some channels on connect
If you find that irssi does not auto-join channels on connect which want you to be identified before you are joining, add -autosendcmd “wait -oftc 2000” to your irssi network settings. This makes irssi wait 2 seconds before any further action, giving services time to identify you.
% /network add -autosendcmd "wait -oftc 2000" OFTC
(In case you are wondering “/network add” is irssi’s way of modifying existing networks. /network was called /ircnet in older irssi versions.)
Expired SSL certificates
Client certificates need to be valid. This ensures that user certificates remain reasonably cryptographically strong. If you encounter problems connecting with SSL, ensure that your system’s real-time clock is set properly, that your certificate issue date is in the past and that your certificate has not expired.
Last time I tried ssl connection to an IRC network I experienced a huge lag, is that still to be expected?
No. In the early days of supporting ssl connections there were a few problems, as always when you implement new features. Nowadays, ssl support is very stable and reliable. You wont see any difference to a connection without ssl (except having an encrypted connection, of course). All the network operators and lots of other people are using SSL connections to OFTC as their only way to access the network.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment