No description
| .gitattributes | ||
| ChangeLog | ||
| configure | ||
| configure.in | ||
| exempts.c | ||
| FloodCheck.c | ||
| Helpers.c | ||
| html.css | ||
| install-sh | ||
| LICENSE | ||
| Makefile.in | ||
| modconfig.h.in | ||
| OnJoinBot.c | ||
| README.SecureServ | ||
| README.SecureServ.html | ||
| RelNotes.txt | ||
| scan.c | ||
| SecureServ.c | ||
| SecureServ.h | ||
| SecureServ.settings | ||
| SecureServ.xml | ||
| SecureServ_help.c | ||
| update.c | ||
| viri.dat | ||
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>SecureServ Manual</title><link rel="stylesheet" href="html.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="d0e1"></a>SecureServ Manual</h2></div></div><div></div><hr></div><div class="toc"><dl><dt>1. <a href="#d0e47">Prerequisites and Installation.</a></dt><dd><dl><dt>1.1. <a href="#d0e90">Compiling and Installation</a></dt></dl></dd><dt>2. <a href="#d0e137">Basic Configuration</a></dt><dd><dl><dt>2.1. <a href="#d0e154">Exclusion Lists</a></dt><dt>2.2. <a href="#d0e207">Helper Lists</a></dt><dt>2.3. <a href="#d0e260">Username and Password for Dat File Updates</a></dt><dt>2.4. <a href="#d0e283">System Messages</a></dt></dl></dd><dt>3. <a href="#d0e315">Detailed Configuration</a></dt><dd><dl><dt>3.1. <a href="#d0e411">SPLITTIME Setting</a></dt><dt>3.2. <a href="#d0e425">VERSION Setting</a></dt><dt>3.3. <a href="#d0e436">CHECKFIZZER Setting</a></dt><dt>3.4. <a href="#d0e445">DOONJOIN Setting</a></dt><dt>3.5. <a href="#d0e454">DOPRIVCHAN Setting</a></dt><dt>3.6. <a href="#d0e463">FLOODPROT</a></dt><dt>3.7. <a href="#d0e472">CHANKEY</a></dt><dt>3.8. <a href="#d0e481">CHANLOCKTIME</a></dt><dt>3.9. <a href="#d0e490">MULTICHECK Setting</a></dt><dt>3.10. <a href="#d0e502">MONBOT Setting</a></dt><dt>3.11. <a href="#d0e511">MONCHANCYCLE Setting</a></dt><dt>3.12. <a href="#d0e520">MONCHANCYCLETIME Setting</a></dt><dt>3.13. <a href="#d0e529">REPORT Setting</a></dt><dt>3.14. <a href="#d0e538">AUTOSIGNOUT Setting</a></dt><dt>3.15. <a href="#d0e547">JOINHELPCHAN Setting</a></dt><dt>3.16. <a href="#d0e556">AKILL Setting</a></dt><dt>3.17. <a href="#d0e565">AKILLTIME Setting</a></dt><dt>3.18. <a href="#d0e574">DOJOIN Setting</a></dt><dt>3.19. <a href="#d0e583">NFCOUNT Setting</a></dt><dt>3.20. <a href="#d0e592">VERBOSE Setting</a></dt><dt>3.21. <a href="#d0e604">CYCLETIME Setting</a></dt><dt>3.22. <a href="#d0e613">AUTOUPDATE Setting</a></dt><dt>3.23. <a href="#d0e622">SAMPLETIME Setting</a></dt><dt>3.24. <a href="#d0e633">HELPCHAN Setting</a></dt><dt>3.25. <a href="#d0e642">BOTECHO Setting</a></dt><dt>3.26. <a href="#d0e651">TREATCHANMSGASPM</a></dt></dl></dd><dt>4. <a href="#d0e663">Operational Commands</a></dt><dd><dl><dt>4.1. <a href="#d0e706">list Command</a></dt><dt>4.2. <a href="#d0e723">CheckChan Command</a></dt><dt>4.3. <a href="#d0e732">cycle Command</a></dt><dt>4.4. <a href="#d0e743">status Command</a></dt><dt>4.5. <a href="#d0e752">update Command</a></dt><dt>4.6. <a href="#d0e767">login Command</a></dt><dt>4.7. <a href="#d0e776">logout Command</a></dt><dt>4.8. <a href="#d0e785">bots Command</a></dt><dt>4.9. <a href="#d0e802">monchan Command</a></dt><dt>4.10. <a href="#d0e819">assist Command</a></dt><dt>4.11. <a href="#d0e832">reload Command</a></dt></dl></dd><dt>5. <a href="#d0e841">Custom Definitions</a></dt><dd><dl><dt>5.1. <a href="#d0e848">Custom Definitions file</a></dt><dd><dl><dt>5.1.1. <a href="#d0e853">Create customviri.dat file</a></dt><dt>5.1.2. <a href="#d0e858">add entries to customviri.dat</a></dt><dt>5.1.3. <a href="#d0e980">Reload the definitions</a></dt></dl></dd></dl></dd><dt>6. <a href="#d0e985">Final Words</a></dt><dd><dl><dt>6.1. <a href="#d0e990">Dealing with Un-detected Attacks/Trojans/Virus etc</a></dt></dl></dd></dl></div><p>Welcome to the SecureServ Manual. This document will aid you in setting up and running SercureServ on your IRC network.</p><p>SecureServ is a advanced IRC Trojan detector, much like a Virus Scanner, but aimed for IRC networks. Using Several different methods, including, but not limited to Version checks, Behavior analysis, and general pattern matching, it aims to detect Trojans and Virus's as well as FloodBots that connect to your IRC network.</p><p>SecureServ's "brains" are based on a "Definition file" or Dat file, that contain information on how to detect the trojans. This means to update SecureServ's detection for new Trojans/Bots only requires that you download a new dat file (which can be automated). There are some pre-conditions to obtaining new Dat files, and these can be found in the Installation chapter.</p><p>Additionally, with 1.0 version of SecureServ, we now support a "customised" dat file that administrators can add their own signatures to to help detect new, or unsupported clients/trojans. (eg, Bottlers). This requires some programing knowledge, and more information about the customviri.dat file can be found in the "Custom Definitions" chapter.</p><p>SecureServ can detect Trojan/Virus's or "Security Risks" to your Network a number of ways, including:</p><div class="itemizedlist"><ul type="disc"><li><p>CTCP Version Checks</p></li><li><p>NickName Patterns</p></li><li><p>UserName (Ident) Patterns</p></li><li><p>RealName Patterns</p></li><li><p>Channel MemberShip Patterns</p></li><li><p>Private/Notice Messages</p></li><li><p>Channel Utilization</p></li><li><p>Logic Checks</p></li></ul></div><p>While we can detect a vast majority of Trojans, and its easy to extend SecureServ to detect new ones without Recompiling/upgrading, its not a fullproof solution. Additionally, Virus/Trojan/Bot authors are getting more and more sophisticated these days, and will always find ways to avoid detection. SecureServ aims to reduce the load on a Network Administration staff in dealing with these Trojans.</p><p>SecureServ is written and maintained by Justin Hammond. It requires the NeoStats software. More information about SecureServ, or NeoStats, can be found at <a href="#">http://www.neostats.net/</a></p><p>SecureServ is Copyright, 2004 by Justin Hammond.</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="d0e47"></a>1. Prerequisites and Installation.</h2></div></div><div></div></div><p>SecureServ is designed to run on Top of NeoStats. The Following requirements at the time of writing are required for NeoStats:</p><div class="itemizedlist"><ul type="disc"><li><p>A Linux or BSD based Server or Shell.</p></li><li><p>A supported IRCd. Currently, Hybrid7, Unreal, Ultimate2.x or Ultimate3.x or NeoIRCd</p></li><li><p>Some basic Unix administration Skill</p></li><li><p>Of Course, a IRC network to connect it all together.</p></li></ul></div><p>Please refer to the NeoStats website for more information on the requirements</p><p>SecureServ itself requires the following:</p><div class="itemizedlist"><ul type="disc"><li><p>NeoStats 2.5.9 or Higher correctly installed and Running</p></li><li><p>A account on <a href="#">http://secure.irc-chat.net</a> is required if you wish to take advantage of updated definition files</p></li><li><p>The time to read this entire document. </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>SecureServ has the potential to Akill/Gline your entire network. Its strongly suggested that you read this entire document before even attempting to compile SecureServ, as I'm just going to laugh, if you didn't read, and it AKILL's your entire network.</p></div></li></ul></div><p>The requirement to have a valid account on <a href="#">http://secure.irc-chat.net</a> is due to the fact that I want to have some control over who receives the definition files. If these Definition files fall into the hands of the TrojanWritters or Virus Writers, its possible they might be able to re-write their bots to avoid detection. Please see the website for more information.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e90"></a>1.1. Compiling and Installation</h3></div></div><div></div></div><p>As long as you have successfully setup NeoStats, and installed it correctly, Compiling SecureServ is very simple and straight forward. First you must extract the files from the download package. This is as simple as:</p><pre class="screen">bash$<b class="command"> tar -xzf SecureServ-<ver>.tar.gz</b></pre><p>This should then create a directory called SecureServ-<version> where <version> is the Version of SecureServ. Then Proceed to Change into the SecureServ directory, and run Configure as follows:</p><pre class="screen">bash$<b class="command">./configure [--enable-debug | --with-neostats=<dir>]</b></pre><p>--enable-debug is only useful for diagnostics purposes when used in conjunction with debugging tools. There should be no need to use this option on a day to day basis</p><p>--with-neostats=<dir> should be used if your neostats directory is not in a standard location (~/NeoStats/). Replace <dir> with the full path to your NeoStats installation directory (NOT SOURCE DIRECTORY)</p><p>Configuring SecureServ will look something like the following screen:</p><pre class="screen">[Fish@fish-dt]$ ./configure
checking for gcc... gcc
checking for C compiler default output... a.out
checking whether the C compiler works... yes
checking whether we are cross compiling... no
checking for suffix of executables...
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ANSI C... none needed
checking for a BSD-compatible install... /usr/bin/install -c
checking for pcre_compile in -lpcre... yes
checking Location of NeoStats...... /home/fish/NeoStats/
checking for /home/fish/NeoStats//include/dl.h... yes
checking Version of NeoStats...... Compatible Version
checking Whether to Enable Debuging...... no
configure: creating ./config.status
config.status: creating Makefile
(*----------------------------------------------------------*)
(| To compile your module, please type 'make' |)
(| If make completes without errors, then you |)
(| Must 'make install', but please be sure that NeoStats |)
(| Is not currently running with a module of the same name |)
(| Running, otherwise Make install will not work |)
(| !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! |)
(| If you are running a BSD, make install may produce a |)
(| Error, if that is the case, then please manually copy |)
(| opsb.so to the NeoStats/dl directory |)
(| !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! |)
(*----------------------------------------------------------*)
(| For Support please visit: |)
(| IRC: /server irc.irc-chat.org |)
(| #neostats channel |)
(| WWW: http://www.neostats.net/boards/ |)
(*----------------------------------------------------------*)
(|This Module was written by: |)
(| fish (fish@dynam.ac) |)
(*----------------------------------------------------------*)
</pre><p>If the configuration did not produce a error, you may then move onto Compiling SecureServ. Compiling is simply just issuing the "make" command (or "gmake" if you are running BSD):</p><pre class="screen">[Fish@fish-dt]$ make
gcc -c -O2 -Wall -I/usr/include/pcre -I/home/fish/NeoStats//include/ -I. SecureServ.c
gcc -c -O2 -Wall -I/usr/include/pcre -I/home/fish/NeoStats//include/ -I. SecureServ_help.c
gcc -c -O2 -Wall -I/usr/include/pcre -I/home/fish/NeoStats//include/ -I. http.c
gcc -c -O2 -Wall -I/usr/include/pcre -I/home/fish/NeoStats//include/ -I. OnJoinBot.c
gcc -c -O2 -Wall -I/usr/include/pcre -I/home/fish/NeoStats//include/ -I. FloodCheck.c
ld -shared -o SecureServ.so SecureServ.o SecureServ_help.o http.o OnJoinBot.o FloodCheck.o -L/usr/lib -lpcre
</pre><p>Again, check for Error messages. As long as there are not error messages, "make install" will install SecureServ, this README file, and any auxiliary files needed into your NeoStats directory:</p><pre class="screen">[Fish@fish-dt]$ make install
/usr/bin/install -c -m 644 SecureServ.so /home/fish/NeoStats//dl/
/usr/bin/install -c -m 644 README.SecureServ SecureServ.settings /home/fish/NeoStats//dl/../doc/
/usr/bin/install -c -m 644 viri.dat /home/fish/NeoStats//dl/../data/
</pre><p>If you receive *ANY* errors at all during the this process, please post them on our Support boards, at http//www.neostats.net/boards/</p><p>Once Installation is complete, you can either configure NeoStats to load SecureServ when it starts, or load SecureServ via IRC.</p><p>To Configure NeoStats to automatically load SecureServ when it boots, add the following line to your "neostats.cfg" file in the NeoStats directory:</p><p><b class="command">LOAD_MODULE SecureServ</b></p><p>To load SecureServ via IRC, you must make sure you have the appropriate permissions and issue the following command:</p><p><b class="command">/msg neostats load SecureServ</b></p><p>Thats it. SecureServ is now loaded and ready for use (in fact, it will already be running now, but read on for further information.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="d0e137"></a>2. Basic Configuration</h2></div></div><div></div></div><p>SecureServ is completely configured online via IRC. When you first start up SecureServ, it attempts some "Sane" defaults for you get started with, but you should always review these settings as soon as you install. There are a few important settings you may want to review right away. They are:</p><div class="itemizedlist"><ul type="disc"><li><p>Exclusion Lists - You should setup a Exclude list for your IRC Services server (NickServ etc)</p></li><li><p>Username and Password for Dat File Updates</p></li><li><p>System Messages sent to users</p></li></ul></div><p>These are outlined below:</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e154"></a>2.1. Exclusion Lists</h3></div></div><div></div></div><p>Exclusion lists allow you to specify certain Hostmasks, Servers, or Channels that should be excluded from monitoring by SecureServ. This exclusion list would allow a administrator to say, allow users on that are matched against Trojans, when the administrator has verified that the Trojan does not in fact exist on the users host. Additionally,</p><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>Exclusions should be setup for your Services Server, so that SecureServ does not try to scan ChanServ, or NickServ, or any of the bots relating to Nickname protection.</p></div><p><span class="bold"><b>Adding a Entry</b></span></p><p>To add a entry to the Exclusion list, use the following format:</p><pre class="screen">/msg SecureServ exclude add <host/Server/Channel> <type> <reason></pre><p>Where:</p><p><host> = The HostName/Server or Channel name. WildCards ? and * are permitted.</p><p><type> = The type of exclusion. 0 is for HostNames, 1 is for Servers, and 2 is for channels.</p><p><reason> = a short description of the exclusion, for operator reference only.</p><p>The output is as follows:</p><pre class="screen">>secureserv< exclude add #chan 2 Blah is my reason
-SecureServ- Added #chan (Channel) exception to list</pre><p><span class="bold"><b>Listing an Entry</b></span></p><p>To list the Exclusions simple type:</p><pre class="screen">/msg SecureServ exclude list</pre><p>And all the current exclusions are listed. Additionally, a Position number is provided for use with the delete command. The output is as follows:</p><pre class="screen">>secureserv< exclude list
-SecureServ- Exception List:
-SecureServ- 1) *.blah.com (Server) Added by Fish for Blah is my reason
-SecureServ- 2) is.blah.com (HostName) Added by Fish for can by high
-SecureServ- 3) #chan (Channel) Added by Fish for Blah is my reason
-SecureServ- End of List.</pre><p><span class="bold"><b>Deleting an Entry</b></span></p><p>To delete a entry, you should first lookup the Position of the entry that you wish to delete. The format of the command is as follows:</p><pre class="screen">/msg SecureServ exclude del <num></pre><p>Where:</p><p><num> is the position of the entry you wish to delete in the list</p><p>The output of the command is as follows:</p><pre class="screen">>secureserv< exclude del 1
-SecureServ- Deleted #chan Channel out of exception list</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e207"></a>2.2. Helper Lists</h3></div></div><div></div></div><p>Helper lists let you grant non-privileged users the ability to maintain your Virus help channel and help users that are infected with virus's that could be removed with simple instructions (such as Spam Virus's that infect Mirc). These users are granted the ability to "release" a infected user from SecureServ or kill un-cooperative, or unresponsive users that SecureServ has identified as being infected. Users that have been joined to the help channel are "held" by SecureServ and are usually prevented from joining other channels (if your IRCd supports this option). This can be helpful so you can clean up users that are infected with simple script based virus's and you require their attention to help you clean their computer. More information about the commands available to use on infected users is available via the assist command detailed below.</p><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>Although SecureServ limits who a "Helper" may kill (only infected users joined to the Help Channel) you should only give out login accounts to trusted users.</p></div><p><span class="bold"><b>Adding a Entry</b></span></p><p>To add a entry to the Helper list, use the following format:</p><pre class="screen">/msg SecureServ helpers add <login> <pass> </pre><p>Where:</p><p><login> = The login name to use to gain access. Does not have to be a nickname.</p><p><pass> = The password to use to login</p><p>The output is as follows:</p><pre class="screen">>secureserv< helpers add myhelper mypass
-SecureServ- Successfully added Helper myhelper with Password mypass to Helpers List
</pre><p><span class="bold"><b>Listing an Entry</b></span></p><p>To list the helpers simple type:</p><pre class="screen">/msg SecureServ helpers list</pre><p>And all the helpers are listed. Additionally, if a nickname is provided after the login name, it means that this nick is logged into this particular helper account.</p><p>The output is as follows:</p><pre class="screen">>secureserv< helpers list
-SecureServ- Helpers List (2):
-SecureServ- fish (Fish)
-SecureServ- myhelper (Not Logged In)
-SecureServ- End of List.
</pre><p><span class="bold"><b>Deleting an Entry</b></span></p><p>To delete a entry, you must provide the login name you wish to delete. The format of the command is as follows:</p><pre class="screen">/msg SecureServ helpers del <login></pre><p>Where:</p><p><login> is the login account you wish to delete.</p><p>The output of the command is as follows:</p><pre class="screen">>secureserv< helpers del myhelper
-SecureServ- Deleted myhelper from Helpers List
</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e260"></a>2.3. Username and Password for Dat File Updates</h3></div></div><div></div></div><p>In order to update SecureServ's Detection, you need to register for a account at http://secure.irc-chat.net/ Once you have received your username and password via email, you can proceed to configure SecureServ to update Dat files automatically for you. SecureServ can be configured to check for updates on a Daily Basis. You can, disable this automatic update if you wish, but this is covered in the "Settings" Section.</p><p>Once you have received your username and password, Issue the following command to SecureServ:</p><pre class="screen">/msg SecureServ set updateinfo <username> <password></pre><p>The output should be as follows:</p><pre class="screen">>SecureServ< set updateinfo myusername myl33tpassword
-SecureServ- Update Username and Password has been updated to myusername and myl33tpassword</pre><p>You can then issue the following command to check that the username and password are correct and also, update your dat file to the latest version automatically:</p><pre class="screen">/msg secureserv update</pre><p>If all goes well, SecureServ should respond with:</p><pre class="screen">>SecureServ< update
-SecureServ- Requesting New Dat File. Please Monitor the Services Channel for Success/Failure
<SecureServ>/#services Fish requested a update to the Dat file
<SecureServ>/#ervices DatFile Version 32 has been downloaded and installed</pre><p>If the update failed for any reason, you will either not receive any message about DatFile being downloaded and installed, or will receive a message detailing the problem.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e283"></a>2.4. System Messages</h3></div></div><div></div></div><p>SecureServ sends different messages to users depending on whats happening. Examples of the messages its send is a "Warning message" to users that they are about to be checked for Virus's, and also messages when they AKILL or warn a user about a possible "Trojan/Infection" etc. These messages can be customized to suit your network, or language of choice easily. The different messages that you can set are:</p><div class="itemizedlist"><ul type="disc"><li><p>"Greeting" messages</p><p>Greeting Messages are sent to uses when they sign on your Network. They are just to inform the user that a CTCP VERSION check is being conducted.</p></li><li><p>"AKILL" messages</p><p>AKILL messages are sent to users when they are about to be akilled from your network due to a positive "infection". You could provide email addresses, contact information, should the user wish to contact you. In addition to the AKILL message, the user is also given a URL they can view with details about their "infection" and how to fix it.</p></li><li><p>"No Help Available" messages</p><p>As SecureServ can also detect Virus's, some network may have channels devoted to helping users remove virus's from their IRC clients. SecureServ has a "Helper" login function that allows you to setup "non-oper" or "oper" users to be helpers. If no one is logged into SecureServ and a virus infected user is detected, instead of attempting to automatically join him to the "Help" channel, he is akilled from the network. This message is sent to the user to let them know that they have a virus, and should seek help.</p></li></ul></div><p>Setting these three types of messages is simple. Just issue the following commands:</p><pre class="screen">/msg SecureServ set signonmsg <message></pre><pre class="screen">/msg SecureServ set akillmesg <message></pre><pre class="screen">/msg SecureServ set nohelpmsg <message></pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>If you don't customize any of these messages, a Default system message is used automatically.</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="d0e315"></a>3. Detailed Configuration</h2></div></div><div></div></div><p>SecureServ attempts to be as configurable as possible in order to cater for each individual networks requirements. This in turn though makes the configuration very complex. There are many many settings with SecureServ that affect how it operates, how it responds and even, how affects the performance of NeoStats Overall. Out of the box, SecureServ provides sensible defaults for these settings, but you may wish to read this section for details on exactly what each option does, and its affect on how SecureServ operates.</p><p>The following list summaries the available Options you can set in SecureServ</p><div class="itemizedlist"><ul type="disc"><li><p>SPLITTIME</p></li><li><p>VERSION</p></li><li><p>CHECKFIZZER</p></li><li><p>DOONJOIN</p></li><li><p>DOPRIVCHAN</p></li><li><p>FLOODPROT</p></li><li><p>CHANKEY</p></li><li><p>CHANLOCKTIME</p></li><li><p>MULTICHECK</p></li><li><p>MONBOT</p></li><li><p>MONCHANCYCLE</p></li><li><p>MONCHANCYCLETIME</p></li><li><p>REPORT</p></li><li><p>AUTOSIGNOUT</p></li><li><p>JOINHELPCHAN</p></li><li><p>AKILL</p></li><li><p>AKILLTIME</p></li><li><p>DOJOIN</p></li><li><p>NFCOUNT</p></li><li><p>VERBOSE</p></li><li><p>CYCLETIME</p></li><li><p>AUTOUPDATE</p></li><li><p>SAMPLETIME</p></li><li><p>HELPCHAN</p></li><li><p>BOTECHO</p></li><li><p>TREATCHANMSGASPM</p></li></ul></div><p>To change any of these settings, you use the Set Interface in SecureServ. Eg:</p><pre class="screen">/msg SecureServ set <option> <params></pre><p>To view the current settings, issue the following command:</p><pre class="screen">/msg SecureServ set list</pre><p>The following Sections describes the different options, their params, and the effect on SecureServ in detail.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e411"></a>3.1. SPLITTIME Setting</h3></div></div><div></div></div><p>SecureServ Monitors the number of joins on a Channel in order to determine if the channel is been attacked by FloodBots. In Order for SecureServ to help Determine what is a FloodBot attack, and what might be a simple Net-Join, it examines the time the user signed on IRC. This value determines how long a user must be on IRC before its determined that their channel join is not part of a "FloodBot" attack.</p><p>The default setting for this option is 300 Seconds (5 Minutes, which, in most cases, is ideal for most networks. You should not need to change this value.</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>If you set this value to high, then during a netjoin (when 2 split servers rejoin) SecureServ may determine that the users coming back from the Split are FloodBots and Close down Channels. Be careful with modifying this value.</p></div><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set SPLITTIME <seconds> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e425"></a>3.2. VERSION Setting</h3></div></div><div></div></div><p>When users sign onto your IRC network, SecureServ issues a "CTCP VERSION" command to the clients, as many Trojans/WarScripts/Virus's have unique replies to CTCP Version requests.</p><p>When SecureServ receives the reply, it compares it to the Definitions, and if there is a Match, will take action based on the Definition File (Either AKILL the user, Join them to a AV help channel, Warn the Operators, or just issue a warning message to the users)</p><p>If you wish to turn off the CTCP VERSION checks, issue the following command</p><pre class="screen">/msg SecureServ set VERSION <ON/OFF></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e436"></a>3.3. CHECKFIZZER Setting</h3></div></div><div></div></div><p>SecureServ can Detect the Fizzer Worm on your IRC network. If you are not affected by Fizzer, its advisable to turn this option off, as it affects performance.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set CHECKFIZZER <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e445"></a>3.4. DOONJOIN Setting</h3></div></div><div></div></div><p>This setting decides if SecureServ should perform OnJoin Virus Checking. When enabled, every CYCLETIME Seconds, SecureServ will create a psydo user and join a random channel. When this setting is off, SecureServ will not check random channels for OnJoin Virus's.</p><p>To Change this Setting, issue the following Command:</p><pre class="screen">/msg SecureServ set DOONJOIN <ON/OFF></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e454"></a>3.5. DOPRIVCHAN Setting</h3></div></div><div></div></div><p>This setting controls if SecureServ's will check Private Channels. Private Channels are defined by the Channel Modes +I, +k +s +p or +O. Enabling this option forces SecureServ to check these channels. Disabling this feature means SecureServ will never check these channels unless forced via a /msg SecureServ check <chan></p><p>To Change this Setting, issue the following Command:</p><pre class="screen">/msg SecureServ set DOPRIVCHAN <ON/OFF></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e463"></a>3.6. FLOODPROT</h3></div></div><div></div></div><p>This setting enables SecureServ to monitor the Channels for possible FloodBot attacks, and to temporarily set the channel +ik when a attack occurs. This option uses the settings from CHANLOCKTIME, SAMPLETIME, and CHANKEY to be configured to work correctly as well.</p><p>To Change this setting, issue the following command:</p><pre class="screen">/msg SecureServ set FLOODPROT <ON/OFF></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e472"></a>3.7. CHANKEY</h3></div></div><div></div></div><p>This setting controls what key will be used when SecureServ "Locks" a channel during a attack. (+k key). You should try to change this key regularly so that attackers can not re-program their floodbots to gain access to your channels with a well known key. If you don't set this option, SecureServ uses a default Key. The length of this key is restricted, and if you try to set a key that is too long, you will receive a error message.</p><p>To Change this setting, issue the following command:</p><pre class="screen">/msg SecureServ set CHANKEY <newkey)</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e481"></a>3.8. CHANLOCKTIME</h3></div></div><div></div></div><p>This setting controls how long SecureServ will "Lock" a channel after detecting a attack. During this time, Channel Administrotors/Operators may remove the mode set, and SecureServ will not mind. If after this time period (+/- 10 seconds) the channel will have the modes that SecureServ set automatically removed, so the channel can return to normal operation.</p><p>To Change this setting, issue the following command:</p><pre class="screen">/msg SecureServ set CHANLOCKTIME <seconds></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e490"></a>3.9. MULTICHECK Setting</h3></div></div><div></div></div><p>By Default, when SecureServ identifies a Positive Match for a Trojan/VIrus etc, it takes action straight away, and discontinues checking for any other matches. This option tells SecureServ, that even if it does find a Match, to continue checking, so that the user is warned of all matches, and not just the first one found.</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Enabling MULTICHECK on a large network is not advised due to performance reasons.</p></div><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set MULTICHECK <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e502"></a>3.10. MONBOT Setting</h3></div></div><div></div></div><p>SecureServ has the option to assign one of the random bots to stay in a channel all the time, instead of cycling like the ONJOIN bots do. This option sets which bot will be used to monitor the channels specified in the MONCHAN command. A listing of available bots is obtained via the Bots Command. .</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set MONBOT <bot> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e511"></a>3.11. MONCHANCYCLE Setting</h3></div></div><div></div></div><p>This setting specifies if SecureServ should cycle the MONCHAN's periodically (by default, it cycles one channel interval specified by the MONCHANCYCLETIME setting). This can help detect OnJoin virus's in the channels you specify a monitor bot should be placed.</p><p>To Change this setting, issue the following Command:</p><pre class="screen">/msg SecureServ set MONCHANCYCLE <ON/OFF></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e520"></a>3.12. MONCHANCYCLETIME Setting</h3></div></div><div></div></div><p>This setting specified the interval that SecureServ will cycle one of the monchans. By Default, if MONCHANCYCLE is enabled, every 30 minutes, one of the MONCHAN's be selected and the monbot will cycle the channel looking for ONJOIN virus's. For example, if you are monitoring 4 channels, each channel will only be cycled every 2 hours (30 minutes x 4 channels) so you should adjust this value accordingly. </p><p>To Change this setting, issue the following Command:</p><pre class="screen">/msg SecureServ set MONCHANCYCLETIME <seconds></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e529"></a>3.13. REPORT Setting</h3></div></div><div></div></div><p>SecureServ has the option to report positive infections to secure.irc-chat.net site for both statistically and in future a blacklist type setup. Enabling this option means that statistics about infections can be reported to you on the secure.irc-chat.net site as well as providing Summarized data to the public (No Private information, such as infected hostnames, or your networks infection rate is reported to the public though - See the secure.irc-chat.net site for more information.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set REPORT <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e538"></a>3.14. AUTOSIGNOUT Setting</h3></div></div><div></div></div><p>SecureServ has the ability to automatically logout helpers that set away while being logged in. This ensures that infected users are only joined to the help channel if a helper is available to help them.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set AUTOSIGNOUT <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e547"></a>3.15. JOINHELPCHAN Setting</h3></div></div><div></div></div><p>SecureServ can optionally join the help channel with the first helper logs in, and leave the help channel when the last helper logs out. No additional functionality is provided when SecureServ joins the channel, its only for the "look" and "feel" of having SecureServ in your antivirus channel.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set JOINHELPCHAN <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e556"></a>3.16. AKILL Setting</h3></div></div><div></div></div><p>If you do not wish SecureServ to ever AKILL a user for a positive match, turn this option off. It will then just issue a warning to all operators about the Client, and Operators are free to do as they see fit.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set AKILL <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e565"></a>3.17. AKILLTIME Setting</h3></div></div><div></div></div><p>This setting changes the Timeout value for AKILL's that SecureServ sets when it detects a "infection"</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set AKILLTIME <SECONDS> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e574"></a>3.18. DOJOIN Setting</h3></div></div><div></div></div><p>IF SecureServ detects a user is infected with a virus, it can optionally join that user to a Antivirus channel. If you do not operate such a channel on your network, then disable this option. If its is disabled, then the user will be AKILLED instead.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set DOJOIN <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e583"></a>3.19. NFCOUNT Setting</h3></div></div><div></div></div><p>SecureServ monitors the number of nick changes a user makes in a 10 second period. If the user exceeds a threshold, it considers the user to be performing a "nickflood" and will akill the user from the network. This Setting Control how many nick changes in a 10 second period the user performs. The default is 5, which should be suitable for most users.</p><p>To Change this Setting, issue the following Command:</p><pre class="screen">/msg SecureServ set NFCOUNT <number></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e592"></a>3.20. VERBOSE Setting</h3></div></div><div></div></div><p>If you like to know what SecureServ is doing (and like to be flooded in the #services channel, then enable this option.</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Not Recommended on a Large Network. SecureServ can get quiet busy!</p></div><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set VERBOSE <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e604"></a>3.21. CYCLETIME Setting</h3></div></div><div></div></div><p>SecureServ automatically creates new "pseudo" users that randomly join channels looking for OnJoin virus's or SPAM. This option changes the interval that SecureServ will Cycle the random users and channels. On a Large network, you should aim for a smaller value, so it covers more of your channels quicker, but on a smaller network, this may become annoying for your users, so a higher value is recommended.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set CYCLETIME <SECONDS> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e613"></a>3.22. AUTOUPDATE Setting</h3></div></div><div></div></div><p>If SecureServ has been Configured with a username and password (as Covered in Section 2.2, you can optionally Setup SecureServ to automatically check and download new dat files if available on a Daily basis. If you prefer to manually update the DAT files via /msg secureserv update, then disable this option</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set AUTOUPDATE <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e622"></a>3.23. SAMPLETIME Setting</h3></div></div><div></div></div><p>As previously mentioned, SecureServ monitors the number of joins on a particular channel over a period of Time. Within SecureServ, this measurement is known as "Average Joins Per Period" or AJPP for short. If this AJPP value is exceeded, SecureServ assumes that the Channel is under a floodbot attack, and will "close" the channel.</p><p>This setting controls the AJPP threshold. Only experienced users should need to modify this setting.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set SAMPLETIME <SAMPLETIME> <JOINS> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e633"></a>3.24. HELPCHAN Setting</h3></div></div><div></div></div><p>If your network has a AntiVirus Channel setup, HELPCHAN sets that channel name. The default is #nohack</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set HELPCHAN <NAME> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e642"></a>3.25. BOTECHO Setting</h3></div></div><div></div></div><p>This option enables SecureServ sending messages any of the onjoin bots, or monbot receives to the services channel. This can help you monitor for potentially new onjoin virus's, or monitor for spam users.</p><p>To Change the setting, issue the following Command:</p><pre class="screen">/msg SecureServ set BOTECHO <ON/OFF> </pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e651"></a>3.26. TREATCHANMSGASPM</h3></div></div><div></div></div><p>This option changes the way that SecureServ treats Channel Messages sent to channels that either a Onjoin bot is a member off, or a channel that is being monitored via a MonBot. SecureServ has its own list of channel messages that it considers as "bad" and will act on accordingly, but sometimes Spambots will spam a channel instead of a individual user. Enabling this option will cause SecureServ to check channel messages against both the list of Signatures for Private Messages as well as the list of Signatures for Channel Messages. </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Enabling this option is NOT a good idea if you have large channels with lots of chatter, as it is very very CPU intensive (and will get worse as we add more PM signatures to the official Viri.dat file). You should only enable this if you enjoy wasting your CPU cycles. Its added benifit is very small in terms of detection rates. As a extra pre-caution, we make it difficult for you to enable this option. This should give you a idea of how *bad* it is to enable. </p></div><p>To Change this setting, issue the following Command:</p><pre class="screen">/msg SecureServ set TREATCHANMSGASPM <ON/OFF></pre></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="d0e663"></a>4. Operational Commands</h2></div></div><div></div></div><p>SecureServ has a number of commands that you can issue it in order to perform checks or operations on your IRC network. These commands aid Administrators in keeping their network secure, and keeping SecureServ upto date.</p><p>The following list summarizes these commands:</p><div class="itemizedlist"><ul type="disc"><li><p>List</p></li><li><p>checkchan</p></li><li><p>cycle</p></li><li><p>status</p></li><li><p>update</p></li><li><p>login</p></li><li><p>logout</p></li><li><p>bots</p></li><li><p>monchan</p></li><li><p>assist</p></li><li><p>reload</p></li></ul></div><p>The following Sections Describe these commands in detail</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e706"></a>4.1. list Command</h3></div></div><div></div></div><p>The List command shows a brief list of all the Definitions that SecureServ currently has loaded. These are direct from the Dat file that is downloaded from the <a href="#">http://secure.irc-chat.net</a> website.</p><p>The format of the command is as follows:</p><pre class="screen">/msg SecureServ list
-SecureServ- Virus List:
-SecureServ- ===========
-SecureServ- 1) Virus: HTTPSpam. Detection: PM. Action: OpersWarn Hits: 0
-SecureServ- 2) Virus: IRCSpam. Detection: PM. Action: OpersWarn Hits: 0
-SecureServ- 3) Virus: Mirc4BUF. Detection: Version. Action: ClientWarn Hits: 0
-SecureServ- 4) Virus: Mirc5BUF. Detection: Version. Action: ClientWarn Hits: 0
-SecureServ- 5) Virus: Mirc6DCC00. Detection: Version. Action: SVSjoin Hits: 0
<....snip.....>
-SecureServ- 30) Virus: Botnet16. Detection: Ident. Action: Akill Hits: 0
-SecureServ- 31) Virus: Botnet18. Detection: Ident. Action: Akill Hits: 0
-SecureServ- 32) Virus: FizzerBot. Detection: Built-In. Action: Akill Hits: 0
-SecureServ- End of List.
</pre><p>More detail about each "Virus" can be found at the <a href="#">http://secure.irc-chat.net/</a> site by searching for the Virus Name.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e723"></a>4.2. CheckChan Command</h3></div></div><div></div></div><p>If you suspect that a user in a Channel is infected with a OnJoin virus, you can force SecureServ to check the channel on your behalf. If SecureServ finds any infection in the channel, it will take the normal action associated with that virus.</p><p>The format of the command is as follows:</p><pre class="screen">/msg SecureServ checkchan <chan>
</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e732"></a>4.3. cycle Command</h3></div></div><div></div></div><p>This command forces SecureServ to part the existing channel it is checking and join the next random Channel.</p><p>The format of the command is as follows:</p><pre class="screen">/msg SecureServ cycle</pre><p>The next channel is chosen at random, but is guaranteed not to be the previous channel it checked.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e743"></a>4.4. status Command</h3></div></div><div></div></div><p>This command gives the Administrator statistics on the how SecureServ is performing, how many checks it has conducted, and currently logged in "helper" users.</p><p>The format of the command is as follows:</p><pre class="screen">/msg SecureServ status
-SecureServ- SecureServ Status:
-SecureServ- ==================
-SecureServ- Virus Patterns Loaded: 17
-SecureServ- CTCP Version Messages Scanned: 106287
-SecureServ- CTCP Messages Acted On: 1729
-SecureServ- CTCP Definitions: 11
-SecureServ- Private Messages Received: 75
-SecureServ- Private Messages Acted on: 0
-SecureServ- Private Message Definitions: 3
-SecureServ- NickNames Checked: 15084
-SecureServ- NickName Acted on: 0
-SecureServ- NickName Definitions: 1
-SecureServ- Ident's Checked: 14287
-SecureServ- Ident's Acted on: 0
-SecureServ- Ident Definitions: 1
-SecureServ- RealNames Checked: 0
-SecureServ- RealNames Acted on: 0
-SecureServ- RealName Definitions: 0
-SecureServ- ChannelNames Checked: 0
-SecureServ- ChannelNames Acted on: 0
-SecureServ- ChannelName Definitions: 0
-SecureServ- Built-In Checks Run: 0
-SecureServ- Built-In Checks Acted on: 0
-SecureServ- Built-In Functions: 1
-SecureServ- AV Channel Helpers Logged in: 0
-SecureServ- Current Top AJPP: 28 (in 5 Seconds): #w4f
-SecureServ- End of List.</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e752"></a>4.5. update Command</h3></div></div><div></div></div><p>That command forces SecureServ to check the Dat File version at <a href="#">http://secure.irc-chat.net/</a> and download the latest version if required.</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Repeated use of this command in a short period of time will result in your account at secure.irc-chat.net being suspended for abuse. Use with CARE</p></div><p>The format of the command is as follows:</p><pre class="screen">/msg SecureServ update</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e767"></a>4.6. login Command</h3></div></div><div></div></div><p>This command allows a "helper" or trusted user that mans your Antivirus or help channel to login to SecureServ to gain additional functionality with regards to handling infected users. The helpers must have a valid login account and password as set in the helpers command.</p><p>The format of the command is as follows:</p><pre class="screen">/msg SecureServ login <login> <pass></pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e776"></a>4.7. logout Command</h3></div></div><div></div></div><p>This command allows a logged in helper to logout of SecureServ if he is going to be away or not paying attention to the help channel for a period of time. You should encourage your users to logout if they can not provide timely response to infected users that may be forcejoined to the channel.</p><p>The format of the command is as follows:</p><pre class="screen">/msg SecureServ logout</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e785"></a>4.8. bots Command</h3></div></div><div></div></div><p>This option allows you to manipulate the random bot list that is used to join random channels (or channels monitored with the monchan command, as detailed below). The available options are:</p><pre class="screen">/msg SecureServ bots list</pre><p>This option lists all available bots.</p><pre class="screen">/msg SecureServ bots add <nick> <ident> <host> <realname></pre><p>This option adds a bot with the nickname, ident, host and realname as specified in the command to the list of bots that will be used to randomly join a channel.</p><pre class="screen">/msg SecureServ bots del <num></pre><p>This option lists will delete a bot from the available bots if its not currently in use.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e802"></a>4.9. monchan Command</h3></div></div><div></div></div><p>This option allows you to manipulate the list of channels that will be monitored all the time by SecureServ for Private Message type virus's. The bot that joins these channels is specified in the monbot section of the set command. You should also investigate the MONCHANCYCLE and MONCHANCYCLETIME options listed above on how to enable the monbot to cycle these monitored channels, as a OnJoin bot will not check a MONCHAN channel.</p><pre class="screen">/msg SecureServ monchan list</pre><p>This option lists all the channels that will be monitored. If the channels do not exist when SecureServ is started, they will be joined when the first user joins the channel. When the last user leaves the channel, they will also leave the channel. </p><pre class="screen">/msg SecureServ monchan add <chan></pre><p>This option adds a channel to be monitored.</p><pre class="screen">/msg SecureServ monchan del <chan></pre><p>This option lists will delete a channel from the monitored list.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e819"></a>4.10. assist Command</h3></div></div><div></div></div><p>This option is only available to "helpers" that have logged into secureserv and is used to control SecureServ's limits over users that have been identified as infected with simple virus's and joined to a help channel. They allow the "helpers" to either release a user from SecureServ's restrictions, or kill un-cooperative, or un-responsive users from the network. The helpers may only perform these actions on users that SecureServ has identified as infected with a simple virus, and automatically joined to the help channel. Helpers may not "kill" users that SecureServ has NOT identified as infected.</p><p>The format of the assist command is as follows:</p><pre class="screen">/msg SecureServ assist release/kill <target></pre><p>The release option allows the user to join all previous channels and continue as normal. After release is used on a user, a helper can no longer kill the target.</p><p>The kill option removes the user from the network via a akill command and broadcasts a message to all opers indicating the helper that used the kill command, and the initial virus the users was detected as having.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e832"></a>4.11. reload Command</h3></div></div><div></div></div><p>This option reloads the viri.dat and customviri.dat files. Its no the same as a update command, as it does not attempt to download new dat files from http://secure.irc-chat.net site. Its useful if you make a change to your customviri.dat file.</p><p>The format of the reload command is as follows:</p><pre class="screen">/msg SecureServ reload</pre></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="d0e841"></a>5. Custom Definitions</h2></div></div><div></div></div><p>You can create your own definitions to be used by SecureServ, but it requires a bit of programing skill, and knowledge of how to detect the trojan/virus.</p><p>We have enabled SecureServ to obtain additional definitions from a custom, administrator defined definition file. This allows IRC administrators to add additional signatures to SecureServ to ban clients that the IRC network does not permit. A common signature is one for Bottlers or IRCork clients. The only drawback is that the definition file is not simple, and some degree of programing knowledge is required.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e848"></a>5.1. Custom Definitions file</h3></div></div><div></div></div><p>If you wish to create your own custom definition, follow these steps:</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="d0e853"></a>5.1.1. Create customviri.dat file</h4></div></div><div></div></div><p>with a text editor, create a new file called customviri.dat in your ~/NeoStats/data directory.</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="d0e858"></a>5.1.2. add entries to customviri.dat</h4></div></div><div></div></div><p>The format of the customviri.dat file is as follows:</p><div class="example"><a name="d0e863"></a><p class="title"><b>Example 1. customvir.dat</b></p><p><span class="emphasis"><em>name</em></span> <span class="emphasis"><em>dettype</em></span> 0 0 "<span class="emphasis"><em>detectionregex</em></span>" "<span class="emphasis"><em>message</em></span>" <span class="emphasis"><em>action</em></span></p><p>It is very important that you follow the spacing format, otherwise your custom definition will fail to load.</p><p>Each individual field is described below:</p><p><span class="bold"><b><tt class="varname">name</tt></b></span></p><p>This is the Virus Name. It can be any combination of upper and lower case characters or numbers, but can not contain spaces, or punctuation.</p><p><span class="bold"><b><tt class="varname">dettype</tt></b></span></p><p>This defines how SecureServ should use this signature to detect Trojans. Its a number and can only be one of the following:</p><p><span class="bold"><b><span class="type">0 - CTCP Version check.</span></b></span> This trys to match the detectionregex against a received CTCP version reply.</p><p><span class="bold"><b><span class="type">1 - Private Message.</span> </b></span>This trys to match the detectionregex against a private message received by the onjoin bots or monbot</p><p><span class="bold"><b><span class="type">2 - Nick.</span></b></span> This trys to match the detectionregex against a nickname.</p><p><span class="bold"><b><span class="type">3 - Ident.</span> </b></span>This trys to match a detectionregex against a ident.</p><p><span class="bold"><b><span class="type">4 - Realname.</span></b></span> This trys to match a detectionregex against a users real name.</p><p><span class="bold"><b><span class="type">5 - Channel.</span> </b></span>This trys to match a detectionregex against a channel name.</p><p><span class="bold"><b><span class="type">10 - Internal.</span></b></span> This is reserved.</p><p><span class="bold"><b><tt class="varname">detectionregex</tt></b></span></p><p>This field is used to define how to detect a Trojan. If for example in the dettype we specify a value of 0, then this is a regular expression that is applied to all CTCP VERSION replies that secureserv receives. </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>This is a "Regular Expression" field. It is not the same as a wildcard field. Regular expressions are much more powerful pattern matching expressions than the standard ? and * options available in typical filesystem or IRC pattern matching code. If you have never used regular expression before, I STRONGLY suggest you test your "Regular expression" code with a utility called "pcretest" available as part of libpcre at www.pcre.org. Additionally, you should try to learn the pattern matching language. This can be done by looking at the man page for "perlre" or the documentation available on www.pcre.org. If you get your pattern matching code wrong, you have the ability to kill everyone on your IRC network, so be extremely careful.</p></div><p>This field must be enclosed in double quotation marks (") and if you use " in your regular expression, you must escape them.</p><p><span class="bold"><b><tt class="varname">message</tt></b></span></p><p>This is the private message sent to the "Infected" user when they are matched against this definition. As customviri.dat definitions do not direct users to the secure.irc-chat.net. site, you should provide as much information as possible in this, or optionally, direct them to your own hosted IRC page. You should place your message inside double quotation marks (") and if you use " in your regular expression, you must escape them.</p><p><span class="bold"><b><tt class="varname">action</tt></b></span></p><p>This field defines what SecureServ should do when it matches a user against this definition. The field is a number only and should only be one of the following.</p><p><span class="bold"><b><span class="type">0 - SVSJOIN.</span></b></span> On IRCds that support SVSJOIN, the user is automatically joined to the help channel, and any online opers are notified of the users infection. If no helpers are logged in, then the user is akilled instead.</p><p><span class="bold"><b><span class="type">1 - AKILL.</span></b></span> Akill the user from the IRC network.</p><p><span class="bold"><b><span class="type">2 - WARN.</span></b></span> Send the message to the user indicating they matched a definition, warn the operators via a global message, and do nothing else.</p><p><span class="bold"><b><span class="type">3 - NOTHING.</span></b></span> Only send the message to the user. Do not take any further action.</p><p>We don't support any customviri.dat definitions, either by the secure.irc-chat.net site, or via our boards, though members of the community may choose to share their customviri.dat files. If you are in doubt or unsure about creating your own customviri.dat files you should always test them with the warn or nothing option as the action type until you are sure that you have the matching correct.</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="d0e980"></a>5.1.3. Reload the definitions</h4></div></div><div></div></div><p>If SecureServ is already operating, you can reload the definitions by issuing a /msg SecureServ reload command. This will make SecureServ reload both the viri.dat file as well as the customviri.dat file. Your customviri.dat entries will be placed before any viri.dat entries, so if you wish to override the action of a viri.dat entry, you can place a copy in the customviri.dat file.</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="d0e985"></a>6. Final Words</h2></div></div><div></div></div><p>This Section is my "Rant" for SecureServ. Although you don't need to read it to operate SecureServ, it does provide you some tips</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="d0e990"></a>6.1. Dealing with Un-detected Attacks/Trojans/Virus etc</h3></div></div><div></div></div><p>If you come across a new "Trojan" or Virus or attack on your network, it might be possible to update SecureServ to be able to detect these new "Virus's"</p><p>If you wish us to consider adding support to SecureServ's Definition files for new "Virus's" please provide us with the following information via http://secure.irc-chat.net/ using the "submit new" link (only available when logged in as a member)</p><p>The following information is required:</p><div class="itemizedlist"><ul type="disc"><li><p>the output from /whois <infected user></p><p>If there are multiple Infected users, please provide multiple /whois outputs. This will aid us in determining a pattern.</p></li><li><p>The results from a /ctcp <infected user> version command, if any</p></li><li><p>Logfiles extracts of the behavior of the bot that makes you suspect it is a new Trojan/Virus</p><p>we will NOT add detection to SecureServ for anything we can not verify is in fact a risk to IRC security. If you submit to us the details of a script that a user is using, because you don't like the colors, Tough. Find some other way to deal with that user.</p></li><li><p>Details of your IRC network</p><p>So that we may contact you directly on your network if we require additional information or wish to the "Virus" in the wild.</p></li></ul></div><p>Before adding new items to the Definitions, we do as much research as possible, and also share this information with other "IRC Security" professionals or teams in order to determine the most effective way to detect this "infection"</p><p>Additionally, we will add "warning" messages to users that are running old copies of IRC software that are vulnerable to security issues (such as allows a Hacker to break into the users computer via IRC) and advise the user to upgrade their IRC client. If you are a client Author of a script or IRC client that has had Security Issues in the past, and wish us to add this "warning" to the Definitions, please contact us directly.</p></div></div></div></body></html>