adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Feature request: continue if SASL failed (when connecting to IRCd) #113

New Issue
Closed
opened 2026-10-05 03:59:37 +02:00 by adam · 6 comments
adam commented 2026-10-05 03:59:37 +02:00
Owner
Copy link
Copy source

It would be nice if there was inbuild SASL support in ZNC.

The cap_sasl module isn't good for this, because

  • It doesn't come by default.
  • It stops connecting when it fails to identify.
    • There are other ways to identify to services than SASL (if SASL fails), for example, server password and *perform command.
It would be nice if there was inbuild SASL support in ZNC. The [cap_sasl](http://wiki.znc.in/Cap_sasl) module isn't good for this, because - It doesn't come by default. - It stops connecting when it fails to identify. - There are other ways to identify to services than SASL (if SASL fails), for example, server password and *perform command. <!-- github-sync-id:5196545 -->
adam closed this issue 2026-10-05 03:59:37 +02:00
adam commented 2026-10-05 03:59:37 +02:00
Author
Owner
Copy link
Copy source

Already added? https://github.com/znc/znc/commit/cab14055de786f21ab7833731e9708e79bfe47e4

01:10:08 raw | YOU -> [PRIVMSG *status :connect]
01:10:08 *raw | IRC -> [:irc.foobar.net NOTICE * :* Looking up your hostname...]
01:10:08 raw | IRC -> [:irc.foobar.net NOTICE * :* Checking Ident]
01:10:08 raw | IRC -> [:irc.foobar.net NOTICE * :* Couldn't look up your hostname]
01:10:15 raw | IRC -> [:irc.foobar.net NOTICE * :* No Ident response]
01:10:15 *raw | IRC -> [:irc.foobar.net CAP * LS :account-notify away-notify extended-join multi-prefix sasl]
01:10:15 *raw | IRC -> [:irc.foobar.net 433 * KindOne :Nickname is already in use.]
01:10:15 *raw | IRC -> [:irc.foobar.net CAP * ACK :multi-prefix ]
01:10:16 *raw | IRC -> [:irc.foobar.net CAP KindOne_ ACK :sasl ]
01:10:18 *raw | IRC -> [:irc.foobar.net 900 KindOne_ KindOne_!KindOne@KindOne. KindOne :You are now logged in as KindOne.]

/msg *sasl help

Already added? https://github.com/znc/znc/commit/cab14055de786f21ab7833731e9708e79bfe47e4 01:10:08 _raw | YOU -> [PRIVMSG *status :connect] 01:10:08 *raw | IRC -> [:irc.foobar.net NOTICE \* :_*\* Looking up your hostname...] 01:10:08 _raw | IRC -> [:irc.foobar.net NOTICE \* :_*\* Checking Ident] 01:10:08 _raw | IRC -> [:irc.foobar.net NOTICE \* :_*\* Couldn't look up your hostname] 01:10:15 _raw | IRC -> [:irc.foobar.net NOTICE \* :_*\* No Ident response] 01:10:15 *raw | IRC -> [:irc.foobar.net CAP \* LS :account-notify away-notify extended-join multi-prefix sasl] 01:10:15 *raw | IRC -> [:irc.foobar.net 433 \* KindOne :Nickname is already in use.] 01:10:15 *raw | IRC -> [:irc.foobar.net CAP \* ACK :multi-prefix ] 01:10:16 *raw | IRC -> [:irc.foobar.net CAP KindOne_ ACK :sasl ] 01:10:18 *raw | IRC -> [:irc.foobar.net 900 KindOne_ KindOne_!KindOne@KindOne. KindOne :You are now logged in as KindOne.] /msg *sasl help <!-- github-comment-id:6500726 -->
adam commented 2026-10-05 03:59:38 +02:00
Author
Owner
Copy link
Copy source

SASL authentication differs from using *perform or server password.
SASL guarantees you to be already authenticated when receiving 001 and later.
*perform does not do that, as it executes its commands only after finishing connections and various negotiations.
Server password can behave in various ways, but, for example, on freenode it's essentially an alias to /msg nickserv identify, so it doesn't guarantee anything.

So if you want to join channels only with cloak from nickserv and not to expose your IP, you should use SASL.

SASL authentication differs from using *perform or server password. SASL guarantees you to be already authenticated when receiving 001 and later. *perform does not do that, as it executes its commands only after finishing connections and various negotiations. Server password can behave in various ways, but, for example, on freenode it's essentially an alias to /msg nickserv identify, so it doesn't guarantee anything. So if you want to join channels only with cloak from nickserv and not to expose your IP, you should use SASL. <!-- github-comment-id:6501974 -->
adam commented 2026-10-05 03:59:39 +02:00
Author
Owner
Copy link
Copy source

22.06.2012 14:56, Mikaela Suomalainen пишет:

On 22.06.2012 08:09, ineedalifetoday wrote:

Already added?

https://github.com/znc/znc/commit/cab14055de786f21ab7833731e9708e79bfe47e4

I cannot find the "AUTHORS" file which that file mentions. Is that the
old cap_sasl or something new?

kylef chose to rewrite it, for git version, and with more features,
external mechanism for example.
And the name is sasl instead of cap_sasl...

22.06.2012 14:56, Mikaela Suomalainen пишет: > On 22.06.2012 08:09, ineedalifetoday wrote: > > > Already added? > > > > https://github.com/znc/znc/commit/cab14055de786f21ab7833731e9708e79bfe47e4 > > I cannot find the "AUTHORS" file which that file mentions. Is that the > old cap_sasl or something new? > > kylef chose to rewrite it, for git version, and with more features, > external mechanism for example. > And the name is sasl instead of cap_sasl... <!-- github-comment-id:6503020 -->
adam commented 2026-10-05 03:59:39 +02:00
Author
Owner
Copy link
Copy source

22.06.2012 15:08, Mikaela Suomalainen пишет:

On 22.06.2012 10:25, Alexey Sokolov wrote:

SASL authentication differs from using *perform or server
password. SASL guarantees you to be already authenticated when
receiving 001 and later. *perform does not do that, as it executes
its commands only after finishing connections and various
negotiations. Server password can behave in various ways, but, for
example, on freenode it's essentially an alias to /msg nickserv
identify, so it doesn't guarantee anything.

So if you want to join channels only with cloak from nickserv and
not to expose your IP, you should use SASL.

I meant that I usually use three methods to identify when I don̈́'t use ZNC.

  1. SASL
  2. Server password
  3. *perform

If SASL fails, server password is used. It usually succeeds, but if it
doesn't, *perform will identify anyway.

If *perform fails, the server is probably netsplitted.

But with ZNC, when SASL authentication fails, whole connecting to
server fails.

ZNC doesn't even support any kind of way to identify with SASL,
Lies, use sasl module in 0.207 or cap_sasl module in 0.206
but
not abort connecting if SASL doesn't work.
Perhaps this can be an option, if to abort connecting or not.

And about server password, freenode accepts username:password as
server password like ZNC and it usually works, unless there is
netsplit or something.
In case of netsplit it continues without authentication, leaving your IP
uncloaked. This is not the case with SASL, which doesn't continue
without authentication.

22.06.2012 15:08, Mikaela Suomalainen пишет: > On 22.06.2012 10:25, Alexey Sokolov wrote: > > > SASL authentication differs from using *perform or server > > password. SASL guarantees you to be already authenticated when > > receiving 001 and later. *perform does not do that, as it executes > > its commands only after finishing connections and various > > negotiations. Server password can behave in various ways, but, for > > example, on freenode it's essentially an alias to /msg nickserv > > identify, so it doesn't guarantee anything. > > > > So if you want to join channels only with cloak from nickserv and > > not to expose your IP, you should use SASL. > > I meant that I usually use three methods to identify when I don̈́'t use ZNC. > 1. SASL > 2. Server password > 3. *perform > > If SASL fails, server password is used. It usually succeeds, but if it > doesn't, *perform will identify anyway. > > If *perform fails, the server is probably netsplitted. > > But with ZNC, when SASL authentication fails, whole connecting to > server fails. > > ZNC doesn't even support any kind of way to identify with SASL, > Lies, use sasl module in 0.207 or cap_sasl module in 0.206 > but > not abort connecting if SASL doesn't work. > Perhaps this can be an option, if to abort connecting or not. > > And about server password, freenode accepts username:password as > server password like ZNC and it usually works, unless there is > netsplit or something. > In case of netsplit it continues without authentication, leaving your IP > uncloaked. This is not the case with SASL, which doesn't continue > without authentication. <!-- github-comment-id:6503123 -->
adam commented 2026-10-05 03:59:40 +02:00
Author
Owner
Copy link
Copy source

Ok, renamed the issue from "SASL support" to "continue if SASL failed"

Ok, renamed the issue from "SASL support" to "continue if SASL failed" <!-- github-comment-id:6503222 -->
adam commented 2026-10-05 03:59:41 +02:00
Author
Owner
Copy link
Copy source

The *sasl module in git implements this feature.

/msg *sasl RequireAuth no

I think requireauth is set to no by default.

The *sasl module in git implements this feature. ``` /msg *sasl RequireAuth no ``` I think requireauth is set to no by default. <!-- github-comment-id:6751571 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#113