adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 02:42:21 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Server passwords are printed during startup #873

New Issue
Closed
opened 2026-10-05 04:49:46 +02:00 by adam · 0 comments
adam commented 2026-10-05 04:49:46 +02:00
Owner
Copy link
Copy source

e.g.:

$ znc
[ .. ] Checking for list of available modules...
[ .. ] Opening config [/home/dwfreed/.znc/configs/znc.conf]...
[ .. ] Loading global module [webadmin]...
[ .. ] Binding to port [+6697] on host [::1]...
[ .. ] Binding to port [+6697] on host [127.0.0.1]...
[ ** ] Loading user [dwfreed]
[ ** ] Loading network [NETWORK]
[ .. ] Adding server [::1 +31459 PASSWORD]...
[ .. ] Loading user module [chansaver]...
[ .. ] Loading user module [controlpanel]...
[ .. ] Loading user module [buffextras]...
[ .. ] Forking into the background...
[ >> ] [pid: 9127]
[ ** ] ZNC 1.7.1 - https://znc.in

This is from: https://github.com/znc/znc/blob/2f4b158fd1d1c03eee5f73777bcb55b0d6c535b5/src/IRCNetwork.cpp#L488

This is an issue because ZNC's startup messages could end up somewhere less secure than ZNC's config file, without realizing it, eg syslog, journal, email, depending on how ZNC is started. ZNC already doesn't send the server password during ListServers as of 1.7.0, so the same should be applied to startup messages.

e.g.: ``` $ znc [ .. ] Checking for list of available modules... [ .. ] Opening config [/home/dwfreed/.znc/configs/znc.conf]... [ .. ] Loading global module [webadmin]... [ .. ] Binding to port [+6697] on host [::1]... [ .. ] Binding to port [+6697] on host [127.0.0.1]... [ ** ] Loading user [dwfreed] [ ** ] Loading network [NETWORK] [ .. ] Adding server [::1 +31459 PASSWORD]... [ .. ] Loading user module [chansaver]... [ .. ] Loading user module [controlpanel]... [ .. ] Loading user module [buffextras]... [ .. ] Forking into the background... [ >> ] [pid: 9127] [ ** ] ZNC 1.7.1 - https://znc.in ``` This is from: https://github.com/znc/znc/blob/2f4b158fd1d1c03eee5f73777bcb55b0d6c535b5/src/IRCNetwork.cpp#L488 This is an issue because ZNC's startup messages could end up somewhere less secure than ZNC's config file, without realizing it, eg syslog, journal, email, depending on how ZNC is started. ZNC already doesn't send the server password during ListServers as of 1.7.0, so the same should be applied to startup messages. <!-- github-sync-id:364455660 -->
adam closed this issue 2026-10-05 04:49:46 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#873