The "ircv3_sts" Module (v3)
Description
This module adds support for the IRCv3 Strict Transport Security specification.
Configuration
To load this module use the following <module>
tag:
<module name="ircv3_sts">
<connect>
This module extends the core <connect>
tags with the following fields:
Name | Type | Default Value | Description |
---|---|---|---|
usests | Boolean | Yes | New in v3.1.0! Whether users in this connect class should have a STS policy advertised to them. |
Example Usage
Disables STS policy advertisement for users in the LocalIPv4 class:
<connect name="LocalIPv4"
allow="127.0.0.0/8"
...
usests="no">
<sts>
The <sts>
tag defines settings about how the sts module should behave. This tag can only be defined once.
Name | Type | Default Value | Description |
---|---|---|---|
host | Text | None | Required! A glob pattern for the hostname a user must send to use STS. |
duration | Duration | 5m (since 3.6.0) 60d (3.0.0 to 3.5.0) | The time period that the STS policy should last for. |
port | Number | None | Required! The port that clients should connect on securely. |
preload | Boolean | No | Whether the STS policy can be included in preload lists. |
Example Usage
<sts host="*.example.com"
duration="60d"
port="6697"
preload="yes">
Client Capabilities
Name | Description |
---|---|
sts | Defines a mechanism for clients to upgrade plaintext IRC connections to TLS (SSL). |
Special Notes
The default duration of 5 minutes is a safety precaution aimed at initial implementation and testing of an STS policy. Once you're comfortable with the configuration the duration should be raised to a month or more for effective enforcement.