To create new wiki account, please join us on #znc at Libera.Chat and ask admins to create a wiki account for you. You can say thanks to spambots for this inconvenience.

Query buffers and OpenSSL.cnf SelfSigned: Difference between pages

From ZNC
(Difference between pages)
Jump to navigation Jump to search
 
DoctorD90 (talk | contribs)
94 edits
Created page with " [default] default_md = sha512 name_opt = ca_default cert_opt = ca_default default_days = 375 policy = @policy_selfsigned [ re..."
 
Line 1: Line 1:
ZNC 1.6 introduces full-featured playback buffers for private messages aka queries.
[default]
 
default_md        = sha512
== Background ==
name_opt          = ca_default
 
cert_opt          = ca_default
Prior ZNC 1.6, private messages were stored to a shared query buffer. Private messages were buffered only when no clients were connected, and the buffer was automatically cleared after playback. The drawback was that it was not possible to replay the query buffer. For example, if you checked your private messages with a mobile client while on the go, it would clear the query buffer and make it hard to get back to it later when connecting with another client. Or when connecting to ZNC with a client from home, you wouldn't see any private messages you received meanwhile if you had left a client open at work.
default_days      = 375
 
policy            = @policy_selfsigned
The reason why it was handled like this was that "query" is a client side concept. ZNC can automatically manage channel buffers based on explicit requests from connected clients to join and leave channels. However, ZNC does not know when a query is closed in a client. If private messages were always buffered, query buffers would pile up in an uncontrollable manner.
 
[ req ]
== Query buffers ==
#Options from the [ req ] section are applied
 
#when creating certificates or certificate signing requests.
In order to enable persistent query buffers, disable the <code>AutoClearQueryBuffer</code> config option that is enabled by default. This can be done via [[controlpanel]], [[webadmin]], or [[configuration|znc.conf]]. This ensures that private messages are buffered even when there are connected clients, and the query buffers are not automatically cleared after playback.
# Options for the `req` tool (`man req`).
 
default_bits        = 4096
Due to the problems explained in the previous and next sections, this feature (<code>AutoClearQueryBuffer=false</code>) does not just work out of the box in any client. To avoid query buffers piling up, either a client/script must clear the appropriate buffer by sending <code>/msg *status clearbuffer &lt;name of the query/receiver&gt;</code> (when a query is closed), or you could use for example the [[clearbufferonmsg]] module.
distinguished_name  = req_selfsigned
 
string_mask        = utf8only
== Self messages ==
default_md          = sha512
 
The whole idea behind this feature is to keep the private discussion history between you and the other participant. It would effectively cripple the discussion if you weren't able to see your own messages. However, not all clients are capable of presenting in a sensible way such received messages where the sender is the user itself. In addition to setting <code>AutoClearQueryBuffer=false</code>, a client must request the <code>znc.in/self-message</code> capability in order to receive self messages in buffer playback.
 
[ req_selfsigned ]
=== Client Support ===
# The [ req_dn ] section declares the information
 
# normally required in a certificate signing request.
* Textual
# You can optionally specify some defaults.
* Communi
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
* [[HexChat]] 2.9.6+ with [https://github.com/TingPing/plugins/blob/master/HexChat/mymsg.py mymsg.py] and optionally [https://github.com/TingPing/plugins/blob/master/HexChat/autoclearbuf.py autoclearbuf.py]
countryName                    = Country Name (2 letter code)
 
countryName_min                = 2
== TL;DR ==
countryName_max                = 2
 
stateOrProvinceName            = State or Province Name (full name)
* Make sure to use a self-message capable client
localityName                    = Locality Name (eg, city)
* <code>AutoClearQueryBuffer=false</code>
organizationName                = Organization Name (eg, company)
* <code>/msg *status clearbuffer &lt;query&gt;</code>
organizationalUnitName          = Organizational Unit Name (eg, section)
 
commonName                      = Common Name (e.g. server FQDN or YOUR name)
[[Category:ZNC]]
emailAddress                    = Email Address
# Optionally, specify some defaults.
countryName_default            = IT
stateOrProvinceName_default    = Italy
localityName_default            = Italy
organizationName_default        = ZNC.in
#organizationalUnitName_default  = ZNC Service
#commonName_default            = wiki.znc.in
emailAddress_default            = user [at] example [dot] com
[ policy_selfsigned ]
# See the POLICY FORMAT section of the `ca` man page.
countryName            = optional
stateOrProvinceName    = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = optional
emailAddress            = optional
[ usr_cert ]
# We’ll apply the usr_cert extension when signing client certificates,
# such as those used for remote user authentication.
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage = critical, clientAuth, emailProtection, codeSigning
[ server_cert ]
# We’ll apply the server_cert extension when signing server certificates,
# such as those used for web servers.
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage = critical, serverAuth

Revision as of 18:03, 23 August 2021

[default]
default_md        = sha512
name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
policy            = @policy_selfsigned

[ req ]
#Options from the [ req ] section are applied
#when creating certificates or certificate signing requests.
# Options for the `req` tool (`man req`).
default_bits        = 4096
distinguished_name  = req_selfsigned
string_mask         = utf8only
default_md          = sha512


[ req_selfsigned ]
# The [ req_dn ] section declares the information
# normally required in a certificate signing request.
# You can optionally specify some defaults.
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName                     = Country Name (2 letter code)
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
localityName                    = Locality Name (eg, city)
organizationName                = Organization Name (eg, company)
organizationalUnitName          = Organizational Unit Name (eg, section)
commonName                      = Common Name (e.g. server FQDN or YOUR name)
emailAddress                    = Email Address

# Optionally, specify some defaults.
countryName_default             = IT
stateOrProvinceName_default     = Italy
localityName_default            = Italy
organizationName_default        = ZNC.in
#organizationalUnitName_default  = ZNC Service
#commonName_default             = wiki.znc.in
emailAddress_default            = user [at] example [dot] com

[ policy_selfsigned ]
# See the POLICY FORMAT section of the `ca` man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = optional
emailAddress            = optional

[ usr_cert ]
# We’ll apply the usr_cert extension when signing client certificates,
# such as those used for remote user authentication.
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage = critical, clientAuth, emailProtection, codeSigning

[ server_cert ]
# We’ll apply the server_cert extension when signing server certificates,
# such as those used for web servers.
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage = critical, serverAuth
Retrieved from "https://wiki.znc.in/index.php?title=Query_buffers&oldid=2929"