To create new wiki account, please join us on #znc at Libera.Chat and ask admins to create a wiki account for you. You can say thanks to spambots for this inconvenience.

Configuration and OpenSSL.cnf SelfSigned: Difference between pages

From ZNC
(Difference between pages)
Jump to navigation Jump to search
add NoTrafficTimeout
 
DoctorD90 (talk | contribs)
94 edits
Created page with " [default] default_md = sha512 name_opt = ca_default cert_opt = ca_default default_days = 375 policy = @policy_selfsigned [ re..."
 
Line 1: Line 1:
{{Languages|Configuration}}
[default]
 
default_md        = sha512
== Creating a config file ==
name_opt          = ca_default
To generate a basic configuration file, run <code>znc --makeconf</code> after installation.
cert_opt          = ca_default
It is NOT a good idea to create a new config file manually, please use <code>znc --makeconf</code>!
default_days      = 375
 
policy            = @policy_selfsigned
== File locations ==
 
[ req ]
* '''Configuration''' - ZNC gets its configuration by reading the file <code>~/.znc/configs/znc.conf</code>.
#Options from the [ req ] section are applied
* '''Misc''' - Other files are also stored in the <code>~/.znc</code> directory, such as the SSL certificate (znc.pem) and the PidFile (znc.pid).
#when creating certificates or certificate signing requests.
* '''Local Modules''' - Stored in <code>~/.znc/modules</code>. ZNC will look in the local module directory first when trying to load a module.
# Options for the `req` tool (`man req`).
* '''Global Modules''' - Stored in <code>/usr/local/lib/znc</code> by default (where <code>/usr/local</code> is the prefix you chose). This is <code>/usr/lib/znc</code> if you used the Debian package.
default_bits        = 4096
* '''Binaries''' - <code>znc</code>, <code>znc-config</code>, and <code>znc-buildmod</code> are all stored in <code>/usr/local/bin</code> (or in <code>/usr/bin</code>) by default. You can change this when you configure by using <code>./configure --prefix=/whatever/path/you/want</code>.
distinguished_name  = req_selfsigned
 
string_mask         = utf8only
== Editing config ==
default_md          = sha512
In most cases you '''should NOT''' edit znc.conf directly.
Use [[webadmin]] instead.
 
[ req_selfsigned ]
If you ''really'' need to edit znc.conf by hand, do the following:
# The [ req_dn ] section declares the information
# pkill -SIGUSR1 znc
# normally required in a certificate signing request.
#: to save current runtime configuration to znc.conf
# You can optionally specify some defaults.
# pkill znc
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
#: to shutdown running ZNC instance
countryName                    = Country Name (2 letter code)
# Edit znc.conf
countryName_min                = 2
# znc
  countryName_max                = 2
#: to start it again with new configuration
  stateOrProvinceName            = State or Province Name (full name)
 
localityName                    = Locality Name (eg, city)
== Config file structure ==
organizationName                = Organization Name (eg, company)
 
organizationalUnitName          = Organizational Unit Name (eg, section)
The following pseudo content illustrates the config structure with single listener, user, network and channel. Naturally, there can be multiple instances of each.
commonName                      = Common Name (e.g. server FQDN or YOUR name)
 
emailAddress                    = Email Address
<pre>
Key = Value
# Optionally, specify some defaults.
 
countryName_default            = IT
<Listener name>
stateOrProvinceName_default    = Italy
    Key = Value
localityName_default            = Italy
</Listener>
organizationName_default        = ZNC.in
 
#organizationalUnitName_default  = ZNC Service
<User name>
#commonName_default            = wiki.znc.in
    Key = Value
emailAddress_default            = user [at] example [dot] com
 
    <Network name>
[ policy_selfsigned ]
         Key = Value
# See the POLICY FORMAT section of the `ca` man page.
 
countryName            = optional
        <Chan name>
stateOrProvinceName    = optional
            Key = Value
localityName            = optional
        </Chan>
organizationName        = optional
    </Network>
organizationalUnitName  = optional
   
commonName              = optional
    <Pass password>
  emailAddress            = optional
        Key = Value
    </Pass>
[ usr_cert ]
</User>
# We’ll apply the usr_cert extension when signing client certificates,
</pre>
# such as those used for remote user authentication.
 
# Extensions for client certificates (`man x509v3_config`).
== Config file settings ==
basicConstraints = critical, CA:FALSE
 
subjectKeyIdentifier = hash
ZNC 1.6 configuration file consists of the following settings. All values are examples.
authorityKeyIdentifier = keyid:always, issuer:always
 
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
=== Global ===
extendedKeyUsage = critical, clientAuth, emailProtection, codeSigning
 
{| class="wikitable" style="width:100%"
[ server_cert ]
|-
# We’ll apply the server_cert extension when signing server certificates,
| rowspan="2" style="width:20%" | '''AnonIPLimit'''
# such as those used for web servers.
| The limit of anonymous unidentified connections per IP.
# Extensions for server certificates (`man x509v3_config`).
|-
basicConstraints = critical, CA:FALSE
| <tt>AnonIPLimit = 10</tt>
subjectKeyIdentifier = hash
|-
authorityKeyIdentifier = keyid:always, issuer:always
| rowspan="2" | '''BindHost'''
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
| The list of allowed bindhosts. Users can select one of these values.
extendedKeyUsage = critical, serverAuth
|-
| <tt>BindHost = ...<br/>BindHost = ...</tt>
|-
| rowspan="2" | '''ConnectDelay'''
| The number of seconds every IRC connection is delayed. IRC servers may refuse a connection when reconnecting too fast. NOTE: Affects connections between ZNC and IRC servers; not connections between IRC clients and ZNC.
|-
| <tt>ConnectDelay = 5</tt>
|-
| rowspan="2" | '''HideVersion'''<br/><sub>(since 1.6)</sub>
| Whether the version number is hidden from the web interface and CTCP VERSION replies.
|-
| <tt>HideVersion = true</tt>
|-
| rowspan="2" | '''LoadModule'''
| The list of global [[Modules|modules]] loaded on ZNC startup.
|-
| <tt>LoadModule = webadmin<br/>LoadModule = modperl<br/>LoadModule = modpython</tt>
|-
| rowspan="2" | '''MaxBufferSize'''
| The maximum playback buffer size. Only admin users can exceed the limit.
|-
| <tt>MaxBufferSize = 500</tt>
|-
| rowspan="2" | '''Motd'''
| The list of "message of the day" lines that are sent to clients on connect via notice from *status.
|-
| <tt>Motd = ...<br/>Motd = ...</tt>
|-
| rowspan="2" | '''PidFile'''
| An optional PID file location. See the [[FAQ#How_can_I_restart_ZNC_automatically_.28in_case_of_a_machine_reboot.2C_crash.2C_etc..29.3F|FAQ]] for how to crontab ZNC.
|-
| <tt>PidFile = /home/znc/.znc/znc.pid</tt>
|-
| rowspan="2" | '''ProtectWebSessions'''
| Whether IP changing during each web session is disallowed.
|-
| <tt> ProtectWebSessions = true</tt>
|-
| rowspan="2" | '''ServerThrottle'''
| The number of seconds between connect attempts to the same hostname.
|-
| <tt>ServerThrottle = 30</tt>
|-
| rowspan="2" | '''Skin'''
| The default web interface skin. Users can override the value.
|-
| <tt>Skin = _default_</tt>
|-
| rowspan="2" | '''SSLCertFile'''
| The file with SSL/TLS certificate, used for ZNC's listening port. Defaults to ~/.znc/znc.pem
|-
| <tt>SSLCertFile = /home/znc/.znc/znc.pem</tt>
|-
| rowspan="2" | '''SSLCiphers'''<br/><sub>(since 1.6)</sub>
| The allowed [https://www.openssl.org/docs/apps/ciphers.html SSL ciphers]. Default value is from [https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29 Mozilla's recomendations]
|-
| <tt>SSLCiphers = EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH</tt>
|-
| rowspan="2" | '''SSLDHParamFile'''<br/><sub>(since 1.7)</sub>
| The file with Diffie-Hellman parameters of SSL/TLS, used for ZNC's listening port. Defaults to ~/.znc/znc.pem. If the file doesn't contain DH parameters, ciphers which use DH can't be used.
|-
| <tt>SSLDHParamFile = /home/znc/.znc/znc.pem</tt>
|-
| rowspan="2" | '''SSLKeyFile'''<br/><sub>(since 1.7)</sub>
| The file with private key of SSL/TLS certificate, used for ZNC's listening port. Defaults to ~/.znc/znc.pem
|-
| <tt>SSLKeyFile = /home/znc/.znc/znc.pem</tt>
|-
| rowspan="2" | '''SSLProtocols'''<br/><sub>(since 1.6)</sub>
| The accepted SSL protocols. Available protocols are All, SSLv2, SSLv3, TLSv1, TLSv1.1 and TLSv1.2. A non-prefixed value overrides any existing values, whereas a '-' or '+' prefixed value disables or enables an additional protocol. It is recommended to keep the ZNC defaults that may change in future versions, and only disable (or enable) additional protocols if necessary. NOTE: ZNC 1.6 disables SSLv2 and SSLv3 by default.
|-
| <tt>SSLProtocols = -SSLv2 -SSLv3 -TLSv1 +TLSv1.1 +TLSv1.2</tt>
|-
| rowspan="2" | '''StatusPrefix'''
| The default prefix for status and module queries. Users can override the value.
|-
| <tt>StatusPrefix = *</tt>
|-
| rowspan="2" | '''TrustedProxy'''<br/><sub>(since 1.6)</sub>
| The list of trusted proxies.
|-
| <tt>TrustedProxy = ...<br/>TrustedProxy = ...</tt>
|-
| rowspan="2" | '''Version'''
| The version of ZNC that was used to write the config file.
|-
| <tt>Version = 1.6.0</tt>
|}
 
=== Listener ===
 
Definition of a port that ZNC listens on. There can be multiple ports, and they can allow different protocols.
 
{| class="wikitable" style="width:100%"
|-
| rowspan="2" style="width:20%" | '''AllowIRC'''
| Whether the port allows IRC connections.
|-
| <tt>AllowIRC = true</tt>
|-
| rowspan="2" | '''AllowWeb'''
| Whether the port allows web connections.
|-
| <tt>AllowWeb = true</tt>
|-
| rowspan="2" | '''Host'''
| An optional host or IP on which ZNC listens.
|-
| <tt>Host = ...</tt>
|-
| rowspan="2" | '''IPv4'''
| Whether the port listens using IPv4.
|-
| <tt>IPv4 = true</tt>
|-
| rowspan="2" | '''IPv6'''
| Whether the port listens using IPv6.
|-
| <tt>IPv6 = true</tt>
|-
| rowspan="2" | '''Port'''
| The port number. WARNING: Some web browsers reject port 6667.
|-
| <tt>Port = 12345</tt>
|-
| rowspan="2" | '''SSL'''
| Whether the port is listening using SSL.
|-
| <tt>SSL = true</tt>
|-
| rowspan="2" | '''URIPrefix'''<br/><sub>(since 1.6)</sub>
| An optional URI prefix for the ZNC web interface. Can be used to make ZNC available behind a reverse proxy.
|-
| <tt>URIPrefix = /znc/</tt>
|}
 
=== User ===
 
Definition of a user. There can be multiple users and each can have multiple networks.
 
{| class="wikitable" style="width:100%"
|-
| rowspan="2" style="width:20%" | '''Admin'''
| Whether the user has admin rights.
|-
| <tt>Admin = true</tt>
|-
| rowspan="2" | '''Allow'''
| The list of allowed IPs for the user. Wildcards (*) are supported.
|-
| <tt>Allow = *</tt>
|-
| rowspan="2" | '''AltNick'''
| The default alternate nick used if the primary nick is reserved. Networks can override the value.
|-
| <tt>AltNick = somebody_</tt>
|-
| rowspan="2" | '''AppendTimestamp'''
| Whether [[timestamps]] are appended to buffer playback messages. NOTE: Only used for clients that do not support server-time.
|-
| <tt>AppendTimestamp = false</tt>
|-
| rowspan="2" | '''AutoClearChanBuffer'''
| Whether channel buffers are automatically cleared after playback. When disabled, messages are buffered even while clients are attached, and already seen messages may be repeated each time clients connect.
|-
| <tt>AutoClearChanBuffer = true</tt>
|-
| rowspan="2" | '''AutoClearQueryBuffer'''<br/><sub>(since 1.6)</sub>
| Whether [[query buffers]] are automatically cleared after playback. When disabled, messages are buffered even while clients are attached, and already seen messages may be repeated each time clients connect.
|-
| <tt>AutoClearQueryBuffer = true</tt>
|-
| rowspan="2" | '''BindHost'''
| An optional bindhost for the user. Must be one of the values specified in the global list of allowed bindhosts.
|-
| <tt>BindHost = ...</tt>
|-
| rowspan="2" | '''Buffer'''
| The maximum amount of lines stored for each channel or query playback buffer. The buffers are stored in memory, and oldest lines are discarded when the limit is reached. Only admin users can exceed the maximum buffer size specified in the global section.
|-
| <tt>Buffer = 300</tt>
|-
| rowspan="2" | '''ChanBufferSize'''<br/><sub>(since 1.7)</sub>
| The maximum amount of lines stored for each channel playback buffer. The buffers are stored in memory, and oldest lines are discarded when the limit is reached. Only admin users can exceed the maximum buffer size specified in the global section.
|-
| <tt> ChanBufferSize = 300</tt>
|-
| rowspan="2" | '''ChanModes'''
| The default modes ZNC sets when joining an empty channel.
|-
| <tt>ChanModes = +stn</tt>
|-
| rowspan="2" | '''ClientEncoding'''<br/><sub>(since 1.6)</sub>
| The client encoding.
|-
| <tt>ClientEncoding = UTF-8</tt>
|-
| rowspan="2" | '''CTCPReply'''
| An optional list of CTCP request-reply-pairs. Syntax: <tt><request> <reply></tt>.
|-
| <tt>CTCPReply = VERSION unknown v1.0</tt>
|-
| rowspan="2" | '''DCCBindHost'''
| An optional bindhost for DCC connections.
|-
| <tt>DCCBindHost = ...</tt>
|-
| rowspan="2" | '''DenyLoadMod'''
| Whether the user is denied access to load modules.
|-
| <tt>DenyLoadMod = false</tt>
|-
| rowspan="2" | '''DenySetBindHost'''
| Whether the user is denied access to set a bindhost.
|-
| <tt>DenySetBindHost = false</tt>
|-
| rowspan="2" | '''Ident'''
| The default ident. Networks can override the value.
|-
| <tt>Ident = znc</tt>
|-
| rowspan="2" | '''JoinTries'''
| The amount of times channels are attempted to join in case of a failure eg. due to channel modes +i/+k/+b.
|-
| <tt>JoinTries = 3</tt>
|-
| rowspan="2" | '''Language'''<br/><sub>(since 1.7)</sub>
| Language of UI translation shown for this user. If not specified, English is used.
|-
| <tt>Language = ru-RU</tt>
|-
| rowspan="2" | '''LoadModule'''
| The list of user [[Modules|modules]] loaded on ZNC startup.
|-
| <tt>LoadModule = controlpanel<br/>LoadModule = chansaver</tt>
|-
| rowspan="2" | '''MaxJoins'''<br/><sub>(since 1.2)</sub>
| The maximum number of channels ZNC joins at once. Lower the value in case getting disconnected for 'Excess flood'.
|-
| <tt>MaxJoins = 3</tt>
|-
| rowspan="2" | '''MaxNetworks'''
| The maximum number of networks the user is allowed to have.
|-
| <tt>MaxNetworks = 5</tt>
|-
| rowspan="2" | '''MaxQueryBuffers'''<br/><sub>(since 1.6)</sub>
| The maximum number of query buffers that are stored. <code>0</code> is unlimited.
|-
| <tt>MaxQueryBuffers = 50</tt>
|-
| rowspan="2" | '''MultiClients'''
| Whether multiple clients are allowed to connect simultaneously.
|-
| <tt>MultiClients = true</tt>
|-
| rowspan="2" | '''Nick'''
| The default primary nick. Networks can override the value.
|-
| <tt>Nick = somebody</tt>
|-
| rowspan="2" | '''NoTrafficTimeout'''<br/><sub>(since 1.7)</sub>
| How much time ZNC waits (in seconds) until it receives something from network or declares the connection timeout. This happens after attempts to ping the peer.
|-
| <tt>NoTrafficTimeout = 180</tt>
|-
| rowspan="2" | '''PrependTimestamp'''
| Whether [[timestamps]] are prepended to buffer playback messages. NOTE: Only used for clients that do not support server-time.
|-
| <tt>PrependTimestamp = true</tt>
|-
| rowspan="2" | '''QueryBufferSize'''<br/><sub>(since 1.7)</sub>
| The maximum amount of lines stored for each query playback buffer. The buffers are stored in memory, and oldest lines are discarded when the limit is reached. Only admin users can exceed the maximum buffer size specified in the global section.
|-
| <tt> QueryBufferSize = 300</tt>
|-
| rowspan="2" | '''QuitMsg'''
| The default quit message ZNC uses when disconnecting or shutting down. Networks can override the value.
|-
| <tt>QuitMsg = ZNC - http://znc.in</tt>
|-
| rowspan="2" | '''RealName'''
| The default real name. Networks can override the value.
|-
| <tt>Real Name = Got ZNC?</tt>
|-
| rowspan="2" | '''Skin'''
| The web interface skin.
|-
| <tt>Skin = _default_</tt>
|-
| rowspan="2" | '''StatusPrefix'''
| The prefix for status and module queries.
|-
| <tt>StatusPrefix = *</tt>
|-
| rowspan="2" | '''TimestampFormat'''
| The format of the [[timestamps]] used in buffer playback messages. NOTE: Only used for clients that do not support server-time.
|-
| <tt>TimestampFormat = [%H:%M:%S]</tt>
|-
| rowspan="2" | '''Timezone'''
| The timezone used for [[timestamps]] in buffer playback messages. NOTE: Only used for clients that do not support server-time.
|-
| <tt>Timezone = Europe/Berlin</tt>
|}
 
=== Network ===
 
Definition of a network. A user can have multiple networks, up to the limit specified by '''MaxNetworks'''.
 
{| class="wikitable" style="width:100%"
|-
| rowspan="2" style="width:20%" | '''AltNick'''
| An optional network specific alternate nick used if the primary nick is reserved.
|-
| <tt>AltNick = somebody_</tt>
|-
| rowspan="2" | '''BindHost'''
| An optional bindhost for the network. Must be one of the values specified in the global list of allowed bindhosts.
|-
| <tt>BindHost = ...</tt>
|-
| rowspan="2" | '''Encoding'''<br/><sub>(since 1.6)</sub>
| An optional network specific encoding.
|-
| <tt>Encoding = UTF-8</tt>
|-
| rowspan="2" | '''FloodBurst'''
| The maximum amount of lines ZNC sends at once.
|-
| <tt>FloodBurst = 4</tt>
|-
| rowspan="2" | '''FloodRate'''
| The seconds between lines ZNC sends after reaching the '''FloodBurst''' limit.
|-
| <tt>FloodRate = 1.00</tt>
|-
| rowspan="2" | '''Ident'''
| An optional network specific ident.
|-
| <tt>Ident = znc</tt>
|-
| rowspan="2" | '''IRCConnectEnabled'''
| Whether the network is enabled ie. connects to IRC.
|-
| <tt>IRCConnectEnabled = false</tt>
|-
| rowspan="2" | '''JoinDelay'''<br/><sub>(since 1.6)</sub>
| The delay in seconds, until channels are joined after getting connected.
|-
| <tt>JoinDelay = 0</tt>
|-
| rowspan="2" | '''LoadModule'''
| The list of network [[Modules|modules]] loaded on ZNC startup.
|-
| <tt>LoadModule = simple_away<br/>LoadModule = route_replies</tt>
|-
| rowspan="2" | '''Nick'''
| An optional network specific primary nick.
|-
| <tt>Nick = somebody</tt>
|-
| rowspan="2" | '''QuitMsg'''<br/><sub>(since 1.6)</sub>
| An optional network specific quit message ZNC uses when disconnecting or shutting down.
|-
| <tt>QuitMsg = ZNC - http://znc.in</tt>
|-
| rowspan="2" | '''RealName'''
| An optional network specific real name.
|-
| <tt>RealName = Got ZNC?</tt>
|-
| rowspan="2" | '''Server'''
| The list of IRC servers. Prefix the port number with a '+' to enable SSL. Syntax: <tt><host> [[+]port] [password]</tt>.
|-
| <tt>Server = irc.freenode.net +6697</tt>
|-
| rowspan="2" | '''TrustedServerFingerprint'''<br/><sub>(since 1.6)</sub>
| The list of trusted server fingerprints.
|-
| <tt>TrustedServerFingerprint = fi:ng:er</tt>
|}
 
=== Chan ===
 
Definition of a channel that ZNC joins when it connects to IRC. A network can have multiple channels.
 
{| class="wikitable" style="width:100%"
|-
| rowspan="2" style="width:20%" | '''AutoClearChanBuffer'''
| Whether the channel specific buffer is automatically cleared after playback.
|-
| <tt>AutoClearChanBuffer = false</tt>
|-
| rowspan="2" | '''Buffer'''
| The maximum amount of lines stored for the channel specific playback buffer.
|-
| <tt>Buffer = 100</tt>
|-
| rowspan="2" | '''Detached'''
| Whether the channel is [[Detaching|detached]]. Detached channels are not visible to clients.
|-
| <tt>Detached = true</tt>
|-
| rowspan="2" | '''Disabled'''<br/><sub>(since 1.6)</sub>
| Whether the channel is disabled. ZNC does not join disabled channels.
|-
| <tt>Disabled = true</tt>
|-
| rowspan="2" | '''Key'''
| An optional channel key.
|-
| <tt>Key = secret</tt>
|-
| rowspan="2" | '''Modes'''
| An optional set of default channel modes ZNC sets when joining an empty channel.
|-
| <tt>Modes = +stn</tt>
|}
 
=== Pass ===
 
Definition of a password, used by clients to connect to ZNC. Generated using <code>znc --makepass</code>.
 
{| class="wikitable alternating" style="width:100%"
|-
| rowspan="2" style="width:20%" | '''Hash'''
| The hash of a salted password.
|-
| <tt>Hash = 44ccdd8655fb2c9bf8e6026fc51dfeabfd3e361f696c9373c00a496a4dcaed6f</tt>
|-
| rowspan="2" | '''Method'''
| The password hashing method.
|-
| <tt>Method = sha256</tt>
|-
| rowspan="2" | '''Salt'''
| A random set of 20 characters for salting the password.
|-
| <tt>Salt = ,e9a+t9WwSCjR_5:XAQu</tt>
|}
 
== Config file change history ==
 
=== Added in 1.7 ===
* '''SSLDHParamFile''' and '''SSLKeyFile''' (Global)
* '''Language''', '''ChanBufferSize''' and '''QueryBufferSize''' (User)
* '''AuthOnlyViaModule''' (Global, User)
 
=== Added in 1.6 ===
* '''HideVersion''', '''SSLCiphers''', '''SSLProtocols''' and '''TrustedProxy''' (Global)
* '''URIPrefix''' (Listener)
* '''AutoClearQueryBuffer''', '''ClientEncoding''', and '''MaxQueryBuffers''' (User)
* '''Encoding''', '''JoinDelay''' and '''QuitMsg''', '''TrustedServerFingerprint''' (Network)
* '''Disabled''' (Chan)
 
=== Added in 1.2 ===
* '''MaxJoins''' (User)
 
=== Older pre 1.x settings ===
* '''DCCVHost''' - This is the IP address used for DCC bouncing.
* '''BounceDCCs''' - If set to <code>true</code>, the DCCs will be bounced by ZNC.
* '''DCCLookupMethod''' - If set to <code>default</code>, ZNC will use the IP the clients sends for the DCC connections; if set to <code>client</code>, ZNC will use the IP the client connects from.
* '''Listener''' = ''[web_only|irc_only] [host or IP] [+]port'' - Configuration of listening port. Use ''web_only'' or ''irc_only'', if you don't want port to be universal. Put host/IP before the port with a space between to bind to a specific IP ''(notice that in this case the listener can't listen on both ipv4 and ipv6)''. Then goes the port ZNC will listen on. If the port is prepended with a '+' (without space) then ZNC listens using SSL. You can have several listeners in one ZNC. (Introduced in [[ChangeLog/0.090|0.090]], see next chapter for older versions)
* '''Listener4''' or '''Listener6''' - Exactly the same as '''Listener''', but will use only IPv4 or IPv6.
* '''ISpoofFile''' - ZNC will write the ident of the user trying to connect to this file. Very useful if your shell supports oidentd.
* '''ISpoofFormat''' - The format of the ISpoofFile.
Before 0.096
* '''BindHost''' was named '''vHost'''
Before 0.090:
* '''Listen''' was similar to '''Listener4''' from last version, without ''irc_only''/''web_only'' support.
* '''Listen6''' was similar to '''Listener''' or '''Listener6''' (depending on your OS) from last version, without ''irc_only''/''web_only'' support.
* TODO: When did Listeners become their own substructure?
 
[[Category:ZNC]]

Revision as of 18:03, 23 August 2021

[default]
default_md        = sha512
name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
policy            = @policy_selfsigned

[ req ]
#Options from the [ req ] section are applied
#when creating certificates or certificate signing requests.
# Options for the `req` tool (`man req`).
default_bits        = 4096
distinguished_name  = req_selfsigned
string_mask         = utf8only
default_md          = sha512


[ req_selfsigned ]
# The [ req_dn ] section declares the information
# normally required in a certificate signing request.
# You can optionally specify some defaults.
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName                     = Country Name (2 letter code)
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
localityName                    = Locality Name (eg, city)
organizationName                = Organization Name (eg, company)
organizationalUnitName          = Organizational Unit Name (eg, section)
commonName                      = Common Name (e.g. server FQDN or YOUR name)
emailAddress                    = Email Address

# Optionally, specify some defaults.
countryName_default             = IT
stateOrProvinceName_default     = Italy
localityName_default            = Italy
organizationName_default        = ZNC.in
#organizationalUnitName_default  = ZNC Service
#commonName_default             = wiki.znc.in
emailAddress_default            = user [at] example [dot] com

[ policy_selfsigned ]
# See the POLICY FORMAT section of the `ca` man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = optional
emailAddress            = optional

[ usr_cert ]
# We’ll apply the usr_cert extension when signing client certificates,
# such as those used for remote user authentication.
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage = critical, clientAuth, emailProtection, codeSigning

[ server_cert ]
# We’ll apply the server_cert extension when signing server certificates,
# such as those used for web servers.
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage = critical, serverAuth
Retrieved from "https://wiki.znc.in/index.php?title=Configuration&oldid=2929"