docs/systems/ircserver.rst

   1 .. index::
   2    single: Systems; Ircserver
   3
   4 =========
   5 Ircserver
   6 =========
   7
   8 Purpose
   9 =======
  10
  11 This system provides the CAcert IRC service for private communications,
  12 allowing usage of CAcert-secured SSL-Encrypted IRC traffic for our everyday
  13 chat, meetings, and general support.
  14
  15 Application Links
  16 -----------------
  17
  18 https://irc.cacert.org/
  19    HTTPS secured Web based IRC access
  20
  21 Administration
  22 ==============
  23
  24 System Administration
  25 ---------------------
  26
  27 * Primary: :ref:`people_jandd`
  28 * Secondary: None
  29
  30 .. todo:: find an additional admin
  31
  32 Application Administration
  33 --------------------------
  34
  35 +--------------+---------------------+
  36 | Application  | Administrator(s)    |
  37 +==============+=====================+
  38 | IRC server   | :ref:`people_jandd` |
  39 +--------------+---------------------+
  40 | IRC services | :ref:`people_jandd` |
  41 +--------------+---------------------+
  42 | Votebot      | :ref:`people_jandd` |
  43 +--------------+---------------------+
  44
  45 Contact
  46 -------
  47
  48 * irc-admin@cacert.org
  49
  50 Basics
  51 ======
  52
  53 Physical Location
  54 -----------------
  55
  56 This system is located in an :term:`LXC` container on physical machine
  57 :doc:`infra02`.
  58
  59 Logical Location
  60 ----------------
  61
  62 :IP Internet: :ip:v4:`213.154.225.233`
  63 :IP Intranet: :ip:v4:`172.16.2.14`
  64 :IP Internal: :ip:v4:`10.0.0.130`
  65 :IPv6:        :ip:v6:`2001:7b8:616:162:2::14`
  66 :MAC address: :mac:`00:ff:9a:79:ca:b1` (eth0)
  67
  68 .. seealso::
  69
  70    See :doc:`../network`
  71
  72 .. index::
  73    single: Monitoring; Ircserver
  74
  75 Monitoring
  76 ----------
  77
  78 :internal checks: :monitor:`ircserver.infra.cacert.org`
  79
  80 DNS
  81 ---
  82
  83 .. index::
  84    single: DNS records; Ircserver
  85    single: DNS records; Irc
  86
  87 =========================== ======== ====================================================================
  88 Name                        Type     Content
  89 =========================== ======== ====================================================================
  90 irc.cacert.org.             IN A     213.154.225.233
  91 irc.cacert.org.             IN AAAA  2001:7b8:616:162:2::14
  92 irc.cacert.org.             IN SSHFP 1 1 39b6c81b9fe76bd3c112f891ad3198f7a6102f4c
  93 irc.cacert.org.             IN SSHFP 1 2 30c1fce412955bb4947bbcb25a395d8e5820403eddb5746ecced578d97f46567
  94 irc.cacert.org.             IN SSHFP 2 1 90fcff63476f93d5e4f5d634ba1407445323d3fe
  95 irc.cacert.org.             IN SSHFP 2 2 734a6729a077d77c79af0e8f45187f88c25d7cd102c34aee1e753d9644c965bc
  96 irc.cacert.org.             IN SSHFP 3 1 5b9191613e743082fd4aa64e1f3a4601ed77f366
  97 irc.cacert.org.             IN SSHFP 3 2 b88f898cd5251b2b6e315a2e266873747b7cd237c0f92458916af938e4694f96
  98 irc.cacert.org.             IN SSHFP 4 1 866a42ee920b7f38a86ca9f3b07af808aae9768c
  99 irc.cacert.org.             IN SSHFP 4 2 68d44bc21d05550c8aab62163b9257c85b9bcf0a4cab1c96ad2ca674b803601c
 100 ircserver.intra.cacert.org. IN A     172.16.2.14
 101 =========================== ======== ====================================================================
 102
 103 .. seealso::
 104
 105    See :wiki:`SystemAdministration/Procedures/DNSChanges`
 106
 107 Operating System
 108 ----------------
 109
 110 .. index::
 111    single: Debian GNU/Linux; Stretch
 112    single: Debian GNU/Linux; 9.4
 113
 114 * Debian GNU/Linux 9.4
 115
 116 Services
 117 ========
 118
 119 Listening services
 120 ------------------
 121
 122 +----------+--------------+---------+----------------------------+
 123 | Port     | Service      | Origin  | Purpose                    |
 124 +==========+==============+=========+============================+
 125 | 22/tcp   | ssh          | ANY     | admin console access       |
 126 +----------+--------------+---------+----------------------------+
 127 | 25/tcp   | smtp         | local   | mail delivery to local MTA |
 128 +----------+--------------+---------+----------------------------+
 129 | 80/tcp   | http         | ANY     | redirect to https          |
 130 +----------+--------------+---------+----------------------------+
 131 | 443/tcp  | https        | ANY     | reverse proxy for kiwiirc  |
 132 +----------+--------------+---------+----------------------------+
 133 | 5666/tcp | nrpe         | monitor | remote monitoring service  |
 134 +----------+--------------+---------+----------------------------+
 135 | 6667/tcp | ircd         | ANY     | IRC                        |
 136 +----------+--------------+---------+----------------------------+
 137 | 7000/tcp | ircd         | ANY     | IRC (SSL)                  |
 138 +----------+--------------+---------+----------------------------+
 139 | 7001/tcp | ircd         | local   | IRC (services)             |
 140 +----------+--------------+---------+----------------------------+
 141 | 7778/tcp | kiwiirc      | local   | kiwiirc process            |
 142 +----------+--------------+---------+----------------------------+
 143 | 8080/tcp | irc-services | ANY     | IRC services               |
 144 +----------+--------------+---------+----------------------------+
 145
 146 irc opens a random UDP port.
 147
 148 The following port forwarding is setup on :doc:`infra02`
 149
 150 +-------------+-------+-----------------+
 151 | Intranet IP | Port  | Target          |
 152 +=============+=======+=================+
 153 | 172.16.2.14 | 13022 | 10.0.0.130:22   |
 154 +-------------+-------+-----------------+
 155 | 172.16.2.14 | 13080 | 10.0.0.130:80   |
 156 +-------------+-------+-----------------+
 157 | 172.16.2.14 | 13443 | 10.0.0.130:443  |
 158 +-------------+-------+-----------------+
 159 | 172.16.2.14 | 13667 | 10.0.0.130:6667 |
 160 +-------------+-------+-----------------+
 161 | 172.16.2.14 | 13700 | 10.0.0.130:7000 |
 162 +-------------+-------+-----------------+
 163
 164 Running services
 165 ----------------
 166
 167 .. index::
 168    single: atheme-services
 169    single: cron
 170    single: exim
 171    single: inspircd
 172    single: kiwiirc
 173    single: nginx
 174    single: nrpe
 175    single: openssh
 176    single: puppet agent
 177    single: rsyslog
 178    single: votebot
 179
 180 +--------------------+--------------------+----------------------------------------+
 181 | Service            | Usage              | Start mechanism                        |
 182 +====================+====================+========================================+
 183 | atheme-services    | IRC services       | init script                            |
 184 |                    |                    | :file:`/etc/init.d/atheme-services`    |
 185 +--------------------+--------------------+----------------------------------------+
 186 | cron               | job scheduler      | init script :file:`/etc/init.d/cron`   |
 187 +--------------------+--------------------+----------------------------------------+
 188 | Exim               | SMTP server for    | init script                            |
 189 |                    | local mail         | :file:`/etc/init.d/exim4`              |
 190 |                    | submission         |                                        |
 191 +--------------------+--------------------+----------------------------------------+
 192 | inspircd           | IRC daemon         | init script                            |
 193 |                    |                    | :file:`/etc/init.d/inspircd`           |
 194 +--------------------+--------------------+----------------------------------------+
 195 | kiwiirc            | IRC web client     | start script                           |
 196 |                    |                    | :file:`/home/kiwiirc/KiwiIRC/kiwi`     |
 197 |                    |                    | started by user kiwiirc                |
 198 +--------------------+--------------------+----------------------------------------+
 199 | nginx              | Reverse proxy for  | init script                            |
 200 |                    | kiwiirc            | :file:`/etc/init.d/nginx`              |
 201 +--------------------+--------------------+----------------------------------------+
 202 | Nagios NRPE server | remote monitoring  | init script                            |
 203 |                    | service queried by | :file:`/etc/init.d/nagios-nrpe-server` |
 204 |                    | :doc:`monitor`     |                                        |
 205 +--------------------+--------------------+----------------------------------------+
 206 | openssh server     | ssh daemon for     | init script :file:`/etc/init.d/ssh`    |
 207 |                    | remote             |                                        |
 208 |                    | administration     |                                        |
 209 +--------------------+--------------------+----------------------------------------+
 210 | Puppet agent       | configuration      | init script                            |
 211 |                    | management agent   | :file:`/etc/init.d/puppet`             |
 212 +--------------------+--------------------+----------------------------------------+
 213 | rsyslog            | syslog daemon      | init script                            |
 214 |                    |                    | :file:`/etc/init.d/syslog`             |
 215 +--------------------+--------------------+----------------------------------------+
 216 | votebot            | CAcert vote bot    | init script (spring-boot)              |
 217 |                    |                    | :file:`/etc/init.d/cacert-votebot`     |
 218 +--------------------+--------------------+----------------------------------------+
 219
 220 Connected Systems
 221 -----------------
 222
 223 * :doc:`monitor`
 224
 225 Outbound network connections
 226 ----------------------------
 227
 228 * :doc:`infra02` as resolving nameserver
 229 * :doc:`emailout` as SMTP relay
 230 * :doc:`puppet` (tcp/8140) as Puppet master
 231 * :doc:`proxyout` as HTTP proxy for APT
 232
 233 Security
 234 ========
 235
 236 .. sshkeys::
 237    :RSA:     SHA256:MMH85BKVW7SUe7yyWjldjlggQD7dtXRuzO1XjZf0ZWc MD5:dc:8f:c3:d7:38:72:39:13:6f:97:db:3d:06:c6:83:db
 238    :DSA:     SHA256:c0pnKaB313x5rw6PRRh/iMJdfNECw0ruHnU9lkTJZbw MD5:52:73:d9:76:38:df:bd:18:37:4a:e3:9d:65:14:ac:39
 239    :ECDSA:   SHA256:uI+JjNUlGytuMVouJmhzdHt80jfA+SRYkWr5OORpT5Y MD5:61:9f:ca:c7:05:0e:46:a1:8f:6d:7f:3a:68:ce:5a:21
 240    :ED25519: SHA256:aNRLwh0FVQyKq2IWO5JXyFubzwpMqxyWrSymdLgDYBw MD5:79:2a:a2:ca:99:23:50:2c:1c:48:cf:8c:fe:b9:51:e5
 241
 242 Dedicated user roles
 243 --------------------
 244
 245 +---------+-------------------------------------+
 246 | User    | Purpose                             |
 247 +=========+=====================================+
 248 | votebot | used to run the votebot             |
 249 +---------+-------------------------------------+
 250 | kiwiirc | used to run the Kiwi IRC web client |
 251 +---------+-------------------------------------+
 252
 253 Non-distribution packages and modifications
 254 -------------------------------------------
 255
 256 The Puppet agent package and a few dependencies are installed from the official
 257 Puppet APT repository because the versions in Debian are too old to use modern
 258 Puppet features.
 259
 260 Votebot
 261 ~~~~~~~
 262
 263 The :ref:`Votebot <votebot>` is a custom developed IRC daemon that is packaged
 264 as a self contained executable Spring-Boot jar archive. The bot is started via
 265 init.
 266
 267 .. _votebot:
 268
 269 .. topic:: Votebot
 270
 271    The vote bot is a Java based IRC bot developed at
 272    https://git.cacert.org/gitweb/?p=cacert-votebot.git and built at
 273    https://jenkins.cacert.org/job/cacert-votebot/. The bot is started
 274    automatically via its init script.
 275
 276 Kiwi IRC
 277 ~~~~~~~~
 278
 279 Kiwi IRC is a nodejs based IRC web client. The software has been installed via
 280 `Github <https://github.com/prawnsalad/KiwiIRC.git>`_ and npm as described in
 281 https://kiwiirc.com/docs/installing and
 282 https://kiwiirc.com/docs/installing/proxies. The software is running on the
 283 local loopback interface and Internet access is provided by an nginx reverse
 284 proxy that also provides https connectivity. NodeJS and npm have been installed
 285 from Debian packages.
 286
 287 .. todo:: setup init script for kiwiirc
 288
 289 Risk assessments on critical packages
 290 -------------------------------------
 291
 292 Votebot is a Java based application and therefore Java security patches should
 293 be applied as soon as they become available.
 294
 295 Kiwi IRC is nodejs based and uses some third party npm packages. The
 296 application is kept behind a reverse proxy but it is advisable to make sure
 297 that available updates are applied.
 298
 299 .. todo:: implement some update monitoring for Kiwi IRC
 300
 301 The system uses third party packages with a good security track record and
 302 regular updates. The attack surface is small due to the tightly restricted
 303 access to the system. The puppet agent is not exposed for access from outside
 304 the system.
 305
 306 Critical Configuration items
 307 ============================
 308
 309 The system configuration is managed via Puppet profiles. There should be no
 310 configuration items outside of the Puppet repository.
 311
 312 .. todo:: move configuration of :doc:`ircserver` to Puppet code
 313
 314 Keys and X.509 certificates
 315 ---------------------------
 316
 317 .. sslcert:: irc.cacert.org
 318    :altnames:   DNS:irc.cacert.org, DNS:ircserver.cacert.org
 319    :certfile:   /etc/ssl/public/irc.cacert.org.crt
 320    :keyfile:    /etc/ssl/private/irc.cacert.org.key
 321    :serial:     1381E8
 322    :expiration: Mar 16 09:35:36 2020 GMT
 323    :sha1fp:     42:F6:7C:4E:0C:AC:8A:42:7D:9A:94:55:7E:73:7E:E9:40:5C:87:91
 324    :issuer:     CA Cert Signing Authority
 325
 326 .. index::
 327    pair: inspircd; configuration
 328
 329 inspircd configuration
 330 ----------------------
 331
 332 Inspircd is installed from a Debian package. It is configured via files in
 333 :file:`/etc/inspircd/`. The main configuration file is :file:`inspircd.conf`.
 334
 335 .. index::
 336    pair: atheme-services; configuration
 337
 338 atheme-services configuration
 339 -----------------------------
 340
 341 Atheme-services is installed from a Debian package. It is configured via
 342 :file:`/etc/atheme/atheme.conf`.
 343
 344 .. index::
 345    pair: Kiwi IRC; configuration
 346
 347 Kiwi IRC configuration
 348 ----------------------
 349
 350 Kiwi IRC configuration is kept in :file:`/home/kiwiirc/KiwiIRC/config.js`. When
 351 the configuration is changed it can be applied by running:
 352
 353 .. code-block:: bash
 354
 355    sudo -s -u kiwi
 356    cd ~/KiwiIRC
 357    ./kiwi reconfig
 358
 359 nginx configuration
 360 -------------------
 361
 362 The nginx configuration for reverse proxying Kiwi IRC is stored in
 363 :file:`/etc/nginx/sites-available/default`. The same certificate and private
 364 key are used for inspirced and nginx.
 365
 366 votebot configuration
 367 ---------------------
 368
 369 Votebot is configured via spring-boot mechanisms. The current configuration file
 370 is :file:`/home/votebot/cacert-votebot-0.1.0-SNAPSHOT.conf` and configures
 371 Votebot to connect to localhost as VoteBot. The bot uses the channels #agm and
 372 #vote. Channels could be changed in an :file:`application.properties` file in
 373 :file:`/home/votebot`. The available property names can be found in the `git
 374 repository`_.
 375
 376 .. _git repository: https://git.cacert.org/gitweb/?p=cacert-votebot.git;a=blob;f=src/main/resources/application.properties
 377
 378 Tasks
 379 =====
 380
 381 Planned
 382 -------
 383
 384 - None
 385
 386 Changes
 387 =======
 388
 389 - Nothing planned
 390
 391 Additional documentation
 392 ========================
 393
 394 .. seealso::
 395
 396    * :wiki:`Exim4Configuration`
 397    * :wiki:`Technology/TechnicalSupport/EndUserSupport/IRC`
 398
 399 References
 400 ----------
 401
 402 Atheme services website
 403    https://atheme.github.io/atheme.html
 404
 405 Inspircd wiki
 406    https://wiki.inspircd.org/
 407
 408 Kiwi IRC documentation
 409    https://kiwiirc.com/docs/
 410
 411 nginx documentation
 412    http://nginx.org/en/docs/