Cloaking is a security feature which hides the IP address and hostname of users on IRC. Below you can read in more detail what it is exactly, how it works and how to change the server settings with regards to cloaking.
What is cloaking
With cloaking turned off, a join on IRC looks like this:
*** User (~email@example.com) has joined #test
With cloaking turned on, users will see:
*** User (~none@rox-2DCA3201.example.net) has joined #test
The first part of the host is partially hidden or "cloaked". Other people won't see your real hostname or IP address. This security feature is useful to prevent users from flooding/attacking each other. They can't flood the other person without knowing their real host/IP. The host is not just cloaked in JOIN's, it is hidden everywhere, including in PART, WHOIS and WHO. Only IRCOps can see the real host / real IP.
The same cloaked host is always generated for the same real host/IP. Thus you can still ban the user with
/MODE #test +b *!*@rox-2DCA3201.example.net.
Cloaking is enabled via user mode +x (like:
/MODE yournick +x) but it is usually enabled by default already (see server configuration below).
Cloaking does not protect against everything
Cloaking helps to protect someone on IRC but there are still other ways to retrieve the IP address of users outside of IRC. A common trick by an attacker would be to paste an URL in the channel. Then, if the victim surfs to it, the attacker can see the victims' real IP address by looking at the webserver logs.
Cloaked IP addresses
When a host does not resolve, only the IP is known. In that case the join won't whow the real IP:
*** User (~firstname.lastname@example.org) has joined #test
But will instead look like this:
*** User (~none@AAAAAAAA.BBBBBBBB.CCCCCCCC.IP) has joined #test
As expected, banning the full host
*!*@AAAAAAAA.BBBBBBBB.CCCCCCCC.IP will ban the IP
*!*@198.51.100.150. But, there are more options available:
|IP Address||Cloaked ban||Effective ban||Description|
||Only bans the IP|
||Bans the /24 netblock|
||Bans the /16 netblock|
||Only bans the IP|
||Bans the /112 netblock|
||Bans the /64 netblock|
If you want cloaking to use the cloaked IP address style always, even for hostnames that resolve fine, then see Forcing to use the IP-style cloaking at the end of next section.
Enabling and forcing cloaking
Admins normally want users to be cloaked by default. This is done by adding
x to set::modes-on-connect. This is already done in both the example configuration files and in the default settings.
Even if users are cloaked by default, they can still unset it to disable their own cloaking. If you want to prevent this, so want users never be able to disable cloaking in any way, then add
x to set::restrict-usermodes.
If you don't want your users to be cloaked by default, then remove the
x from modes-on-connect. Users can then still manually set themselves
+x. If you don't want that either, then add
x to set::restrict-usermodes. Note that cloaking is a security feature for your users and thus disabling it is NOT recommended.
A cloaked host is generated by a cloaking module. You must load at least one cloaking module. This too, is done by default already via the default modules.default.conf that almost everyone uses. It is also possible to use another cloaking algorithm created by a 3rd party, but not many have been written.
The cloaking algorithm requires secret cloaking keys to be set, see set::cloak-keys for more information. It is VERY important to keep the cloak keys secret. If the cloak keys are known by other (bad) people then it is theoretically possible to decode (or rather: brute force) the original host. If your cloaking keys are leaked or stolen then we suggest changing them. Note though, that this makes all current bans on cloaked hosts and IPs ineffective so this has a major impact on bans. There is no way to convert bans with cloak-keys X to bans with new cloak-keys Y. It is therefore best to avoid leaking cloak-keys at all cost!
Forcing to use the IP-style cloaking
Some admins find cloaked hostnames such as
d5142341.example.net too revealing. They prefer to always use the cloaked IP address style instead such as
6CAB8F7C.1067B5DC.20B6CFB2.IP. If you want that, then set the option set::cloak-method to ip.