channel security concept

tripp · Post by **tripp** » Fri Sep 12, 2003 3:09 am

hi,
first off let me say thanks to everyone for all of the info i have learned from this board. i've been a long time reader but haven't posted much, if at all. also many thanks to slennox for netbots, great stuff.

i have a 16 bot botnet (on 5 different shells), and im trying to figure out the most efficient way to set these bots to achieve the most security for my efnet channel. i have read johoho's channel security concept, and i'm wondering what everyone thinks about his ideas for dividing the bots duties up on these levels? is this going to introduce any major holes in security?

im thinking of dividing my bots up with 4 bots in charge of opping, 3 in charge of dealing with the public, 5 in charge of security, and finally 3 bots that will not have duties split at all.

the bots on the different duties will be spread across the different shells and irchubs as much as possible.

i know that channel security is kind of a secretive issue, but, if you have any info that you are willing to share with the rest of us, feel free to post config options or script recomendations, because i'm still a little confused over which bot duties should get what settings. in the past my bots have always all ran the same settings, this whole division of duties concept is rather new to me.

any other suggestions from some of the more experienced users?
im open to any criticism/suggestions.

thanks much,
t

BiLL · Post by **BiLL** » Sat Sep 13, 2003 6:34 am

yeah i would like to see some botnetop settings or even all netset settings/conf settings from some eggdrop gurus here hehe

.

tripp · Post by **tripp** » Sat Sep 13, 2003 12:08 pm

yeah, i would like to as well.

i know there are some serious eggy guru's in here, but, i also had a feeling that no one would want to share their personal security tricks. so it is not a big shock to see that no one is.

i'm currently working on the different config settings and netset settings, the trickiest part so far is trying to figure out the settings for each duty of the bot in sentinel...

.... for instance, turning off certain flood protections in sentinel for each bot depending on the duties of each bot.

this would not be so difficult if i was not so paranoid, i keep thinking this is going to break netbots (namely sentinel.) and in turn render my bots useless.

so, please if anyone would share their ideas, it would ease my concerns. and i know there are a lot of other readers here wondering the same things.

t

Post by **Sir_Fz** » Sat Sep 13, 2003 2:02 pm

well turning some sentinel protections would be setting them to 0:0 rather than playing with the code.

tripp · Post by **tripp** » Sat Sep 13, 2003 8:01 pm

Sir_Fz wrote:well turning some sentinel protections would be setting them to 0:0 rather than playing with the code.

yup... i am not playing with the code....

thats why im interested in settings advice... not coding advice.

i think they are almost ready, ill be happy to share my -config and -netset settings once i am finished.

t

p.s. sir_fz i'm interested in getting another shell, where are your servers located? are they at foo? do you have multiple boxes? drop me a pm.

gumbydammit · Post by **gumbydammit** » Sat Sep 13, 2003 8:43 pm

it would be nearly impossible to tell you settings tripp..Your settings for your channels will diff from other peoples channels as they depend on size, traffic and many other things.. so my advice is to play with the settings extensively.. until you are happy with their sensitivity.Splitting your bots tasks is never a bad idea.. i do it.. bots work best when not overloaded with things to do obviously..

tainted · Post by **tainted** » Mon Sep 15, 2003 1:49 am

Also remember that having your net really paranoid can cause you more headaches than sighs of relief in the future. Using three bots per shell like that is a huge hole in your security imo as well. A well executed flood on those couple of shells - even half of them - would render your net basicly useless when you divide the duties like that.

Your best bet in my opinion is to get a nice spread and traceroute each of the irc servers from each shell - make sure the bots connect to the closest servers to their box first. Also, consider limbo'ing your hub - it provides a layer of secrecy against intrusion attempts to its shell, DoS attacks, and in the event of large scale channel flooding it wouldn't be lagged up trying to play hub, kicking/banning/moding/etc along with internal botnet stuff. Keep every bot doing everything unless you run pub triggers like quotes and games - those are always best on their own, unlinked, non-privilaged bot. I've seen so many scripts with pub triggers get exploited due to weak tcl coding - if that did happen it would be isolated and that one bot vs your real net wouldnt be a match. Just my 2p..Been messin with bots on efnet for years.