Controlling access to your channel

1 · Why you need to know this information

DALnet encourages you to read this guide because:

• If your channel encounters problems such as abusive behaviour or a takeover, and you are not there, you will need HOPs, AOps and possibly SOps/Managers so that the problem can be solved.

• We have added a Manager access in Channels oplist, to know more about how to add Managers please visit http://docs.dal.net/docs/chanserv.html#5.

• If your channel becomes large, you may need Managers to help manage it.

• Adding the wrong people as HOPs/AOps/SOps/Managers, or adding HOPs/AOps/SOps/Managers in the wrong way, can cause security loopholes that might let unfriendly users cause problems in the channel, so you should be fully informed about using these features.

• If you need permanent bans on users, you'll need to know how to set AKICKs.

A summary can be found in section 9 , which briefly explains who you should add as SOps, AOps or HOPs and how to add them.

2 · What HOPs/AOps/SOps and Managers are

HOPs / AOps / SOps and Managers people whom you trust enough to allow them certain powers on your channel.

Managers are the "highest" level of channel ops (@). They have *almost* full control over the channel with the exception of changing the channel's foundership. Please visit http://docs.dal.net/docs/chanserv.html#5 for more instructions.

SOps are a "higher" level than AOps and have all the AOp privileges in addition to some extra powers. As the founder, you are at a higher level still and you have all the SOp and AOp privileges, plus some founder-only powers. There is no need to add yourself to the SOp or AOp lists. HOPs have the lowest access level in the channel.

It's beyond the scope of this guide to give help on how to use all the ChanServ powers that are granted to AOps and SOps. However, by each ability the appropriate help command is given; typing this while on IRC will provide more information.

HOPs have the following powers:

• They are given ops (%) when they enter the channel; if for some reason they are in the channel without ops, they can get ChanServ to give them ops at any time. ( /chanserv help op )

• They can kick other users who aren't opped (+o) or voiced (+v).

• They can change the topic of the channel even if +t is set.

• They can unban themselves from the channel if they are banned. ( /chanserv help unban )

• They receive memos that are sent to the whole 'channel'. They may also be able to send memos to the whole channel; there is a channel setting that determines whether HOPs, AOps, SOps, or just the founder can send memos to the channel. ( /chanserv help set memo , /memoserv help send )

• They can invite themselves to the channel (useful if it is invite-only) unless it has been set "private". ( /chanserv help invite )

• They can view the channel HOp, AOp, SOp, and AKICK lists. (see section 4 )

AOps have the following powers:

• They are given ops (@) when they enter the channel; if for some reason they are in the channel without ops, they can get ChanServ to give them ops at any time. ( /chanserv help op )

• They can use ChanServ to give/remove ops to/from other members of the channel (if they do this, a notice will be sent to the channel alerting others on the channel of the action, so it is not anonymous). ( /chanserv help op )

• They can unban themselves from the channel if they are banned. ( /chanserv help unban )

• They receive memos that are sent to the whole 'channel'. They may also be able to send memos to the whole channel; there is a channel setting that determines whether HOps, AOps, SOps, or just the founder can send memos to the channel. ( /chanserv help set memo , /memoserv help send )

• It is possible to set channels so that only ops can change the topic. (However it's also possible to set them so that only Managers/SOps or only the founder can change the topic.) ( /chanserv help set topiclock )

• They can use the MDEOP commands to solve channel takeover problems, but this will not work if SOps or the founder are on the channel. ( /chanserv help mdeop )

• They can invite themselves to the channel (useful if it is invite-only) unless it has been set "private". ( /chanserv help invite )

• They can view the channel HOp, AOp, SOp, and AKICK lists. (see section 4 )

SOps have the following powers:

• They can use the MKICK command to solve channel takeover problems, but this will not work if the founder is on the channel. ( /chanserv help mkick ) (see section 4 )

• They can give, and take away, AOp privileges from people. (see section 4 )

• They can set or remove AKICKs (permanent bans) for the channel. (see section 7 and section 8 )

• They can remove all bans from the channel using ChanServ. ( /chanserv help unban )

• They receive memos sent to channel SOps. ( /memoserv help sendSOp )

Managers have the following additional powers:

Channel Managers can:
- Manage the SOp list (add/remove SOps)
- Change WEBPASSWD                
- Wipe HOp/VOp/AOp/SOp lists
- Change channel description
- Masskick and massdeop a channel up to and including the access level of AOp
- Set/unset OPGUARD
- Set/unset VOICEGUARD
- Set/unset HOPGUARD
- Set/unset MLOCK
- Set/unset IDENT
- Set/unset KEEPTOPIC
- Set/unset RESTRICT
- Set/unset URL
- Set/unset VERBOSE
- Set/unset TOPICLOCK (unless it's locked to the founder)
- Set/unset LEAVEOPS
- Set/unset PRIVATE
- Set/unset MEMO level (unless it's locked to the founder)
- See successor's nick with ChanServ INFO

Channel Managers can *NOT*:
- Change channel password
- Change founder
- Set/unset successor
- Set/unset mailblock
- Add/remove other Managers
- Set/unset UNSECURE (currently broken and doesn't do anything)
- Use sendpass

3 · Things to consider when giving op (@, %) access privileges

HOPs/AOps/SOps and Managers are the people who can handle channel problems such as flooding and takeovers when you are not there. If you intend to run a successful channel, it is your reponsibility to ensure there are sufficient HOPs, AOps (especially) and SOps so that order in the channel can be maintained. If the channel is being used with no HOPs/AOps present, then it is an easy target for flooding and abuse.

When you give people op (@, %) access privileges, you give them some control over the channel, but they are still answerable to you - you could remove their access privileges at any time.

However, you should still make sure only to give op (@, %) access to people that you trust as they can cause problems. Although they cannot do any permanent damage - the founder can undo any changes they make - they can certainly cause serious problems especially when you're not there. You should keep this in mind when giving op (@, %) access privileges.

On a similar note: never give out the password to the channel to anyone. This is the same as handing over the channel to them - co-founderships are not supported by DALnet and in a dispute, anybody with the password is considered the sole owner of the channel. If you want to share power on your channel with others who you trust, make them Managers.

If a different arrangement is desirable, you can use socially agreed restrictions (for example, the founder might agree never to add Managers without consulting the existing Managers). However DALnet's software and staff will always consider the founder of a channel to be the only person finally responsible for how that channel is run. And please note that DALnet will never help anyone who loses a channel because they shared a password; passwords should always be kept secure.

4 · How to add or remove Managers/SOps/AOps and HOPs

The channel founder or Manager are the only ones who can give or take away SOp privileges. However, the founder is the only one who can give or take away Manager privileges. Managers/SOps and the founder can give or take away HOp/AOp privileges. The list commands are available to AOps/SOps or Managers and the founder, but not to ordinary users.

5 · Advice on using address masks in your access list

It's generally best to use nicknames, rather than address masks, in op(@, %) access lists. You can only add a channel manager using a nickname and not a hostmask. There are several reasons for this:

• You can always tell exactly who has HOP/AOp/SOp access.

• It's not really possible to make a mistake and give lots more people AOps than were intended (for example if you put a * in the wrong place in a mask.)

• If you encounter problems with somebody using the same server as an AOp and getting ops meant for the AOp, these can be solved without removing AOps from the genuine person.

There is one advantage to using address masks:

• You can always tell exactly what address masks will get ops automatically.

If you do decide to use address masks to give AOps, see the Ban Guide which explains address masks.

Note that although that guide explains how to use them to ban people, when you use them on the AOp list they are not banned but given AOps.

6 · Problems with the wrong people getting access

(Note: This section is written about AOps, but all of it applies to SOps as well.)

There are times you may find someone you did not add to the access list(s) gain access to the channel. The reason why this happens is because of the ops (@) hostmask matches the one listed in the Op's NickServ's access list.

People can get ops in the channel (but not access to any of the ChanServ AOp commands) if ChanServ is down and your channel is empty when they enter it. Unfortunately, there's nothing you can do about this, but ChanServ rarely stays down for more than a few minutes.

People can also get ops if they are given them by somebody who already has ops (e.g. an AOp/SOp or Managers). If you do not want to allow this, you can use a feature called OPGUARD which is explained at the end of this section.

7 · What AKICKs are

AKICKs are the ChanServ equivalent of a ban from the channel and are used to remove offending users from your channel. They do not disappear if the channel becomes empty; they stay until the channel founder or Manager or SOp removes them.

The key problem with standard channel bans (the sort you get when you click the 'Ban' option on popup menus, or type /ban or /mode #channel +b mask commands) is that these are temporary; if everybody leaves the channel so that it's empty, the system 'forgets' all the normal bans that were set.

Normally bans are set to deal with temporary nuisances so this is not a problem. However, sometimes you can encounter problems with a user who continually comes to the channel to cause problems - in this case, you need to ban them permanently.

In this situation you use AKICKs, which work similarly to bans but are handled by Services - when a user on the AKICK list enters a channel, they are automatically banned and kicked out by ChanServ. As mentioned above, AKICKs don't disappear until they are removed, even if the channel becomes empty.

8 · How to add or remove AKICKs

Only channel founders/Managers and SOps have the power to add or remove AKICKs.

9 · Summary

Managers/SOps, AOps and HOps are people you trust enough to give them some power on your channel. Among other things, this means that they will automatically be given ops (@,%) when they enter. Managers can change some of the channel's settings, can add or remove SOps/AOps/HOps and AKICKs (only trusted users can gain this access). SOps also have the ability to add and remove AOps, hOps and AKICKs (permanent bans from the channel), so you should be especially careful when making people SOps.

If there is somebody you trust whom you think should have AOps on your channel

Type /nickserv info nick to check their nick is registered - if it is not, ask them to register it and repeat the above when they've done so. Once you're sure the nickname is registered, type /chanserv AOp #channel add nick .

If your channel needs a Manager or SOp for some reason - for instance if it is a large channel and you need help with channel management such as choosing AOps

Be certain you can trust the person you'd like to make an Manager or SOp, and check their nick is registered as above. Then type /chanserv Manager #channel add nick . /chanserv SOp #channel add nick .

If at a later date you need to remove an HOp, AOp, SOp or Manager from the channel list because they have proven untrustworthy, left IRC, or similar

Type /chanserv HOp or AOp or SOp or Manager #channel list . When you find the entry for that person, you should note the number and type /chanserv HOp or AOp or SOp or Manager #channel del number .

If you need to ban somebody permanently

You (or an Manager or SOp on the channel; not AOps) can add them to the AKICK list by using /chanserv akick #channel add mask , where mask is a standard ban mask for the troublemaker. You can remove AKICKs at a later date in a similar way to removing AOps or SOps or Managers. (See section 8 .)