Controlling access to your channel

Why you need to know this information

DALnet encourages you to read this guide because:

If your channel encounters problems such as abusive behaviour or a takeover, and you are not there, you will need AOPs and possibly SOPs so that the problem can be solved.

If your channel becomes large, you may need SOPs to help manage it.

Adding the wrong people as AOPs or SOPs, or adding AOPs or SOPs in the wrong way, can cause security loopholes that might let unfriendly users cause problems in the channel, so you should be fully informed about using these features.

If you need permanent bans on users, you'll need to know how to set AKICKs.

A summary can be found in , which briefly explains who you should add as SOPs or AOPs and how to add them.

What AOPs and SOPs are

AOPs and SOPs are people whom you trust enough to allow them certain powers on your channel.

SOPs are a "higher" level than AOPs and have all the AOP privileges in addition to some extra powers. As the founder, you are at a higher level still and you have all the SOP and AOP privileges, plus some founder-only powers. There is no need to add yourself to the SOP or AOP lists.

It's beyond the scope of this guide to give help on how to use all the ChanServ powers that are granted to AOPs and SOPs. However, by each ability the appropriate help command is given; typing this while on IRC will provide more information.

AOPs have the following powers:

They are given ops (@) when they enter the channel; if for some reason they are in the channel without ops, they can get ChanServ to give them ops at any time. ( /chanserv help op )

They can use ChanServ to give/remove ops to/from other members of the channel (if they do this, a notice will be sent to the channel alerting others on the channel of the action, so it is not anonymous). ( /chanserv help op )

They can unban themselves from the channel if they are banned. ( /chanserv help unban )

They receive memos that are sent to the whole 'channel'. They may also be able to send memos to the whole channel; there is a channel setting that determines whether AOPs, SOPs, or just the founder can send memos to the channel. ( /chanserv help set memo , /memoserv help send )

It is possible to set channels so that only ops can change the topic. (However it's also possible to set them so that only SOPs or only the founder can change the topic.) ( /chanserv help set topiclock )

They can use the MDEOP commands to solve channel takeover problems, but this will not work if SOPs or the founder are on the channel. ( /chanserv help mdeop )

They can invite themselves to the channel (useful if it is invite-only) unless it has been set "private". ( /chanserv help invite )

They can view the channel AOP, SOP, and AKICK lists. (see )

SOPs have the following additional powers:

They can use the MKICK command to solve channel takeover problems, but this will not work if the founder is on the channel. ( /chanserv help mkick ) (see )

They can give, and take away, AOP privileges from people. (see )

They can set or remove AKICKs (permanent bans) for the channel. (see and )

They can remove all bans from the channel using ChanServ. ( /chanserv help unban )

They receive memos sent to channel SOPs. ( /memoserv help sendsop )

Things to consider when giving AOP or SOP privileges

AOPs and SOPs are the people who can handle channel problems such as flooding and takeovers when you are not there. If you intend to run a successful channel, it is your reponsibility to ensure there are sufficient AOPs (especially) and SOPs so that order in the channel can be maintained. If the channel is being used with no AOPs present, then it is an easy target for flooding and abuse.

When you give people AOP or SOP privileges, you give them some control over the channel, but they are still answerable to you - you could remove the AOP or SOP privileges at any time.

However, you should still make sure only to give AOPs or SOPs to people that you trust as they can cause problems. Although they cannot do any permanent damage - the founder can undo any changes they make - they can certainly cause serious problems especially when you're not there. You should keep this in mind when giving AOP or SOP privileges.

On a similar note: never give out the password to the channel to anyone. This is the same as handing over the channel to them - co-founderships are not supported by DALnet and in a dispute, anybody with the password is considered the sole owner of the channel. If you want to share power on your channel with others who you trust, make them SOPs.

If a different arrangement is desirable, you can use socially agreed restrictions (for example, the founder might agree never to add SOPs without consulting the existing SOPs). However DALnet's software and staff will always consider the founder of a channel to be the only person finally responsible for how that channel is run. And please note that DALnet will never help anyone who loses a channel because they shared a password; passwords should always be kept secure.

How to add or remove AOPs and SOPs

The channel founder is the only one who can give or take away SOP privileges. SOPs and the founder can give or take away AOP privileges. The two list commands are available to AOPs or SOPs and the founder, but not to ordinary users.

Listing current SOPs or AOPs /chanserv sop #channel list /chanserv aop #channel list

These commands list all the SOPs or AOPs (respectively) on the channel.

If you have a large channel, you may find it useful to list only selected SOPs or AOPs based on their nicknames or masks:

/chanserv sop #channel list wildcard /chanserv aop #channel list wildcard

(For example, /chanserv aop #mychannel list g* would list all AOPs on #mychannel whose nicknames began with g.)

Whichever list command you use, each AOP or SOP is listed with a number which makes it easier to remove them if necessary (see below).

Adding SOPs or AOPs /chanserv sop #channel add nick or mask /chanserv aop #channel add nick or mask

These commands add people to the SOP or AOP lists. This is equivalent to giving people SOP or AOP privileges.

Generally you should add AOPs or SOPs using their nick (which should be registered) but you can also do so with a mask if necessary. Masks work in the same way as channel ban masks - though of course here they have the effect of granting AOP or SOP privileges to the target, not banning them - and are not explained in this guide; for more information see the Ban Guide.

If you want to make somebody an SOP who is currently an AOP (or vice versa), you don't need to remove them from the AOP list, because Services will automatically remove them for you at the same time as adding them to the SOP list.

You should check somebody has a registered nick before you give them AOPs by typing

/nickserv info nick

and ask them to register if their nick isn't registered. If you try to add AOPs for somebody whose nick isn't registered, it will add them using a mask, which isn't really a good idea (see ).

Each channel is limited to a maximum of 300 AOPs and 100 SOPs. ChanServ will warn you if you attempt to add more than this.

Note: Users can set a nickname mode NOOP which will mean they can't be added to any channel AOP or SOP lists. See /nickserv help set noop for more information.

Removing SOPs or AOPs /chanserv sop #channel del number or entry in list /chanserv aop #channel del number or entry in list

These commands are used to remove people from the SOP or AOP lists. SOPs and AOPs may be removed for misconduct or for whatever the reason may be.

You can use these commands in several ways; the easiest is to first use the appropriate list command, and then give the number of the entry you want deleted. Alternatively, you can give the nick or the access mask you want deleted; if you use this method you must specify the nick or mask exactly as it is given in the list.

If you are deleting entries based on their numbers in the list, you should only delete a single entry at a time. The numbers may change after each deletion, so you will need to repeat the list command to check what the correct number is.

VERBOSE mode

If the VERBOSE mode is turned on for a channel, then whenever there is a change to certain aspects of the channel (in particularly, when somebody adds or removes AOP/SOPs or AKICKs), all ops currently on the channel will be informed with a notice.

To enable this feature:

/chanserv set #channel verbose on

Advice on using address masks in your AOP/SOP lists

It's generally best to use nicknames, rather than address masks, in AOP/SOP lists. There are several reasons for this:

You can always tell exactly who has AOPs or SOPs.

It's not really possible to make a mistake and give lots more people AOPs than were intended (for example if you put a * in the wrong place in a mask.)

If you encounter problems with somebody using the same server as an AOP and getting ops meant for the AOP, these can be solved without removing AOPs from the genuine person.

There is one advantage to using address masks:

You can always tell exactly what address masks will get ops automatically.

If you do decide to use address masks to give AOPs, see the Ban Guide which explains address masks.

Note that although that guide explains how to use them to ban people, when you use them on the AOP list they are not banned but given AOPs.

Problems with the wrong people getting AOPs/SOPs

(Note: This section is written about AOPs, but all of it applies to SOPs as well.)

There are times you may find someone you did not add to the access list(s) gain access to the channel. The reason why this happens is because of the AOP or SOP's hostmask matches the one listed in the Op's NickServ's access list.

People can get ops in the channel (but not access to any of the ChanServ AOP commands) if ChanServ is down and your channel is empty when they enter it. Unfortunately, there's nothing you can do about this, but ChanServ rarely stays down for more than a few minutes.

People can also get ops if they are given them by somebody who already has ops (e.g. an AOP or SOP). If you do not want to allow this, you can use a feature called OPGUARD which is explained at the end of this section.

Finding out why somebody has privileges

To discover why somebody has AOP or SOP privileges in a channel, you can use the ChanServ why command:

/chanserv why #channel nickname

This will explain the AOP or SOP list entry (if any) that is responsible for granting that person privileges, so it can be temporarily removed if there is a problem.

Access list problems

When you have people added to your AOP list by nickname, this means that anybody matching the 'access list' of any of your AOPs will get AOP privileges in the channel.

If people who aren't AOPs get opped by ChanServ on the channel, there may well be a problem with access lists - you can normally tell which AOP's list is the problem because the non-AOP who got opped will come from the same service provider (eg aol.com, netcom.com, iquest.net, etc.) as one of your AOPs. You can confirm this with the why command given above.

You should contact the AOP (by memo if they are not online) suggesting that they improve their access list or remove it entirely, identifying to NickServ with their password when they log on to DALnet. In the meantime, if the person who has ops is causing trouble you may want to temporarily remove the relevant AOP privileges.

If you or they don't fully understand the concept of NickServ access lists - which allow you to use your nickname on DALnet without giving the password every time, but introduce security weaknesses if you use a major Internet service provider - then the NickServ Access Guide contains the explanation you need.

You've probably realised by now that a malicious AOP could intentionally set their access list to, for instance, allow everybody ops on the channel. This is another reason for making sure you trust people before you give them AOPs.

As a temporary solution if there is a problem with access masks, or if security needs to be high, you can set IDENT mode on for the channel. This means that ChanServ will only allow those AOPs who've also identified to NickServ (with the password for their nick) access to their privileges on the channel, including ops.

The founder can set IDENT mode for a channel using

/chanserv set #channel ident on

Note that if you do this, any entries using masks rather than nicknames will not have any effect. For more information:

/chanserv help set ident Unwanted ops

Even when ChanServ manages a channel, it is possible that some people who are not AOPs or SOPs might get ops (@) in that channel. The main way this can happen is if an AOP gives them ops.

If you as channel founder do not want this to happen, you can enable the OPGUARD feature. When this feature is turned on, ChanServ will not allow people to have ops (@) on a channel (even temporarily) unless they are on the AOP or SOP list or are the founder. If somebody else is given ops, ChanServ will remove their ops immediately.

To enable this feature:

/chanserv set #channel opguard on

What AKICKs are

AKICKs are the ChanServ equivalent of a ban from the channel and are used to remove offending users from your channel. They do not disappear if the channel becomes empty; they stay until the channel founder or SOP removes them.

The key problem with standard channel bans (the sort you get when you click the 'Ban' option on popup menus, or type /ban or /mode #channel +b mask commands) is that these are temporary; if everybody leaves the channel so that it's empty, the system 'forgets' all the normal bans that were set.

Normally bans are set to deal with temporary nuisances so this is not a problem. However, sometimes you can encounter problems with a user who continually comes to the channel to cause problems - in this case, you need to ban them permanently.

In this situation you use AKICKs, which work similarly to bans but are handled by Services - when a user on the AKICK list enters a channel, they are automatically banned and kicked out by ChanServ. As mentioned above, AKICKs don't disappear until they are removed, even if the channel becomes empty.

How to add or remove AKICKs

Only channel founders and SOPs have the power to add or remove AKICKs.

Listing current AKICKs /chanserv akick #channel list

This command, which can be used by channel AOPs as well as SOPs and the founder, lists all of the AKICKs currently in place on the channel.

Each AKICK is listed together with a number which you can use to remove it more easily.

Adding an AKICK by mask /chanserv akick #channel add mask

This command adds an AKICK to the channel. You must specify the user's mask in the same way as for a ban - nickname ! username @ hostname .

If the address in /whois of a user you were trying to ban was user@dialup22-81.provider.com and your channel was called #frogs, you would typically use /chanserv akick #frogs add *!user@*.provider.com ('AKICK people with any nickname, if they have the username "user", and are coming from provider.com')

For more guidance on address masks for bans, which work the same way in AKICKs as in channel, please see the Ban Guide.

You can add a maximum of 200 AKICKs for a single channel.

Adding an AKICK by nickname /chanserv akick #channel add nickname

If the person has a registered nickname, you can add an AKICK using their nick. This may or may not be useful because in some cases they can simply connect with a different nickname to evade the ban.

So if you don't understand address masks for bans, you can use this method instead, but it is more reliable to do it by manually specifying the mask.

Removing an AKICK /chanserv akick #channel del number or mask

You can use this commands in two ways; the easiest is to first use the list command (given above), and then give the number of the entry you want deleted. Alternatively, you can give the mask you want deleted; if you use this method you must specify the mask exactly as it is given in the list.

Summary

SOPs and AOPs are people you trust enough to give them some power on your channel. Among other things, this means that they will automatically be given ops (@) when they enter. SOPs also have the ability to add and remove AOPs and AKICKs (permanent bans from the channel), so you should be especially careful when making people SOPs.

If there is somebody you trust whom you think should have AOPs on your channel

Type /nickserv info nick to check their nick is registered - if it is not, ask them to register it and repeat the above when they've done so. Once you're sure the nickname is registered, type /chanserv aop #channel add nick .

If your channel needs an SOP for some reason - for instance if it is a large channel and you need help with channel management such as choosing AOPs

Be certain you can trust the person you'd like to make an SOP, and check their nick is registered as above. Then type /chanserv sop #channel add nick .

If at a later date you need to remove an AOP or SOP from the channel list because they have proven untrustworthy, left IRC, or similar

Type /chanserv aop or sop #channel list . When you find the entry for that person, you should note the number and type /chanserv aop or sop #channel del number .

If you need to ban somebody permanently

You (or an SOP on the channel; not AOPs) can add them to the AKICK list by using /chanserv akick #channel add mask , where mask is a standard ban mask for the troublemaker. You can remove AKICKs at a later date in a similar way to removing AOPs or SOPs. (See .)