4

I have a small server running Ubuntu 12.04 LTS. On it I wanted to set up IRC with SSL support. it appears that ircd-hybrid is most popular. I am not married to using it so other options are welcome. However, I am not seeing other options.

I have installed using apt-get. That isn't the problem. The problem is that the apt-get install version doesn't enable SSL. Try connecting to the SSL port 6697 using SSL and it will not work. Hence the work to build it myself. If you actually follow the source of the ircd-hybrid package the configuration requires that you edit it and add the "USE_OPENSSL = 1" option.

Because hybrid doesn’t support OpenSSL by default, you have to do a manual patch to get it working.

Anyway, I followed the instructions (I listed a couple at the end) and install ircd-hybrid no problem. It's actually running now. However, I noticed that SSL isn't working. The port is never being listened to. Digging deeper, I look back at the building process and notice that OpenSSL isn't being included.

So I have been trying to build and just to clarify, here is the ./configure output:

Compiling ircd-hybrid 7.2.2

Installing into: /usr
Ziplinks ................ yes
**OpenSSL ................. no**
Modules ................. shared
IPv6 support ............ yes
Net I/O implementation .. sigio
EFnet server ............ no (use example.conf)
Halfops support ......... yes
Small network ........... no
G-Line voting ........... yes

A few line up in the output of the ./configure script I notice that it seems that all the encryption algos are unavailable!

checking for OpenSSL... /usr
checking for OpenSSL 0.9.6 or above... found
checking for RSA_free in -lcrypto... yes
checking for EVP_bf_cfb... no
checking for EVP_cast5_cfb... no
checking for EVP_idea_cfb... no
checking for EVP_rc5_32_12_16_cfb... no
checking for EVP_des_ede3_cfb... no
checking for EVP_des_cfb... no

Which if you look into the configure script you'll see that at least one of the encryption libraries need to be enabled. This is a hunch as I am not entirely positive about this. It seems that OpenSSL has disabled RC5 and a couple other algos.

I've rebuilt and installed OpenSSL with the enable-rc5 and other flags but no dice.

This is on Ubuntu 12.04. Help? Anyone? I'd like to enable SSL on IRC on my personal server. It doesn't have to be ircd-hybrid.

I have been looking at the forums on Ubuntu and generally following these instructions.

Thanks!

EDIT I have been chatting with the fella that figured out the solution on the first link I posted above. He was able to successfully build and run with SSL on a clean 12.04 install using the default OpenSSL package and the patched pircd-hybrid package. The system I am on was originally built using 10.x. I wonder if doing those upgrades to 12.04 LTS somehow broke something along the way. For example, his running of the ircd-hybrid configuration yields these in the crypto part of the setup:

checking for OpenSSL... /usr
checking for OpenSSL 0.9.6 or above... found
checking for RSA_free in -lcrypto... yes
checking for EVP_bf_cfb... yes
checking for EVP_cast5_cfb... yes
checking for EVP_idea_cfb... no
checking for EVP_rc5_32_12_16_cfb... no
checking for EVP_des_ede3_cfb... yes
checking for EVP_des_cfb... yes

I am running the latest open ssl:

$ openssl version
OpenSSL 1.0.1 14 Mar 2012

Not sure why the configure script isn't seeing those cipher algos.

EDIT 2: Just installed a VM on my ESXi box. Brand new 32-bit install 12.04 LTS. Same problem. Installs fine via apt-get but SSL is not enabled. Tried the patch and it is also missing the algos as I listed above.

1
  • I had actually successfully followed the marvelserv instructions previously and had a totally working version install and running. Quite a few months later I am now unable to connect with clients to the server (failing SSL handshake). I figured it might have been from a libssl-dev upgrade somewhere along the line. Tried to rebuild the package same as you, now none of the libssl algorithms are being detected either... really hope someone finds out what this is from.
    – Nicholi
    May 23, 2013 at 20:37

2 Answers 2

1

Is there a reason you're building these packages yourself? Ubuntu already has these packages premade for you.

apt-get install ircd-hybrid

Or if you'd rather see what other choices are available:

apt-cache search ircd
3
  • You can't do that if you want to include SSL which has been disabled to avoid legal issues for the maintainers of the ircd-hybrid package. If it were that easy I wouldn't have asked this question here.
    – mhradek
    Jan 13, 2013 at 21:53
  • apt-cache show ircd-hybrid says: "If enabled, SSL client support and server-to-server RSA encryption." So the package should have SSL support.
    – qbi
    Jan 18, 2013 at 19:33
  • Yes, it does. Can you show me how to enable it? From what I see it requires a patch to enable it. There's entire threads on building and getting SSL to work for IRCd-hybrid. It's not like I missed something by using the apt-get installer. Tried it. It doesn't work by default. I've updated my question to be more exact.
    – mhradek
    Jan 22, 2013 at 18:02
1

I've just managed to get this going after a lot of hassle. Sadly, I don't think I'm going to be able to provide a "how to do it", but I do intend to submit a bug report. Also, my understanding is sketchy, so excuse me if I use the wrong terminology.

Basically, the problem is an incompatibility between ircd-hybrid and libssl1.0.0. Where it's looking for cyphers such as EVP_bf_cfb, in libssl1.0.0 it needs to be using EVP_bf_cfb64, etc. I did some fudging around and made it compile with the cyphers being detected, but it still didn't connect to other servers.

Sadly, whilst libssl0.9.8 is available in Ubuntu 12.04 LTS, libssl-dev is only available in the 1.0.0 flavour. I installed the 0.9.8 packages from 10.04 LTS (not recommended, I'm sure), but then there were various compilation issues in ircd-hybrid relating to a different problem. I've fixed these, and have finally got a working ircd-hybrid running on 64bit 12.04 LTS.

My guess is that, since SSL isn't enabled by default in ircd-hybrid, when other things change and break only the SSL build, it doesn't get spotted by the package maintainers.

As I say, I shall now attempt to file a bug report against 12.04 LTS, and see if that gets anywhere.

1
  • Fantastic. Thank you for documenting what you did as best you can.
    – mhradek
    Jul 17, 2013 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .