Tutorial: Securing your bot

A default Autumn install comes with the following commands:

!autumn	Displays information about the version of Autumn running the leaf.
!commands	Displays a list of commands this leaf responds to.
!reload	Reloads leaves’ source code and support code.
!quit	Terminates the leaf.

With the exception of the first two, you probably don’t want just anyone to be able to use any of these commands. The good news is Autumn out-of-the-box restricts access to these commands.

The four commands listed above are handled by a leaf called Administrator. This leaf is included by default in all new seasons. It also comes configured with an authenticator, a special stem listener that restricts access to certain commands (in this case, !reload and !quit).

Autumn comes with four authenticators, and you have the option to write your own if you need to. See the Autumn::Authentication class to get started.

Authenticating by privilege level

This is the authenticator that Administrator is configured with by default. Only channel operators, administrators, and channel founders/owners can perform restricted commands. You can change these options in your leaf configuration (either in config/seasons/SEASON_NAME/leaves.yml or in leaves/LEAF_NAME/config.yml).

Authenticating by nick

The simplest approach is to authenticate by nickname. This is a quick and easy way to add a basic level of security to your leaves. The downside is obvious: Once you leave the channel, anyone can simply change their nick to yours and they gain access to all commands. This approach is best used in well-behaved, smaller channels, to act as a basic deterrent.

To use nick-based authentication, change the authentication configuration hash for your leaf as follows:

authentication:
  type: nick
	nick: AdminDude

You can alternatively provide a nicks option with a YAML array of authenticated nicknames.

Authenticating by password

A much more secure approach is to authenticate by password. In this approach, the leaf will not respond to protected commands unless they are accompanied by the correct passphrase. In this approach, you private-message your password to the leaf, and the leaf then authenticates your nick. Because nicks can change, any time you leave the channel, change your nick, or take any other such action, you forfeit your credentials. Furthermore, you forfeit your credentials after a given time period has elapsed. You will hae to then reenter your password.

To use password-based authentication, change the authentication configuration hash for your leaf as follows:

authentication:
	type: password
	password: supersecret

You can optionally specify expire_time to override the default credential timeout.

Authenticating by hostname

A user’s hostmask is available in his sender hash (which is passed to your filter method). A hostmask is unique for an IP address, meaning that if you change your nick you don’t lose your credentials. However, if you log in from a different computer, you will have a different IP address.

Many IRC servers have a “host-hiding” usermode that, when enabled, scrambles the first part of a user’s hostname. This helps ensure that would-be hackers can’t use someone’s IP address to make malicious attacks on them. On some servers, this usermode is enabled by default. If you are working with a host-hiding IRC server, you should investigate scrambled hostnames to see which part of the hostname you can use for your authentication.

To use hostmask-based authentication, change the authentication configuration hash for your leaf as follows:

authentication:
	type: hostname
	hosts:
		- firsthost.net
		- secondhost.org

The hosts option should be a list of host suffixes that you log in from (everything after the first period of the hostname given by the IRC server). If you want to customize the hostmask, you can provide your own regex (as a string) to the hostmask option.