If you run an IRC network and make it secure, you might run into issues. You can create self-signed certificates, but these aren't trusted by all clients and do pose issues. You can use a wildcard SSL, but this won't work if you use anything other than servername.your.net. You can purchase legitimate a legitimate SSL for your network, or each server, but this cost does add up, even if it's an el'cheapo.
I've recently run into this issue with the network I'm a part of, irc.austnet.org. Up until recently we have been a domestic chat network and most of our users wouldn't even know what SSL is or how to use it, now we are getting more tech savvy users who want to use SSL but our servers were set up very poorly, using a self-signed certificate which expired almost a decade ago and only had one FQDN/hostname on it, not ideal!
I started messing around with LetsEncrypt, for free SSL certificates which last 90 days, however the way they work mean that if you're using a round-robin DNS, which nearly all IRC networks do, you will run into issues where the method you're using to authenticate your server will jump to the wrong server and fail. An option we have is to use DNS updates, but we didn't want to leave ourselves open to attack if our certificate vendor was compromised.
A workaround for this is to set up a web server on all of the IRCd hosts which redirect back to a common certificate vendor. Here's what I did.
On all of the servers, I installed nginx and redirected the /.well-known/acme-challenge/ folder to our web server by doing the following:
Install nginx using your distribution manager, or source. For Ubuntu:
sudo apt-get install nginx
Allow port 80 through your firewall, if required. For Ubuntu:
sudo ufw allow http comment 'Open HTTP for LetsEncrypt SSL'
Edit the nginx default server. For Ubuntu:
sudo pico /etc/nginx/sites-enabled/default
Modify the file so it reflects below, really this just needs to add in the first rewrite line. I added the second rewrite line just so all other traffic that goes to our IRCd hosts gets redirected to our main website:
server {
listen 80 default_server;
listen [::]:80 default_server;
# push acme challenge to certificate generator
rewrite ^/(.well-known/acme-challenge/.*)$ http://yoursslhost.your.net/$1 redirect;
# push all other traffic to website
rewrite ^/.*$ http://www.your.net/ redirect;
}
Restart the nginx service. For Ubuntu:
sudo service nginx restart
Now that we have the redirections set up, I ran certbot, the below command is what I used. In this case, /var/www/ is where my default websites sit, this will need to change if you have a different than default configuration:
sudo certbot certonly --preferred-challenges http --webroot -w /var/www/ -d irc.your.net,name1.region1.your.net,name2.region2.your.net
After this, I then had some working certificates in /etc/letsencrypt/archive/irc.your.net/, but how can we get these onto all of the servers?! LetsEncrypt requires renewals of the certificates every 90 days and I didn't want to have to copy the certificates over to all of the servers every three months! I did a quick script to copy the new certificates into a common place I could access from scp.
So this is where I decided to use scp to pull the certificates to each of the servers. All that's required is an SSH key and you're sweet. I decided to use a common key for all of the servers, as all this has access to is the certificates themselves and nothing else.
From one of my servers, I created a new SSH key:
ssh-keygen -t rsa
By default, this will prompt you for a location, the default location can be used if you don't already have a default key configured for connections, if you do then choose somewhere else. Once the key is generated, move them into the ~/.ssh/ folder on all of your servers as id_rsa and id_rsa.pub.
After that was done, I put the content from the id_rsa.pub into the ~/.ssh/authorized_keys file on the certificate vendor, on a restricted account. Then I set up a cronjob on all of the servers to pull the file, using the following command:
scp -i ~/.ssh/id_rsa account@yoursslhost.your.net:/path.to/cert.pem /home/ircd/inspircd/conf/cert.pem
scp -i ~/.ssh/id_rsa account@yoursslhost.your.net:/path.to/privkey.pem /home/ircd/inspircd/conf/priv.pem
And once you've done that, you're sweet! SWEET I SAY! Maybe I'll configure a script to automatically rehash the IRCd every 24hrs or something as well from the command line, just so the certificates are updated. |
