Skip to content

Command: add#

Summary#

Command Default Level Global Only?
add 200 no

Description#

  • Adds an entry to the whitelist or blacklist
  • Clients joining channel will be scanned against lists when mode is on or secure
Secure Mode The secure mode is only available on networks using ircu, such as Undernet or Quakenet.

When in secure mode, a channel will be set to +Dm to moderate the channel and delay the join or new users.

All current users will be voiced, and a periodic timer will use /names -d to find new users, scan them, and only voice the users after they have passed the scans, thereby making the client visible to other users.

This mode can be extremely effective when dealing with floodnets as the normal channel joins are never seen if the client is hit through some form of detection.

  • Entry types supported:
    • user: user ACCOUNT on network (e.g., X usernames on Undernet)
    • host or ip: host or IP
    • rname: realname field of client
    • regex: regular expression using format nick!user@host/realname
    • text: text match, whereby for whitelist entries to make the bot responds with comment and for blacklist entries the bot kickbans the client using reason as the kick message
    • country: two digit code of the IP address country of origin
    • asn: Autonomous System Number of the client's IP address
    • chan: matching channels the user is in (from /whois response)
    • last: last N users who recently joined channel
  • Multiple values can be added of the same type with one command, by comma delimiting them
  • Actions to take when joining clients match a list:
    • accept: accept the client and stop further scans
    • voice: voice the client
    • op: op the client
    • ban: kickban the client (the only valid action for blacklist entries)
  • Allow reason to be optional, using configuration default for blacklist entries
  • Allow cumulative matching to allow act when a minimum of joins clients join the channel within secs seconds. Once matched, hold the matching window open for a further optional hold seconds, for faster seubsequent matching. Default to 1:1:1

Usage#

add ?chan? <white|black> <user|host|rname|regex|text|country|asn|chan|last> <value1,value2..> <accept|voice|op|ban?joins:secs:hold?>  [reason|comment]
  • Channel parameter is optional. If not given, the bot will default to the originating channel, the channel the user has the most access in, or lastly, the default Armour channel.
  • Specifying a channel of * will add a global list entry, applying to all channels the bot has registered.

Examples#

user#

Add username Empus to whitelist and automatically op when joining channels, using the reason of My master!: 
@Empus | y add white user Empus op My master!
 @yolk | added user whitelist entry (id: 67 -- value: Empus -- action: op -- reason: My master!)
Add all clients to the blacklist that have a network account user with hack in their username: 
@Empus | y add black user *hack* ban Hackers are not welcome
 @yolk | added user blacklist entry (id: 81 -- value: *hack* -- action: op -- reason: Hackers are not welcome)

Entry method user is only available for networks that use ircu such as Undernet or Quakenet.

host#

Add IP 10.0.0.1 to whitelist to accept clients, using the reason of local machine: 
@Empus | y add white host 10.0.0.1 accept local machine
 @yolk | added host whitelist entry (id: 68 -- value: 10.0.0.1 -- action: accept -- reason: local machine)
Add subnet 142.250.204.160/27 to whitelist and accept clients using MrBob's VPS: 
@Empus | y add white host 142.250.204.160/27 accept MrBob's VPS
 @yolk | added host whitelist entry (id: 89 -- value: 142.250.204.160/27 -- action: accept -- reason: local machine)
Add user@host mask with CIDR notation to blacklist: 
@Empus | y add black host *!jimbo@172.217.160/27
 @yolk | added host whitelist entry (id: 90 -- value: *!jimbo@172.217.194.160/27 -- action: kickban -- reason: abuse)
Add hostmask *!mrbob@*.isp.com to blacklist to kickban clients, using the reason of abusive user 
@Empus | y add black host *!mrbob@*.isp.com kb abusive user
 @yolk | added host blacklist entry (id: 69 -- value: *!mrbob@*.isp.com -- action: kickban -- reason: abusive user)
Actions Blacklist entries will accept ban, b, kb, kickban, and k as all resulting in kickban as the resulting action when a client matches the entry.

Whitelist entries will accept:

  • accept or a to accept a client
  • op or o to op a client
  • voice or v to voice a client

Action will default to accept for whitelist entries and kickban for blacklist entries. Meaning, this field is optional and the below can also be used:

@Empus | y add black host *!mrbob@*.isp.com abusive user
 @yolk | added host blacklist entry (id: 69 -- value: *!mrbob@*.isp.com -- action: kickban -- reason: abusive user)

rname#

Add realname 'Mr Bob' to blacklist to kickban clients, using the default reason (from configuration): 
@Empus | y add black rname Mr?Bob
 @yolk | added rname blacklist entry (id: 70 -- value: Mr?Bob -- action: kickban -- reason: abuse)
Wildcards Wildcards are supported in all list entries:
  • * denotes any characters (zero times or more)
  • ? denotes any single character (including a space)

regex#

Add regex blacklist entry to kickban clients that have no resolved ident and have a nickname ending in two or more numbers: 
@Empus | y add black regex ^[^!]+\d{2,}!~
 @yolk | added regex blacklist entry (id: 71 -- value: ^[^!]+\d{2,}!~ -- action: kickban -- reason: abuse)
Warning Regular expression matches are very powerful but extra care should be taken with the expression to ensure they do not hit innocent clients.

Add regex blacklist entry to kickban clients with unresolved idents when 3 or more join within 2 seconds, using floodbot as the reason: 

@Empus | y add black regex ^[^!]+!~ 3:2 floodbot
 @yolk | added regex blacklist entry (id: 73 -- value: ^[^!]+!~ -- action: kickban -- limit: 3:2 -- reason: floodbot)

Same as above, but this time after a positive match, immediately match other clients within a 10 second window, extending by that same 10 seconds for each subsequent match: 

@Empus | y add black regex ^[^!]+!~ 3:2 floodbot
 @yolk | added regex blacklist entry (id: 74 -- value: ^[^!]+!~ -- action: kickban -- limit: 3:2:10 -- reason: floodbot)

Limits

Cumulative limits in the form of joins:secs:hold can be used on any host or regex entries in the blacklist. These can be a very effective tool to deal with floodbots by using more wider hostmasks and patterns but only matching when configured thresholds are reached.

text#

Add a text match whitelist entry to make the bot respond with Coke is better when any client says pepsi: 
@Empus | y add white text *pepsi* Coke is better
@yolk | added text whitelist entry (id: 75 -- value: *pepsi* -- reply: Coke is better)
Resulting in the below channel responses: 
@Empus | who likes pepsi anyway?
 @yolk | Coke is better
Blacklist Text Entries Adding text type entries to the blacklist will instead make the bot kickban the client using the comment as the kick reason (in this case Coke is better)

country#

Add a blacklist entry for the entire country of China based on the origin of the IP address: 
@Empus | y add black country cn Hacked Chinese box
 @yolk | added country blacklist entry (id: 76 -- value: CN -- action: kickban -- reason: Hacked Chinese box)

asn#

Add Google's Autonomous System Number (ASN) to whitelist their entire IP space: 
@Empus | y add white asn AS15169 Google
 @yolk | added asn whitelist entry (id: 77 -- value: 15169 -- action: accept -- reason: Google)

chan#

Add blacklisted channel #hackers to kickban members with reason Hackers not allowed 
@Empus | y add black chan #hackers Hackers not allowed
 @yolk | added chan blacklist entry (id: 78 -- value: #hackers -- action: kickban -- reason: Hackers not allowed)
Add any channel with hack in its name to blacklist, with the same reason: 
@Empus | y add black chan #hackers Hackers not allowed
 @yolk | added chan blacklist entry (id: 78 -- value: #hackers -- action: kickban -- reason: Hackers not allowed)
White Listing Channels Because whitelists are always checked before blacklists, it is not recommended to use whitelisted channels that the bot is not also in.

This is because doing so would necessitate a /WHOIS before blacklist entries can be matched, thereby slowing down blacklist matching for other entry types (especially for host, regex, and user where the user is usermode +x on Undernet).

last#

Add the last 3 clients that joined the channel to the blacklist with host entry type and default reason: 
@Empus | y add black last 3
 @yolk | added host whitelist entry (id: 81 -- value: 74.125.68.27 -- action: kickban -- reason: abuse)
 @yolk | added host whitelist entry (id: 82 -- value: 172.253.118.26 -- action: kickban -- reason: abuse)
 @yolk | added host whitelist entry (id: 83 -- value: 74.125.68.26 -- action: kickban -- reason: abuse)
Host Tracking The bot will remember recently joined hosts within the last N seconds for a channel, set by configuration variable lasthosts

dronebl#

Add IP to DroneBL: 
@Empus | y add black dronebl 74.125.68.27
 @yolk | added host to dronebl (ip: 74.125.68.27)
DroneBL Adding entries to DroneBL requires configuration and an RPC2 key obtained from DroneBL.

Shortcuts#

Command shortcuts are supported for faster entry management. To use shortcuts, use the first letter of the list type, method, and action 

@Empus | y a w u Empus o My master!
 @yolk | added user whitelist entry (id: 67 -- value: Empus -- action: op -- reason: My master!)
Is the same as: 
@Empus | y add white user Empus op My master!
 @yolk | added user whitelist entry (id: 67 -- value: Empus -- action: op -- reason: My master!)
This makes adding blacklist entries faster when coupled with configuration defaults: 
@Empus | y a b u MrBob
 @yolk | added user blacklist entry (id: 80 -- value: MrBob -- action: kickban -- reason: abuse)
Multiple entries can also be added with one command by comma delimiting the values: 
@Empus | y add black user MrBob,MsJane troublesome
 @yolk | added user blacklist entry (id: 89 -- value: MrBob -- action: kickban -- reason: troublesome)
 @yolk | added user blacklist entry (id: 90 -- value: MsJane -- action: kickban -- reason: troublesome)

Command Description
cmds List available commands
help View the help for a given command
chanscan Scans the entire channel and acts upon matches
mod Modifies the settings of a list entry
rem Remove a list entry
search Search for whitelist & blacklist entries
scan Scan a client or value against lists and return results
view View an existing list entry