From 3ffc53e13e7d153312ef1daa4c798ed0eed977eb Mon Sep 17 00:00:00 2001 From: Sven Moritz Hallberg Date: Tue, 12 Feb 2008 01:25:41 +0100 Subject: add a blurb about OTR to the README --- doc/README | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'doc') diff --git a/doc/README b/doc/README index bb6596ba..10f21501 100644 --- a/doc/README +++ b/doc/README @@ -48,6 +48,10 @@ DEPENDENCIES BitlBee's only real dependency is GLib. This is available on virtually every platform. Any recent version of GLib (2.4 or higher) will work. +Off-the-Record encryption support will be included by default if the +configure script finds libotr in one of the usual places. You can pass +--otr=1 or --otr=0 to force it on or off, respectively. + These days, MSN Messenger clients have to connect to the MS Passport servers through HTTPS. BitlBee can use several SSL libraries for this: GnuTLS, NSS (which comes with Mozilla) and OpenSSL. OpenSSL is not GPL-compatible in some @@ -151,8 +155,8 @@ Our version control system is Bazaar-NG. Our repository is at: http://code.bitlbee.org/ -A NOTE ON ENCRYPTION -==================== +A NOTE ON PASSWORD ENCRYPTION +============================= There used to be a note here about the simple obfuscation method used to make the passwords in the configuration files unreadable. However, BitlBee -- cgit v1.2.3 From f5ac0fb078ee98bd836f1527dc90952f74ab0c18 Mon Sep 17 00:00:00 2001 From: Sven Moritz Hallberg Date: Tue, 12 Feb 2008 02:32:28 +0100 Subject: document otr commands --- doc/user-guide/commands.xml | 149 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 149 insertions(+) (limited to 'doc') diff --git a/doc/user-guide/commands.xml b/doc/user-guide/commands.xml index 5a1e398c..4f4e44b3 100644 --- a/doc/user-guide/commands.xml +++ b/doc/user-guide/commands.xml @@ -243,6 +243,155 @@ + + + Off-the-Record encryption control + otr <subcommand> [<arguments>] + + + + + Available subcommands: connect, disconnect, smp, trust, info, keygen, and forget. See help otr <subcommand> for more information. + + + + + + otr connect <nick> + + + + + Attempts to establish an encrypted connection with the specified user by sending a magic string. + + + + + + + + otr disconnect <nick> + + + + + Resets the connection with the specified user to cleartext. + + + + + + + + otr smp <nick> <secret> + + + + + Attempts to authenticate the given user's active fingerprint via the Socialist Millionaires' Protocol. + + + + If an SMP challenge has already been received from the given user, responds with the specified secret. Otherwise, a challenge for the secret will be sent. If the protocol succeeds (i.e. both parties gave the same secret), the fingerprint will be trusted. + + + + + + + + otr trust <nick> <fp1> <fp2> <fp3> <fp4> <fp5> + + + + + Manually affirms trust in the specified fingerprint, given as five blocks of precisely eight (hexadecimal) digits each. + + + + + + + + otr info + otr info <nick> + + + + + Shows information about the OTR state. The first form lists our private keys and current OTR contexts. The second form displays information about the connection with a given user, including the list of their known fingerprints. + + + + + + + + otr keygen <account-no> + + + + + Generates a new OTR private key for the given account. + + + + + + + + otr forget <thing> <arguments> + + + + + Forgets some part of our OTR userstate. Available things: fingerprint, context, and key. See help otr forget <thing> for more information. + + + + + + otr forget fingerprint <nick> <fingerprint> + + + + + Drops the specified fingerprint from the given user's OTR connection context. It is allowed to specify only a (unique) prefix of the desired fingerprint. + + + + + + + + otr forget context <nick> + + + + + Forgets the entire OTR context associated with the given user. This includes current message and protocol states, as well as any fingerprints for that user. + + + + + + + + otr forget key <fingerprint> + + + + + Forgets an OTR private key matching the specified fingerprint. It is allowed to specify only a (unique) prefix of the fingerprint. + + + + + + + + + Miscellaneous settings -- cgit v1.2.3 From 1c18ce17500c2952ca1dcae4aa903e20574b3fca Mon Sep 17 00:00:00 2001 From: Sven Moritz Hallberg Date: Tue, 12 Feb 2008 03:09:57 +0100 Subject: update settings documentation --- doc/user-guide/commands.xml | 88 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 83 insertions(+), 5 deletions(-) (limited to 'doc') diff --git a/doc/user-guide/commands.xml b/doc/user-guide/commands.xml index 4f4e44b3..8c2a30ca 100644 --- a/doc/user-guide/commands.xml +++ b/doc/user-guide/commands.xml @@ -546,6 +546,17 @@ + + true + + + + If set to true, BitlBee will color incoming encrypted messages according to their fingerprint trust level: untrusted=red, trusted=green. + + + + + false @@ -612,6 +623,22 @@ + + encrypted + encrypted, trusted, notaway, false + + + + Specifies under which circumstances BitlBee should give the "halfop" mode flag (+h) to buddies. + + + + If "false", the flag is never set. On "notaway", the flag is removed for users marked as "away" and set for all others. On "encrypted", the flag is set for users with whom we have an encrypted connection. On "trusted", it is set only for encrypted connections using a trusted key. + + + + + true @@ -634,17 +661,52 @@ - - both - both, root, user, none + + trusted + encrypted, trusted, notaway, false - Some people prefer themself and root to have operator status in &bitlbee, other people don't. You can change these states using this setting. + Specifies under which circumstances BitlBee should give the "op" mode flag (+o) to buddies. + + + + If "false", the flag is never set. On "notaway", the flag is removed for users marked as "away" and set for all others. On "encrypted", the flag is set for users with whom we have an encrypted connection. On "trusted", it is set only for encrypted connections using a trusted key. + + + + + true + + - The value "both" means both user and root get ops. "root" means, well, just root. "user" means just the user. "none" means nobody will get operator status. + Some people prefer themself and root to have operator status in &bitlbee, other people don't. You can set the desired state for root using this setting. + + + + + + true + + + + Some people prefer themself and root to have operator status in &bitlbee, other people don't. You can set the desired state for yourself using this setting. + + + + + + opportunistic + never, opportunistic, manual, always + + + + This setting controls the policy for establishing Off-the-Record connections. + + + A value of "never" effectively disables the OTR subsystem. In "opportunistic" mode, a magic whitespace pattern will be appended to the first message sent to any user. If the peer is also running opportunistic OTR, an encrypted connection will be set up automatically. On "manual", on the other hand, OTR connections must be established explicitly using otr connect. Finally, the setting "always" enforces encrypted communication by causing BitlBee to refuse to send any cleartext messages at all. @@ -830,6 +892,22 @@ + + trusted + encrypted, trusted, notaway, false + + + + Specifies under which circumstances BitlBee should give the "voice" mode flag (+v) to buddies. + + + + If "false", the flag is never set. On "notaway", the flag is removed for users marked as "away" and set for all others. On "encrypted", the flag is set for users with whom we have an encrypted connection. On "trusted", it is set only for encrypted connections using a trusted key. + + + + + false -- cgit v1.2.3 From 903a2fcc60f82f52fe05c79250e6875dc48f23f0 Mon Sep 17 00:00:00 2001 From: Sven Moritz Hallberg Date: Sat, 16 Feb 2008 17:24:38 +0100 Subject: remove (broken) 'otr forget key' command again --- doc/user-guide/commands.xml | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) (limited to 'doc') diff --git a/doc/user-guide/commands.xml b/doc/user-guide/commands.xml index 8c2a30ca..2d6b866d 100644 --- a/doc/user-guide/commands.xml +++ b/doc/user-guide/commands.xml @@ -345,7 +345,7 @@ - Forgets some part of our OTR userstate. Available things: fingerprint, context, and key. See help otr forget <thing> for more information. + Forgets some part of our OTR userstate. Available things: fingerprint and context. See help otr forget <thing> for more information. @@ -376,19 +376,6 @@ - - otr forget key <fingerprint> - - - - - Forgets an OTR private key matching the specified fingerprint. It is allowed to specify only a (unique) prefix of the fingerprint. - - - - - - -- cgit v1.2.3 From d0faf626e98cf8a332afac5ac7d61c80dd8d3064 Mon Sep 17 00:00:00 2001 From: Sven Moritz Hallberg Date: Sun, 17 Feb 2008 02:58:41 +0100 Subject: put 'otr forget key' back in, which now works --- doc/user-guide/commands.xml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'doc') diff --git a/doc/user-guide/commands.xml b/doc/user-guide/commands.xml index 2d6b866d..8c2a30ca 100644 --- a/doc/user-guide/commands.xml +++ b/doc/user-guide/commands.xml @@ -345,7 +345,7 @@ - Forgets some part of our OTR userstate. Available things: fingerprint and context. See help otr forget <thing> for more information. + Forgets some part of our OTR userstate. Available things: fingerprint, context, and key. See help otr forget <thing> for more information. @@ -376,6 +376,19 @@ + + otr forget key <fingerprint> + + + + + Forgets an OTR private key matching the specified fingerprint. It is allowed to specify only a (unique) prefix of the fingerprint. + + + + + + -- cgit v1.2.3 From 823de9d44f262ea2364ac8ec6a1e18e0f7dab658 Mon Sep 17 00:00:00 2001 From: Sven Moritz Hallberg Date: Thu, 12 Mar 2009 20:10:06 +0100 Subject: commit updates by ashish shukla --- doc/CHANGES | 21 +++++++++++++++++++++ doc/user-guide/commands.xml | 10 +++++++--- 2 files changed, 28 insertions(+), 3 deletions(-) (limited to 'doc') diff --git a/doc/CHANGES b/doc/CHANGES index ac1f1f02..84dbe162 100644 --- a/doc/CHANGES +++ b/doc/CHANGES @@ -3,6 +3,27 @@ found in the bzr commit logs, for example you can try: http://bugs.bitlbee.org/bitlbee/timeline?daysback=90&changeset=on +Version 1.2.3: +- Fixed one more flaw similar to the previous hijacking bug, caused by incon- + sistent handling of the USTATUS_IDENTIFIED state. All code touching these + variables was reviewed and should be correct now. + +Finished 7 Sep 2008 + +Version 1.2.2: +- Security bugfix: It was possible to hijack accounts (without gaining access + to the old account, it's simply an overwrite) +- Some more stability improvements. +- Fixed bug where people with non-lowercase nicks couldn't drop their account. +- Easier upgrades of non-forking daemon mode servers (using the DEAF + command). +- Can be cross-compiled for Win32 now! (No support for SSL yet though, which + makes it less useful for now.) +- Exponential backoff on auto-reconnect. +- Changing passwords gives less confusing feedback ("password is empty") now. + +Finished 26 Aug 2008 + Version 1.2.1: - Fixed proxy support. - Fixed stalling issues while connecting to Jabber when using the OpenSSL diff --git a/doc/user-guide/commands.xml b/doc/user-guide/commands.xml index f0653232..3a7bd5a8 100644 --- a/doc/user-guide/commands.xml +++ b/doc/user-guide/commands.xml @@ -469,12 +469,16 @@ - - 300 + + 5*3<900 - Tell BitlBee after how many seconds it should attempt to bring an IM-connection back up after a crash. It's not a good idea to set this value very low, it will cause too much useless traffic when an IM-server is down for a few hours. + Tell BitlBee after how many seconds it should attempt to bring a broken IM-connection back up. + + + + This can be one integer, for a constant delay. One can also set it to something like "10*10", which means wait for ten seconds on the first reconnect, multiply it by ten on every failure. Once successfully connected, this delay is re-set to the initial value. With < you can give a maximum delay. -- cgit v1.2.3