Tip of the day: Check out Special users on how to give trusted users/bots more rights without making them IRCOp.

Oper block

From UnrealIRCd documentation wiki
Jump to navigation Jump to search

In oper blocks you define all the IRC Operators accounts. Once defined you use the /OPER command on IRC to become IRCOp.

Recommended reading:


oper <name> {
        /* Required items: */
        mask <hostmask>;
        class <class-name>;
        operclass <operclass-name>;
        /* Optional items to further limit who can /OPER */
        password <password>;
        auto-login <yes|no>;
        require-modes <modes>
        maxlogins <num>;
        /* Optional items to define what will be set upon successful /OPER */
        vhost <new virtual hostname>;
        swhois <whois info>;
        modes <modes>;
        snomask <snomask>;
        server-notice-colors yes|no;
        server-notice-show-event yes|no;

Required items


The name in the oper name { block defines which name to use in the OPER command on IRC (/OPER name password). This name is case sensitive!

Most people use their nick name here. You can use latin characters (A-Z a-z), numbers and _-[]. Do not use special characters like ö (as in Björn) or Arabic/Greek/etc. Such characters may cause you problems with /OPER'ing due to character set differences.


The password item defines the password to use. Passwords are case sensitive. Instead of using a plaintext password here, we highly recommend you to use Hashed passwords or SSL certificate fingerprints, see Authentication types.

In UnrealIRCd 6.0.4 and later the password item is no longer required. If you don't put a password then be sure to use a good mask (see next)!


The mask defines from which host/IP this oper block may be used, this can be used for increased security. Set this to mask *; if you want to permit any IP.

You may also use multiple masks, in which case the syntax becomes like: mask {; *.example.net; };.

See Mask item for more options. For example, instead of an IP address or host, you can require a certain certificate fingerprint: mask { certfp "00112233etc."; } or a Services account: mask { account TrustedUser; }.


After a successful /OPER attempt the user will be put in the class you specify here. It's recommended to use a special class you created for opers (eg: class opers;) that typically has higher flood limits than ordinary users.


This defines which Operclass block to use. The operclass block configures which privileges this IRCOp will have (which IRCOp commands you may use, etc..).

See the default list of operclasses from which you can choose. The highest are netadmin and netadmin-with-override.

Optional items


NOTE: Requires UnrealIRCd 6.0.4 or later

If auto-login is set to yes then the user is automatically logged in if they match the mask. In this case there can be no password item.

This is generally only used for logins with certfp, see the automatic oper example at the end of this article.


This allows you to restrict the number of concurrent oper logins from this host, for example if you set it to 1 then only 1 person can be oper'ed via this block at any time.


This hostname (virtual host) will be set after you successfully oper up.


Allows you to add one or more extra lines to the /WHOIS information for this oper. For example:

swhois "a Network Administrator";


Set these user modes after successful oper up.


By default an IRCOp gets the Snomasks from set::snomask-on-oper. You can use this oper::snomask to specify a different set of snomasks. See Snomasks for a full list.

snomask "+bBcdfk";


By default an IRCOp will be joined to the channels in set::oper-auto-join. You can override this setting by setting an oper::auto-join in an individual oper block. If you use this, don't forget to use double quotes and optionally specify multiple channels with a comma. Eg: auto-join "#opers,#staff";


Here you can put user modes that the user must have in order to use the OPER command. For example, you can put z here to require opers to use a SSL/TLS connection.

This setting is not used much anymore, as requiring IRCOps to be on TLS is already done via set::plaintext-policy::oper nowadays (which is even on by default).


Note: this setting only exists in UnrealIRCd 6 and later

Enable or disable colors in server notices (to snomasks). Valid options are yes and no. The default for all IRCOps is configured via set::server-notice-colors.


Note: this setting only exists in UnrealIRCd 6.0.2 and later

Enable or disable showing of the subsystem.event (eg: connect.LOCAL_CLIENT_CONNECT) in server notices to snomasks. Valid options are yes and no. The default for all IRCOps is configured via set::server-notice-show-event.


Simple example

oper bobsmith {
	class opers;
	mask { smithco.com; *.somedialupisp.com; };
	password "f00";
        operclass netadmin;
	swhois "a Network Administrator";

Automatic oper

NOTE: This requires UnrealIRCd 6.0.4 or later

This uses the certificate fingerprint 00112233etc.. If the user connects with SSL/TLS with that client certificate fingerprint they become IRCOp automatically, they don't have to type the OPER command.

oper bobsmith {
        auto-login yes;
	mask { certfp "00112233etc."; }
        class opers;
        operclass netadmin;
	swhois "a Network Administrator";

Using security-groups

NOTE: This requires UnrealIRCd 6.0.4 or later

This uses the certificate fingerprint 00112233etc.. We create a security-group first, and then use that security-group in both the oper { } block and the except ban { } block.

security-group bobsmit {
        certfp "00112233etc.";

oper bobsmith {
        auto-login yes;
	mask { security-group bobsmith; }
        class opers;
        operclass netadmin;
	swhois "a Network Administrator";

/* Be nice and exempt the oper from server bans too */
except ban {
        mask { security-group Syzop; }
        type all;

Walking through bans, joining invite only channels

If IRCOps want to bypass channel restrictions, like joining a +i channel or walking through bans, op'ing yourself in a channel, etc. then see the OperOverride article for all information on this.