Question 1

Why am I getting 'Cannot connect a server to a user port' and 'remote host forcibly closed an existing connection' when trying to link ngIRCd to an IRC network like GameSurge?

Accepted Answer

ngIRCd is an IRC **server**, not a client, so it cannot simply connect to another IRC server as a user. To link to a network like GameSurge, you must set up a proper server-to-server link in ngIRCd.conf (using a `[Server]` block) and coordinate with the remote server administrator to exchange the necessary credentials and permissions. Connecting as a client to the user port (e.g., 6667) will be rejected with this error. Ensure you are using the server link port and the correct server password if required. Check your logs for clues: the message 'Cannot connect a server to a user port' indicates the remote server is refusing the link because the connection arrived on a client port.

Question 2

Why does ngircd TLS connection fail with 'non-properly terminated' error when using systemd-style socket activation?

Accepted Answer

This error occurs when ngircd is started via a socket-activated service (e.g., systemd or Shepherd's `make-systemd-constructor`), because its internal `sd_listen_fds()` implementation does not correctly inherit TLS-enabled sockets. The connection times out and shows 'The TLS connection was non-properly terminated'.

**Workaround:** Launch ngircd directly without socket activation. In GNU Shepherd, use `make-forkexec-constructor` instead of `make-systemd-constructor`. For systemd, use `Type=simple` or `Type=forking` instead of socket activation. Example Shepherd service:

```scheme
(service
  '(ngircd)
  #:start (make-forkexec-constructor
            '("ngircd" "--nodaemon" "--config" "/path/to/ngircd.conf")
            #:user "ngircd"
            #:group "ngircd")
  #:stop (make-kill-destructor))
```

This avoids the broken socket-handoff path while TLS works correctly. Note that plain-text connections (port 6667) may still work with socket activation, but TLS requires this workaround until the underlying bug in `sd_listen_fds` handling is fixed upstream.

Question 3

How to enable certificate validation for server-to-server TLS links in ngIRCd?

Accepted Answer

Use the patch from attachment 50 to add CA certificate and CRL checking to the OpenSSL backend. This mitigates MITM attacks by validating server certificates during TLS handshake. Apply the patch to your ngIRCd source, but note it was created for an older version and may require updates for config format changes in ngIRCd 18+. The patch is not yet merged upstream. Download: `http://strlen.de/ngircd/0002-SSL-TLS-add-initial-certificate-support-to-openssl.patch.bz2`

ngIRCd

Core Features

What It Can't Do

Use Cases

Tags

Getting Started

Similar Projects