Simple cell with standalone router/server + backup

Hello fellow SILCers.

This is my first post.

I'm having some problems setting up my cell the way I want. At the end
of the e-mail I also have some short questions about SILC.

I've successfully set up a minimal cell for work (and some friends).
As silcd does not keep state across restarts, I would also like to set
up a backup router that acts only as backup for state information and
does not accept client connections, but I'm having trouble molding the
example configuration into something that works for me. This is the
setup I would like (best viewed in monospace):

+--------+            +--------+
| Client |            | Client |
+--------+            +--------+
      \                  /
+--------------------------+
| silc.dose.se             |
| (SILC Server 1.1.11)     |
| (FreeBSD 7.0)            |
|                          |
| Primary router and only  |
| server of the cell.      |
+--------------------------+
            ||
+--------------------------+
| silc2.dose.se            |
| (SILC Server 1.1.11)     |
| (OpenBSD 3.9)            |
|                          |
| Only acts as a router    |
| backup, and will not     |
| accept clients.          |
+--------------------------+

Only public key authentication should be used for authentication
between clients and silc.dose.se and between silc.dose.se and its
backup silc2.dose.se. You can see my two silcd.conf files attached to
this mail.

My method for testing if this works have been:

First test that traffic can actually pass between the two routers on
706/tcp. Then:

1) Connect to silc.dose.se, create a channel and make it permanent.
2) Restart silcd on silc.dose.se.
3) Check if it regained state, i.e. if the channel is there (it's not).

And when that didn't work also:

1) Run `tcpdump -i ne3 port 706` on silc2.dose.se.
2) Connect to silc.dose.se.
3) Perform state-changing commands on silc.dose.se such as changing
channel modes.
4) See if tcpdump catches any traffic (it doesn't) coming from the
state transfer.

If anyone quickly spots where I've gone wrong with this, that would be
great, as I'd really like to have some kind of redundancy for the
state, and not just a standalone server.

Now for a few general SILC questions I couldn't find in the FAQ or by googling:

* Exactly much of the state is transferred to a backup router? Are
channel topics transferred? I had a look at section 3.14 Backup
Routers of the spec, but I'm still a bit unsure about this.

* If I should decide to let clients connect to my backup router
(silc2.dose.se) in the future, what would happen to client connections
to silc.dose.se when it goes down? Would the actual client connections
be "transferred" to the backup (silc2.dose.se)? (I'm guessing not).

* The /DETACH command puzzles me. It is advertised as an option for
keeping presence on a network without running a client. My question is
then; of what use is this when all messages for me are dropped by the
server when I'm detached? In my opinion this is "keeping presence"
only in a technical sense, because to me and my peers on the network,
the effect is the same as a /QUIT, they can't send messages to me and
I can't send messages to them. I've seen it mentioned that it is good
if you need to upgrade your client without disconnecting, but the
question remains; what are the benefits of /DETACH over actually
disconnecting?

* I'm using the PublicKeyDir to load public keys of clients that are
allowed to connect. If I want to add a new public key, I can force
silcd to reload the keys from the directory by sending it the HUP
signal. But it seems that if I remove a key from the directory and
send the HUP signal, the key is not removed the running silcd. I.e.
this mechanism is accumulative. Is this intentional? Is there another
way to remove a public key that has been added by PublicKeyDir from a
running server without restarting it?

* I've tried to get more debugging information in the logs or on
stderr by passing -D with a really high value like 100000, but still
the logs are pretty quiet and mostly show startup/shutdown messages
and authentication failures. Is there a way to get more verbose
debugging messages?

I might have had some more questions but I can't think of them now and
I need to head off to work :)

Lastly I would like to thank Pekka and all the contributors to SILC
for an outstanding piece of software and a kick-ass protocol and
network model. Very neatly packaged software too; compiled without a
hitch on my old-ish OpenBSD 3.9 box. Thanks!

Best regards,
Elvis Stansvik

_______________________________________________________________
Info:    https://lists.silcnet.org/mailman/listinfo/silc-users
Archive: https://lists.silcnet.org/pipermail/silc-users
FAQ:     http://silcnet.org/support/faq/

#
# silc.dose.se
#
# This is the primary router / server of the cell.
#
# SILC Server 1.1.11
# FreeBSD 7.0
#

General {
	connections_max = 1000;
	keepalive_secs = 300;
	reconnect_count = 7;
	reconnect_interval = 10;
	reconnect_interval_max = 600;
	reconnect_keep_trying = true;
	key_exchange_pfs = true;
};

ServerInfo {
	hostname = "silc.dose.se";

	Primary {
		ip = "0.0.0.0";
		port = 706;
	};

	ServerType = "My SILC Server";
	Location = "Foo";
	Admin = "Foo";
	AdminEmail = "[email protected]";
	User = "silcd";
	Group = "silcd";
	PublicKey = "/usr/local/etc/silc/silcd.pub";
	PrivateKey = "/usr/local/etc/silc/silcd.prv";
	PidFile = "/var/run/silcd.pid";
};

Logging {
	Timestamp = true;
	FlushDelay = 180;

	Info {
		File = "/var/log/silc/silcd.log";
		Size = "100k";
	};

	Warnings {
		File = "/var/log/silc/silcd_warnings.log";
		Size = "50k";
	};

	Errors {
		File = "/var/log/silc/silcd_errors.log";
		Size = "50k";
	};

	Fatals {
		File = "/var/log/silc/silcd_fatals.log";
		Size = "50k";
	};
};

ConnectionParams {
	name = "normal";
	connections_max = 200;
	connections_max_per_host = 10;
	keepalive_secs = 300;
	reconnect_count = 7;
	reconnect_interval = 10;
	reconnect_interval_max = 600;
	reconnect_keep_trying = true;
};

Client {
	PublicKeyDir = "/usr/local/etc/silc/userkeys";
};

Admin {
	PublicKey = "/usr/local/etc/silc/adminkeys/admin.pub";
};

ServerConnection {
  Host = "silc2.dose.se";
  PublicKey = "/usr/local/etc/silc/silc2.dose.se.pub";
};

RouterConnection {
  Host = "silc2.dose.se";
  PublicKey = "/usr/local/etc/silc/silcd.pub";
  BackupHost = "silc.dose.se";
  BackupPort = 706;
  BackupLocal = true;
};

#
# silc2.dose.se
#
# Backup router for silc.dose.se.
#
# SILC Server 1.1.11
# OpenBSD 3.9
#

Include "/opt/etc/silcalgs.conf";

General {
	connections_max = 1000;
	keepalive_secs = 300;
	reconnect_count = 7;
	reconnect_interval = 10;
	reconnect_interval_max = 600;
	reconnect_keep_trying = true;
	key_exchange_pfs = true;
	# debug_string = "";
};

ServerInfo {
	hostname = "silc2.dose.se";

	Primary {
		ip = "0.0.0.0";
		port = 706;
	};

	ServerType = "Foo";
	Location = "Foo";
	Admin = "Foo";
	AdminEmail = "[email protected]";
	User = "_silcd";
	Group = "_silcd";
	PublicKey = "/opt/etc/silcd.pub";
	PrivateKey = "/opt/etc/silcd.prv";
	#MotdFile = "/opt/etc/motd.txt";
	PidFile = "/var/run/silcd.pid";
};

Logging {
	Timestamp = true;
	FlushDelay = 180;

	Info {
		File = "/opt/logs/silcd.log";
		Size = "100k";
	};

	Warnings {
		File = "/opt/logs/silcd_warnings.log";
		Size = "50k";
	};

	Errors {
		File = "/opt/logs/silcd_errors.log";
		Size = "50k";
	};

	Fatals {
		File = "/opt/logs/silcd_fatals.log";
		Size = "50k";
	};
};

ConnectionParams {
	name = "normal";
	connections_max = 200;
	connections_max_per_host = 10;
	keepalive_secs = 300;
	reconnect_count = 7;
	reconnect_interval = 10;
	reconnect_interval_max = 600;
	reconnect_keep_trying = true;
};

ServerConnection {
	Host = "silc.dose.se";
	PublicKey = "/opt/etc/silc.dose.se.pub";
	Params = "normal";
	Backup = true;
};