open https://gitlab.synchro.net/main/sbbs/-/work_items/1297

Since IRCd 2.6 (7ab40ac2e6, trim-54-tube, 2026-10-22), every client that sends `PASS` has it checked against the BBS user database, whether or not `[BBSServices]` is enabled. The check in `Unregistered_Check_User_Registration()` (`exec/load/ircd/unregistered.js`) is gated only on `system.matchuser` existing:

```js
if (this.password && system.matchuser !== undefined) {
identity = IRC_services_authenticate(this.login_id || this.uprefix, this.password, ...);
if (!identity) identity = IRC_services_authenticate(this.nick, this.password, ...);
```

`services.md` describes `PASS` authentication as part of the local NickServ feature ("`PASS` with a matching `USER` or nickname uses the same authentication"), and says local BBS services are disabled by default. The code applies it on every 2.6+ server regardless.

## Why it matters

- **It works as a password-guessing oracle against BBS accounts.** On success, the username loses its `~` prefix (or becomes the user's handle), and the client sees that in its own `nick!user@host` (001, WHOIS). Each connection tests two candidate account names (the `USER` name, then the nick) against one password. The comparison is case-insensitive, like the BBS's own.
- **Failures are invisible to the BBS's login protection.** `IRC_services_authenticate()` doesn't count a failed attempt anywhere: not the failed-login tracking, the hack log, or the `ip.can` auto-filter. An attacker can guess against the user base over IRC without tripping anything that would stop the same guessing over telnet/SSH/web.
- **Success writes to the user record** (`connection = "IRC"`, `logontime = Epoch()`) on every IRC connection with a correct password, on a server that has not opted in to anything.

It is live on any server running 2.6 or later; cvs.synchro.net runs 2.7.

## Suggested fix

1. Gate the `PASS` authentication on `EmbeddedServices_Config.nickserv` (`[BBSServices] NickServ=true`), as the documentation already implies.
2. Treat a failed attempt as a failed login: feed it into the same login-failure accounting the BBS servers use, so repeated failures from one IP are throttled and filtered.
3. Possibly also require the IRC connection to be TLS before accepting a BBS password (see #1213 for the client side).

Related: `irc.js` sends the user's BBS password as `PASS` by default; filed separately.

-- *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.38-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)