A BBS server, written from scratch, with security, graphics, and audio built in at the foundation.

One BBS, every terminal

Screens are built, not just played back

Most BBS screens are hand-drawn .ANS files, and everyone gets the same bytes. Rainwire builds each screen from widgets (menus, forms, lists, dialogs) and draws it with a renderer for the caller's terminal. It finds out what your terminal can do when you connect: device attributes, SyncTERM's CTerm reply, a UTF-8 probe and TERMinator's TRACE query. Hand-drawn ANSI art still works as an asset.

These are the same screens from the same server. Use the buttons above to switch looks. Click any screenshot to enlarge it.

Security as a headline feature

Intrusion detection and prevention, built in

Detection: Rainwire watches how every caller behaves. Failed logins, wrong two-factor codes, bad SSH handshakes, connection floods and honeypot hits all add to a threat score for that address. Prevention: once the score passes your threshold, the address is banned automatically on every listener, and repeat offenders get longer bans each time. Banned and denied addresses are refused the moment they connect, before any SSH or telnet handshake, so they cost almost nothing.

This is an application-layer intrusion prevention system (IPS) that understands BBS logins. Rainwire also ships the packet layer: a stateful nftables ruleset with SYN-flood and per-source rate limits, and a small privileged helper that turns every Rainwire ban into a kernel drop, so banned addresses never reach the server again.

• Allow and deny lists for single IPs and CIDR ranges. The allow list protects retro callers on unusual networks.
• Connection caps per address, plus rate limits on new connections.
• Automatic bans once an address passes the score threshold. Each repeat offence doubles the ban, up to a limit you set.
• Honeypot ports: touch one and you're banned on every listener, then held in a tarpit that feeds your scanner a never-ending banner.
• Bot fingerprints: known scanner SSH clients and password logins as root or admin are scored on sight.
• Credential-stuffing detection: one address trying many handles is scored, and guesses on one handle are counted across every address.
• IPv6 grouped by /64, so rotating addresses doesn't get around a ban.
• Live control: changes in the sysop panel apply at once, are saved in the database, and override config.lua until you reset.

Accounts that are hard to steal

• argon2id password hashing.
• TOTP two-factor login works with any authenticator app. Secrets are encrypted at rest, codes can't be replayed, and you get ten one-use recovery codes.
• 2FA is asked after every kind of login, SSH keys included. Sysops can be required to set it up.
• Handles lock after repeated failures, from any address, for longer each time. SSH-key logins still get through, so an attacker can't lock the sysop out.
• Sysop accounts can be tied to your own networks. The right password from anywhere else is treated as a wrong one, and every sysop login raises an alert.
• No reusable passwords over plain telnet. Telnet callers log in with one-time codes, so a sniffed session exposes that session and never the account.
• An audit log records every login, failure, ban and privilege change.

Getting in

SSH without the chicken-and-egg problem

On most BBSes you need an account to get SSH access, and you need to connect to make an account. On Rainwire, anyone can connect. The real gate is the BBS login, and there's no shell behind it.

ssh new@bbs

ssh yourhandle@bbs

Options → SSH keys

Clients like SyncTERM that send a saved password are logged in directly. A bad match lands on the normal form, which gives nothing away about whether the handle exists.

For sysops

Simple to run, easy to change

-- Edit and save: the next caller sees it. No restart.
return {
  title = "Main Menu",
  items = {
    { key = "M", label = "Message bases",
      access = "true" },
    { key = "F", label = "Fido echoes",
      access = "level >= 50 and group(fido)" },
    { key = "Y", label = "Sysop",
      access = "level >= 255 and mfa",
      action = "menu:sysop" },
  },
}

$ rainwire admin users
$ rainwire admin level SomeUser 50
$ rainwire admin group SomeUser add fido
$ rainwire admin mfa-reset SomeUser        # lost phone
$ rainwire admin unban 203.0.113.9
$ rainwire admin audit 40
$ rainwire admin backup

Linked boards

The Rainwire network

Rainwire BBSes can share message boards, with posts from every member system. It's off by default, and each sysop chooses which boards to carry. This network is a modern layer between Rainwire systems.

Rainwire vs Mystic and Synchronet

Different choices, for different reasons

Mystic and Synchronet are great, battle-tested systems with decades of history. Here's where Rainwire does things differently.

Rainwire deliberately leaves out FTP, a web front end, an inbound email server and legacy services like Gopher and finger. That keeps the attack surface small. If you need those today, Mystic and Synchronet have you covered.