A BBS server, written from scratch, with security, graphics, and audio built in at the foundation.

One BBS, every terminal

Screens are built, not just played back

Most BBS screens are hand drawn .ANS files, and everyone gets the same bytes. Rainwire builds each screen from widgets (menus, forms, lists, dialogs) and draws it with a renderer for the caller's terminal. It finds out what your terminal can do when you connect: device attributes, SyncTERM's CTerm reply, a UTF-8 probe and TERMinator's TRACE query. Hand drawn ANSI art still works as an asset.

These are the same screens from the same server. Use the buttons above to switch looks. Click any screenshot to enlarge it.

Security as a headline feature

Intrusion detection and prevention, built in

Detection: Rainwire watches how every caller behaves. Failed logins, wrong two factor codes, bad SSH handshakes, connection floods and honeypot hits all add to a threat score for that address. Prevention: once the score passes your threshold, the address is banned automatically on every listener, and repeat offenders get longer bans each time. Banned and denied addresses are refused the moment they connect, before any SSH or telnet handshake, so they cost almost nothing.

This is an application layer intrusion prevention system (IPS) that understands BBS logins. Rainwire also ships the packet layer: a stateful nftables ruleset with SYN flood and per source rate limits, and a small privileged helper that turns every Rainwire ban into a kernel drop, so banned addresses never reach the server again.

• Allow and deny lists for single IPs and CIDR ranges. The allow list protects retro callers on unusual networks.
• Connection caps per address, plus rate limits on new connections.
• Automatic bans once an address passes the score threshold. Each repeat offence doubles the ban, up to a limit you set.
• Honeypot ports: a port no real caller uses, such as 2323. Touch one and you're banned on every listener at once.
• Tarpits: instead of just dropping a scanner caught on a honeypot, Rainwire keeps it stuck on a dead-end connection, wasting its time so it can't move on to the next server. It costs your BBS almost nothing.
• Bot fingerprints: known scanner SSH clients and password logins as root or admin are scored on sight.
• Credential stuffing detection: one address trying many handles is scored, and guesses on one handle are counted across every address.
• IPv6 grouped by /64, so rotating addresses doesn't get around a ban.
• Live control: changes in the sysop panel apply at once, are saved in the database, and override config.lua until you reset.

Accounts that are hard to steal

• argon2id password hashing.
• TOTP two factor login works with any authenticator app. Secrets are encrypted at rest, codes can't be replayed, and you get ten one use recovery codes.
• 2FA is asked after every kind of login, SSH keys included. Sysops can be required to set it up.
• Handles lock after repeated failures, from any address, for longer each time. SSH key logins still get through, so an attacker can't lock the sysop out.
• Sysop accounts can be tied to your own networks. The right password from anywhere else is treated as a wrong one, and every sysop login raises an alert.
• An audit log records every login, failure, ban and privilege change.

Getting in

SSH without the chicken and egg problem

On most BBSes you need an account to get SSH access, and you need to connect to make an account. On Rainwire, anyone can connect. The real gate is the BBS login, and there's no shell behind it.

Clients like SyncTERM that send a saved password are logged in directly. A bad match lands on the normal form, which gives nothing away about whether the handle exists.

For sysops

Simple to run, easy to change

-- Edit and save: the next caller sees it. No restart.
return {
  title = "Main Menu",
  items = {
    { key = "M", label = "Message bases",
      access = "true" },
    { key = "F", label = "Fido echoes",
      access = "level >= 50 and group(fido)" },
    { key = "Y", label = "Sysop",
      access = "level >= 255 and mfa",
      action = "menu:sysop" },
  },
}

Sysop jobs from the shell

Prefer the command line? The rainwire admin commands cover everyday sysop work on the server itself: listing users, changing levels and groups, resetting a lost two-factor device, lifting a ban, reading the audit log and taking a backup. They work whether the BBS is running or not.

$ rainwire admin users
$ rainwire admin level SomeUser 50
$ rainwire admin group SomeUser add fido
$ rainwire admin mfa reset SomeUser        # lost phone
$ rainwire admin unban 203.0.113.9
$ rainwire admin audit 40
$ rainwire admin backup

Sysop Studio

Make the board yours, without writing code

Your own pages, your artwork and animated GIFs, the order callers see things in, menus and themes. All of it can be changed from the web panel, from the sysop menus inside the BBS, or by dropping plain files into your local/ folder. The three are the same files, so use whichever suits you. Every editor has a live preview drawn by the BBS's own renderer, at any tier and screen size, so you see it before your callers do. Upgrades never touch your changes.

• Pages: a screen of your own with pipe-coded text or a whole ANSI screen, an animated header, pictures and keys. Open it from any menu item.
• Pictures and animated GIFs anywhere: drop a file onto the preview and it lands where you dropped it. Drag it to move it and pull its corner to resize it.
• Animated without TRACE: GIFs play in TERMinator and SyncTERM, and callers on a basic telnet terminal get the ANSI you give in their place.
• Colour codes with effects: Mystic style pipe codes plus hex, 256 colours, fades like the Rainwire logo, and shimmer and pulse effects.
• Menus your way: drag items to reorder them, choose list, columns, tiles or an ANSI screen whose hotspots you draw with the mouse, and place the menu box where you want.
• Themes: colours, boxes, fonts and art per theme, section or screen. Make, copy, rename and share them as theme packs.

Optional web interface

Manage your board from a browser

Most of the Sysop menu is also a web page on your own network: watch who's on, change settings, edit menus and themes, manage users, bulletins and bans. It's part of the same program, on by default for your own network, and one setting turns it off.

• A web interface to monitor and manage your BBS from a browser. It's built into the same binary, served over HTTPS, and only answers your own network.
• For your own network only. Addresses outside your sysop list are dropped before a page loads, and only sysop accounts can sign in.
• The same login as the BBS, with your two-factor code, failed attempts counted by intrusion protection, and every change written to the audit log.
• A live dashboard: who's online, today's numbers, last callers, busiest doors, scheduled jobs and the threat watch, refreshed every few seconds.
• Every setting as a form, with toggles, rule checks as you type, and the same careful save as the BBS editors.

Linked boards

The Rainwire network

Rainwire BBSes can share message boards, with posts from every member system. It's off by default, and each sysop chooses which boards to carry. This network is a modern layer between Rainwire systems.

Rainwire vs Mystic and Synchronet

Different choices, for different reasons

Mystic and Synchronet are great, battle tested systems with decades of history. Here's where Rainwire does things differently.

Beta testing

Download Rainwire

The beta is available for testing. It's a complete board you can run today: messages, mail, files, chat, doors, the web interface and intrusion protection. Ask for a copy below and you'll get the download link by email.