HDTenEightyP/NetNews huggingface dataset:
From: jmsellen@watdragon.waterloo.edu (John M. Sellens)
Subject: Re: File security
Organization: DCS Software Activists Squad
Date: Tue, 7 Apr 1992 07:43:43 GMT

In article <1992Apr6.234215.14082@news2.cis.umn.edu> lindner@danzig.micro.umn.edu (Paul Lindner) writes:
|On the UNIX side we've gone to great lengths to keep everything
|secure.  The server operates in two secure modes.  The first is the
|chroot() mode, which restricts access using the chroot system call.
|Very secure, it's what anonymous ftp uses...
|
|There's also a mode that doesn't use chroot().  It has overridden file
|open functions that check for bad paths, and restrict to a specific
|directory. 
|
|>Is this an irrational fear?
|
|No, it's quite rational.  We've taken care of it though...

Famous last words of course :-)

The UNIX server is thought to be fairly secure, with reasonable methods
used to make it that way.  Anything under the data directory (regardless
of permissions or modes) must be treated as available through the gopher
server (though some of it might not be), and if you have actual sensitive
data on a machine, don't run a gopher server on it.

Security in general is difficult.  The gopher server is fairly well-defined,
so security shouldn't be too difficult, so it should be reasonably secure.
From: nolf@frith.egr.msu.edu
Newsgroups: alt.gopher
Subject: news
Date: 8 Apr 92 00:40:58 GMT
Article-I.D.: natasha.9204080041.AA01373
Distribution: alt
Original-To: gopher-news@boombox.micro.umn.edu
X-Mailer: ELM [version 2.3 PL11]

I was wondering if anyone knew of a news
service that was much like PC Gopher or
POPmail.  If you know please e-mail
me.  Thank-you.

Sarah Nolf

nolf@frith.egr.msu.edu


-- 
/-------------------------------------------------------------\
| Sarah Nolf                  |  Phone:     (517) 355-5124    | 
| Case Center                 |  Fax:       (517) 355-7516    | 
| 120B Engineering Building   |  Bitnet:    nolf@msuegr       |
| Michigan State University   |  Internet:  nolf@egr.msu.edu  |
| East Lansing, Mi  48824     |                               |
\-------------------------------------------------------------/

      For every man of action, there was a dreamer.

		         o     o
		            o
                       oo       oo
		        o       o
		         ooooooo
From: BRUNELLI@mis.mcw.edu
Newsgroups: alt.gopher
Subject: Re: Indicate cities where some things are.
Date: 8 Apr 92 19:41:00 GMT
Article-I.D.: mis.01GILUMIXWCWBOS6TV
Distribution: alt
Original-To: Joy.Lynam@MVS.UDEL.EDU
Original-Cc: gopher-news@boombox.micro.umn.edu
X-Organization: Medical College of Wisconsin (Milwaukee, WI)
X-Vms-To: IN%"Joy.Lynam@MVS.UDEL.EDU"
X-Vms-Cc: IN%"gopher-news@boombox.micro.umn.edu"

Did you comment out "search = waissearch" and add "search = none" in the 
Makefile?
Date: Fri, 10 Apr 1992 9:36:51 CDT
From: LAPOINTE@uthscsa.edu (David Lapointe)
Subject: Re: New PC Gopher II
Original-To: gopher-news@boombox.micro.umn.edu
X-Vmsmail-To: SMTP%"gopher-news@boombox.micro.umn.edu"
Newsgroups: alt.gopher
Distribution: alt

I just installed PCGII and it slick as gopher g.. Never mind!

I have problem with adding bookmarks. Here's how it goes.
I start with the screen listing NorthAmerican Sites and begin to
select on after another to add to a bookmark list.

So I have selected three, say, by going to their respective opening
screens and creating a bookmark there. When I bring up the bookmark list and 
select any of the three, I get the NorthAmerican Sites screen. Whoa the
bookmark remembered (sic) the previous gopher hole (NA sites).

Ok I'll go to a site and go down an entry. Nope then the bookmark saves
that place. Hmm I can't seem to put a bookmark on an opening screen.

Is there a trick to this? 

.david 

+*******************************************************************+
* David Lapointe                    | INTERNET:lapointe@uthscsa.edu *    
* UT Health Science Center          | BITNET:  lapointe@uthscsa     *
* 7703 Floyd Curl Drive             |                               *
* San Antonio, Texas 78284-7832     |                               *
* (512) 567-2112                    |                               *
+********************************************************************
* Never Roast what is already Boiled                                *
+********************************************************************
From: mark@cda.mrs.umn.edu (Mark Van Overbeke)
Newsgroups: alt.gopher
Subject: gopher security
Date: 7 Apr 92 13:01:02 GMT
Article-I.D.: news2.1992Apr7.130102.16290
Organization: University of Minnesota - Morris

From umn.edu!danzig!lindner Tue Apr  7 07:54:54 CDT 1992
Article: 315 of alt.gopher
Newsgroups: alt.gopher
From: lindner@danzig.micro.umn.edu (Paul Lindner)
Subject: Re: File security
Organization: University of Minnesota, Minneapolis
Date: Mon, 6 Apr 1992 23:42:15 GMT

In <1992Apr4.084017.16880@nuscc.nus.sg> bchtantw@nuscc.nus.sg (Dr Tan Tin Wee) writes:

>We are in the process of setting up a gopher server using gopherd
>but there are some questions at the back of our minds.  Pardon my
>ignorance but as I am not formally trained in computing, I would like
>to know if
>gopher is secure enough to  prevent any user from modifying
>the client somehow to take advantage of some unknown (to me) loop hole
>in the gopher server to retrieve files read/writable to the gopher
>server other than those files and directories that are gopher
>retrievable via the normal channels.

...and Paul Lindner says...

>On the UNIX side we've gone to great lengths to keep everything
>secure.  The server operates in two secure modes.  The first is the
>chroot() mode, which restricts access using the chroot system call.
>Very secure, it's what anonymous ftp uses...

>There's also a mode that doesn't use chroot().  It has overridden file
>open functions that check for bad paths, and restrict to a specific
>directory. 

On the VMS side, the server looks at the line fed to it by the client
and checks to see if the first 11 characters are gopher_root.  If they
are, then it looks to see if the file exists.  If the first 11
characters are not gopher_root, then the server just says it cannot
access that file.  It won't even try.

>>Is this an irrational fear?

>No, it's quite rational.  We've taken care of it though...
I agree.

>--
> | Paul Lindner | lindner@boombox.micro.umn.edu   | Slipping into madness
> |              | Computer & Information Services | is good for the sake
> | GopherMaster | University of Minnesota         | of comparision.
>///// / / /    /////// / / / /  /  /  /   /      //// / / / /  /  /  /   /


-- 
Mark Van Overbeke                   Systems Software Programmer
Computing Services                  BITNET:    Mark@UMNMOR.BITNET   (VMS)
University of Minnesota, Morris     INTERNET:  Mark@caa.mrs.umn.edu (VMS) 
Morris, MN   56267           (612) 589-6378    mark@cda.mrs.umn.edu (Ultrix)
From: gucme@gdunix.gd.chalmers.se (Matz Engstrom)
Newsgroups: alt.gopher
Subject: segmentation fault in Unix Client v0.8 on Ultrix 4.2
Date: 8 Apr 92 07:56:23 GMT
Article-I.D.: gdunix.9204080756.AA05187
Distribution: alt
Original-To: gopher-news@boombox.micro.umn.edu
Original-Cc: gucme@gdunix.gd.chalmers.se

Hello, we recently got version 0.8 of gopher for UNIX. The server
works fine, but the client makes a core dump with "segmentation fault".
It does so directly, before anything is displayed on the screen.
We are on Ultrix 4.2 revision 96. Yes I have put in "-lcursesX" in
the Makefile. Do you have any idea?
From: fxa@boombox.micro.umn.edu ("Farhad Anklesaria" )
Newsgroups: alt.gopher
Subject: Re: g2ftp
Date: 9 Apr 92 21:52:19 GMT
Article-I.D.: boombox.9204092152.AA28382
Distribution: alt
Original-To: gopher-news@boombox.micro.umn.edu

In alt.gopher article <1992Apr9.155229.28908@mercury.unt.edu>, 
billy@sol.acs.unt.edu (Billy Barron - VAX/UNIX Systems Manager) writes:

> In gopher 0.9, I found two different versions of g2ftpd.  One was called
> g2ftpd and looked like a slightly modified version of the one available
> in 0.8.  Then there was gopherftp, which seemed to have no installation
> instructions.  What's the difference and how do you install it?

Never mind those two :-)

The first (g2ftpd) was a prototype Perl script to be run by inetd.
The next (gopherftp) was a heavily modified Perl daemon contributed by
John Ladwig.  A big improvement, though still not efficient enough and still 
with problems.  But the gopher-to-ftp service got very popular and
we couldn't support it using Perl and unrestricted access anymore.

Now (as of 15 minutes ago) you will find a tiny C version of the daemon
called g2fd.c in the gopher2FTP directory on boombox.  This is snappier,
does its job much more efficiently, and has simple load-limiting
code built in. It is run by inetd.

There is a ReadMe file to explain how to make and install it.
We'll probably roll its functionality into the next release of gopherd.

Bugs as usual to gopher@boombox.micro.umn.edu.



F.
--
Farhad Xerxes Anklesaria
Curmudgeon-In-Residence
Microcomputer Research Group 
University of Minnesota
fxa@boombox.micro.umn.edu
                         "Just balancing ain't riding."
From: mark@cda.mrs.umn.edu (Mark Van Overbeke)
Newsgroups: alt.gopher
Subject: vms gopher client and server
Date: 17 Apr 92 13:54:56 GMT
Article-I.D.: news2.1992Apr17.135456.2253
Organization: University of Minnesota - Morris

VMS gopher sites:

   I saw a posting asking about gopher and UCX.  I have access now to a
UCX system but am having some problems there with UCX.  Is there a UCX
site out there that has either a client or server up and running and
actually working?  All I have tried so far is the client.  I cannot seem
to get past the socket() call.  It even looks like the one in the
documentation(bookreader over the network).  I even made sure that I had
all the same include files in my stuff that they had in the client
sample in the doc.  I have my .opt file set up the way they suggest.
Maybe my next step is to try their client and see if that will run.

Another problem I noticed is that telnet doesn't do exactly what the
documentation shows.  Maybe it is the way they have UCX set up.  It
shows that you should be able to type connect hostname port at the
telnet prompt and connect to another host at the alternate port.  I can
only get this to work, sort of, if I use the IP number instead of the
hostname.  The hostname I am trying to connect to does not exist in
their hosts file for UCX.  I am relying on the UCX BIND (maybe not a
good idea) to give back the correct address.  It seems to work ok if I
do a telnet hostname.  Other than that, I have cleaned up some other
problems.  I will be posting the updated client and server when I can
get the UCX stuff working.  If that takes too long, I will post the new
sources without UCX support.  I will then be updating the sources to
V0.9.  I may even wait for V1.0 depending on how long down the road that
is.  I have heard of some "cleaning up" that is being done to the code
so that might be my best course of action.

-- 
Mark Van Overbeke                   Systems Software Programmer
Computing Services                  BITNET:    Mark@UMNMOR.BITNET   (VMS)
University of Minnesota, Morris     INTERNET:  Mark@caa.mrs.umn.edu (VMS) 
Morris, MN   56267           (612) 589-6378    mark@cda.mrs.umn.edu (Ultrix)
Xref: sparky alt.gopher:363 alt.wais:507
From: G.J.Hill@ecs.soton.ac.uk (Gary Hill)
Newsgroups: alt.gopher,alt.wais
Subject: Background info .... please
Date: 15 Apr 92 14:33:23 GMT
X-Mailer: ELM [version 2.3 PL11]


This is pretty much a plea for information.  I would be grateful for
any pointers that anyone can give me to background info, motivation
for, implementations, availability etc. for wais, gopher and
world-wide web and similar initiatives,

thanks in advance,

Gary Hill, gjh@uk.ac.soton.ecs
From: lindner@danzig.micro.umn.edu (Paul Lindner)
Newsgroups: alt.gopher
Subject: Re: File security
Date: 6 Apr 92 23:42:15 GMT
Article-I.D.: news2.1992Apr6.234215.14082
Organization: University of Minnesota, Minneapolis

In <1992Apr4.084017.16880@nuscc.nus.sg> bchtantw@nuscc.nus.sg (Dr Tan Tin Wee) writes:

>We are in the process of setting up a gopher server using gopherd
>but there are some questions at the back of our minds.  Pardon my
>ignorance but as I am not formally trained in computing, I would like
>to know if
>gopher is secure enough to  prevent any user from modifying
>the client somehow to take advantage of some unknown (to me) loop hole
>in the gopher server to retrieve files read/writable to the gopher
>server other than those files and directories that are gopher
>retrievable via the normal channels.

On the UNIX side we've gone to great lengths to keep everything
secure.  The server operates in two secure modes.  The first is the
chroot() mode, which restricts access using the chroot system call.
Very secure, it's what anonymous ftp uses...

There's also a mode that doesn't use chroot().  It has overridden file
open functions that check for bad paths, and restrict to a specific
directory. 

>Is this an irrational fear?

No, it's quite rational.  We've taken care of it though...
--
 | Paul Lindner | lindner@boombox.micro.umn.edu   | Slipping into madness
 |              | Computer & Information Services | is good for the sake
 | GopherMaster | University of Minnesota         | of comparision.
///// / / /    /////// / / / /  /  /  /   /      //// / / / /  /  /  /   /
From: lindner@mudhoney.micro.umn.edu (Paul Lindner)
Newsgroups: alt.gopher
Subject: Re: Running gindexd as a non-root id
Date: 7 Apr 92 16:20:46 GMT
Article-I.D.: news2.1992Apr7.162046.17271
Organization: University of Minnesota, Minneapolis

In <1992Apr6.162907.1506@mercury.unt.edu> billy@sol.acs.unt.edu (Billy Barron - VAX/UNIX Systems Manager) writes:

>Is it possible to run gindexd as anything but root?  I've tried doing an
>su gopher -c gindexd..., which doesn't work.  Also, I've tried doing the
>su gopher and then separately gindexd ... commend, which also does not work.

>Any ideas? 

Sounds like you're using a privileged port.  Try using a port above
1024.  (Or is it 2048?)  I do know that unprivileged users can use
ports around 4000 or so.
--
 | Paul Lindner | lindner@boombox.micro.umn.edu   | Slipping into madness
 |              | Computer & Information Services | is good for the sake
 | GopherMaster | University of Minnesota         | of comparision.
///// / / /    /////// / / / /  /  /  /   /      //// / / / /  /  /  /   /
Newsgroups: alt.gopher
From: raisch@world.std.com (Robert Raisch)
Subject: Re: MIME
Organization: The World Public Access UNIX, Brookline, MA
Distribution: alt
Date: Thu, 16 Apr 1992 18:52:43 GMT

It's interesting that there is a lot of attention being paid to MIME.
It's a marvelous idea, and one whose time has definately come, but...

The real value of gopher is it's ability to address the "least common
denominator", a VT100 for example.

Though MIME offers some interesting features, it seems targeted to
support sophistocated mail service which assumes a mega-mip, mega-pel
workstation, where the VAST majority of net connected systems are not.

Adding MIME to gopher is good.

Standardizing on MIME as the message protocol in gopher is:
	a. overkill
	b. of little *general* use
	c. probably something which will further tend to
	   seperate the "haves" from the "have-nots".

IMHO.  /rr
From: raisch@Control.COM (Robert Raisch)
Newsgroups: alt.gopher
Subject: Internal Links
Date: 15 Apr 92 21:57:26 GMT
Distribution: alt
Organization: Control Technology Corp., Hopkinton MA

Another possible extension to the current gopher model might be the
inclusion of [links] within a text document.

When the document is presented to the user it looks like:


--------------------------------------------------------------

	The Potential of [Gopher] for Hyper-Media Applications

			by

		[Robert L. Raisch]

--------------------------------------------------------------



But when it arrives at the client side it actually looks like:


--------------------------------------------------------------
	The Potential of [[Gopher\t0/About Gopher\tgopher.micro.umn.edu\t70] for Hyper-Media Applications

			by

		{{Robert L. Raisch\t0Who is Raisch?\tcontrol.com\t70}

--------------------------------------------------------------

Possible links could be:

	[[replacement]	-- upon selection, the current frame is replaced.
	{{popup}	-- upon selection, a new temporary frame is presented.

So that:

	Upon selection of the [Gopher] link, the next frame to be displayed
	would be the standard "About Gopher" at gopher.micro.umn.edu


	And the [Robert L. Raisch] link, would popup a new frame with a
	short biography of the author, which would not replace the current
	gopher frame.


This would be a trivial extension to the client only, and would, I feel
present the user with a very useful tool.  Perhaps this is a new 'type'
of document?  I would suggest that it be called a "Gopher Object Document".

	/rr
-- 
"What makes you think that you can dictate how people love each other?" -Soren
Copyright 1991 by raisch; contents cannot be sold for profit without permission.
From: lindner@mudhoney.micro.umn.edu (Paul Lindner)
Newsgroups: alt.gopher
Subject: Re: Bug in 0.9 titles
Keywords: gopher 0.9
Date: 16 Apr 92 16:24:11 GMT
Article-I.D.: news2.1992Apr16.162411.6831
Organization: University of Minnesota, Minneapolis

In <1992Apr15.130354.13514@cca.vu.nl> valke@cca.vu.nl (Peter Valkenburg) writes:

>There appears to be a bug in the gopher client 0.9 with the handling of
>titles.  If you return to the parent/root directory from a submenu, the
>menu title remains unchanged.  I checked this with the 0.9beta release on
>consultant.micro.umn.edu and it does not have this problem.  Is this a
>bug that has crept in after the beta release?  Is there a fix?

>Regards,

>	Peter Valkenburg (valke@cca.vu.nl).

Yes it is a bug.  Gopher1.0 will fix this.  1.0 is much reorganized
though.  I'll have a patch for 0.9 soon.

--
 | Paul Lindner | lindner@boombox.micro.umn.edu   | Slipping into madness
 |              | Computer & Information Services | is good for the sake
 | GopherMaster | University of Minnesota         | of comparision.
///// / / /    /////// / / / /  /  /  /   /      //// / / / /  /  /  /   /
From: ratzan@rwja.umdnj.edu (Lee Ratzan)
Newsgroups: alt.gopher
Subject: lethal misuse of databases-fatal retraction
Keywords: abuse database retraction
Date: 15 Apr 92 12:53:45 GMT
Organization: Robert Wood Johnson Medical School, Piscataway NJ

I submit for your review an information intrigue entitled
"Fatal Retraction" which appears in the current issue of
the Wilson Library Bulletin (March 1992, vol 66, no 7, p 30).
It is available at most public and university libraries.

Your comments are welcome!


Thank you,


Lee Ratzan
From: michael@fantasy.gatech.edu (Michael Mealling)
Newsgroups: alt.gopher
Subject: Re: gopher & MIME
Date: 16 Apr 92 22:00:44 GMT
Article-I.D.: fantasy.9204162200.AA06693
Distribution: alt
Original-To: gopher-news@boombox.micro.umn.edu
X-Mailer: ELM [version 2.3 PL11]

(I can't post directly to alt.gopher so I guess this will have to do... :-(

In response to the comments that MIME added to gopher will seperate the
haves from the have nots:

MIME was designed with the common denominator (VT-100) in mind. With MIME
the have-not users can still view what their systems are capable of viewing.
Whereas without it he would have seen nothing. MIME is not strictly 
multimedia. It is a system by which you can include any type of information
in any format in a file. It can be a WAIS docid, a gopher pointer, a
www link, or anything you can think of that will accept information and act
on it. 

Documents are many things, not just text....

-Michael Mealling

(Oh yea, I just finished making a MIME type for gopher. I will be posting
the patches soon. )

-- 
------------------------------------------------------------------------------
Michael Mealling                     ! Hypermedia WWW, WAIS, and gopher will be
Georgia Institute of Technology      ! here soon via MIME. Your view of the 
Internet: michael@fantasy.gatech.edu ! internet is about to change completely!
Newsgroups: alt.gopher
From: gaynor@magnus.acs.ohio-state.edu (Jim Gaynor)
Subject: Gopher for VMS/UCX - wazzup?
Organization: The Ohio State University
Date: Thu, 16 Apr 1992 13:33:40 GMT


Here I am, seeing all these availability for MVS and updated UN*X
Gophers, and becoming almost jealous... :-)

I seem to recall seeing notice that a new version of VMS Gopher
(client?  server?) would be coming out rsn, perhaps with UCX support.

Any further developments?

-- 
Jim Gaynor - System Analyst       Internet: gaynor@agvax2.ag.ohio-state.edu
Ohio State University - ACS/FMS   Phone: Voice 614/292-4338 - FAX 614/292-7443
ObDiscl:  Everything stated here and above is _my_ opinion.  Mine mine mine!
ObQuote: "We need bigger guns. Big, big guns"  Det. Dick Derkin, "Split Second"
From: gilbertd@sunflower.bio.indiana.edu (Don Gilbert)
Newsgroups: alt.gopher
Subject: Re: File security
Date: 7 Apr 92 00:53:09 GMT
Article-I.D.: bronze.1992Apr7.005309.12936
Organization: Biology, Indiana University - Bloomington

If you use the default gopher security method, chrooand run gopher
as a root process, then most every file and folder inside a gopher directory 
path is available to the enterprising cracker thru telnet.  I found this
out when I overlaid a gopher server on an anonymous ftp server.  I had
a folder in the ftp folder tree called "private" which was unreadable to
ftp users (due to privileges).  Neither was it available to normal
gopher users, as it was not linked into the main gopher directory listing.

But some nosy person used standard telnet to the secondary gopher server at
the port for the ftp folder tree and then used gopher commands interactively
to fetch out private files, since the permissions on that folder were no
proof against the root privileges that the gopher process was running at.

This is no big deal as long as you remember that all files and folders
under a gopher directory, except for any which are avoided in your
server (the standard ones are "dev", "etc", "bin", ...), are available
to those who like to poke around where they are not wanted.

-- Don

-- 
Don Gilbert                                     gilbert@bio.indiana.edu
biocomputing office, biology dept., indiana univ., bloomington, in 47405
Organization: Wirtschaftsuniversitaet Wien, Vienna, Austria
Date: Tuesday, 14 Apr 1992 14:20:06 WUT
From: Gerhard Gonter <GONTERNN@awiwuw11.wu-wien.ac.at>
Newsgroups: alt.gopher
Subject: list of current gopher oriented research and development
Distribution: world

Hello,
  maybe it would be useful to create a list of all gopher oriented
research and development projects that are currently in progress.

  The ideal place for such a list would be Gopher Central, but if
necessary I would volunteer to run the list here...

best wishes, Gerhard Gonter

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Gerhard Gonter                                   <GONTER@AWIWUW11.BITNET>
Tel: +43/1/31336/4111   Fax: .../702       <Gerhard.Gonter@WU-Wien.ac.at>
Life is like a cobol program. So many damn bugs and no way to find them.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Newsgroups: alt.gopher
From: billy@sol.acs.unt.edu (Billy Barron - VAX/UNIX Systems Manager)
Subject: Running gindexd as a non-root id
Organization: University of North Texas
Date: Mon, 6 Apr 1992 16:29:07 GMT

Is it possible to run gindexd as anything but root?  I've tried doing an
su gopher -c gindexd..., which doesn't work.  Also, I've tried doing the
su gopher and then separately gindexd ... commend, which also does not work.

Any ideas? 

Billy Barron
billy@unt.edu