From: root@rainbow (System Administrator ())
Newsgroups: news.software.nntp
Subject: Re: User authentication
Date: 14 Dec 92 18:07:48 GMT
Originator: root@rainbow.cse.nau.edu

From article <1992Dec11.103811.4070@schbbs.mot.com>, by mmuegel@next3.corp.mot.com (Michael S. Muegel):
> Is anyone working on adding user authentication to the NNTP standard? What
> I mean is, it would be nice to be able to ACL off groups in order to
> create "private" groups on what is a very public service. This would require
> changes to the NNTP clients as well (prompt for password or the like).
> 
> Along those lines, has anyone just put in hacks like this to their NNTP
> server and any clients?
> 
> Sorry if this is a common question, I stopped doing news administration 
> sometime ago.
> 
> Thanks!
> -Mike

I implemented our own version of user authentication in NNTP 1.5.9
for Northern Arizona University.  (We're running B-news 2.11.19).
Basically, when you think about it, there's a few different types
of authentication that are needed:

1. anyone on a per-machine basis is allowed to post.

2. nobody on a given host is allowed to post, unless the news administrator
   on the news server gives them permission (adds them to a group, or adds
   them to a file on the server, etc).

3. user posting permission is assigned by the system administrator of
   the client machine, and tells the server if each user is allowed to post
   or not.

ACTUALLY IMPLEMENTING THEM

Number 1 is already part of NNTP, via the "nntp_access" file.

We added number 2 by placing a secret password string on each client,
and modifying the pseudo "inews" on the client to send the password to
the server when a user posts.  This way the server knows to trust the
posting attempt (since "inews" is the only one that can know this password),
so the server checks a file to see if that user on that client should
be allowed to post.  If so, the posting is performed.

We added number 3 for another department that administers their own
machines, because they wanted to dictate who could post and who could not,
even though they are not in charge of any news server.  The implementation
of this one is simple: the server expects a password from the client "inews"
(like with number 2 above) but then accepts the posting no matter who the
user is.  Thus the client administrators are expected to decide which users
are allowed to post and which are not, and handle it locally.  If they ever
connect to us from their "inews" and can hand us that password, then we
know they have already approved the posting.

DOES IT WORK?

These methods seem to work well at our site.  Once we added the ability
for all users to post to the local newsgroups, it got even better.
(I.E., all users everywhere at NAU can post to local newsgroup hierarchies).

WHY BE SO RESTRICTIVE?

I would like to add that the only thing I request before I enable someone
for world-wide news posting is that they read and understand two of the
documents posted regularly on Usenet News: "How to Use USENET Effectively"
by Matt Bishop, and "posting-rules" by Mark Horton and Gene Spafford.
The user can read my paper printouts, or view them on-line.  Once they do
this I send them an acknowledgement via e-mail, describing some things to
keep in mind when posting to Usenet.  In 4 years I have not had one complaint
about any postings from our site.

-- 
Paul Balyoz, Senior Systems Programmer  root@rainbow.cse.nau.edu
Northern Arizona University             root@naucse.cse.nau.edu
PO Box 15600, Flagstaff AZ 86011        {pab,root}@sunset.cse.nau.edu
NICname: PB1                            ...arizona!naucse!root
Newsgroups: news.software.nntp,news.software.anu-news