HDTenEightyP/NetNews huggingface dataset:
From: davidg@aegis.or.jp (Dave McLane)
Newsgroups: news.software.b
Subject: Re: Controlling access to newsgroups
Date: 11 Jan 93 23:22:42 GMT

rsalz@rodan.UU.NET (Rich Salz) writes:

>In <3655@aegis.or.jp> davidg@aegis.or.jp (Dave McLane) writes:
>>So far the conclusion I've come to is that the newsreader(s) will
>>have to pass the uid to the nntp server ...
>This is not as easy as you think.  Any client can connect to your
>server.  Making it impossible for them to send the right uid is
>very difficult.
>	telnet news-server 110
>	200 Restricted server, go ahead
>	group mgmt.raises
>	480 permission denied
>	UID 0
>	280 Hello boss
>	group mgmt.raises
>	211 15 989 1006 mgmt.raises
>	...

>As someone else mentioned, INN can do some access control based
>on IP address and/or cleartext name/password; these commands can be
>sent at any time by a reader to vary its access dynamically.

I see the problem. So maybe the only way it would work would be to
have the person telnet themselves to the server where they would
have to have an account. Awkward to be sure, but it would only
have to be for the restricted groups....

Any other ideas anybody?

Dave

--
Dave McLane 
JUNET: davidg@aegis.or.jp (ONLY within Japan: post otherwise)
Nagaokakyoshi, Kyoto Japan Tel: +81-75-951-1168 Fax: +81-75-957-1087
 
Newsgroups: news.software.b
From: henry@zoo.toronto.edu (Henry Spencer)
Subject: Re: innxmit times out talking to Cnews site
Date: Wed, 6 Jan 1993 17:40:34 GMT
Organization: U of Toronto Zoology

In article <1idl2eINNovi@wintermute.phys.psu.edu> kenh@leps5.phys.psu.edu (Ken Hornstein) writes:
>I am running INN 1.2 on a DECstation 5000/240 running Ultrix 4.3.  Lately,
>I've been seeing errors like this in nntpsend.log:
>
>No reply after sending "rec/radio/amateur/misc/30836", Connection timed out
>Rewriting batch file and exiting.
>
>This only happens when talking to one particular site.  The site in question
>is running C-news (I don't know what version)...

C News can't possibly be involved in this, actually, since it doesn't speak
NNTP, and this is an NNTP failure of some kind...
-- 
"God willing... we shall return."       | Henry Spencer @ U of Toronto Zoology
       -Gene Cernan, the Moon, Dec 1972 |  henry@zoo.toronto.edu  utzoo!henry
Newsgroups: news.software.b
From: gary@sci34hub.sci.com (Gary Heston)
Subject: Re: Controlling access to newsgroups
Reply-To: gary@sci34hub.sci.com (Gary Heston)
Organization: SCI Systems, Inc., Huntsville, Al.
Date: Mon, 11 Jan 1993 15:12:07 GMT

In article <C0nrwC.LKI@news2.cis.umn.edu> molenda@msi-i9.msi.umn.edu (Jason Molenda) writes:
  [ about restricting access to specific newsgroups ]
|Dave, I think you missed his point.  Why not have everything in spool/news
|owned by 'news' and then have different groups (i.e. in /etc/group) for
|each newsgroup or hierarchy that you want to control?  like a altsex
|group, for instance.  The directory permissions on spool/news/alt/sex
|would be rwxr-x---, owner `news', group `altsex'.  Then put the users
|who you want to have access to the group in /etc/group and be done with
|it.

This might work on a small site, but with more than a couple of dozen
users, it'd become unwieldy *real* fast. Also, current news software
wants both owner *and* group set to "news", so it would involve considerable
work there, not to mention the rewrite of the newsreaders.

From an admin point of view, I think most of us a) don't have time, and 
b) don't want to bog down /etc/groups with 3,000 new (and large) entries.


-- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
"Data sheet: HSN-3000 Nuclear Event Detector. The [NED] senses the gamma
radiation pulse [from a] nuclear weapon." As if we wouldn't notice...
Newsgroups: news.software.b
From: brad@clarinet.com (Brad Templeton)
Subject: Re: Controlling access to newsgroups
Organization: ClariNet Communications Corp.
Date: Mon, 11 Jan 1993 07:06:22 GMT

Note that it is not sufficient to change permissions this way if your
nntp server runs as "news."   NNTP clients will be able to read all
the restricted groups.

This is true no matter what scheme you use.  Thus the solution is that
the nntp server should not run as news, but some dummy user you create
such as "nntp."

That's a good idea anyway, since it's a potential security hole to have
it run as news.

The downside of course is that you then can restrict reading to nntp users,
they must all be locked out of restricted groups, unless the nntp protocol
is changed.
-- 
Brad Templeton, ClariNet Communications Corp. -- Sunnyvale, CA 408/296-0366
From: kenh@leps5.phys.psu.edu (Ken Hornstein)
Newsgroups: news.software.b
Subject: Re: innxmit times out talking to Cnews site
Date: 6 Jan 1993 18:55:30 GMT
Organization: Penn State, Laboratory for Elementary Particle Science

In article <C0G13r.E77@zoo.toronto.edu> henry@zoo.toronto.edu (Henry Spencer) writes:
>C News can't possibly be involved in this, actually, since it doesn't speak
>NNTP, and this is an NNTP failure of some kind...

Yes, as it's already been pointed out to me, C News and NNTP are seperate
(something that I keep forgetting).  But it turns out that the routers between
me and my feed site were the culprit.

--Ken
Xref: sparky news.software.b:3732 news.software.nntp:1762 news.software.readers:2735
From: barrett@daisy.ee.und.ac.za (Alan P Barrett)
Newsgroups: news.software.b,news.software.nntp,news.software.readers
Subject: Re: Controlling access to newsgroups
Followup-To: news.software.nntp,news.software.readers
Date: 10 Jan 1993 14:38:27 +0200
Organization: Dept. Elec. Eng., Univ. Natal, Durban, S. Africa
Distribution: inet
NNTP-Posting-Host: daisy.ee.und.ac.za

[ I am broadening the Newsgroups line to include news.software.nntp
  and news.software.readers, and am directing followups out of
  news.software.b.  --apb ]

In article <3614@aegis.or.jp>,
davidg@aegis.or.jp (Dave McLane) writes:
> Yes, that's what I'm looking for. A newsreader that implements the
> restrictions on a newsgroup by newsgroup basis for each user.

You could implement the restrictions in an NNTP server.  Then you wouldn't
have to change the newsreader clients much, except perhaps to teach
them to participate in some authentication dialogue with the server.

The NNTP server that comes with INN has some support for authentication
based on user names and passwords, and some support for restricting
access to groups based on passwords.  You might start with that, and
extend it as necessary to satisfy your needs.

--apb
Alan Barrett, Dept. of Electronic Eng., Univ. of Natal, Durban, South Africa
RFC822: barrett@ee.und.ac.za                    Bang: m2xenix!undeed!barrett
Newsgroups: news.software.b
From: henry@zoo.toronto.edu (Henry Spencer)
Subject: Re: Controlling access to newsgroups
Date: Sun, 10 Jan 1993 01:47:05 GMT
Organization: U of Toronto Zoology

In article <3594@aegis.or.jp> davidg@aegis.or.jp (Dave McLane) writes:
>I'm would like to control access to some of the newsgroups according
>to a file of uids in /etc/xxxxx
>
>As far as I know, this isn't possible with Bnews, readnews, rn, nn.
>Is that right? Or did I miss something? 
>
>How about Cnews can it handle this? 

Bear in mind that the news articles are stored in ordinary files that
are normally readable to anyone.  People can read news using "cat" if
they must.  You're going to have to change the permissions on the files
(or, more practically, the directories they're in).  C News, and I'm
pretty sure B News as well, will run fine so long as *it* can read and
write in those directories -- it doesn't care whether anyone else can.
If the Unix rwxrwxrwx permissions aren't flexible enough to do what
you want, then you're going to have to make the directories inaccessible
to everyone and implement your restrictions in a newsreader that runs
as a privileged user.  Nobody's done this that I know of.
-- 
"God willing... we shall return."       | Henry Spencer @ U of Toronto Zoology
       -Gene Cernan, the Moon, Dec 1972 |  henry@zoo.toronto.edu  utzoo!henry
Newsgroups: news.software.b
From: markmc@halcyon.com (Mark McWiggins)
Subject: INN config.data files for common systems to be included w/distribution?
Organization: Northwest Nexus Inc. (206) 455-3505
Date: Fri, 8 Jan 1993 06:46:22 GMT

This would get us back to the Good Old Days before the horrors of C News
installation:

	cp config.mysys config.data
	make world install

And happy InterNetNewsing forever after.

Just a thought.
-- 
Mark McWiggins        Hermes & Associates		+1 206 632 1905 (voice)
markmc@halcyon.com    Box 31356, Seattle WA 98103-1356  +1 206 632 1738 (fax)
Newsgroups: news.software.b
From: gary@sci34hub.sci.com (Gary Heston)
Subject: Re: Sudden slowdown of Cnews processing
Reply-To: gary@sci34hub.sci.com (Gary Heston)
Organization: SCI Systems, Inc., Huntsville, Al.
Date: Tue, 5 Jan 1993 16:48:53 GMT

In article <1993Jan4.211910.14359@bony1.bony.com> stevef@bony1.bony.com (Steve Faiwiszewski) writes:
|Our site uses a DECstation 3100/ Ultrix 4.2 for our newsfeed, using a
|relatively stale copy of Cnews (circa July 1990).  Everything has been
|running smoothly (more or less) for a LONG LONG time.  But on about Dec 24,
|the news processing suddenly started dragging its feet.  Things were
|so bad that we couldn't keep up with our feed, and nobody could post
|anything even locally, as there was always a relaynews process hanging
|around locking the system.
|
|
|The relaynews process that gets spawned by the newsrun script spending
|most of its time in D state (disk wait).  I tried a few things to no avail:
|1) Ran expire a few times for good measure
|2) Recreated the filesystem to eliminate disk fragmentation as a factor
|
|I then recreated the history files using the mkhistory script, and
|that seems to have cured the problem.

Sounds like something corrupted your histrory files, and it wasn't 
being handled very well (of course, one can't allow for every possibility).

The reason your history files were significantly smaller is that previously,
they held the message IDs from articles that have already been expired; now,
you've only got those from articles on hand. Your history file should grow
back to it's previous size in a few weeks.

I don't think you need to worry about upgrading, unless you want to.

-- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
"Data sheet: HSN-3000 Nuclear Event Detector. The [NED] senses the gamma
radiation pulse [from a] nuclear weapon." As if we wouldn't notice...
From: davidg@aegis.or.jp (Dave McLane)
Newsgroups: news.software.b
Subject: Re: Controlling access to newsgroups
Date: 10 Jan 93 07:06:09 GMT

henry@zoo.toronto.edu (Henry Spencer) writes:

>In article <3594@aegis.or.jp> davidg@aegis.or.jp (Dave McLane) writes:
>>I'm would like to control access to some of the newsgroups according
>>to a file of uids in /etc/xxxxx
>>
>>As far as I know, this isn't possible with Bnews, readnews, rn, nn.
>>Is that right? Or did I miss something? 
>>
>>How about Cnews can it handle this? 

>Bear in mind that the news articles are stored in ordinary files that
>are normally readable to anyone.  People can read news using "cat" if
>they must.  You're going to have to change the permissions on the files
>(or, more practically, the directories they're in).  C News, and I'm
>pretty sure B News as well, will run fine so long as *it* can read and
>write in those directories -- it doesn't care whether anyone else can.

I want to deny all access to the ~/spool/news and only have the news
software be able to read/write the directories and files.

>If the Unix rwxrwxrwx permissions aren't flexible enough to do what
>you want, then you're going to have to make the directories inaccessible
>to everyone and implement your restrictions in a newsreader that runs
>as a privileged user.  Nobody's done this that I know of.

Yes, that's what I'm looking for. A newsreader that implements the
restrictions on a newsgroup by newsgroup basis for each user. You
can do this with Waffle, but the newsreader is very primitive. They
say that such a thing exists for VAX/VMS, but I'm user UNIX.

What I want would check some /etc/xxxx file each time it changed
newsgroups to see if the current users was permitted to access.

If was hoping somebody had already done this....

Dave

--
Dave McLane 
JUNET: davidg@aegis.or.jp (ONLY within Japan: post otherwise)
Nagaokakyoshi, Kyoto Japan Tel: +81-75-951-1168 Fax: +81-75-957-1087
Newsgroups: news.software.b
From: mark@drd.com (Resident.Alien)
Subject: Where do NNTP cogniscenti hang out?
Organization: DRD Corporation
Distribution: na
Date: Mon, 11 Jan 1993 13:01:35 GMT

Is this the place it or is there a mailing list of active
users/managers of NNTP-based news transport systems?
-- 
mark.lawrence@drd.com                                     (918)743-3013
DRD Corp., 5506 South Lewis Ave., Tulsa, OK 74105         (918)745-9037 fax
From: rsalz@rodan.UU.NET (Rich Salz)
Newsgroups: news.software.b
Subject: Re: Where do NNTP cogniscenti hang out?
Date: 11 Jan 1993 10:39:33 -0500
Organization: UUNET Technologies Inc, Falls Church, VA
NNTP-Posting-Host: rodan.uu.net

{I removed the 'Distribution: na' line.}

The NNTP-Mangers mailing list <nntp-managers-request@colossus.apple.com>
is very quiet, except for occasional connectivity discussions, as in "can
anyone give me a biz.* feed within the US Gov't?"  In has had the
occasional announcement of new NNTP software releases, and an even more
rare comment on it.  It is not a general "how do I make INN work with
SunOS2.x" list.  The list is primarily redistributed by NSFnet regional;
so if you are on NSFnet, ask your local folks who (if anyone)
redistributes it.  For example, nntp-managers-nearnet-request@think.com,
if you're a NEARnet member (I believe).

There is a mailing list to disucss nntplink
<linkers-request@zaphod.mps.ohio-state.edu>.  It is almost all notices
about new beta releases, and the occasional fix for a beta-bug.

I am sure Stan Barber maintains a mailing list for people testing the
reference implementation and RN ; Wayne has one for TRN; I have one
for INN.  In general, those are for people actively working on beta releases.

The short answer then:
    public discussion of released software happens right here, often
    cross-posted to news.software.nntp (the latter is an INET gorup).
	/r$
Xref: sparky news.software.b:3778 news.software.nn:1747
From: anselmo@nic.near.net (Ed Anselmo)
Newsgroups: news.software.b,news.software.nn
Subject: Re: PROBLEM posting to moderated AND unmoderated groups in one command
Date: 12 Jan 1993 18:14:34 -0500
Organization: NEARnet, Cambridge, MA
	<9301111543.AA09132@sap-ag.de>
	<1993Jan11.231902.10422@magnus.acs.ohio-state.edu>
	<2B532F0A.9185@ics.uci.edu>
NNTP-Posting-Host: nic.near.net
In-reply-to: tittle@ics.uci.edu's message of 12 Jan 93 20:50:18 GMT

>>Doesn't matter. As long as they're mentioned in the "Newgroups:" header,
>>they'll get there.

>Not true, not at my site.  If I have a group that nn here doesn't know
>about, it barfs and puts the message in a dead.article file.  Can't do
>it...

This varies by news transport; INN's nnrpd won't post to newsgroups
which aren't in your active file.  For example, what if the unknown
newsgroup to which you're cross-posting is a moderated group?
-- 
Ed Anselmo      anselmo@nic.near.net      NEARnet, Cambridge, MA
Xref: sparky news.software.b:3699 news.software.nntp:1744 news.admin.misc:993
From: henry@zoo.toronto.edu (Henry Spencer)
Newsgroups: news.software.b,news.software.nntp,news.admin.misc
Subject: BOF at Usenix
Date: 6 Jan 93 18:32:40 GMT
Organization: U of Toronto Zoology

News-software enthusiasts who are going to the Usenix conference in
San Diego, please note that I'm working on getting a news/Usenet BOF
scheduled for Thursday evening after the reception.  The short description
I sent in was:

	Usenet and software for it, including (but not limited to)
	C News, INN, NNTP, revision of RFC1036, current state and
	future of Usenet, the past of Usenet, news on CDROM, etc.

Rich Salz isn't coming to this Usenix, alas, but we'll try to do
justice to INN without him.

(Why Thursday?  Because Wednesday evening is full of "big-name" BOFs
that I don't want to compete with -- and that I do want to attend! --
and Tuesday is a bit early for people who come for the technical
sessions only.)
-- 
"God willing... we shall return."       | Henry Spencer @ U of Toronto Zoology
       -Gene Cernan, the Moon, Dec 1972 |  henry@zoo.toronto.edu  utzoo!henry
From: rynes@slc3.ins.cwru.edu (Edward M. Rynes - M.E.D./P.o.D.)
Newsgroups: news.software.b
Subject: Re: innxmit times out talking to Cnews site
Date: 6 Jan 93 16:36:23 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
NNTP-Posting-Host: slc3.ins.cwru.edu

kenh@leps5.phys.psu.edu (Ken Hornstein) writes:

>No reply after sending "rec/radio/amateur/misc/30836", Connection timed out
>Rewriting batch file and exiting.
>
>This only happens when talking to one particular site.  The site in question
>is running C-news (I don't know what version).  I get the error on the same
>file a couple of times, and then it goes through successfully.  Then after
>a while it will hang on a different file.  The other side gets an error that
>says "EOF received before final period".

This is just an off the wall suggestion but we had a similar problem with
one of our feeds.  It turned out to be old software on a router interpreting
three `+'s at certain intervals as a hangup signal. (or something like that)

To test this, try to send the article via email (SMTP) and FTP.  If you also
have problems with those transfers then I would have someone check the routers
between you and your feed.
-- 
Edward M. Rynes  <rynes@INS.CWRU.Edu>              "Even in my drunken stupor
Information Network Services                I've got to admire your ingenuity
Case Western Reserve University               And I nod my head, oh so wisely
Cleveland, OH  44106-7072                      to the rhythm of your cruelty"
Newsgroups: news.software.b
From: molenda@i9.msi.umn.edu (Jason Molenda)
Subject: Re: Controlling access to newsgroups
Organization: University of Minnesota
Date: Tue, 12 Jan 1993 02:50:16 GMT

davidg@aegis.or.jp (Dave McLane) writes:

>Any other ideas anybody?

hack the reader?  i.e. see if you can't rip the 'g' guts out of rn (so
they can only read one group at a time) and add code to do
authorization based on an access file (aka ACLs) at startup so they need
to type "rn <grpname>".

I have no idea how modular the goto-next-group code is in rn.  I'm just
throwing an idea out.  I think you're going to end up with a gross
hack no matter what you do.
-- 
Jason Molenda, University of Minnesota, Supercomputer Inst., Technical Support
SGI Iris Admin        molenda@jason.msi.umn.edu       DoD #1867     '77 CB750F
From: brad@clarinet.com (Brad Templeton)
Subject: Re: Controlling access to newsgroups
Organization: ClariNet Communications Corp.
Date: Tue, 12 Jan 1993 07:17:21 GMT

You could always encrypt articles and have a reading program on the other
end with access to the passwords, which in turns only allows access to
the right users, however you must do this:

	Have reasonably quick encryption, somehow still secure.

	The remote program nor the nntp server should be capable of
	dumping core or being ptraced.
-- 
Brad Templeton, ClariNet Communications Corp. -- Sunnyvale, CA 408/296-0366
From: swlodin@kocrsv01.delcoelect.com (Steve Lodin)
Newsgroups: news.software.b
Subject: Adding new local newsgroups on multiple servers
Date: 8 Jan 93 14:41:20 GMT
Organization: Delco Electronics Corp.
Originator: swlodin@kocrsw15


I have multiple news servers for local newsgroups.  Up until this
point, I have been manually addgroup'ing new groups on each server. 
Can someone point me to the documentation for creating and send the 
control messages to add groups.  Also, since I don't want this to 
escape my site, can someone enlighten me on the gotchas.

Thanks alot!


Steve

Steve Lodin	(317)451-0479	Internet:	swlodin@kocrsv01.delcoelect.com
SysAdmin, Software Technology			swlodin@koess.gm.hac.com
Delco Electronics Corporation	UUCP:		deaes!swlodin
-- 
Steve Lodin	Internet: swlodin@kocrsv01.delcoelect.com  UUCP: deaes!swlodin

One good reason why computers can do more work than people is that they
never have to stop and answer the phone.
Newsgroups: news.software.b
From: bernie@metapro.DIALix.oz.au (Bernd Felsche)
Subject: Re: Controlling access to newsgroups
Organization: MetaPro Systems, Perth, Western Australia
Date: Mon, 11 Jan 93 07:23:29 GMT

In <C0M7MI.931@zoo.toronto.edu> henry@zoo.toronto.edu (Henry Spencer) writes:

>In article <3594@aegis.or.jp> davidg@aegis.or.jp (Dave McLane) writes:
>>I'm would like to control access to some of the newsgroups according
>>to a file of uids in /etc/xxxxx
>>
>>As far as I know, this isn't possible with Bnews, readnews, rn, nn.
>>Is that right? Or did I miss something? 
>>
>>How about Cnews can it handle this? 

>Bear in mind that the news articles are stored in ordinary files that
>are normally readable to anyone.  People can read news using "cat" if
>they must.  You're going to have to change the permissions on the files
>(or, more practically, the directories they're in).  C News, and I'm
>pretty sure B News as well, will run fine so long as *it* can read and
>write in those directories -- it doesn't care whether anyone else can.
>If the Unix rwxrwxrwx permissions aren't flexible enough to do what
>you want, then you're going to have to make the directories inaccessible
>to everyone and implement your restrictions in a newsreader that runs
>as a privileged user.  Nobody's done this that I know of.

I've been planning this for a while, and have some bits
noted down on paper (what else can you do if the machine's
down...) The scheme's based on ACL's in each newsgroup
directory. The preferred reader will be nn, mainly because
I've seen the source before. That will run setgid news.

An alternative I've already dismissed using shared-memory
and a news-article server on each host as being too BIG to
implement in available time and because my address doesn't
match *edu*. Any wannabe PhD's interested in this approach
can implement and prove me wrong :-) I would have liked that
method as there's only one place where perm's get checked.
Also, it means that the newsreader only needs setgid at
startup, (probably) to attach a shared memory segment from
the server. It can then relinquish setgid privileges, so
that the probablility of security holes is reduced.

The news transport system will also have to be aware -
especially if you have NNTP readers, or feed sites, of
possible restrictions. Alternatively, if an article-server
is used, then that could be used to validate permissions too.

-- 
+-----+ Bernd Felsche                     _-,_|\  #include <std/disclaimer.h>
| | | | MetaPro Systems Pty Ltd          /  |   \ bernie@metapro.DIALix.oz.au
| | | | 328 Albany Highway,              X_.'-._/         Fax: +61 9 472 3337
|m|p|s| Victoria Park, Western Australia 6100  v        Phone: +61 9 362 9355
Xref: sparky news.software.b:3777 news.software.nntp:1784
From: ssh@snow.boulder.ibm.com (Steve Hultquist (347-3994))
Newsgroups: news.software.b
Subject: Re: Broken moderator connection in c-news
Date: 8 Jan 93 16:16:57 GMT
Reply-To: <ssh@vnet.ibm.com>
Organization: ISSC Boulder

*blush*

Never mind.
--
Steve Hultquist                          Open systems and networking specialist
Change agent, Unix weenie, powder hunter                           ISSC Boulder
From: sphynx@nlhb.rostov-na-donu.su (Filippov Sergey Anatolyevich)
Newsgroups: news.software.anu-news
Subject: Who is living in this group?
Date: 5 Jan 93 12:45:46 GMT
Reply-To: sphynx@nlhb.rostov-na-donu.su
Organization: LS Hospital from Novocherkassk


I make search for bussines connect.
Language programming:
	-FoxPro
	-Assembly IBM PC
	-C
Who is living...
Newsgroups: news.software.anu-news,news.software.nntp,news.software.readers