🚀 go-pugleaf

andrew@calvin.dgbt.doc.ca (Andrew Patrick) writes:
>> Is there a way for me to have private local newsgroups?
>> 
>> That is, I have a list of users and they should be the only ones who
>> can read and post to this newsgroup.  Better yet, no one else should
>> even know about this newsgroup.
>> 
>> I am using C-News and various news readers.

	We've hacked the NNTP reference implementation (1.5.11) to include a
nonstandard command we call "IYAM" (with apologies to Popeye and fans).  Upon
connection (or anytime during the session), the client newsreader issues a
command like this:

iyam mcmahon password

	Where "mcmahon" is the user's name and "password" is a half-hearted
attempt at authentication.

	The NNTP reference implementation already has the ability to restrict
groups based on hostname.  The IYAM command simply checks a file containing a
list of user IDs and a list of groups to which they have access.  If a match
is found (and the password is correct), the appropriate newsgroups are removed
from the restricted list for that session, and the reader can access them in
the usual fashion.  We've also modified the LIST command to not return the
names of restricted groups unless a valid IYAM command has been issued.

	There are a few drawbacks to this method.  Primarily, that it relies
on a modification to client newsreaders to issue the IYAM command at the
appropriate time.  We have been able to use this approach successfully with
ANUNEWS and Rpent (from the University of Virginia), but haven't yet tried it
with nn, trn, rvn, or others.  Also, the client newsreader must have the
password compiled into it in cleartext, so the appropriate permissions must
be set on the executables to keep people from running "strings" on it and
obtaining the password.
	Of course, we have no illusions about this setup being entirely
secure.  Another drawback is that if an unauthorized person knows the name of
a restricted group, he or she can still post to it.  Additionally, if someone
knows the Message-ID of an article in a restricted group, it's still possible
to retrieve the article with standard NNTP commands.
	I'm sure there are other problems, but it works well for us.


	Mike
---
Michael S. McMahon, Network Specialist         Computing & Data Communications
mcmahon@unomaha.edu                            University of Nebraska at Omaha