🚀 go-pugleaf

kenh@leps5.phys.psu.edu (Ken Hornstein) writes:

....

>Two ideas come to mind:

>	Use something like RFC931 authentication to verify users (although
>RFC931 is really an identification protocol, not an authentication protocol).

>	Make a setuid news reader that only people in a special group can
>execute, and have the reader bind to a reserved local port, and have the
>NNTP server check for a reserved remote port.

>Both of these ideas have plenty of problems (an understatement :-) ), but
>they would work (at least, I can't see any problems).

I'm not sure I've got it right but there seem to be two problems: 

First is to put somekind of check in the program directly accessing
the news spool to control accessing. If there was only a single
machine involved, this might only involve writing a single function
that would check to see if the uid is permitted access and compiling
it into each newsreader at the point where it changes groups.
(Naturally, the news spool would have to be set up to deny access to
anything but those newsreaders.)

Second, if nntp is being used then this same function could be added
to the nntp server but then there needs to be a way to make sure
that only authorized programs could access the server. I think this
is what you are talking about with the 'reserved port' but I'm not
sure what that is, can you explain? 

Dave

--
Dave McLane 
JUNET: davidg@aegis.or.jp (ONLY within Japan: post otherwise)
Nagaokakyoshi, Kyoto Japan Tel: +81-75-951-1168 Fax: +81-75-957-1087