🚀 go-pugleaf

In article <3594@aegis.or.jp> davidg@aegis.or.jp (Dave McLane) writes:
>I'm would like to control access to some of the newsgroups according
>to a file of uids in /etc/xxxxx
>
>As far as I know, this isn't possible with Bnews, readnews, rn, nn.
>Is that right? Or did I miss something? 
>
>How about Cnews can it handle this? 

Bear in mind that the news articles are stored in ordinary files that
are normally readable to anyone.  People can read news using "cat" if
they must.  You're going to have to change the permissions on the files
(or, more practically, the directories they're in).  C News, and I'm
pretty sure B News as well, will run fine so long as *it* can read and
write in those directories -- it doesn't care whether anyone else can.
If the Unix rwxrwxrwx permissions aren't flexible enough to do what
you want, then you're going to have to make the directories inaccessible
to everyone and implement your restrictions in a newsreader that runs
as a privileged user.  Nobody's done this that I know of.
-- 
"God willing... we shall return."       | Henry Spencer @ U of Toronto Zoology
       -Gene Cernan, the Moon, Dec 1972 |  henry@zoo.toronto.edu  utzoo!henry

henry@zoo.toronto.edu (Henry Spencer) writes:

>In article <3594@aegis.or.jp> davidg@aegis.or.jp (Dave McLane) writes:
>>I'm would like to control access to some of the newsgroups according
>>to a file of uids in /etc/xxxxx
>>
>>As far as I know, this isn't possible with Bnews, readnews, rn, nn.
>>Is that right? Or did I miss something? 
>>
>>How about Cnews can it handle this? 

>Bear in mind that the news articles are stored in ordinary files that
>are normally readable to anyone.  People can read news using "cat" if
>they must.  You're going to have to change the permissions on the files
>(or, more practically, the directories they're in).  C News, and I'm
>pretty sure B News as well, will run fine so long as *it* can read and
>write in those directories -- it doesn't care whether anyone else can.

I want to deny all access to the ~/spool/news and only have the news
software be able to read/write the directories and files.

>If the Unix rwxrwxrwx permissions aren't flexible enough to do what
>you want, then you're going to have to make the directories inaccessible
>to everyone and implement your restrictions in a newsreader that runs
>as a privileged user.  Nobody's done this that I know of.

Yes, that's what I'm looking for. A newsreader that implements the
restrictions on a newsgroup by newsgroup basis for each user. You
can do this with Waffle, but the newsreader is very primitive. They
say that such a thing exists for VAX/VMS, but I'm user UNIX.

What I want would check some /etc/xxxx file each time it changed
newsgroups to see if the current users was permitted to access.

If was hoping somebody had already done this....

Dave

--
Dave McLane 
JUNET: davidg@aegis.or.jp (ONLY within Japan: post otherwise)
Nagaokakyoshi, Kyoto Japan Tel: +81-75-951-1168 Fax: +81-75-957-1087

[ I am broadening the Newsgroups line to include news.software.nntp
  and news.software.readers, and am directing followups out of
  news.software.b.  --apb ]

In article <3614@aegis.or.jp>,
davidg@aegis.or.jp (Dave McLane) writes:
> Yes, that's what I'm looking for. A newsreader that implements the
> restrictions on a newsgroup by newsgroup basis for each user.

You could implement the restrictions in an NNTP server.  Then you wouldn't
have to change the newsreader clients much, except perhaps to teach
them to participate in some authentication dialogue with the server.

The NNTP server that comes with INN has some support for authentication
based on user names and passwords, and some support for restricting
access to groups based on passwords.  You might start with that, and
extend it as necessary to satisfy your needs.

--apb
Alan Barrett, Dept. of Electronic Eng., Univ. of Natal, Durban, South Africa
RFC822: barrett@ee.und.ac.za                    Bang: m2xenix!undeed!barrett

davidg@aegis.or.jp (Dave McLane) writes:

>henry@zoo.toronto.edu (Henry Spencer) writes:

>>Bear in mind that the news articles are stored in ordinary files that
>>are normally readable to anyone.  People can read news using "cat" if
>>they must.  You're going to have to change the permissions on the files
>>(or, more practically, the directories they're in).  C News, and I'm

>I want to deny all access to the ~/spool/news and only have the news
>software be able to read/write the directories and files.

Dave, I think you missed his point.  Why not have everything in spool/news
owned by 'news' and then have different groups (i.e. in /etc/group) for
each newsgroup or hierarchy that you want to control?  like a altsex
group, for instance.  The directory permissions on spool/news/alt/sex
would be rwxr-x---, owner `news', group `altsex'.  Then put the users
who you want to have access to the group in /etc/group and be done with
it.
-- 
$@%8%'%$%=%s!&%b%l%s$@(J     Jason Molenda     molenda@msi.umn.edu
$@%_%M%=%?Bg3X%9!<%Q!<%3%s%T%e!<%?8&5f=j(J  Sun/SGI $@%7%9%F%`4IM}<T(J

molenda@msi-i9.msi.umn.edu (Jason Molenda) writes:

>davidg@aegis.or.jp (Dave McLane) writes:

>>henry@zoo.toronto.edu (Henry Spencer) writes:

>>>Bear in mind that the news articles are stored in ordinary files that
>>>are normally readable to anyone.  People can read news using "cat" if
>>>they must.  You're going to have to change the permissions on the files
>>>(or, more practically, the directories they're in).  C News, and I'm

>>I want to deny all access to the ~/spool/news and only have the news
>>software be able to read/write the directories and files.

>Dave, I think you missed his point.  Why not have everything in spool/news
>owned by 'news' and then have different groups (i.e. in /etc/group) for
>each newsgroup or hierarchy that you want to control?  like a altsex
>group, for instance.  The directory permissions on spool/news/alt/sex
>would be rwxr-x---, owner `news', group `altsex'.  Then put the users
>who you want to have access to the group in /etc/group and be done with
>it.

Ooops, maybe I didn't state what I wanted clearly enough.

I want any user to be able to read any newsgroup on a case-by-case
basis without having to exit the newsreader (to change group).

Dave

--
Dave McLane 
JUNET: davidg@aegis.or.jp (ONLY within Japan: post otherwise)
Nagaokakyoshi, Kyoto Japan Tel: +81-75-951-1168 Fax: +81-75-957-1087

In <C0M7MI.931@zoo.toronto.edu> henry@zoo.toronto.edu (Henry Spencer) writes:

>In article <3594@aegis.or.jp> davidg@aegis.or.jp (Dave McLane) writes:
>>I'm would like to control access to some of the newsgroups according
>>to a file of uids in /etc/xxxxx
>>
>>As far as I know, this isn't possible with Bnews, readnews, rn, nn.
>>Is that right? Or did I miss something? 
>>
>>How about Cnews can it handle this? 

>Bear in mind that the news articles are stored in ordinary files that
>are normally readable to anyone.  People can read news using "cat" if
>they must.  You're going to have to change the permissions on the files
>(or, more practically, the directories they're in).  C News, and I'm
>pretty sure B News as well, will run fine so long as *it* can read and
>write in those directories -- it doesn't care whether anyone else can.
>If the Unix rwxrwxrwx permissions aren't flexible enough to do what
>you want, then you're going to have to make the directories inaccessible
>to everyone and implement your restrictions in a newsreader that runs
>as a privileged user.  Nobody's done this that I know of.

I've been planning this for a while, and have some bits
noted down on paper (what else can you do if the machine's
down...) The scheme's based on ACL's in each newsgroup
directory. The preferred reader will be nn, mainly because
I've seen the source before. That will run setgid news.

An alternative I've already dismissed using shared-memory
and a news-article server on each host as being too BIG to
implement in available time and because my address doesn't
match *edu*. Any wannabe PhD's interested in this approach
can implement and prove me wrong :-) I would have liked that
method as there's only one place where perm's get checked.
Also, it means that the newsreader only needs setgid at
startup, (probably) to attach a shared memory segment from
the server. It can then relinquish setgid privileges, so
that the probablility of security holes is reduced.

The news transport system will also have to be aware -
especially if you have NNTP readers, or feed sites, of
possible restrictions. Alternatively, if an article-server
is used, then that could be used to validate permissions too.

-- 
+-----+ Bernd Felsche                     _-,_|\  #include <std/disclaimer.h>
| | | | MetaPro Systems Pty Ltd          /  |   \ bernie@metapro.DIALix.oz.au
| | | | 328 Albany Highway,              X_.'-._/         Fax: +61 9 472 3337
|m|p|s| Victoria Park, Western Australia 6100  v        Phone: +61 9 362 9355

In article <C0nrwC.LKI@news2.cis.umn.edu> molenda@msi-i9.msi.umn.edu (Jason Molenda) writes:
  [ about restricting access to specific newsgroups ]
|Dave, I think you missed his point.  Why not have everything in spool/news
|owned by 'news' and then have different groups (i.e. in /etc/group) for
|each newsgroup or hierarchy that you want to control?  like a altsex
|group, for instance.  The directory permissions on spool/news/alt/sex
|would be rwxr-x---, owner `news', group `altsex'.  Then put the users
|who you want to have access to the group in /etc/group and be done with
|it.

This might work on a small site, but with more than a couple of dozen
users, it'd become unwieldy *real* fast. Also, current news software
wants both owner *and* group set to "news", so it would involve considerable
work there, not to mention the rewrite of the newsreaders.

From an admin point of view, I think most of us a) don't have time, and 
b) don't want to bog down /etc/groups with 3,000 new (and large) entries.


-- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
"Data sheet: HSN-3000 Nuclear Event Detector. The [NED] senses the gamma
radiation pulse [from a] nuclear weapon." As if we wouldn't notice...

I can't think of anything except a kerebized nntp/newsreader pair
that's gonna do the job reading across NNTP.
-- 
	"You can't get here from here."

gary@sci34hub.sci.com (Gary Heston) writes:

>In article <C0nrwC.LKI@news2.cis.umn.edu> molenda@msi-i9.msi.umn.edu (Jason Molenda) writes:
>  [ about restricting access to specific newsgroups ]
>|Dave, I think you missed his point.  Why not have everything in spool/news
>|owned by 'news' and then have different groups (i.e. in /etc/group) for
>|each newsgroup or hierarchy that you want to control?  like a altsex
>|group, for instance.  The directory permissions on spool/news/alt/sex
>|would be rwxr-x---, owner `news', group `altsex'.  Then put the users
>|who you want to have access to the group in /etc/group and be done with
>|it.

>This might work on a small site, but with more than a couple of dozen
>users, it'd become unwieldy *real* fast. Also, current news software
>wants both owner *and* group set to "news", so it would involve considerable
>work there, not to mention the rewrite of the newsreaders.

Right.

>From an admin point of view, I think most of us a) don't have time, and 
>b) don't want to bog down /etc/groups with 3,000 new (and large) entries.

Right again. However, if there was only one hierarchy of newsgroups,
it might be a good solution.

Dave

--
Dave McLane 
JUNET: davidg@aegis.or.jp (ONLY within Japan: post otherwise)
Nagaokakyoshi, Kyoto Japan Tel: +81-75-951-1168 Fax: +81-75-957-1087