From:	ADVAX::"mcnc!VM1.NoDak.EDU!GIH900%SAO.AARNET.EDU.AU" "Geoff Huston" 31-JUL-1990 20:22:24.06
To:	Multiple recipients of list ANU-NEWS <ANU-NEWS@NDSUVM1>
CC:	
Subj:	RE: Security and the served newsgroups

Received: by ADVAX.DECnet (utk-mail11 v1.5) ; Mon, 30 Jul 90 18:21:09 EDT
Received:  from mcnc by ge-dab.GE.COM (5.61/GE-DAB 1.12) with UUCP
	id AA03423 for everhart; Mon, 30 Jul 90 18:21:00 -0400
Received: from VM1.NoDak.EDU by mcnc.mcnc.org (5.59/MCNC/6-11-90)
	id AA12074; Tue, 31 Jul 90 18:48:27 EDT
Message-Id: <9007312248.AA12074@mcnc.mcnc.org>
Received: from NDSUVM1.BITNET by VM1.NoDak.EDU (IBM VM SMTP R1.2.1MX) with BSMTP id 5447; Tue, 31 Jul 90 17:48:15 CDT
Received: from NDSUVM1.BITNET by NDSUVM1.BITNET (Mailer R2.07) with BSMTP id
 5435; Tue, 31 Jul 90 17:48:14 CDT
Date:         Wed, 1 Aug 90 08:47:19 GMT
Reply-To: Geoff Huston <mcnc!VM1.NoDak.EDU!GIH900%SAO.AARNET.EDU.AU>
Sender: ANU-NEWS Discussion <ANU-NEWS@VM1.NoDak.EDU>
From: Geoff Huston <mcnc!VM1.NoDak.EDU!GIH900%SAO.AARNET.EDU.AU>
Subject:      RE: Security and the served newsgroups
X-To:         ANU-NEWS@VM1.NODAK.EDU
To: Multiple recipients of list ANU-NEWS <ANU-NEWS@NDSUVM1>
 
>Though this is not explicitly an ANU-NEWS question, I hope  there  are  readers
>who might help me with hints or ideas.
>
>Has anybody any experience with protecting newsgroups on a central news server,
>i.e.  is  it  possible  to  grant  or deny access to readers on a remote client
>system  for  a  newsgroup  served on the central server? I'm afraid it can't be
>done,  because  an  NNTP  request  for  items  will not show for which user the
>specified item must be retrieved, isn't it?.
 
$ type news_root:nntp_access.news
#++
#   NEWS_ROOT:NNTP_ACCESS.NEWS
#
#   Template file for NNTP access management. If this file is not placed
#   in NEWS_ROOT: then all NNTP clients will have full access (read, transfer
#   and post) to the server's newsgroups.
#
#   The format of the file is one entry per line, with a number of blank
#   separated fields in each entry.
#
#   The file contains a list of remote hosts, a set of access rights, and a set
#   of accessible newsgroup names. The access rights are read, transfer and
#   post. Read controls whether the client can view items from the server.
#   Transfer controls whether the server will allow the "ihave" command from
#   the client. Post controls whether the server will allow the "post" command
#   from the client.
#
#   Field 1 is the name of the remote node or network, or "default"
#    For DECnet clients the field is the remote node name.
#    For CMU-Tek TCP clients the field is the remote node name.
#    For WIN TCP clients the remote node name is always "TCP" in this
#       version (until someone supplies the correct code for the driver).
#
#   Field 2 is the read / transfer access. Valid field values are:
#       r[ead] - allows read and transfer access
#       v[iew] - allows read access, but not reansfer access
#       x[fer] - allows transfer access, but not read access
#       n[oread] - no read and no transfer access
#     Any other value is interpreted as no read and no transfer access.
#
#   Field 3 is the post access access, and is optional. If not specified
#    then no post access is allowed. Valid field values are:
#       p[ost] - allows post access
#       n[opost] - no post access
#     Any other value is interpreted as no post access.
#
#   Field 4 is the newsgroup access list, and is optional (but if specified,
#    then a post access field is also required for correct parsing of the
#    entry). The field is a comma separated (no blanks) list of newsgroup
#    names, or newsgroup hierarchy names. Specific negation of access to
#    newsgroups is also possible using the ! character as a prefix to
#    the newsgroup name. The wildcard characters "*" and "%" are also
#    implemented in the filter.
#
#   The rest of the line following a '#' character is discarded as a comment.
#
#--
# Example:
#
# node csc1 can access the newsgroups news, news.*, test, test.*
#
csc1    read    post    news,test
#
# node csc has similar access to csc1, but without access to news.csc1 and
#   news.csc1.*
#
csc     read    post    news,test,!news.csc1
#
# default access is to the net.* newsgroups only
#
default view    post    net.*
