NNTP-GW(8)

NAME
nntp-gw - network news protocol proxy

SYNOPSIS
nntp-gw [-daemon <port>] [-fastdaemon <port>] [-as <tag>]

DESCRIPTION
The Firewall Toolkit nntp proxy is an application level proxy that provides configurable access control, authentication and logging mechanisms. The nntp proxy, which runs on the firewall, passes nntp requests through the firewall (at the application level), using rules you supply, and forwads answers back to the client You can configure the proxies to allow connections based on:

•   source IP address

•   source host name

•   server IP address

•   server host name

•   newsgroup name

•   user name

All packets, and therefore all application requests go to the firewall. On the firewall, the nntp proxy software relays information from one side of the firewall to the other. The proxy prevents the applications on outside networks from talking directly with the applications on your inside network, and vice versa. No IP packets pass from one side of the firewall to the other. All data are passed at the application level.

The network news proxy (nntp-gw) generally runs as a daemon (invoked from system startup script, p.e. /etc/rc.local) and listens for requests on the specified port (tcp/110, as indicated in /etc/services ,is reasonable default). Whenever the system receives a connection request on this port, the nntp proxy checks its configuration information (in the netperm-table) and determines whether the initiating host has permission to use spooler. If the host does not have permission, the proxy logs the connection attempt and displays an error message.

The proxy may also be invoked from tcp/ip "superserver" (inetd or xinetd). -daemon parameter should be omitted in this case.

If the host has permission, the proxy authenticates the user (if required), logs the transaction and passes the request to the destination host.

In the news reader, configure the host running nntp-gw as NNTP server. If the server requires authentication then configure the username and password in the news reader as for a local server.

If access to multiple external NNTP servers is required then configure the news reader to expect the NNTP server to require authentication. Configure the news reader to give the name of the external news server to access as the username, with an empty password. Many news readers permit the configuration of multiple news reading accounts. Configure one account for each external news server.

For example:
    NNTP server = newsproxy.yourdomain.com
    Username    = peergroups.shiva.com
    Password    =

Note that access to multiple external news servers which require
authentication is also possible.  In this case configure the username
as user@server.

For example:
    NNTP server = newsproxy.yourdomain.com
    Username    = 123456@betanews.microsoft.com
    Password    = x1q3sdj1qasd

OPTIONS

  Command Line Options
The network news proxy recognizes the following command line options (whether started from the command line or from within /etc/rc.local):

-daemon port
    Indicates that the network news proxy runs as a daemon, and the port (name or number) on which the network news proxy listens. When -daemon option is used, configuration is being read from netperm-table for every new connection accepted by proxy.

    port Specifies either a numeric id or symbolic name from the /etc/services file.

-fastdaemon port
    Indicates that the network news proxy runs as a daemon, and the port (name or number) on which the network news proxy listens. When -fastdaemon option is used, configuration is being read from netperm-table once the daemon starts or if SIGHUP is received.

-as tag
    Changes default application tag for netperm-table from "nntp-gw" to any given string.

  Configuration Options
The network news proxy reads configuration rules from the /usr/local/etc/netperm-table. It reads all rules using the nntp-gw and * (wildcard) keywords. The network news proxy reads the netperm-table from top to bottom. If there are multiple rules in the table that could apply for a particular attribute, the line network news proxy uses the first one that it finds. See netperm-table(5) for a more complete explanation of netperm-table syntax and precedence.

The network news proxy recognizes the following attributes:

hosts
    host-pattern [host-pattern...] [options]

rules specify host and access permissions. Typically, a hosts rule will be in the form of:

nntp-gw: deny-hosts unknown

nntp-gw: hosts 192.33.112.* 192.94.214.*

There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Optional parameters permit the selective enabling or disabling of logging information, etc. Sub-options are:

    -transparent specifies that the proxy runs in transparent mode; see OS-specific details on how to setup transparent redirection. Proxy destination host is not extracted from username part but taken from connection properties instead. This makes proxy "transparent", so no special client setup is required.

    -plug-to server-address specifies that proxy is "hardwired" to a given server.

    -user username
    -user { username [username..] } specifies a list of users allowed to communicate to remote news server. By default, all users are permitted.

    -authuser username specifies user name for extended authorization

    -extnd specifies that the proxy should request per-operation permissions from authsrv.

    -client-dscp dscp-tag-name
    -client-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for client to proxy connection.

    -server-dscp dscp-tag-name
    -server-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for proxy to server connection.

log event

Define what events to log. Only the first "log" line is read. The following keywords are available for event :

    article-summary For each selected newsgroup, log the number of articles read and the total number of bytes in those articles. This is required for nntp-top.

    command Log each command received from the client. This is useful for debugging.

    list-size Log the size of textual responses. This is useful for detecting excessive use of NEWNEWS etc.

    post Log the response code and the number of bytes for the POST and IHAVE commands.

    response Log the status response line. This is useful for debugging.

milter filter
post-milter filter
read-milter filter

Defines content inspection filter for all, post and read operations.

    filter
        Defines milter socket address in unix:/domain-path or inet:port@host format.

newsgroups pattern [ -message msg ] [ -delay delay ] [ -quit ]

Specify access permissions for newsgroups. The "newsgroups" attribute comes in two flavours: "permit-newsgroups" for permitting access to matching newsgroups and "deny-newsgroups" for denying access to matching newsgroups. "newsgroups" is equivalent to "permit-newsgroups". If there are multiple "newsgroups" lines, all of them will be read, stopping at the first matching line. If there is no matching line, access will be permitted.

    pattern
        can contain "*" to match any sequence of characters. Letter case is ignored.

    Following options are valid for deny-newsgroup only:

    msg Specifies denial message. The default value is "411 access denied".

    delay
        Sleep for "delay" seconds after sending the response. This is an attempt to make people actually see the response and to encourage removing blocked newsgroups from their active list. By default, there is no delay.

If -delay doesn't help, you may try -quit. With -quit, nntp-gw ends the connection after sending the response.

There are no options for "permit-newsgroups".

directory directory
    Specifies the directory that the network news proxy makes its root directory before providing service.

groupid group
    Specifies the name of the group the network news proxy uses when running.

    group
        Specifies either a name or numeric id from the /etc/group file.

timeout seconds
    Specifies the number of seconds the network news proxy is idle (with no network activity) before disconnecting

userid user
    Specifies the user ID the proxy uses when running.

    user
        Specifies either a name or numeric id from the /etc/passwd file. This option is equivalent to the -user command in previous versions.

EXAMPLES
The following example defines simple newsgroups access policy.

    # permit workstations at LAN to access local nntpcache
    nntp-gw: permit-hosts 10.0.0.* -plug-to mynntp
    nntp-gw: deny-newsgroups alt.binaries.erotica.breasts.small
    nntp-gw: deny-newsgroups comp.lang.cobol.*

FILES

/etc/rc.local
    Command script that controls automatic reboot, and includes startup information for the network news proxy.

/usr/local/etc/netperm-table
    The network permissions file contains configuration information for the Firewall Toolkit, including the network news proxy.

BUGS
Report bugs to arkenoi@gmail.com or fwtk-users@buoy.com mailing list. Include a complete example, explaining what you expected to happen and what actually happened. Be sure to indicate the type of system (operating system, hardware, etc.) you are using, as well as the version of the network news proxy.

AUTHOR
Eberhard Mattes, Giles Heron.

SEE ALSO
netperm-table(5), rc(8), authsrv(8), netacl(8)