Access and Authentication

Access and Authentication

The AccessList decides which clients may connect, which groups they see, read and post to, and whether they log in. Nothing is allowed by default, not even localhost: a client without a matching entry gets 502 You have no permission to talk. Goodbye.

AccessList entries

AccessList {
  Client 192.0.2.0/24 {
    allow read post
    List *
    Read *
    PostTo *
    Authentication none
  }
  Client 2001:db8::/32 {
    allow read
    List *
    Read *
    PostTo !*
    Authentication none
  }
  Default {
    allow none
  }
}

• The first matching entry is used, so put Default last. Without a Default entry the file doesn't load.
• Client takes:
  • an IPv4 or IPv6 address with a prefix length (192.0.2.0/24, 2001:db8::/32) or a netmask (192.168.0.0/255.255.0.0);
  • a plain address, which means exactly that host (Client 10.1.2.3);
  • a host name (exact match, news.example.org) or a domain suffix starting with a dot (.example.org), matched against the client's host name;
  • stdin: the client of an inetd session (newscache -i).
• IPv4 clients of the dual-stack listener (ListenTo DEFAULT) are matched by their plain IPv4 address.

Check what NewsCache made of the file with newscache -p, and what a connected client gets with xdebug dump authorization (needs debug).

Rights

Setting	Meaning
allow read post debug authentication none	read: reading commands; post: POST; debug: the XDEBUG command (it shows the configuration, without upstream passwords); authentication: only AUTHINFO until the client logs in; none: nothing.
List groups	Groups shown by LIST, NEWGROUPS and the like.
Read groups	Groups the client may select and read.
PostTo groups	Groups the client may post to.

Group lists are comma-separated; a name may end in *, and ! excludes: *,!alt.binaries.* is everything except alt.binaries. The most specific match wins.

Read is enforced everywhere: GROUP, LISTGROUP, and the message-ID forms of ARTICLE, HEAD, BODY, STAT, HDR, XHDR and XPAT (an article fetched by message-ID must be in at least one group the client may read, judged by its Newsgroups header). A post is refused if any of its groups is not in PostTo.

Logins

Authentication selects how a client logs in (AUTHINFO USER / AUTHINFO PASS) and what a login adds:

Value	Meaning
none	No login.
file:/path	Users from a password file (below).
unix[:list:read:postto:allow]	Local accounts (getpwnam/getspnam); see the limits below.
pam[:list:read:postto:allow]	PAM (build with --with-pam); service newscache, or the one set with PAMServicename.
pam+file:/path	Password checked by PAM, extra rights from a file.

A login adds rights to those of the entry. That gives two patterns:

Login required: the entry allows only the login, and the user file gives the rights.

  Default {
    allow authentication
    List !*
    Read !*
    PostTo !*
    Authentication file:/etc/newscache.users
  }

Until it logs in, such a client can do little more than log in (AUTHINFO, HELP, QUIT); reading and posting commands get 480 Authentication required.

Login optional: allow read post together with Authentication file:... lets everybody read and post without logging in; a login only adds rights (for example "everyone on the LAN may read, users who log in may post too"). Don't use this if you want to keep strangers out.

The user file

One user per line:

user:hash:list:read:postto:allow

• Only user:hash is required. Missing fields at the end add nothing, like empty ones: alice:$6$... checks the login only, and the client keeps the rights of its entry.
• list, read, postto are group lists that are added to the entry's List, Read and PostTo.
• allow adds rights (read,post,debug). !read, !post and !debug remove that one right.
• The hash is a crypt(3) hash: openssl passwd -6 (SHA-512) or openssl passwd -1 (MD5); htpasswd hashes work too. Plain-text passwords only with --enable-plainpass.

Example:

alice:$6$xyz...:*:*:*:read,post
bob:$1$abc...:*:de.*:de.*:read

NewsCache reads the file at login, after it has switched to its Username (news), so that user must be able to read it:

chown root:news /etc/newscache.users
chmod 0640 /etc/newscache.users

unix and PAM: local accounts don't work

NewsCache checks passwords after it has switched to Username, and only root may read /etc/shadow. So:

• Authentication unix can't check local accounts with shadow passwords; the log says "cannot read the shadow password".
• Authentication pam with pam_unix (what password-auth and common-auth use for local accounts) fails the same way: run as news, its helper unix_chkpwd only checks news's own password. NewsCache logs PAM's error with a hint.

Use the user file (file:), or PAM modules that work without root, such as pam_sss (SSSD, LDAP, FreeIPA), pam_ldap or pam_pwdfile. Running NewsCache as root to get around this is not recommended.

Failed logins

After a failed AUTHINFO PASS, NewsCache waits AuthFailureDelay seconds (default 15) times the number of failed logins in the connection, and closes the connection after the third failure.

Reply codes: 480 or 502

Situation	Reply
No matching entry, or allow none	502 at connect, then the connection is closed
A command the entry doesn't allow, and a login could allow it	480 Authentication required
A group or article the client may not read, and a login could help	480
The same, but the client is logged in or its entry has no Authentication	502 access denied
POST to a group not in PostTo, logged in or no login possible	441
Unknown command	500 What?

Newsreaders offer a login only after a 480, so entries that allow a login use 480 until the client has logged in.

CAPABILITIES shows what the client may do at that moment: READER, HDR, OVER and LIST ... only with the read right, POST only with the post right, AUTHINFO USER only before a login.

See also

• newscache.conf(5), sections "AccessSpec" and the examples
• doc/newscache-pam.txt
• FEDORA.md, "Letting clients in"