TLS for Clients

TLS for Clients

From 1.3.23, NewsCache can offer NNTP over TLS to its clients itself, so that logins and articles aren't sent in the clear. It does implicit TLS: TLS from the first byte, usually on port 563 (nntps), which is what RFC 8143 recommends. STARTTLS on the plain port is not offered. TLS to the upstream servers is a separate setting, see Upstream Servers and TLS.

It needs a build with GnuTLS (the default when GnuTLS is found; newscache -o lists --with-gnutls).

A second listener

ListenTo DEFAULT
TLSListenTo DEFAULT:563
TLSCertFile /etc/newscache/fullchain.pem
TLSKeyFile /etc/newscache/privkey.pem
#TLSPriority NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2

Option	Meaning
TLSListenTo address[:port]	A second listening socket, for TLS clients. Same form as ListenTo; the default port is 563. Without it there is no TLS listener. Both listeners serve the same spool, with the same AccessList and MaxConnections.
TLSCertFile file	The server's certificate in PEM, followed by its intermediate certificates (certbot's fullchain.pem).
TLSKeyFile file	Its private key, PEM, not encrypted.
TLSPriority string	Optional GnuTLS priority string, e.g. to allow only TLS 1.2 and 1.3. Default: the system's (on Fedora and RHEL the crypto policy). NewsCache warns if it allows SSL 3.0, TLS 1.0 or 1.1 (RFC 8996).

TLSListenTo without the certificate and key, one of the two without the other, or TLSListenTo in a build without GnuTLS is a configuration error.

Certificate and key

• NewsCache loads them when it starts, before it switches to Username, so a key that only root may read works. If they can't be loaded, or don't belong together, it exits with the reason on stderr.
• newscache -p checks them too (exit status 2 on failure).
• It warns about a key that every user may read, and about a certificate that has expired or isn't valid yet (it still serves it; clients will refuse it).
• Renewal: SIGHUP loads them again, but by then NewsCache runs as Username. Make the key readable by Groupname (for example mode 0640, group news), or restart NewsCache after a renewal. If the reload fails, the certificate loaded before stays and the error is logged. A certbot deploy hook can copy the files and send SIGHUP.
• A changed ListenTo or TLSListenTo needs a restart; SIGHUP logs a notice then.

Requiring TLS for logins

In an AccessList entry, AuthRequiresTLS yes lets its clients log in only over TLS. On a plain connection AUTHINFO USER and AUTHINFO PASS get 483 Encryption required (RFC 4643), and CAPABILITIES lists AUTHINFO without USER. The client's other rights don't change; with a required login (Authentication unix without fields) TLS is then required in practice. NewsCache warns if the entry has no Authentication, or if there is no TLS for clients at all (then nobody of that entry can log in).

AccessList {
  Default {
    allow authentication
    List !*
    Read !*
    PostTo !*
    Authentication file:/etc/newscache.users
    AuthRequiresTLS yes
  }
}

See Access and Authentication.

Limits

• The TLS handshake must be done within ClientTimeout seconds, at most 30 (also when ClientTimeout is 0): a client that connects and doesn't finish it is dropped without a reply.
• When a client stops reading and a write times out, the session ends; pending output is not repeatedly flushed through further timeouts.
• When MaxConnections is reached, a TLS client is disconnected without the 400 too many users a plain client gets (it would be plain text in a TLS connection).
• NewsCache doesn't ask clients for certificates; AUTHINFO is the login.

inetd and systemd sockets

newscache -t is inetd mode with TLS: standard input is the client's socket, and NewsCache does the handshake with TLSCertFile and TLSKeyFile. The client is matched in the access list by its address (with -i it is called stdin).

nntps stream tcp nowait root /usr/sbin/newscache -t

root in the user field lets NewsCache read a root-only key before it switches to Username; otherwise use news and a key readable by it.

Checking it

openssl s_client -connect news.example.org:563 -servername news.example.org

shows the certificate and then the 200 greeting; type CAPABILITIES. The log has one line per session with the protocol and cipher, and TLS handshake failed: <reason> for a client that couldn't connect.

Version 1.3.22 and older

Older versions have no TLS for clients; put a TLS proxy such as haproxy or stunnel in front (doc/newscache-stunnel-ssl.txt). NewsCache then sees every client as coming from the proxy's address.

Sources: newscache.conf(5), newscache(8), NewsCache.texi.