Subject: re: news authentication in 3.92

From: Mark Crispin <[email-masked]>
Date: Mon, 1 Apr 1996 01:57:08 -0800 (PST)

On 25 Mar 1996 20:20:25 GMT, Matthew D Stock wrote:
> At long last, pine has authentication support, which means that it may not
> be used as a newsreader at our site.  Unfortunately, I can't seem to get it
> to function.  From what I can tell by browsing the code, if pine
> notices a 480 response from the server, it should prompt me for a username
> and password to use to authenticate myself.  This doesn't seem to happen,
> and I get the "480 Authentication required" message on the screen.  I
> wasn't able to find any documentation on how to get this to work.  Does
> anyone have any suggestions?

Wait a second...

Are you saying that the AUTHINFO command is needed for *reading* news with
NNTP, instead of just for posting?

If so, this is news to me.

We don't have that kind of NNTP server here, and there's no published protocol
specification to refer to, so I'm pretty much reduced to guessing how it's
supposed to work.

---

From: Mike Brudenell <[email-masked]>
Date: Mon, 1 Apr 1996 11:49:33 +0100 (BST)

Hah!  I was just about to test this when I saw your message go by!

The scenario as I understand it....

Here we are using the INN news server software to run our service.  The
latest official release of this is version 1.4.  Version 1.5 is still
"under development" (I believe) but I suspect is a _long_ way off.  In
view of this someone is now maintaining an archive of unofficial releases
of INN 1.4 which include the various patches floating around the Net.
These are named INN1.4unoff1, INN1.4unoff2, etc.  The latest is unoff 4.

INN allows (wild-carded) machine addresses to be configured so that a
username and password have to be used.

Vanilla INN 1.4 allowed any host allowed to connect to the server to
_read_ any newsgroup.  Posting was either enabled by default (no username
and password set up in the configuration file), or _only_ after
authenticating (username and password set up in configuration file).

However the _idea_ behind INN's authentication seems to be that the news
administrator should be able to control what newsgroups (authenticating)
people can _read_ as well as _post to_.  Vanilla INN 1.d did not allow
this.

However some of the fixes introduced into the unoff3 release (and possibly
also in earlier unoff releases) fixed this (promptly breaking our local
configuration file for a while!).

The result is that in INN1.4unoff3 (and, presumably, later releases) your
are required to authenticate before you can _read_ news (eg, the "GROUP"
command returns a "480 Authentication required for command" message).
This is so that the news server knows which groups you have access to.

So if Pine doesn't support authentication for _reading_ it isn't going to
work against INN1.4unoff3 and later where authentication is needed.

[I've just checked, and it does indeed fail.]

Just when you thought it was safe to leave the programming... :-)

Mike Brudenell                                         <[email-masked]>
------------------------------------------------------------------------
The Computing Service, University of York, Heslington, York, YO1 5DD, UK
Tel: +44-1904-433811  FAX: +44-1904-433740  http://www.york.ac.uk/~pmb1/

---

From: Matthew D Stock <[email-masked]>
Date: Mon, 1 Apr 1996 08:53:16 -0500 (EST)

> [ The scenario as you understand it ]

Yes, that's my understanding as well.  Browsing the INN unoff4 source, they
assume you have almost no privs until you authenticate.

I would strongly suggest finding information about the AUTHINFO "generic"
authentication, and using that.  It seems to solve a variety of problems,
and will allow sites to authenticate in any way they choose.  There are
docs regarding it on Dave Barr's site if I remember correctly.
Thanks,
  -Matt

---

From: Matthew D Stock <[email-masked]>
Date: Mon, 1 Apr 1996 08:58:43 -0500 (EST)

> NNTP, instead of just for posting?

See my last message WRT news reading, but that isn't my real problem.
I was having problems posting.  I couldn't find any docs or description on
how to use the authentication features in pine, so I started browsing the
code.  It seems to me that I would be prompted for my username and password
if pine tried to post, and got a 480 in response.  It would then use that
username and password to authenticate, and then try again.  This doesn't
seem to happen.  Am I missing something, or are there docs to look at for
this?

BTW, since I plan on moving to unoff4 as our newsreading news server
sometime during the summer, it would be nice to see AUTHINFO generic
supported in pine.  trn now has support, and so their dev group may be able
to help you implement it.  Until all of this stuff settles out, we have
pine newsreading/posting disabled.  :-/
Thanks,
  -Matt

---

From: Mark Crispin <[email-masked]>
Date: Mon, 1 Apr 1996 19:11:18 -0800 (PST)

Mike -

I appreciate your offer for access to your NNTP server.  If you want to do
this, any *.cac.washington.edu name should be allowed.

However, I am quite a bit concerned by what you're telling me.  It seems that
this functionality is a moving target, and worse, is in an unofficial release
that is not blessed by the developer of that software.

It makes me feel as if I'm being asked to jump from a building on the
assurance that by the time I reach the ground someone will have contrived to
have erected a net.  And, of course, that this newly-erected net will be where
I aimed for and not some other place that was decided after I jumped...

I think that I have to insist upon a formal spec as well as a testbed so I
have some idea what I'm implementating against.  Too many programs besides
Pine depend upon c-client, and thus we have to tread very carefully.  I
implemented AUTHINFO USER based upon what I was told, and apparently some
people are having problems with it.  Others seem to think that it works fine.

---

From: Mike Brudenell <[email-masked]>
Date: Tue, 2 Apr 1996 09:42:09 +0100 (BST)

On Mon, 1 Apr 1996, Mark Crispin wrote:

> Mike -
>
> I appreciate your offer for access to your NNTP server.

I've set this up, Mark, and will e-mail you separately with the username
and password to use when authenticating to the server.

> that is not blessed by the developer of that software.

The question _really_ is "Is there still a developer of INN?"  INN 1.4 has
been the official release for *ages* with no sign of 1.5 at all.  I heard
a rumour that Rich Salz, the author, was suffering from burn-out and had
suspended development ... but may very well be wrong (do you know anything
about this, Matthew?)  I have tried e-mailing him with a bug report, but
the message could not be delivered as the destination machine didn't come
up on the network.

Hence the establishment of the unoff archives, so that people have easy
access to kits with bug-fix patches included.

> people are having problems with it.  Others seem to think that it works fine.

I think two quite separate issues are being confused here...

1.  INN 1.4unoff1 still supports and makes use of AUTHINFO USER / AUTHINFO
PASS.  The *only* difference is what commands are available to a
connection before it has authenticated.  INN1.4vanilla allows GROUP,
ARTICLE, etc wheras INN1.4unoff1 and later don't.  This forces the user to
authenticate before they can read news.

2.  Matthew mentioned AUTHINFO GENERIC support.  This is, as I understand
it, quite different and separate from AUTHINFO USER.  I hadn't actually
heard of it until Matthew mentioned it, but looking at the source code
seems to imply it is merely a different way of authenticating.  In
particular it allows the Yes/No to be decided by external support programs
(located in an approved directory, of course!).

Sites "working fine" are probably using one of: non-INN software as their
server; INN1.4vanilla; INN1.4unoff1 or later but without authentication.

A workaround, easily implemented, is for news administrators such as
myself to patch the nnrpd (news reading daemon) source code so that the
news _reading_ commands are again available before a user authenticates.

Personally I would feel compelled to do this if Pine couldn't be adjusted
to accept and respond to a request for authentication returned in response
to NNRP commands other than POST.  (We've been having some problems here
this term with "problem" postings; I want to get authentication turned on,
but we are using Pine as our preferred and support news reader ... hence I
need to solve or workaround the problem!)

Basically Pine (or more accurately C-Client?) needs to be able to respond
to a "480 Authentication required" whatever command caused it to be issued
(not just POST).  I may be mistaken (I haven't checked the source code
yet) but shouldn't this be fairly straightforward?

The AUTHINFO GENERIC (apparently "just" a method of requesting a different
authentication scheme be used) can wait (at least, it can in our books!).

Cheers,

---

From: Mike Brudenell <[email-masked]>
Date: Tue, 2 Apr 1996 09:57:23 +0100 (BST)

For information, INN1.4unoff3 allows only the following commands to be
used until you have successfully authenticated (assuming the news server
is configured so that you _do_ have to authenticate, of course!):

	AUTHINFO
	DATE
	HELP
	MODE
	SLAVE

Everything else will (should!) generate a "480 Authentication required"
response if you have yet to authenticate.

As far as I can tell from the (UNIX) Pine source code the only two files
affected are in the c-client library:

	nntp.c		... uses POST, but is already programmed to
			    detect and respond to a 480 message.

	nntpcunx.c	... uses LIST, GROUP, LISTGROUP, XHDR, HEAD,
			    BODY and STAT without checking for 480
			    responses.

Cheers,

---

From: Mark Crispin <[email-masked]>
Date: Tue, 2 Apr 1996 02:48:12 -0800 (PST)

OK, I will look into revamping this in imap-4 toolkit, so it'll be in Pine
4.0.

-- Mark --

DoD #0105, R90/6 pilot, FAX: (206) 685-4045  ICBM: N 47 39'35" W 122 18'39"
Science does not emerge from voting, party politics, or public debate.

---

From: Matthew D Stock <[email-masked]>
Date: Tue, 2 Apr 1996 09:06:37 -0500 (EST)

> the message could not be delivered as the destination machine didn't come

No, I don't have any more information.  That was my understanding as well
though.

 > (located in an approved directory, of course!).

This is correct.  Chris Lewis and Rich Salz wrote a protocol draft for
AUTHINFO GENERIC in late '94.  I don't know exactly when it was implemented
in INN, but support is starting to show up in clients as part of the
release.  xrn and trn currently have support, and others may exist as well.

 > authentication scheme be used) can wait (at least, it can in our books!).

It's more critical for us.  We have a large user base (25k+ users), and we
need to have accountability for posting.  We have a large number of
machines and the university, and the central computing groups don't control
all of them (and can't be sure that they run identd).  Add to that the fact
that there are a large number of PCs on campus and a PPP dial string, the
problem becomes pronounced.

With AUTHINFO GENERIC, we can use a password file authentication module
which will solve this problem.  We get per-user control, but none of the
syncronization hassles of adding all of the users to the server access file.
We can also add kerberos authentication for those who don't want to send a
cleartext password.
  -Matt