Usenet articles are notoriously easy to forge, and control messages are no exception. Since administrators often want to have their news systems automatically honor requests from some particular people to add or remove newsgroups, it is risky to trust the From: and Sender: headers to identify the real sender of a message, as has historically been done. Thus a system using Philip Zimmerman's Pretty Good Privacy® (PGP® ) was developed to provide a more secure means of authenticating the sender of a control message.
Unlike traditional PGP authentication of messages, which just verifies that the contents of the body of a message are unchanged from when it was digitally "signed", this system also needed to sign a few headers of the control message to verify the action to be taken and to guard against certain other pitfalls. Another goal was to make the signature as unobtrusive as possible and require minimal changes to existing software in order to work.
Here is the short and simple version for someone who feels confident hacking around the news system and doesn't like to read a lot:
Here is a more verbose version of the instructions:
There are two pieces of code that will need to be added to a news server to make use of this authentication system: a stand-alone script that verifies an article is what it says it is, and a patch to hook it into the news server's processing of control messages.
The stand-alone program, ftp://ftp.uu.net/networking/news/misc/pgpcontrol/pgpverify, is a Perl script that should work with Perl version 4 and up. (I have not tested it with earlier versions.) It does not contain any code making it dependent on any particular news server software.
ftp://ftp.uu.net/networking/news/misc/pgpcontrol/server-patches/ has patches (currently "a patch" is more correct) for hooking the system into existing news server software. Choose the one for your system from the list below.
I regret that I do not have the time to develop more patches, but I will gladly add patches for other systems to this page as they are made available to me. I am particularly interested in getting patches for C News version CR.E. The INN version 1.4sec patch will apply to all INN "unoff" versions, albeit with a little bit of fuzz.
First you must ensure that the absolute paths to perl and to pgp are correct in the first few lines of the pgpverify program. No other configuration of options or pathnames should be needed.
Next, the following steps assume, solely for the sake of making it easy for me to write a simple recipe, that you have copied pgpverify and the patch for your system to your news server as /tmp/pgpverify and /tmp/pgpcontrol.pch respectively. I have tried to format this so that you should be able to cut and paste any of the lines in italics directly to your shell.
cd to the executable program directory that has ctlinnd mv /tmp/pgpverify pgpverify cd to the root of your INN source tree cd site patch < /tmp/pgpcontrol.pch make install
You're out of luck until someone writes a patch and instructions for your system and makes it available to me for redistribution.
To verify messages, you must have a PGP public key for each signer that you wish to trust. It should be entered in a key ring that is accessible to the user-id that runs the news system by running pgp -ka on a file containing the key to add. For example, at a site that runs the news server software as news, the following command run by the news user-id should add the key bounded by BEGIN and END "PGP PUBLIC KEY BLOCK" lines in the file /tmp/key to the default key ring that would be used for authentication:
pgp -ka /tmp/key
As a general policy rule, control message signers will not use their control message keys to introduce other keys, so when PGP asks you a question similar to, "Would you trust this user to act as an introducer and certify other people's public keys to you?" answer that you would not.
After you have added the appropriate key to your key ring, you need to tell the news software to validate the control messages received. As implemented, the system will perform the requested action if the message can be authenticated and it will mail the message to the news system administrator if it cannot. Clearly there are other possible actions that could be implemented, but I wanted to keep the patches minimal. Future releases of the server software will probably have increased flexibility.
Automatic processing of control messages is handled by control.ctl, which you edit in the same site subdirectory where you patched parsecontrol. control.ctl has several lines at the beginning of it that describe the format of the file, and there is an even longer control.ctl(5) manual page. To enable PGP verification in addition to the normal authorization done by control.ctl, use the action verify-pgp_userid in the fourth field.
For example, if you trust tale@uunet.uu.net to manage groups in the "Big 8" hierarchies, you could have lines line these:
newgroup:tale@uunet.uu.net:\ comp.*|humanities.*|misc.*|news.*|rec.*|sci.*|soc.*|talk.*:\ verify-news.announce.newgroups rmgroup:tale@uunet.uu.net:\ comp.*|humanities.*|misc.*|news.*|rec.*|sci.*|soc.*|talk.*:\ verify-news.announce.newgroups checkgroups:tale@uunet.uu.net:\ comp.*|humanities.*|misc.*|news.*|rec.*|sci.*|soc.*|talk.*:\ verify-news.announce.newgroups
Additionally, if you like the logging feature available with the action doit=logfile, you can get the same logging by using verify-pgp_userid=logfile.
You're out of luck until someone writes a patch and instructions for your system and makes it available to me for redistribution.
Get ftp://ftp.uu.net/networking/news/misc/pgpcontrol/sample.control and save it to a file on your system; /tmp/sample.control will be used for this example. You'll use it to make sure things will work as expected.
To verify the control message, you will need the key for news.announce.newgroups and authorization in your news system for tale@uunet.uu.net to automatically perform "newgroup". Go ahead and enable it for the test even if you don't want to really allow this, because it is easy enough to rescind after the test by editing the control message authorization file and removing the key with pgp -kr news.announce.newgroups.
You can check that the pgpverify part of the system will work properly simply by feeding it the sample control message on stdin:
pgpverify < /tmp/sample.control
If if could run pgp and find the correct key in the default key ring, the string news.announce.newgroups should be printed. The exit status of the script, found in most shells with the command echo $? as the next command after pgpverify, should be 0 (zero).
If it doesn't work and you've tried and tried to figure out why, email me a complete description of the problem you are having and how you have tried to remedy it. At a bare minimum, your mail should include a copy of the message you are trying to verify, a typescript of the attempted execution, and the output of pgp -kc and pgp -kvc news.announce.newgroups.
When pgpverify passes its test, use the appropriate procedure below for you news server to verify the authorization system.
First, cd to the directory where parsecontrol is installed. Then execute the following four lines, in order, as the user who owns the news system:
/bin/sh PROG=newgroup set -- tale@uunet.uu.net "" /tmp/sample.control (. ./parsecontrol "$@"; echo $ACTION)
If the message verified correctly, the echo command should output doit; otherwise, verification failed and the output should be mail.
Edit /tmp/sample.control and change all occurences of newusers to newgroups. Then repeat the parsecontrol and echo lines. This time verification should fail.
You're out of luck until someone writes a patch and instructions for your system and makes it available to me for redistribution.
The existence of key here only means that I, David Lawrence, trust the person who uses it to be a responsible maintainer of that particular hierarchy of groups. You are solely responsible for deciding whether you will use the keys here at your own site.
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAjFsLmQAAAEEAKPbDQI6oDtYJYPvYxt7I4PMxThaq51Z/5kqfW7C3dMn6vPL d+UsXHfRzMaQXkLBR4nIaQj5OHVtbKCjVTVIMtgfgsPeh9GRSONW870S5HUTQcB7 eDhQqvvst1ZEowhTf/CX01chaxOfWq3ZPB09VVohQTmvRJn2BMJdOtO4janBAAUR tBduZXdzLmFubm91bmNlLm5ld2dyb3Vwc4kAlQIFEDF33BHCXTrTuI2pwQEBiJQD /1uiv20adyB2a3tzBYESEEhKtugAVHGRJQJE4Ar5PrcnovF3aNpLFumslIaAzCwP XlCANMjFHg140IB6SgJ8W8XH15u+1cMOmqTbk0wtmVgeLOLaSMgNWt65FV4AUn7e RZdhK8j/JKxE0a+6gKu4S0PiUDrvnCEWUPjlXiqsbnjR =E8K8 -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2i mQCNAzF41OMAAAEEAOnjgblNPQ+Xhnxw3K/EMz1vm2sfi2Ci/XG8HsWg2yc+hQla fMGQbQciSDFsBK0Kmy7gNvC9c7qAsQfeqpvQqJ+3hJiUvbQIi6bj2ZOSqE58Vh80 7Y+Fx71R/AKGZ88dGbysUg1r5770aw6JP1wn6Ve29PRTdS7yasmXGhU4K2T9AAUT tBVmci5hbm5vdW5jZS5uZXdncm91cHOJAJUDBRAxf8MhyZcaFTgrZP0BAZ0ZA/0S nxzmcN/yI858v+80ZpWaMkO/OtdF49gCfv/yv8xrRQfdGkjLFIl+Gry/H9236MZD rTSjb5R2PaicExO3b0tcRAAGOXyrRwc1squDdSvldko2ewQE9giZ4T1+fJRou1yO hbwPmaOBOt2EropUpvRPfKNeu/vjdKv1GEREkhIZTQ== =o/05 -----END PGP PUBLIC KEY BLOCK-----
When establishing a PGP key and control message sender, please use tokens that are not tied to a particular individual. This makes it easier to transfer the administrative responsibility when it finally comes time. (The all-too-common "tale@uunet.uu.net" sender is still used for control messages because of its legacy in the installed server base; I would prefer to use newgroups-request@uunet.uu.net.) Please also do not sign other keys with the key that is used for control messages.
If you will be using this script to sign control messages, please let me know the hierarchy that you are responsible for maintaining and the information that you would like to appear in the List of PGP Public Keys for Newsgroup Administration.