NNTPS | open news network

xinetd nnrpd wird für den Port 119 vom innd gestartet. Bei Fedora ist nnrpd -S nicht mit einkompiliert, da wird man sich das RPM selber bauen müssen (siehe unten). Aber für den Fall, dass der inn sowieso schon --with-openssl kompiliert wurde und ein Zertifikat bei der Installation mit make cert erstellt wurde, dann genügt:


cat /etc/xinetd.d/nntps
service nntps
{
disable = no
socket_type = stream
protocol = tcp
user = news
wait = no
server = /usr/lib/news/bin/nnrpd
server_args = -S
per_source = 4
instances = 200
log_on_success      += DURATION HOST USERID
}

der Eintrag im Kasten zum Starten von nttps. inetd Und wer statt des xinetd den openbsd-inetd benutzt, editiert '/etc/inetd.conf': nntps stream tcp6 nowait news /usr/sbin/tcpd /usr/lib/news/bin/nnrpd-ssl -S nntps stream tcp4 nowait news /usr/sbin/tcpd /usr/lib/news/bin/nnrpd-ssl -S Zertifikat erstellen


cat /etc/news/makecert.ssl
SSLBIN=/usr/bin/
NEWSUSER=news
NEWSGROUP=news
PATHLIB=/usr/lib/news/lib
##  Install a certificate for TLS/SSL support.
cert:
        $(SSLBIN)/openssl req -new -x509 -nodes \
            -out $(PATHLIB)/cert.pem -days 366 \
            -keyout $(PATHLIB)/key.pem
        chown $(NEWSUSER) $(PATHLIB)/cert.pem
        chgrp $(NEWSGROUP) $(PATHLIB)/cert.pem
        chmod 640 $(PATHLIB)/cert.pem
        chown $(NEWSUSER) $(PATHLIB)/key.pem
        chgrp $(NEWSGROUP) $(PATHLIB)/key.pem
        chmod 600 $(PATHLIB)/key.pem

sasl.conf


cat /etc/news/sasl.conf
 
tls_ca_path:            /usr/lib/news/lib                                        
tls_cert_file:          /usr/lib/news/lib/cert.pem
tls_key_file:           /usr/lib/news/lib/key.pem

Certifikation Request CONFIG=/etc/news/custom_openssl.cnf


cat >> /etc/news/custom_openssl.cnf << EOF
# -------------- BEGIN custom openssl.cnf -----
 HOME                    = /etc/news
 oid_section             = new_oids
 [ new_oids ]
 [ req ]
 default_days            = 730            # how long to certify for
 default_keyfile         = /usr/lib/news/lib/key.pem
 distinguished_name      = req_distinguished_name
 encrypt_key             = no
 string_mask = nombstr
req_extensions = v3_req # Extensions to add to certificate request
 [ req_distinguished_name ]
 commonName              = Common Name (eg, YOUR name)
 commonName_default      = news.newsserver.example
 commonName_max          = 64
 [ v3_req ]
subjectAltName=DNS:newsX.open-news-network.org
# -------------- END custom openssl.cnf -----
EOF

Certification Request Datei erstellen HOST=news HOME=/etc/news openssl req -batch -config $CONFIG -newkey rsa:2048 -out $HOME/${HOST}_csr.pem cat $HOME/${HOST}_csr.pem Bei http://www.cacert.org/ oder http://www.startssl.com/ sich mit dem Inhalt von news_csr.pem ein Serverzertifkat holen und den Inhalt des Zertifikats in cert.pem einfügen: vi /usr/lib/news/lib/cert.pem CA.pem von der CA runterladen nach /usr/lib/news/lib/ legen und in der sasl.conf angeben z.B:


tls_ca_path:            /usr/lib/news/lib
tls_ca_file:            /usr/lib/news/lib/root.crt
tls_cert_file:          /usr/lib/news/lib/cert.pem
tls_key_file:           /usr/lib/news/lib/key.pem

Debian Debian hat als Besonderheit nicht nnrpd sondern nnrpd-ssl als extra Binary.


cat > /etc/xinetd.d/nntps << "EOF"
# description: NNTP over SSL
service nntps
{
disable = no
socket_type = stream
protocol = tcp
user = news
wait = no
server = /usr/lib/news/bin/nnrpd-ssl
server_args = -S
per_source = 4
instances = 200
log_on_success      += DURATION HOST USERID
}
EOF

Fedora Fedora.src.rpm besorgen und inn.spec anpassen. Fedora10 mit verlageerten home auf /home/news statt /var/lib/news, da das Fedora-rpm ohne ssl-Support ausgeliefert wird und deswegen "nntp -S" nicht geht. Dieses Specfile hier beinhaltetet inn-2.4.5.filter_nnrpd.patch, der beim Sourcerpm nicht dabei ist.


cat /home/compileuser/rpm/SPECS/inn.spec
Summary: The InterNetNews (INN) system, an Usenet news server
Name: inn
Version: 2.4.5
Release: opennews4%{?dist}
#see LICENSE file for details
License: GPL+ and BSD and MIT and Public Domain
Group: System Environment/Daemons
URL: http://www.isc.org/products/INN/
Source0: ftp://ftp.isc.org/isc/inn/inn-%{version}.tar.gz
Source2: inn-default-distributions
Source4: inn-cron-expire
Source5: inn-cron-rnews
Source7: inn-cron-nntpsend
Source8: innd.init
Source10: inn-faq.tar.gz
Patch:  inn-2.4.3.rh.patch
Patch2: inn-2.4.1.perl.patch
Patch3: inn-2.4.1.headusage.patch
Patch4: inn-2.4.1.pie.patch
Patch6: inn-2.4.1.posix.patch
Patch7: inn-2.4.3.warn.patch
Patch8: inn-2.4.2-makedbz.patch
Patch9: inn-2.4.3.rcreaderaddrinuse.patch
Patch10: inn-2.4.3-nologinshell.patch
Patch11: inn-2.4.5-dynlib.patch
Patch12: inn-2.4.5.filter_nnrpd.patch
BuildRequires: perl-devel python db4-devel byacc krb5-devel pam-devel e2fsprogs-devel
BuildRequires: perl(ExtUtils::Embed)
Requires(pre): shadow-utils
Prereq: chkconfig, grep, coreutils, sed
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
Requires: bash >= 2.0, inews
 
# XXX white out bogus perl requirement for now
Provides: perl(::usr/lib/innshellvars.pl)
 
Buildroot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
%description
INN (InterNetNews) is a complete system for serving Usenet news and/or
private newsfeeds.  INN includes innd, an NNTP (NetNews Transport
Protocol) server, and nnrpd, a newsreader that is spawned foreach
client.  Both innd and nnrpd vary slightly from the NNTP protocol, but
not in ways that are easily noticed.
 
Install the inn package if you need a complete system for serving and
reading Usenet news.  You may also need to install inn-devel,if you
are going to use a separate program which interfaces to INN, like
newsgate or tin.
 
%package devel
Summary: The INN (InterNetNews) library
Group: Development/Libraries
Requires: inn = %{version}
 
%description devel
The inn-devel package contains the INN (InterNetNews) library, which
several programs that interface with INN need in order to work (for
example, newsgate and tin).
 
If you are installing a program which must interface with theINN news
system, you should install inn-devel.
 
%package -n inews
Summary: Sends Usenet articles to a local news server for distribution
Group: System Environment/Daemons
 
%description -n inews
The inews program is used by some news programs (for example,inn and
trn) to post Usenet news articles to local news servers.  Inews reads
an article from a file or standard input, adds headers, performs some
consistency checks and then sends the article to the local news server
specified in the inn.conf file.
 
Install inews if you need a program for posting Usenet articles to
local news servers.
 
%pre
getent group news >/dev/null || groupadd -r news
getent passwd news >/dev/null || \
useradd -r -g news -d /etc/news -s /bin/bash \
-c "News server user" news
exit 0
 
%prep
%setup  -q  -a 10
%patch  -p1 -b .rh
%patch2 -p1 -b .perl
%patch3 -p1 -b .headusage
%patch4 -p1 -b .pie
%patch6 -p1 -b .posix
%patch7 -p1 -b .warn
%patch8 -p1 -b .makedbz
%patch9 -p1 -b .addrinuse
%patch10 -p1 -b .nologin
%patch11 -p1 -b .dynlib
%patch12 -p1 -b .filter_nnrpd
 
perl -pi -e 's/LOCK_READ/LLOCK_READ/' `find . -type f`
perl -pi -e 's/LOCK_WRITE/LLOCK_WRITE/' `find . -type f`
 
%build
export DEFINE_INN_FLAGS="-D_XOPEN_SOURCE=600 -D_BSD_SOURCE -DHAVE_ET_COM_ERR_H"
 
%ifarch s390 s390x sparc sparcv9 sparc64
export CFLAGS="$RPM_OPT_FLAGS $DEFINE_INN_FLAGS -fPIC -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE"
%else
export CFLAGS="$RPM_OPT_FLAGS $DEFINE_INN_FLAGS -fpic -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE"
%endif
 
with_tmp_path=/var/lib/news/tmp ./configure \
  --prefix=/usr/lib/news \
  --sysconfdir=/etc/news --mandir=%{_mandir} \
  --with-log-dir=/home/news/log --with-spool-dir=/home/news\
  --with-db-dir=/home/news/db  --with-run-dir=/var/run/news \
  --with-etc-dir=/etc/news --with-tmp-dir=/home/news/db/tmp \
  --with-perl --enable-shared --enable-uucp-rnews \
  --enable-pgp-verify --with-sendmail=/usr/sbin/sendmail \
  --with-news-user=news --with-news-group=news --with-news-master=news \
  --with-openssl\
  --enable-ipv6 \
  --enable-libtool \
  %{_target_platform}
 
# XXX don't include  to avoid linking with -ldb1.
perl -pi -e 's/HAVE_DB1_NDBM_H/XXX_HAVE_DB1_NDBM_H/' ./include/config.h
 
make
 
%install
rm -rf $RPM_BUILD_ROOT
mkdir -p $RPM_BUILD_ROOT
make install DESTDIR=$RPM_BUILD_ROOT
 
# -- Install man pages needed by suck et al.
mkdir -p $RPM_BUILD_ROOT/usr/include/inn
mkdir -p $RPM_BUILD_ROOT/var/spool/news
mkdir -p $RPM_BUILD_ROOT/var/log/news
mkdir -p $RPM_BUILD_ROOT/var/lib/news
for f in clibrary.h config.h dbz.h libinn.h storage.h
do
    install -c -m 0644 ./include/$f $RPM_BUILD_ROOT/usr/include/inn
done
for f in defines.h system.h
do
    install -c -m 0644 ./include/inn/$f $RPM_BUILD_ROOT/usr/include/inn
done
 
mkdir -p $RPM_BUILD_ROOT/etc
mv $RPM_BUILD_ROOT/usr/lib/news/bin/rc.news $RPM_BUILD_ROOT/etc
 
touch     $RPM_BUILD_ROOT/home/news/db/subscriptions
chmod 644 $RPM_BUILD_ROOT/home/news/db/subscriptions
 
install -m 644 %{SOURCE2} $RPM_BUILD_ROOT/home/news/db/distributions
 
mkdir -p $RPM_BUILD_ROOT/etc/cron.{hourly,daily}
install %{SOURCE4} $RPM_BUILD_ROOT/etc/cron.daily/inn-cron-expire
install %{SOURCE5} $RPM_BUILD_ROOT/etc/cron.hourly/inn-cron-rnews
install %{SOURCE7} $RPM_BUILD_ROOT/etc/cron.hourly/inn-cron-nntpsend
 
mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
install %{SOURCE8} $RPM_BUILD_ROOT/etc/rc.d/init.d/innd
 
touch $RPM_BUILD_ROOT/home/news/db/history
#LD_LIBRARY_PATH=$RPM_BUILD_ROOT/usr/lib $RPM_BUILD_ROOT/usr/bin/makedbz -i \
#       -f $RPM_BUILD_ROOT/var/lib/news/history
#chmod 644 $RPM_BUILD_ROOT/var/lib/news/*
 
cat > $RPM_BUILD_ROOT/etc/news/.profile < $RPM_BUILD_ROOT%{_sysconfdir}/ld.so.conf.d/inn-%{_arch}.conf
 
 
#Build filelist
rm -rf $RPM_BUILD_ROOT/usr/lib/news/include
echo "%defattr(-,news,news)" > files.list
find $RPM_BUILD_ROOT -type f -or -type l | \
  sed -e "s|$RPM_BUILD_ROOT||g" | \
  sed 's|^/etc/cron|%config(noreplace) %attr(-,root,root) &|'| \
  sed 's|^/etc/rc.d|%config(noreplace) %attr(-,root,root) &|'| \
  sed 's|^/etc|%config(noreplace) &|' | \
  sed 's|^/etc/news|%config(noreplace) %attr(0640,news,news) &|' | \
  sed 's|^/home/news/db/|%config(noreplace) &|' | \
  sed 's|.*innshellvar|%config &|' | \
  sed 's|/home/news/log/news|%ghost &|' | \
  sed 's|/usr/lib/news/bin/inndstart$|%attr(4550,root,news) /usr/lib/news/bin/inndstart|' | \
  sed 's|/usr/lib/news/bin/startinnfeed$|%attr(4550,root,news) /usr/lib/news/bin/startinnfeed|' | \
  sed 's|/usr/lib/news/bin/rnews$|%attr(4550,uucp,news) /usr/lib/news/bin/rnews|' > files.list
  echo "/usr/lib/news/bin/filter/*.pyc" >> files.list
  echo "/usr/lib/news/bin/filter/*.pyo" >> files.list
  (echo "%defattr(-,news,news)" ; grep -v inews files.list | \
  egrep -v "\.(h|so|a|la)$" | \
  grep -v "news/inn.conf" | \
  grep -v "/man/") > files.main
  echo "%defattr(-,root,root)" > files.devel
  egrep "\.(h|so)$" files.list >> files.devel
 
%clean
rm -rf $RPM_BUILD_ROOT
rm -f files.list files.main files.devel files.inews
 
%post
/sbin/ldconfig
/sbin/chkconfig --add innd
su -m news -c '/usr/lib/news/bin/makedbz -i -o'
 
umask 002
touch /home/news/log/news.notice
touch /home/news/log/news.crit
touch /home/news/log/news.err
chown -R news:news /home/news/log/news*
 
%triggerpostun -- inn < 2.3.0
service innd stop > /dev/null 2>&1
exit 0
 
 
%triggerin -- rsyslog
if [ -f /etc/rsyslog.conf ]; then
  if ! grep -q INN /etc/rsyslog.conf; then
    sed 's/mail.none;/mail.none;news.none;/' < /etc/rsyslog.conf > /etc/rsyslog.conf.inn
    mv /etc/rsyslog.conf.inn /etc/rsyslog.conf
 
    echo '' \
       >> /etc/rsyslog.conf
    echo '#' \
       >> /etc/rsyslog.conf
    echo '# INN' \
       >> /etc/rsyslog.conf
    echo '#' \
       >> /etc/rsyslog.conf
    echo 'news.=crit                                        /home/news/log/news.crit'   >> /etc/rsyslog.conf
    echo 'news.=err                                         /home/news/log/news.err'    >> /etc/rsyslog.conf
    echo 'news.notice                                       /home/news/log/news.notice' >> /etc/rsyslog.conf
    echo 'news.=debug                                       /home/news/log/news.debug' >> /etc/rsyslog.conf
 
    fi
  if [ -f /var/run/rsyslogd.pid ]; then
    kill -HUP `cat /var/run/rsyslogd.pid` 2> /dev/null ||:
  fi
fi
 
%triggerin -- sysklogd
if [ -f /etc/syslog.conf ]; then
  if ! grep -q INN /etc/syslog.conf; then
    sed 's/mail.none;/mail.none;news.none;/' < /etc/syslog.conf > /etc/syslog.conf.inn
    mv /etc/syslog.conf.inn /etc/syslog.conf
 
    echo '' \
       >> /etc/syslog.conf
    echo '#' \
       >> /etc/syslog.conf
    echo '# INN' \
       >> /etc/syslog.conf
    echo '#' \
       >> /etc/syslog.conf
    echo 'news.=crit                                        /home/news/log/news.crit'   >> /etc/syslog.conf
    echo 'news.=err                                         /home/news/log/news.err'    >> /etc/syslog.conf
    echo 'news.notice                                       /home/news/log/news.notice' >> /etc/syslog.conf
    fi
  if [ -f /var/run/syslogd.pid ]; then
    kill -HUP `cat /var/run/syslogd.pid` 2> /dev/null ||:
  fi
fi
 
%preun
if [ $1 = 0 ]; then
    service innd stop > /dev/null 2>&1
    /sbin/chkconfig --del innd
    if [ -f /home/news/db/history.dir ]; then
       rm -f /home/news/db/history.*
    fi
fi
 
%postun
/sbin/ldconfig
if [ "$1" -ge 1 ]; then
    service innd condrestart > /dev/null 2>&1
fi
exit 0
 
%files -f files.main
%defattr(-,news,news,-)
%dir /usr/lib/news
%dir /usr/lib/news/bin
%dir /usr/lib/news/doc
%dir /usr/lib/news/lib
%dir /usr/lib/news/bin/rnews.libexec
%dir /usr/lib/news/bin/auth
%dir /usr/lib/news/bin/auth/passwd
%dir /usr/lib/news/bin/auth/resolv
%dir /usr/lib/news/bin/filter
%dir /usr/lib/news/bin/control
%if "(_libdir}" != "/usr/lib"
%dir %{_libdir}/news
%endif
%dir /etc/news/
%dir /home/news
%dir /home/news/archive
%dir /home/news/articles
%attr(0775,news,news) %dir /home/news/incoming
%attr(0775,news,news) %dir /home/news/incoming/bad
%dir /home/news/innfeed
%dir /home/news/outgoing
%dir /home/news/overview
%dir /home/news/log
%dir /home/news/log/OLD
%dir /home/news/db
%dir /home/news/db/tmp
%dir /var/run/news
%defattr(-,root,root)
%{_mandir}/man1/c*.1.gz
%{_mandir}/man1/f*.1.gz
%{_mandir}/man1/g*.1.gz
%{_mandir}/man1/inn*.1.gz
%{_mandir}/man1/n*.1.gz
%{_mandir}/man1/p*.1.gz
%{_mandir}/man1/r*.1.gz
%{_mandir}/man1/s*.1.gz
%{_mandir}/man[58]/*
%doc NEWS README* ChangeLog CONTRIBUTORS LICENSE INSTALL
%doc %dir samples
 
%files devel -f files.devel
%defattr(-,root,root)
%{_mandir}/man3/*
 
%files -n inews
%defattr(-,root,root)
%config(noreplace) /etc/news/inn.conf
/usr/bin/inews
%attr(0755,root,root) /usr/lib/news/bin/inews
%{_mandir}/man1/inews*
 
%changelog
Sa 3. Jan 06:20:56 CET 2009 Arnold Schiller news@news2.open-news-network.org Opennewsversion mit patch fillter_nnrpd.pl

Sprache Nicht definiert