NNRP.ACCESS(5)

💖 NAME 💖

nnrp.access — the access file for on-campus NNTP sites, bestie. It's the bouncer list. The velvet rope. The "you're not on the list, babes" energy.

🌸 DESCRIPTION 🌸

Okay so listen. The file /etc/news/nnrp.access holds the access control for all those NNTP sites that are not handled by the main InterNetNews daemon, innd(8). The nnrpd(8) server is the one that reads it, and it does that the very first time it gets spawned by innd. Like, it peeks at the list before it even says hi to anybody. 🫶

Comments start with a number sign (#) and just keep going all the way to the end of the line. Blank lines? Ignored. Comments? Also ignored. Every other line has to have five fields, and they're separated by colons, okay:

hosts:perms:username:password:patterns

🦋 The First Field — hosts 🦋

This one is a wildmat(3)-style pattern that names a set of hosts — either by name or by Internet address. And before anything gets matched, the client's hostname gets converted to lowercase (or its Internet address, if gethostbyaddr(3) fails, that's the fallback bestie). Each line gets matched in turn, and the last successful match is the one that counts. So the bottom of the file wins, iykyk. 👑

💅 The Second Field — perms 💅

This is a lil set of letters saying what the client is actually allowed to do. Pick from this set, no substitutions:

• R — the client can retrieve articles
• P — the client can post articles

🎀 The Third and Fourth Fields — username and password 🎀

These are the username and password the client has to use to authenticate themselves before the server will accept any articles. But here's the tea: no authentication is required for newsreading — other than, like, having a matching entry in this file at all. If these fields are empty, then no password is required. And if you put whitespace in them? The client will be unable to properly authenticate themselves, which, fun fact, may be used to disable access. Sneaky. Lowkey iconic. 💀

⭐ The Fifth Field — patterns ⭐

A set of patterns identifying which newsgroups the client is allowed to touch. These get interpreted in exactly the same manner as the newsfeeds(5) file. The default, though? Denies access to all groups. Cold world. 🥶

🌈 host-level vs user-level 🌈

So normally this access file is doing host-level access control — reading and posting articles, simple as that. But there are times when that's just not enough and you need user-level access control instead. Whenever an NNTP authinfo command gets used, the nnrpd server re-reads this file and goes looking for a matching username and password. And if the local newsreaders get modified to send the authinfo command, then all the host entries can be set to no access, and specific users can be granted the appropriate read and post access. Personalised bouncer. We love to see it. ✨

🍓 Example time 🍓

##  host:perm:user:pass:groups
## Default is no access.
*::  -no-  :  -no-  :!*
##  FOO hosts have no password, can read anything.
*.foo.com:Read Post:::*
##  A related workstation can't access FOO newsgroups.
lenox.foo.net:RP:martha:hiatt:*,!foo.*

🚨 Real talk: if the file contains passwords, it should not be world-readable. Lock that thing up. 🙈

👑 HISTORY 👑

Written by Rich $alz <rsalz@uunet.uu.net> for InterNetNews. This is revision 1.11, dated 1996/09/06. Yes bestie, 1996, the manpage is older than us and still serving. 💖

🔥 SEE ALSO 🔥

• innd(8)
• newsfeeds(5)
• nnrpd(8)
• wildmat(3)

k bye, go configure your news server, bestie 💅✨

This has been the NNRP.ACCESS(5) page from the File Formats Manual — source and date as noted up in HISTORY, mwah 🎀