Trying to find a better way to post to a news-server than rnews, I tried some tools now, including lynx, slrnpull and telnet (this one mostly for debugging purposes).
Turns out I cannot even do a proper posting with telnet. I worked exactly according to how I understood the instructions:
https://www.oreilly.com/library/view/linux-network-administrators/1565924002/ch22.html
https://tools.ietf.org/html/rfc3977#section-6.3.1

Connecting to an inn2 server, I get:

Escape character is '^]'.
200 rocksolid3 InterNetNews NNRP server INN 2.6.1 ready (no posting)
authinfo user **********
381 Enter password
authinfo pass **********
281 Authentication succeeded
post
340 Ok, recommended message-ID <rrrav3$fml$1@rocksolidbbs.com>
From: testos
Subject: test article
Newsgroups: rocksolid.shared.test
Body:

the brown fox jumps over whatever
..
441 Invalid syntax encountered in headers (unexpected byte, no colon-space, or empty content line)

Guess it must have something to do with <CR><LF> that is expected at the end of a message, so I tried to do:
telnet> toggle crlf
before, but the result did not change. Adding a line between the text and the . brought the same results.
Having lo line after the body gives an error message about the body missing.

Somebody please explain to me how that works ?

Thanks,

trw

--
Posted on def4

On Mon, 21 Dec 2020 23:36:02+0000
trw <trw@anon.com> wrote:

>
> Trying to find a better way to post to a news-server than rnews, I
> tried some tools now, including lynx, slrnpull and telnet (this one
> mostly for debugging purposes). Turns out I cannot even do a proper
> posting with telnet. I worked exactly according to how I understood
> the instructions:
> https://www.oreilly.com/library/view/linux-network-administrators/1565924002/ch22.html
> https://tools.ietf.org/html/rfc3977#section-6.3.1
>
> Connecting to an inn2 server, I get:
>
> Escape character is '^]'.
> 200 rocksolid3 InterNetNews NNRP server INN 2.6.1 ready (no posting)
> authinfo user **********
> 381 Enter password
> authinfo pass **********
> 281 Authentication succeeded
> post
> 340 Ok, recommended message-ID <rrrav3$fml$1@rocksolidbbs.com>
> From: testos
> Subject: test article
> Newsgroups: rocksolid.shared.test
> Body:
>
> the brown fox jumps over whatever
> .
> 441 Invalid syntax encountered in headers (unexpected byte, no
> colon-space, or empty content line)
>
> Guess it must have something to do with <CR><LF> that is expected at
> the end of a message, so I tried to do:
> telnet> toggle crlf
> before, but the result did not change. Adding a line between the text
> and the . brought the same results. Having lo line after the body
> gives an error message about the body missing.
>
> Somebody please explain to me how that works ?

I think if you remove the 'Body:' line it may work.

That line is part of the headers and appears as a header with no
content. Try to just remove that line and see what happens.

Finding the end of the headers is simply finding the first empty line
sent.

Retro Guy

On Mon, 21 Dec 2020 23:36:02+0000
trw <trw@anon.com> wrote:

>
> Trying to find a better way to post to a news-server than rnews, I
> tried some tools now, including lynx, slrnpull and telnet (this one
> mostly for debugging purposes). Turns out I cannot even do a proper
> posting with telnet. I worked exactly according to how I understood

I use rpost for things like nocem messages and anything I need to send
from a file or automated. It works well for me. I do this in a bash
script.

yes, rpost was discussed before, see here: http://x5qrtsbiebrxj65t.onion/index.php?t=msg&goto=10204

i still don't have it on my server (running debian buster), but now i realize it is a part of suck, so i will give it a try.

the target of my research is of course to have something that works remotely for bbx. and the easier the interface the better.
another possible benefit might be to write a little shellscript/gui that posts messages signed with pgp to a rocksolid node (having an easy way for network wide server independent identity management).

--
Posted on def4

Many thanks, that worked now. I could post a message from this little script here (see the test group for results).

#!/usr/bin/expect

#set ip "127.0.0.1 119"
set ip "192.168.1.189 7000"

spawn "/bin/bash"
send "telnet $ip
"
sleep 1
expect "'^]'."
send "mode reader"
send "
"
expect "#"
send "authinfo user *******"
send "
"
expect "#"
send "authinfo pass *******"
send "
"
sleep 1
expect "#"
send "group rocksolid.shared.test"
send "
"
sleep 1
expect "#"
send "post
"
sleep 1
expect "#"
send "From: testbot@anon.com
"
expect "#"
send "Subject: testbot message, ignore
"
expect "#"
send "Newsgroups: rocksolid.shared.test

"
expect "#"
send "test message for automated posting - ignore me
"
send ".
"
send "quit
"
expect eof
exit 0

--
Posted on def4

Yes, that was it, and the "From:" has to come from an email-like address:

281 Authentication succeeded
post
340 Ok, recommended message-ID <rrs8go$k3k$1@novabbs.org>
From: testos 7
Subject: testme
Newsgroups: rocksolid.shared.test

without body saying Body:
..
441 From: address not in Internet syntax
post
340 Ok, recommended message-ID <rrs8im$k3k$2@novabbs.org>
From: testtos8@anaon.com
Subject: test it
Newsgroups: rocksolid.shared.test

now ?
..
240 Article received <rrs8im$k3k$2@novabbs.org>

Thanks a lot

--
Posted on def4

The script is garbled up of course. I can upload it somewhere if someone wants it.

--
Posted on def4

and one more question in relation to posting:
would it be a problem to enable IHAVE on an inn2 ?
the advantage would be that the message-id could be predefined as thus known to the code.
or maybe i could achieve the same with POST ?

--
Posted on def4

From cli, this works nicely:

Command:

rpost $newsserver -U $username -P $password <<%end
$(<./msg/668db00cef8eb620785984b9be4716a2)
%end

Output:

Using Port 4567
Official host name: 192.168.1.1
Connected to 192.168.1.1
200 rocksolid3 InterNetNews NNRP server INN 2.6.1 ready (no posting)
Attempting to authenticate user
Authentication succeeded
340 Ok, recommended message-ID <rrt9s2$e3p$1@rocksolidbbs.com>
240 Article received <668db00cef8eb620785984b9be4716a2@def4>
Closing connection to 192.168.1.1

The same put in a function of my script:

Output:

Using Port 4567
Official host name: 192.168.1.1
Connected to 192.168.1.1
200 rocksolid2 InterNetNews NNRP server INN 2.6.1 ready (no posting)
Attempting to authenticate user
Authentication succeeded
340 Ok, recommended message-ID
441 Invalid syntax encountered in headers (unexpected byte, no colon-space, or empty content line)
Closing connection to 192.168.1.1

I guess I mess up some characters when calling from the script, but why ? Are heredocs maybe not to be used in functions ?

--
Posted on def4

Ok, in the script it was necessary to filter out the leading tabs, done with
<<-%end (with a "-")
instead of
<<%end (without the "-")
Now it is working from the script, so this message should arrive at def4 and rocksolid.2 at about the same time.
Which also means that bbx is now fully independent of a local news server and just needs an account somewhere.

Very nice.

--
Posted on def4

On Tue, 22 Dec 2020 11:45:03+0000
trw <trw@anon.com> wrote:

>
> and one more question in relation to posting:
> would it be a problem to enable IHAVE on an inn2 ?
> the advantage would be that the message-id could be predefined as
> thus known to the code. or maybe i could achieve the same with POST ?

If your prog requires the server to allow IHAVE, you limit yourself to
what servers you can connect to. Many (most?) won't allow it. Also
rslight server doesn't even support it.

I think you already posted that you found you can set the msgid before
sending anyway.

>If your prog requires the server to allow IHAVE, you limit yourself to what servers you can connect to. Many (most?) won't allow it. Also rslight server doesn't even support it.

Yes, that's true. What is the reason most servers do not allow it ? Is this a potential attack vector ?

>I think you already posted that you found you can set the >msgid before sending anyway.

Yes, when doing POST the server suggests a message-id, but does not insist on it, you can still announce your own.

Basically, rpost solved all the issues around posting for me.

--
Posted on def4

On Wed, 23 Dec 2020 10:47:30+0000
trw <trw@anon.org> wrote:

>
> >If your prog requires the server to allow IHAVE, you limit yourself
> >to what servers you can connect to. Many (most?) won't allow it.
> >Also rslight server doesn't even support it.
>
> Yes, that's true. What is the reason most servers do not allow it ?
> Is this a potential attack vector ?

I can't really answer that with any confidence. For me it's simply 'I
don't need it. Other servers don't do it, why should I?' I know, not
deep thought but I'm guessing it might be a common one. The end being
that if you require a host to support (or enable) ihave, you then have
less servers you can interact with.

> >I think you already posted that you found you can set the >msgid
> >before sending anyway.
>
> Yes, when doing POST the server suggests a message-id, but does not
> insist on it, you can still announce your own.
>
> Basically, rpost solved all the issues around posting for me.

rpost is nice. It's made repetitive things easy for me (nocem,
chkgroups messages, etc.)

trw <trw@anon.org> wrote:
>
>> If your prog requires the server to allow IHAVE, you limit yourself to
>> what servers you can connect to. Many (most?) won't allow it. Also
>> rslight server doesn't even support it.
>
> Yes, that's true. What is the reason most servers do not allow it ? Is
> this a potential attack vector ?

It probably was kept for backwards compatibility with software that was in
use back in old days. As far as I know, none of the major newsreaders
support IHAVE. Articles sent using IHAVE should contain all required
headers, including Date and Path, plus, if I remember correctly it behaves
little bit different if used by the client instead of other server. For
example, I’m not sure if INN allows using special headers such as X-Trace
if message is being posted by user, regardless if it was posted using POST
or IHAVE.

It’s not really a potential attack vector, but IHAVE opens the possibility
to use more sophisticated forging (i.e. including fake Path header to make
message look like it was posted on different server.) To exclude such
possibility many news servers have a peer or two that is offering them all
articles regardless if Path header indicates that they already passed the
server in question. Overhead is minimal, since server will refuse all
articles it actually seen before.

I can try to explain with examples if you want.

--
Neodome

Thanks Neodome, for the explanation, it is pretty clear to me. And yes, it is understandable that it is not used if it enables the kind of forgery you describe.
Luckily, with the use of rpost, I don't need it.

--
Posted on def4

trw <trw@anon.org> wrote:
>
> Thanks Neodome, for the explanation, it is pretty clear to me. And yes,
> it is understandable that it is not used if it enables the kind of forgery you describe.
> Luckily, with the use of rpost, I don't need it.
>

If you will ever need it in the future, INN allows to use IHAVE on per-user
basis. You don’t have to turn it on for everyone.

--
Neodome