Common Configuration Questions

• How do I set up DNews to take in a 'normal' NNTP - IHAVE feed?
• How do I setup DNews to take an IHAVE feed from 4 machines and send back to another?
• How do I set up a news gateway for my LAN?
• How do I set my EXCLUDE parameter correctly?
• How do I setup DNews for local (Intranet) use?
• How do I split the spool directory into it's separate parts?
• How do I restrict the news groups available on my server?
• How do I censor the contents of news groups on my server?
• How do I manage DNews remotely using dnewsmanager?
• How do I set up Clarinet groups?
• Security considerations, how can my system be abused?

How do I setup DNews to take in a 'normal' NNTP - IHAVE feed?

In access.conf, give your feed site access to send you ihave messages:

my.feeder.site.com:ihave:::*

In dnews.conf, comment out the nntp_feeder definition.

In newsfeeds.conf, replace:

site $NNTP_FEEDER
   groups *
   builtin
   posting

With:

site my.feeder.site
   groups *
   builtin

And in dnews.conf if you aren't sucking news at all add a line:

cachedall true

If you are running dmulti restart dnews.

You need to FTP an active file from your provider. If he won't supply you one then you can get one from the NetWin FTP site, but it is better to get a local one. Copy this file to your spool directory:

(Stop DNews first)
copy active_from_provider.txt /dnews/spool/active.dat
Now, read the FAQ section entitled "How do I set my EXCLUDE parameter correctly?"

Here is an example of a full feed from UUNET. Note the exclude parameter is essential.

-------dnews.conf---------
In dnews.conf comment out nntp_feeder by putting a HASH in
front of the line, and add cachedall true, e.g.

------newsfeeds.conf cut here ----------
site me
   groups *
site news.uu.net
   groups *,!local.*
   builtin
   exclude uunet
site YOUR.MAIL.GATEWAY
   smtp

------access.conf cut here and change your domain and ipnumbers ------
# Don't let the world connect :-)
*:logoff:::*

How do I setup DNews to take an ihave feed from 4 machines and send back to another?

Let's assume you have been told you will get a feed from any or all of:

news1.xxx.net
news2.xxx.net
news3.xxx.net
news4.xxx.net

And you have also been told to send your feed back to

newsup.xxx.net

And after examining the PATH header in a news item from your upstream feed you have seen that they stamp all incoming messages with the name 'news_stamp.xxx.net'

Then you would setup access.conf like this:

news1.xxx.net:ihave:::*
news2.xxx.net:ihave:::*
news3.xxx.net:ihave:::*
news4.xxx.net:ihave:::*

And you would setup newsfeeds.conf like this:

site me
   groups *
site newsup.xxx.net
   groups *
   builtin
   exclude news_stamp.xxx.net
site your.mail.gatewway
   smtp

How do I setup a news gateway for my LAN using NT RAS dialling?

With DNews, a modem, and Windows NT (or 95) you can give all the users on a LAN internet news access (to read and post) with only a single dial-in modem to any local internet provider. You can use the RAS dialing features to allow DNews to dial when it wants to get or send news.

ras_number 2343234
ras_username chris
ras_password hahahaha

How do I set my EXCLUDE parameter correctly?

In newsfeeds.conf you must set your exclude parameter to stop DNews from sending incoming messages back to your feed site. Let's assume your feed site is called fastfeed.world.net. You need to find out what it stamps onto news articles, to do this read a news article (and show all headers so you can see the PATH header) e.g.

Newsgroups: alt.winsock.trumpet
Subject: Sportster Si does not seem to work with TRUMPET
Date: Thu, 26 Oct 1995 22:44:08
Organization: Personal
Lines: 8
Message-ID: <moleski.2.0016BD02@sasknet.sk.ca>
NNTP-Posting-Host: eagle28.sasknet.sk.ca
X-Newsreader: Trumpet for Windows [Version 1.0 Rev A]
Path: fast1.world.net!world.net! news.icix.net!esol.intermedia.com

Look thru the path, left to right, and find the first or most generic name for your feed site, in this case 'world.net' looks like the best name to choose. So here is the entry you should put in newsfeeds.conf, you may need the built-in and posting settings as well but that is up to you.

site fastfeed.world.net
      groups *
   exclude world.net
   builtin

You may need to delete your .feed and .sending files from the spool directory to clear out the backlog of articles queued.

You can use the settings 'onlyposts' or 'path_max 4' to stop routing without having to get the exclude setting correct

How do I setup DNews for local (intranet) use?

This is fairly simple to achieve, install DNews normally, then in dnews.conf set

cachedall true

Don't define the 'nntp_feeder' variable at all, remove the word 'posting' from newsfeeds.conf then start the server.

Now create your local groups, try to pick names that will never conflict with internet names if you decide to join up at a later date, to achieve this add your company's name to the start of each group name (or an abbreviation of it)

tellnews newgroup netwin.chatting y Group for chatting about things
tellnews newgroup netwin.schedule y For scheduling meetings
tellnews newgroup netwin.products y Product sheets and info for sales staff

Done!

How do I split the NT spool area up?

Since DNews 4.x these directories come split up, prior to that by default the history, workarea and spool are all in the same directory on NT. To split it up after installation stop DNews and split the files like this:

*.xov --> xover_dir directory

history.* --> history area

db_*.* --> spool

(everything else) --> workarea

How do I restrict the news groups on my server?

Do this by modifying your ME feed in newsfeeds.conf, e.g.

site me
   groups *,!*sex*,@*binaries*,!*erotic*

The '!' symbol means 'NOT'

The '@' symbol also means 'NOT' but it also rejects items that are cross-posted to other groups that are acceptable, so it is more severe.

After adjusting your me feed, use these commands:

tellnews reload
tellnews undelete "*"
tellnews matchfeed

How do I censor the items within news groups?

Since version 4.2g you can use the following commands, however use these with restraint as they do affect performance.

site me
   groups *
   accept default
   reject subject "sex"
   reject from "baduser@badsite"
   reject body "naughtyword"
   reject article "make money fast"
site local.interest
   groups *
   reject default
   accept body "netwin.co.nz"
   accept body "dnews"

Any header can be used including the fake headers, 'body' meaning everything except the headers, and 'article' meaning everything.

The matching is NOT case sensitive. If the header CONTAINS the specified text then the rule is applied. Rules are applied in order, if no rule matches then the default rule is applied, and there MUST be a default rule.

There is one special character allowed '\n' which can be used to match 'beginning of line' in the body or article option.

To reject items containing Mime attachments you might use something like:

reject body "\nContent-Transfer-Encoding: x-uue"

For performance reasons it is best to only use headers rather than body and article, and it is also best to minimize the number of rules.

For more elaborate control of incoming artiles see spam.htm

How do I manage DNews remotely using Dadmin?

Obtain dadmin.exe from the nt distribution of DNews and run it on the local machine.

Using the web manager remotely

You can also use the web manager to control DNews remotely (on Nt And Unix) see here for details

Taking a newsfeed direct from ClariNet

In access.conf you need to add entries for Clarinet, currently DNews uses reverse DNS to check who is sending you data, so you need entries which will match all clarinet news hosts. Give the ClariNet tech support READ access to your server as well.

*.clari.net:IHAVE,READ:::*
*.clarinet.com:IHAVE:::*
*.ccnet.com:IHAVE:::*

In dnews.conf, enable reverse DNS lookups:

nodns false

In newsfeeds.conf, prevent any clari groups from being accidentally sent to your normal upstream sites or any outgoing feeds you have (if any). And add an upstream feed for the clarinet discussion group clari.net.talk, be very certain you don't send any other clarinet groups anywhere.

site me
   groups *
site $nntp_feeder
   groups *,!clari*
site clari.
   groups !*,clari.net.talk
   builtin

Choose a subscription and fetch a newsgroup list appropriate for it, these are just some of the options. You may find the groups already exist on your server so this step may not be necessary.

newsgroups.1 One-Star Edition
newsgroups.2 Two-Star Edition
newsgroups.3 Three-Star Edition
newsgroups.3c Three-Star Edition with Commerce Business Daily
newsgroups.edu Educational Edition
newsgroups.4 Four-Star/Corporate/Edu+ Edition
ftp ftp.clari.net
ftp> user anonymous
ftp>
ftp> cd help/admin
ftp> get newsgroups.1

Add a dummy header line and one blank line to the newsgroups.1 file so it looks like a real news message, and then use the checkgroups command to merge it in with your current list of news groups.

tellnews checkgroups newsgroups.1 (Note: This only works in DNews 4.2m or later)

Add a dummy line to your moderators.conf line as the clarinet groups are not really moderated groups. This should go above the last rule in this file, e.g.

clari.*:modreply@clari.net
*:%s@uunet.uu.net

That's all you need to do, you should now have all the ClariNet news groups and your news items should start arriving as soon as you email/call ClariNet and ask them to turn on your feed.

If you have any problems feel free to contact NetWin Support for advice and assistance. We will usually want to see a section of DNEWS.LOG and your DNEWS.CONF and or NEWSFEEDS.CONF files.

Security considerations, how can my system be abused?

If you have given access to everyone. e.g. in your access.conf with an entry like "*", with later versions of DNews it tries very hard to warn if this is the case. To test if your access.conf is correct, try to connect from some other ISP.

If you are using names in access.conf, rather than numbers, it is just possible for someone to lie to a dns server. This is not trivial and I believe the fake entry can be traced fairly easily via the dns authorities, so it is rarely a problem but I believe it can be done. The only reliable solution I know of is to not use names in your access.conf. If this occurs you will still see an ip number in your logs that is not local.

Anyone can post items that appear to have come from your system, but didn't really. This is trivial, usually you can tell if posts are genuinely from your machine by comparing the path of the items and other headers. If your access.conf grants IHAVE access to anyone other than your incoming feed, then it allows 3 above from your site, (where people post at your site and pretend they are posting from another site).

To increase security you should add to dnews.conf

post_rec true

This is the default in the latest versions. It means you get a log of information (post.rec) about local posts that doesn't rotate. This has the information you need to figure out who posted spam via your system.

Adding user authentication is another good idea, with NT and Unix DNews supports the system's native user database.

In access.conf use this:

*:logoff:::*
*your.domain:read,post:$lookup$:$lookup$:*

And if you have case sensitive usernames/passwords, then in dnews.conf add:

auth_case true