# $Id: nntpcache.access-dist,v 1.4 2002/03/24 13:14:18 proff Exp $
#
# this is an example nntpcache.access file.
# user names are pulled off the wire via RFC931 "ident". if the
# remote host isn't running identd, then the username "unknown" will be
# returned.
#
# matching is top down, from the general to the specific. the LAST MATCH is 
# dominant, except where the the "quick" keyword is used. If the last match
# is a negation then access is refused.
#
# this is a merged access schema. it controls both permission to talk
# as well as the finer grain per group permissions.
#
# a wild card for the hostname and the keyword "strip" in the permissions
# field will cause that group to be stripped out of the active, active.times,
# newsgroups, and xgtitle files
#
# if a group field contains the match-all "*" then the authorisation
# entry is used in both the initial connection authorisation and in
# per-group authorisation. if the group field contains the keyword
# "<nntp>" then the entry is ONLY used in connection authorisation.
# anything else is only used during group authorisation.
#
# warning: 
# 	   if a client is given permission to connect,
# 	   but is denied read access to a particular group,
#	   then it can still read articles from that group
#	   IFF they are cross-posted to another group, which the
#	   client has permission to read.
#
# for these access controls to work at a group level and not just at
# connection time, you need to have "groupSecurity" turned on in
# the nntpcache.config file.
#
# for these permissions (other than strip) to be applied to
# LISTs of groups (i.e "directories" of groups, such as the
# active/active.times/newsgroups/newgroups lists) you need to
# have listSecurity turned on in the nntpcache config file.
#
# if "filter" is in the permissions then the fourth
# field contains a list of filter files which are used for pattern
# matching on content/headers.
#
# nb. for various reasons, filters may not work 100% effectively without
#     groupSecurity being on.
#
# "auth" in the permissions field dictates that AUTHINFO authorisation
# is required for the line to have any effect. (username/password, as
# per /etc/passwd or NIS). The auth type can be further specified with
# '=' and ';' to seperate additional arguments. i.e
#
#                  auth=arg1;arg2;...argn
#
# where arg1 is the authentication method, "user/pass" or "sasl"
# and arg2 is the authenticator i.e "ldap", "passwd", "pipe", or
# "radius".
# for example
#
#		   auth=user/pass;passwd
# or
#                  auth=user/pass;ldap
#
# By default nntpcache does not run as root (after binding port 119), which
# means that it is unable to verify passwords in a shadow password file. 
# if you are using shadow passwords (i.e the encrypted passwords are not
# visible in /etc/passwd), then you will need either tell nntpcache to
# run as root ("user root" in nntpcache.config), or use the suid pipe
# authenticator. i.e
#
#                  auth=user/passwd;pipe
#
# with default pipe authenticator, "unixauth". See "pipeProgram" in
# nntpcache.config, for more details.
# 
# if the client is authorised, then the fith field comes into play.
# this last field is a comma seperated list of filenames which
# contain usernames to be matched against the user name used in the
# authorisation. 
#
# nb. lines can not be longer that 1023 bytes each
#	
# the default policy is no access.
# the following line reverses this
#
# host patern		group		permissions	filters userfiles
#
*			*		read,post
# whatever is not denied is permitted; we are now a woodstock access file.
# cooling!
# but hendrix is dead, and the world has moved into a new reign 
# of conservatism. not so cool.
*			*		deny
# we are now a french legal system access file. users are guilty until
# proven innocent (mmmmmmmmmmmmmm. guilty users). Okay, okay it's
# the French legal system before la pr?somption d'innocence.
#
# credentials for internal nocem daemon
<nocem@nntpcache>	*		read,quick

# developers get full access to everything, regardless
# of what subsequent rules say
#
polysynaptic.iq.org	*		read,post,quick
# allow anyone from localhost to conncet to the web statistics port
localhost		<http>		read,quick
# full access for our local network
localhost		*		read,post,filter	spam.filter
suburbia.net		*		read,post
*.suburbia.net		*		read,post
203.4.184.*		*		read,post
# except for
*			tempered.*	deny
# give ihave only access to our feeder sites - 
# the * here in the group field serves as a place holder
lemming.dsd.gov.au	*		ihave
# except for tinkertrain, which both feeds and reads
tinkertrain.suburbia.net *		ihave,read,post
# stdin is used for debuging (e.g nntpcached -n -i)
# note that we don't allow REAL hosts to have funny
# characters like <> in them.
<STDIN>			*		read,post
# and some people we like, but only for specific groups
connectnet.net.au	suburbia.*	read
*.connectnet.net.au	suburbia.*	read
proff@*.gnu.ai.mit.edu	suburbia.*	read
*.uwes.navy.mil		suburbia.*	read
four.net		suburbia.*	post,read
salz@*.bbn.com		suburbia.*	read,post
#
# the * here in the filters list is just a place holder, as
# the "filter" keyword isn't specified.
*@iq.org		tempered.*	read,post
# smut is low on our bandwidth priorities
*			*pictures*	deny,strip
*			*binaries*	deny,strip
# strip some bogus groups that waste resources
*			*.-.*,		deny,strip
*			*._.*		deny,strip
