Newsgroups: news.software.b
Path: utzoo!henry
From: henry@utzoo.uucp (Henry Spencer)
Subject: Re: Cnews security
Message-ID: <1989Jun25.175214.13599@utzoo.uucp>
Organization: U of Toronto Zoology
References: <9482@b-tech.ann-arbor.mi.us> <1989Jun24.204900.24693@utzoo.uucp> <9490@b-tech.ann-arbor.mi.us>
Date: Sun, 25 Jun 89 17:52:14 GMT

In article <9490@b-tech.ann-arbor.mi.us> zeeff@b-tech.ann-arbor.mi.us (Jon Zeeff) writes:
>... Unless I've done the installation very wrong, users do 
>end up running the crucial binaries newsspool and relaynews.  If you 
>are using uucp, users indirectly run newsspool via rnews and relaynews 
>is called from inews.  These are news owned programs.  

Uh, why would a user ever run rnews?  Only other systems do that.

As for relaynews via inews, yes, this is the only exception to the rule.
And this one is absolutely inescapable -- if users are to be able to post
news, they have to be able to run something which has news powers.  How
would you avoid this?
-- 
NASA is to spaceflight as the  |     Henry Spencer at U of Toronto Zoology
US government is to freedom.   | uunet!attcan!utzoo!henry henry@zoo.toronto.edu