## $Id: nnrpd_auth.py 10282 2018-05-14 12:42:14Z iulius $ ## ## This is a sample authentication module for the Python nnrpd hook. ## ## See the INN Python Filtering and Authentication Hooks documentation ## for more information. ## The python_auth: parameter in readers.conf is used to load this script. ## ## An instance of AUTH class is passed to nnrpd via the set_auth_hook() ## function imported from nnrpd. The following methods of that class ## are known to nnrpd: ## ## __init__() - Use this method to initialize your ## general variables or open a common ## database connection. May be omitted. ## authen_init() - Init function specific to ## authentication. May be omitted. ## authenticate(attributes) - Called when a python_auth statement ## is reached in the processing of ## readers.conf. Returns a response ## code, an error string and an ## optional string to appear in the ## logs as the username (make sure that ## such a message is properly encoded ## in UTF-8 so as to comply with the ## NNTP protocol). ## authen_close() - Called on nnrpd termination. Save ## your state variables or close a database ## connection. May be omitted. ## ## If there is a problem with return codes from any of these methods, ## then nnrpd will die and syslog the exact reason. ## ## There are also a few Python functions defined in nnrpd: ## ## set_auth_hook() - Called by nnrpd as this module is loaded. ## It is used to pass a reference to an ## instance of authentication class to nnrpd. ## syslog() - An equivalent replacement for regular syslog. ## One consideration for using it is to ## uniform nnrpd logging. ## Sample authentication class. It defines all auth methods known to nnrpd. class AUTH: """Provide authentication callbacks to nnrpd.""" def __init__(self): """This is a good place to initialize variables or open a database connection.""" # Create a list of NNTP codes to respond on authentication. self.authcodes = { 'ALLOWED': 281, 'DENIED': 481, 'ERROR': 403 } syslog('notice', 'nnrpd authentication class instance created') def authen_init(self): """Called when this script is initialized.""" pass def authenticate(self, attributes): """Called when python_auth: is encountered in readers.conf.""" # Just for debugging purposes (in Python 3.x syntax). # By default, do not log passwords (available in attributes['pass']). # syslog('notice', 'n_a authenticate() invoked: hostname %s, ipaddress %s, port %lu, interface %s, intipaddr %s, intport %lu, user %s' % ( \ # attributes['hostname'].tobytes(), \ # attributes['ipaddress'].tobytes(), \ # attributes['port'], \ # attributes['interface'].tobytes(), \ # attributes['intipaddr'].tobytes(), \ # attributes['intport'], \ # (attributes['user'].tobytes() if attributes['user'] else "-"))) # Do username password authentication. # Python 2.x syntax: # if attributes['user'] and attributes['pass'] \ # and 'foo' == str(attributes['user']) \ # and 'foo' == str(attributes['pass']): # Python 3.x syntax: # if attributes['user'] and attributes['pass'] \ # and b'foo' == attributes['user'].tobytes() \ # and b'foo' == attributes['pass'].tobytes(): # syslog('notice', 'authentication by username succeeded') # return (self.authcodes['ALLOWED'], 'No error', 'default_user') syslog('notice', 'authentication by username failed') return (self.authcodes['DENIED'], 'Access Denied!') def authen_close(self): """Called on nnrpd termination.""" pass ## The rest is used to hook up the auth module on nnrpd. It is unlikely ## you will ever need to modify this. ## Import functions exposed by nnrpd. This import must succeed, or nothing ## will work! from nnrpd import * ## Create a class instance. myauth = AUTH() ## ...and try to hook up on nnrpd. This would make auth object methods visible ## to nnrpd. import sys try: set_auth_hook(myauth) syslog('notice', "authentication module successfully hooked into nnrpd") except Exception: # Syntax valid in both Python 2.x and 3.x. e = sys.exc_info()[1] syslog('error', "Cannot obtain nnrpd hook for authentication method: %s" % e.args[0])