ckpasswd

title: ckpasswd(8)

summary: nnrpd password authenticator

text:
# ckpasswd(8)

## NAME
ckpasswd - nnrpd password authenticator

## SYNOPSIS
ckpasswd [-gs] [-d database] [-f filename] [-u username -p password]

## DESCRIPTION
ckpasswd is the basic password authenticator for nnrpd, suitable for being run from an auth stanza in readers.conf. See readers.conf(5) for more information on how to configure an nnrpd authenticator.

ckpasswd accepts a username and password from nnrpd and tells nnrpd(8) whether that's the correct password for that username. By default, when given no arguments, it tries to check the password using PAM if support for PAM was found when INN was built. Failing that, it tries to check the password against the password field returned by getpwnam(3). Note that these days most systems no longer make real passwords available via getpwnam(3) (some still do if and only if the program calling getpwnam(3) is running as root).

When using PAM, ckpasswd identifies itself as "nnrpd", not as "ckpasswd", and the PAM configuration must be set up accordingly. The details of PAM configuration are different on different operating systems (and even different Linux distributions); see EXAMPLES below for help getting started, and look for a pam(7) or pam.conf(4) manual page on your system.

When using any method other than PAM, ckpasswd expects all passwords to be stored encrypted by the system crypt(3) function and calls crypt(3) on the supplied password before comparing it to the expected password. If you're using a different password hash scheme (like MD5), you must use PAM.

## OPTIONS
-d database

Read passwords from a database (ndbm, gdbm or dbm format depending on what your system has) rather than by using getpwnam(3). ckpasswd expects database.dir and database.pag to exist and to be a database keyed by username with the encrypted passwords as the values. While INN doesn't come with a program intended specifically to create such databases, on most systems it's fairly easy to write a Perl script to do so. Something like:

```
    #!/usr/bin/perl
    use NDBM_File;
    use Fcntl;
    tie (%db, 'NDBM_File', '/path/to/database', O_RDWR|O_CREAT, 0640)
        or die "Cannot open /path/to/database: $!\n";
    $| = 1;
    print "Username: ";
    my $user = <STDIN>;
    chomp $user;
    print "Password: ";
    my $passwd = <STDIN>;
    chomp $passwd;
    my @alphabet = ('.', '/', 0..9, 'A'..'Z', 'a'..'z');
    my $salt = join '', @alphabet[rand 64, rand 64];
    $db{$user} = crypt ($passwd, $salt);
    untie %db;

```

Note that this will echo back the password when typed; there are obvious improvements that could be made to this, but it should be a reasonable start. Sometimes a program like this will be available with the name dbmpasswd.

This option will not be available on systems without ndbm, gdbm or dbm libraries.

-f filename

Read passwords from the given file rather than using getpwnam(3). The file is expected to be formatted like a system password file, at least vaguely. That means each line should look something like:

```
    username:pdIh9NCNslkq6

```

(and each line may have an additional colon after the encrypted password and additional data; that data will be ignored by ckpasswd). Lines starting with a number sign ("#") are ignored. INN does not come with a utility to create the encrypted passwords, but htpasswd (which comes with Apache) can do so and it's a quick job with Perl (see the example script under -d, or also below). If using Apache's htpasswd program, be sure to give it the -d option so that it will use crypt(3).

A line in filename for the user "user" with the password "pass" would be "user:LIfOpbjNaEQYE" as obtained by the following command:

```
    % htpasswd -nbd user pass
    user:LIfOpbjNaEQYE

```

In case htpasswd is not installed or if you do not want to depend on it, another command involving Perl does a similar job:

```
    % perl -e 'print "user:".crypt("pass", "LI")."\n";'
    user:LIfOpbjNaEQYE

```

-g

Attempt to look up system group corresponding to username and return a string like "user@group" to be matched against in readers.conf. This option is incompatible with the -d and -f options.

-p password

Use password as the password for authentication rather than reading a password using the nnrpd authenticator protocol. This option is useful only for testing your authentication system (particularly since it involves putting a password on the command line), and does not work when ckpasswd is run by nnrpd. If this option is given, -u must also be given.

-s

Check passwords against the result of getspnam(3) instead of getpwnam(3). This function, on those systems that supports it, reads from /etc/shadow or similar more restricted files. If you want to check passwords supplied to nnrpd(8) against system account passwords, you will probably have to use this option on most systems. Most systems require special privileges to call getspnam(3), so in order to use this option you may need to make ckpasswd setgid to some group (like group "shadow") or even setuid root. ckpasswd has not been specifically audited for such uses! It is, however, a very small program that you should be able to check by hand for security.

This configuration is not recommended if it can be avoided, for serious security reasons. See "SECURITY CONSIDERATIONS" in readers.conf(5) for discussion.

-u username

Authenticate as username. This option is useful only for testing (so that you can test your authentication system easily) and does not work when ckpasswd is run by nnrpd. If this option is given, -p must also be given.

## EXAMPLES
See readers.conf(5) for examples of nnrpd(8) authentication configuration that uses ckpasswd to check passwords.

An example PAM configuration for /etc/pam.conf that tells ckpasswd to check usernames and passwords against system accounts is:

```
    nnrpd auth    required pam_unix.so
    nnrpd account required pam_unix.so
```

Your system may want you to instead create a file named nnrpd in /etc/pam.d with lines like:

```
    auth    required pam_unix.so
    account required pam_unix.so
```

This is only the simplest configuration. You may be able to include common shared files, and you may want to stack other modules, either to allow different authentication methods or to apply restrictions like lists of users who can't authenticate using ckpasswd. The best guide is the documentation for your system and the other PAM configurations you're already using.

To test to make sure that ckpasswd is working correctly, you can run it manually and then give it the username (prefixed with "ClientAuthname:") and password (prefixed with "ClientPassword:") on standard input. For example:

```
    (echo 'ClientAuthname: test' ; echo 'ClientPassword: testing') \
        | ckpasswd -f /path/to/passwd/file
```

will check a username of "test" and a password of "testing" against the username and passwords stored in /path/to/passwd/file. On success, ckpasswd will print "User:test" and exit with status 0. On failure, it will print some sort of error message and exit a non-zero status.

## HISTORY
Written by Russ Allbery <eagle@eyrie.org> for InterNetNews.

$Id: ckpasswd.pod 9937 2015-09-02 12:44:39Z iulius $

## SEE ALSO
crypt(3), nnrpd(8), pam(7), readers.conf(5).


cnfsheadconf

package: inn

title: cnfsheadconf(8)

summary: Read and write CNFS headers

text:
# cnfsheadconf(8)

## NAME
cnfsheadconf - Read and write CNFS headers

## SYNOPSIS
cnfsheadconf [-hw] [-c class]

## DESCRIPTION
cnfsheadconf reads pathetc/cycbuff.conf and pathetc/storage.conf to determine which CNFS buffers are available. It then reads all of them or the specified cyclic buffer via the -c flag, and modifies the header as directed by the interactive user if -w is used.

## OPTIONS
-c class

Print the status of the specified class. It also modifies it in case -w is used.

-h

Print usage information and exit.

-w

Prompt for modifications to make to cycbuff header.

## HISTORY
Written by Katsuhiro Kondou <kondou@nec.co.jp> for InterNetNews. Converted to POD by Julien Elie.

$Id: cnfsheadconf.pod 8545 2009-07-03 21:56:39Z iulius $

## SEE ALSO
cycbuff.conf(5), inn.conf(5), storage.conf(5).


cnfsstat

title: cnfsstat(8)

summary: Show usage of CNFS buffers

text:
# cnfsstat(8)

## NAME
cnfsstat - Show usage of CNFS buffers

## SYNOPSIS
cnfsstat [-ahpPsv] [-c class] [-i seconds] [-l [seconds]] [-m buffer]

## DESCRIPTION
cnfsstat reads pathetc/cycbuff.conf and pathetc/storage.conf to determine which CNFS buffers are available. It then reads the specified cyclic buffers and shows their usage status. cnfsstat can be invoked from rc.news if docnfsstat is set to true in inn.conf, and the result is written to syslog(3).

## OPTIONS
-a

Besides its usual output, cnfsstat prints the age of the oldest article in the cycbuff. You may also want to use the -v flag to see extended consistency checks.

-c class

Only information for the specified class is printed.

-h

Print usage information and exit.

-i seconds

With this option, cnfsstat has an initial sleep of seconds seconds at startup. This is useful when cnfsstat is started at the same time as INN, so that it can wait a little before beginning performing its checks.

-l [seconds]

With this option, cnfsstat prints a status snapshot every seconds seconds, and only exits if an error occurs. When unspecified, the default interval is 600 seconds. At each iteration, cnfsstat checks whether the cycbuff.conf and storage.conf files have been modified, and loads the new configuration if needed.

-m buffer

Print information about the specified buffer in a format suitable for MRTG.

-p

Print an MRTG config file.

-P

Write PID into pathrun/cnfsstat.pid.

-s

Write output to syslog(3) instead of standard output.

-v

Write additional information, especially about consistency checks for article storage and the history file.

## HISTORY
Written by Katsuhiro Kondou <kondou@nec.co.jp> for InterNetNews. Converted to POD by Julien Elie.

$Id: cnfsstat.pod 9721 2014-09-24 17:35:46Z iulius $

## SEE ALSO
cycbuff.conf(5), history(5), inn.conf(5), rc.news(8), storage.conf(5).


controlchan

title: controlchan(8)

summary: Channel\-fed control message handler

text:
# controlchan(8)

## NAME
controlchan - Channel-fed control message handler

## SYNOPSIS
controlchan [-ch]

## DESCRIPTION
controlchan removes the responsibility for handling control messages (except cancels) from innd and instead processes them from a channel or file feed.

The two Perl modules "Encode" and "MIME::Parser" are required by controlchan.

To reduce load, controlchan keeps a copy of control.ctl and control.ctl.local in memory and checks permissions (including any required PGP headers) before any scripts are called. These two configuration files are automatically reloaded when controlchan notices they have been modified. Also, the default case of an unrecognized control article is handled internally. The "drop" case is handled with far less fuss.

Normally, controlchan is invoked by innd as configured in newsfeeds. An example entry is below. Make sure that the newsgroup "control.cancel" exists so that controlchan does not have to scan through cancels, which it will not be processing anyway.

```
    controlchan!\
        :!*,control,control.*,!control.cancel\
        :AC,Tc,Wnsm\
        :<pathbin in inn.conf>/controlchan
```

controlchan can also be manually invoked with a mere path to a file (containing a complete control article with its headers and its body) or a token on its standard input:

```
    echo '/path/to/a/control/article' | controlchan
    echo '@0303465234000000000000235AE000000002@' | controlchan
```

Note that in the (very, very unlikely) event that you need to process ihave/sendme control messages, be sure that logipaddr is set to false in inn.conf, because in this case controlchan needs a site name, not an IP address.

controlchan tries to report all log messages through syslog(3), unless connected to an interactive terminal. To enable syslog(3)'ing for versions of Perl prior to 5.6.0, you will need to have run h2ph on your system include files at some point (this is required to make "Sys::Syslog" work). If you have not done so, do this:

```
    cd /usr/include
    h2ph * sys/*
```

If you run FreeBSD, you will need to run the following in addition:

```
    h2ph machine/*
```

## OPTIONS
-c

By default, controlchan does not process articles whose Date: or Injection-Date: header fields are too far in the past (more than artcutoff days, as set in inn.conf) or one day in the future. It allows preventing a malicious replay of old control articles. Using the -c flag disables this check on the cutoff date.

-h

Gives usage information.

## HISTORY
Written by Katsuhiro Kondou <kondou@nec.co.jp> for InterNetNews. Converted to POD by Julien Elie.

$Id: controlchan.pod 10283 2018-05-14 12:43:05Z iulius $

## SEE ALSO
control.ctl(5), inn.conf(5).


ctlinnd

title: ctlinnd(8)

summary: Control the main InterNetNews daemon

text:
# ctlinnd(8)

## NAME
ctlinnd - Control the main InterNetNews daemon

## SYNOPSIS
ctlinnd [-hs] [-t timeout] [command [argument ...]]

## DESCRIPTION
ctlinnd sends a message to the control channel of innd(8), the main InterNetNews daemon.

In the normal mode of behavior, the message is sent to the server, which then performs the requested action and sends back a reply with a text message and an exit code for ctlinnd. If the server successfully performed the command, ctlinnd will print the reply on standard output and exit with a status of zero. If the server could not perform the command, it will direct ctlinnd to exit with a status of one. By default, ctlinnd will wait forever for a response from innd; this can be changed with the -t flag.

The "shutdown", "xabort", and "xexec" commands do not generate a reply, since they cause innd to exit. After these commands, ctlinnd will always exit silently with a status of zero.

## OPTIONS
-h

Prints a command summary. If a command is given along with the -h flag, only the usage for that command will be given.

-s

If the command was successful, don't print the output from innd.

-t timeout

Specifies how long to wait for the reply from the server, for commands other than "shutdown", "xabort", and "xexec". timeout is the number of seconds to wait. A value of zero says to wait forever, and a value less than zero says not to wait at all but just exit immediately with status zero. When waiting for a reply, ctlinnd will check every two minutes to be sure the server is still running, to make it less likely that ctlinnd will just hang. The default is zero, indicating that ctlinnd should wait forever.

## COMMANDS
Here is the complete list of supported commands. Note that nearly all commands have a fixed number of arguments. If a parameter may be an empty string, it is still necessary to pass the empty string to ctlinnd as an argument (specified in the shell as two adjacent quotes, like '').

addhist message-id arrival expires posted token

Add an entry to the history database for message-id. The angle brackets around the message-ID are optional. It should normally be protected from the shell with single quotes. arrival, expires, and posted should be the number of seconds since epoch and indicate when the article arrived, when it expires (via the Expires: header), and when it was posted (given in the Date: header), respectively. expires should be 0 if the article doesn't have an Expires: header. token is the storage API token for the article, and may be empty.

This command can only be used while the server is running, and will be rejected if the server is paused or throttled.

allow reason

Allow remote connections, reversing a prior "reject" command. reason must be the same text given to the "reject" command, or the empty string (which matches any reason).

begin site

Begin feeding site. The server will rescan the newsfeeds file to find the specified site and set up a newsfeed for it. If the site already existed, a "drop" for that site is done first. This command is forwarded; see NOTES below.

cancel message-id

Remove the article with the specified message-ID from the local system. This does not generate a cancel control message; it only affects the local system. The angle brackets around the message-ID are optional. It should normally be protected from the shell with single quotes (and not double quotes). For instance:

```
    ctlinnd cancel 'test@foo.bar'

```

Note that the history database is updated with the specified message-ID so if an article with the same message-ID is afterwards received, it will be rejected; it is useful for rejecting spam before it arrives.

If the server is throttled manually, this command causes it to briefly open the history database. If the server is paused or throttled for any other reason, this command is rejected.

changegroup group status

The newsgroup group is changed so that its status (the fourth field in the active file) becomes status. This may be used to make an existing group moderated or unmoderated, for example. This command, unlike "newgroup" or "rmgroup", can only be used while the server is running, and will be rejected if the server is paused or throttled.

checkfile

Check the syntax of the newsfeeds file and display a message if any errors are found. The details of the errors are reported to syslog.

drop site

Flush and drop site from the server's list of active feeds. This command is forwarded; see NOTES below.

feedinfo site

Print detailed information about the state of the feed to site, or brief status about all feeds if site is the empty string.

flush site

Flush the buffer for the specified site. The action taken depends on the type of feed the site receives; see newsfeeds(5) for more information. This is useful when the site is being fed by a file and batching is about to start, or to cleanly shut down and respawn a channel feed. If site is an empty string, all sites are flushed and the active file and history database are also flushed to disk. This command is forwarded; see NOTES below. Flushing the innfeed channel feed is the recommended method of restarting innfeed to pick up new configuration. innd will spawn a new innfeed process while the old process shuts down cleanly.

flushlogs

Close the news and error log files and rename them to add ".old" to the file name, then open fresh news and error logs. The active file and history database are also flushed to disk. Exploder and process channels are reopened so that they properly take into account the new log files.

go reason

Re-open the history database and start accepting articles again, reversing a previous "pause" or "throttle" command. reason must be either the empty string or match the text that was given to the earlier "pause" or "throttle" command. If a "reject" command is in effect, this will also reverse it by doing the equivalent of an "allow" command if the reason matches reason. Likewise, if a "reserve" command had been given, this will clear the reservation if reason matches the text that was given to "reserve".

The history database is automatically closed on "throttle" or "pause" and reopened on "go", so the history database can be replaced during the pause or throttle without requiring an explicit "reload" command. If any other configuration files or the active file were modified, a "reload" command should be given to force the server to re-read those files.

If the server throttled itself because it accumulated too many I/O errors, this command will reset the error count.

If innd was not started with the -n y flag, this command also does the equivalent of a "readers" command with "yes" as the flag and reason as the text.

hangup channel

Close the socket for the specified incoming channel. This may be useful when an incoming connection appears to be hung (although innd will close idle connections automatically after a timeout).

help [command]

Print a command summary for all commands, or just command if one is specified. This is equivalent to the -h option.

kill signal site

Signal signal is sent to the process underlying the specified site, which must be a channel or exploder feed. signal may be a numeric signal number or one of "hup", "int", or "term"; case is not significant.

logmode

Cause the server to log its current operating mode to syslog.

lowmark file

Reset the low water marks in the active file based on the contents of file. Each line in file must be of the form:

```
    group low-value

```

For example:

```
    comp.lang.c++ 243

```

This command is mostly used by news.daily to update the active file after nightly expiration.

mode

Print the server's operating mode as a multi-line summary of the parameters and the operating state. The parameters in the output correspond to command-line flags to innd and give the current settings of those parameters that can be overridden by command-line flags.

name channel

Print the name and relevant information for the given incoming or outgoing channel, or for all channels if channel is an empty string. The response is formatted as:

```
    <name>:<number>:<type>:<idle>:<status>

```

where <name> is the name of the channel, <number> is its number (generally the same as the file descriptor assigned to it), <idle> is the idle time for an NNTP channel or the process ID for a process channel, and <status> is the status for NNTP channels.

The type is one of the following values:

```
    control     Control channel for ctlinnd
    file        An outgoing file feed
    localconn   Local channel used by nnrpd and rnews for posting
    nntp        NNTP channel for remote connections
    proc        The process for a process feed
    remconn     The channel that accepts new remote connections

```

Channel status indicates whether the channel is paused or not. Nothing is shown unless the channel is paused, in which case "paused" is shown. A channel will be paused automatically if the number of remote connections for that label in incoming.conf is greater than max-connections within hold-time seconds.

newgroup group [status [creator]]

Create the specified newsgroup. The status parameter is the fourth field of the active file entry, as described in active(5). If it is not an equal sign, only the first character is used. creator should be the identity of the person creating the group. If the newsgroup already exists, this is equivalent to the "changegroup" command. creator, encoded in UTF-8 if given, may be omitted; if so, it will default to the newsmaster (as specified at configure time, normally "usenet"). status may also be omitted; if so, it will default to "y" (a normal, unmoderated group). The combination of defaults make it possible to use the text of the Control: header directly (although don't do this without checking the syntactic validity of the header first).

This command can only be done while the server is running or throttled manually. It will update its internal state when a "go" command is sent. This command updates the active.times file as well. This command is forwarded; see NOTES below.

param letter value

Change the specified server parameter. letter is the innd command-line option to set and value is the new value. For example:

```
    ctlinnd param i 5

```

would direct the server to allow only five incoming connections. To enable or disable the action of the -n flag, use "n" for the letter and "y" or "n", respectively, for the value.

The supported values for letter are "a", "c", "H", "i", "l", "n", "o", "T", "t", and "X".

pause reason

Pause the server so that no incoming articles are accepted. No existing connections are closed, but the history database is closed. This should be used for short-term locks, such as when replacing the history database. If the server was not started with the -n y flag, this command also does the equivalent of a "readers" command with "no" as the flag and reason as the text, encoded in UTF-8.

perl flag

Enable or disable Perl filtering. This command is only available if INN was built with Perl filtering support. If flag starts with "y", filtering is enabled; if it starts with "n", filtering is disabled. When filtering is disabled, if the filter_innd.pl Perl filter defined a function "filter_end", it will be called prior to the deactivation of the filter.

python flag

Enable or disable Python filtering. This command is only available if INN was built with Python filtering support. If flag starts with "y", filtering is enabled; if it starts with "n", filtering is disabled.

readers flag text

Allow or disallow readers. If flag starts with the letter "n", then reading is disallowed by causing the server to pass text as the value of the -r flag to nnrpd. If flag starts with the letter "y" and text is either an empty string or the same string, encoded in UTF-8, that was used when reading was disabled, reading will be re-enabled. This command has no effect if nnrpd is being run separately rather than spawned by innd.

reject reason

Remote connections (those that would not be handed off to nnrpd) are rejected with reason given as the explanation, encoded in UTF-8. Existing connections are not closed.

reload what reason

Update the in-memory copy of server configuration files. what identifies what should be reloaded, and reason is reported to syslog in the message noting the reload. There is no way to reload inn.conf, storage.conf, or other configuration files for the storage or overview backends. To pick up changes to those files, use "ctlinnd xexec innd" to restart innd.

If what is the empty string or the word "all", everything is reloaded. If it is the word "history", the history database is closed and re-opened. If it is the word "incoming.conf", the corresponding file is reloaded. If it is the word "active" or "newsfeeds", both the active and newsfeeds files are reloaded, which will also cause all outgoing feeds to be flushed and restarted.

If what is the word "filter.perl", the filter_innd.pl file is reloaded. If the Perl filter defined a function "filter_before_reload", it will be called prior to re-reading filter_innd.pl. If the Perl function "filter_after_reload" is defined, it will be called after filter_innd.pl has been reloaded. Reloading the Perl filter does not enable filtering if it has been disabled; use "perl y" to do this instead. startup_innd.pl cannot be reloaded. This file is not available for reloading unless INN was compiled with Perl filtering support.

If what is the word "filter.python", the filter_innd.py file is reloaded. If a Python method named "filter_before_reload" exists, it will be called prior to re-reading filter_innd.py. If a Python method named "__init__" exists, it will be called after filter_innd.py has been reloaded. Reloading the Python filter does not enable filtering if it has been disabled; use "python y" to do this. This file is not available for reloading unless INN was compiled with Python filtering support.

renumber group

Update the low water and high water marks for group in the active file based on the information in the overview database. Regardless of the contents of the overview database, the high water mark will not be decreased. (Decreasing it may cause duplicate article numbers to be assigned after a crash, which can cause serious problems with the tradspool storage method.) If group is the empty string, all newsgroups are renumbered. Renumber only works if overview data has been created (if enableoverview is set to true in inn.conf).

renumberlow file

Identical to the "lowmark" command.

reserve reason

Require the next "pause" or "throttle" command to use reason as its reason, encoded in UTF-8. This reservation is cleared by giving an empty string for the reason. This is used by programs like expire to coordinate pauses and throttles of the server and avoid trampling on other instances of themselves.

rmgroup group

Remove the specified newsgroup. The group is removed from the active file and its overview information is purged, making it immediately unavailable to readers. Unlike the "newgroup" command, this command does not update the active.times file. This command can only be done while the server is running or throttled manually. This command is forwarded; see NOTES below.

send feed text

The specified text is sent as a control line to the exploder feed.

shutdown reason

The server is shut down, with the specified reason recorded in the log and sent to all open connections. It is a good idea to send a "throttle" command first so that feeds can be shut down more gracefully. If Perl or Python filtering is compiled in and enabled, certain functions are called at "throttle" or "shutdown" (to save filter state to disk, for example). Consult the embedded filter documentation for details.

stathist (off | filename)

Enable or disable generation of history performance statistics. If the parameter is "off", no statistics are gathered. Otherwise, statistics are written to the specified file. A parser for this file is provided in the contrib tree of the INN distribution.

status (off | interval)

Adjust the frequency with which innd reports status information to syslog. Status reporting is turned off if "off" or 0 is given as the argument. Otherwise, status will be reported every interval seconds. See status in inn.conf(5) for information on how to set the default.

throttle reason

Close all existing incoming connections and outgoing feeds and reject new connections. Close the history database. This should be used for long-term locks or for running a large number of "newgroup" and "rmgroup" commands without restarting all outgoing feeds between each one. (Note that changing the status of existing newsgroups when the server is throttled cannot be done.) If the server was not started with the -n y flag, then this command also does the equivalent of a "readers" command with "no" as the flag and reason as the text, encoded in UTF-8.

timer (off | interval)

Adjust the frequency with which innd reports performance information to syslog. Performance monitoring is turned off if "off" or 0 is given as the argument. Otherwise, statistics will be reported every interval seconds to syslog. See timer in inn.conf(5) for information on how to set the default.

trace item flag

Turn tracing on or off for the specified item. flag should start with the letter "y" or "n" to turn tracing on or off, respectively. If item starts with a number, tracing is set up for the specified innd channel, which must be an incoming NNTP feed. If it starts with the letter "i", general innd tracing is turned on or off. If it starts with the letter "n", future nnrpd processes spawned by "innd" will or will not be passed the -t flag, as appropriate. This will not affect any nnrpd processes already running, or nnrpd processes started by some means other than innd.

xabort reason

Log the specified reason and then abort. On most systems, this will cause innd to dump a core file. This is only useful for debugging.

xexec path

Shut down the server, but then rather than exiting, exec innd with all of its original arguments except for -r. path may be either "innd" or an empty string, both of which are equivalent. Any other value is an error. This is the easiest way to start a new copy of innd after upgrading or reload configuration files that can't be reloaded via the "reload" command.

## NOTES
In addition to being acted on by the server, certain commands can be forwarded to an appropriate child process. If the site receiving the command is an exploder (such as buffchan) or a funnel that feeds into an exploder, the command can be forwarded. In this case, the server will send a command line to the exploder that consists of the ctlinnd command name. If the site funnels into an exploder that has an asterisk ("*") in its "W" flag (see newsfeeds(5) for more information on feed specifications), the site name will be appended to the command; otherwise, no argument is appended.

## BUGS
ctlinnd uses Unix domain sockets on most systems to communicate with innd and is therefore limited by whatever maximum packet size the operating system imposes on Unix domain datagrams. This may mean that server replies are limited to 4 KB on some systems.

## HISTORY
Written by Rich $alz <rsalz@uunet.uu.net> for InterNetNews. Rewritten in POD by Russ Allbery <eagle@eyrie.org>.

$Id: ctlinnd.pod 9767 2014-12-07 21:13:43Z iulius $

## SEE ALSO
active(5), active.times(5), buffchan(8), incoming.conf(5), innd(8), inndcomm(3), inn.conf(5), newsfeeds(5), nnrpd(8).


cvtbatch

title: cvtbatch(8)

text:
# cvtbatch(8)

## NAME
cvtbatch - Convert Usenet batch files to INN format

## SYNOPSIS
cvtbatch [-w items]

## DESCRIPTION
cvtbatch reads standard input as a sequence of lines, converts each line, and writes it to standard output. It is used to convert simple batch files that contain just the storage API token of an article to INN batch files that contain additional information about each article.

Each line is taken as a storage API token indicating a Usenet article. Only the first word of each line is parsed; anything following whitespace is ignored. Lines not starting with a valid token are also silently ignored.

If the input file consists of a series of message-IDs, then use grephistory with the -s flag piped into cvtbatch.

## OPTIONS
-w items

The -w flag specifies how each output line should be written. The items for this flag should be chosen from the "W" flag items as specified in newsfeeds(5). They may be chosen from the following set:

```
    b    Size of the article in bytes.
    f    Storage API token of the article (same as "n").
    m    Article message-ID.
    n    Storage API token of the article.
    t    Arrival time of the article as seconds since epoch.

```

The default is "nm", that is to say the storage API token followed by the message-ID of the article.

## HISTORY
Written by Rich $alz <rsalz@uunet.uu.net> for InterNetNews. Converted to POD by Julien Elie.

$Id: cvtbatch.pod 8704 2009-11-03 18:51:44Z iulius $

## SEE ALSO
grephistory(1), newsfeeds(5).


docheckgroups

title: docheckgroups(8)

text:
# docheckgroups(8)

## NAME
docheckgroups - Process checkgroups and output a list of changes

## SYNOPSIS
docheckgroups [-u] [include-pattern [exclude-pattern]]

## DESCRIPTION
docheckgroups is usually run by controlchan in order to process checkgroups control messages. It reads a list of newsgroups along with their descriptions on its standard input. That list should be formatted like the newsgroups(5) file: each line contains the name of a newsgroup followed by one or more tabulations and its description.

docheckgroups will only check the presence of newsgroups which match include-pattern (an egrep expression like "^comp\..*$" for newsgroups starting with "comp.") and which do not match exclude-pattern (also an egrep expression) except for newsgroups mentioned in the pathetc/localgroups file. This file is also formatted like the newsgroups(5) file and should contain local newsgroups which would otherwise be mentioned for removal. There is no need to put local newsgroups of hierarchies for which no checkgroups control messages are sent, unless you manually process checkgroups texts for them. Lines beginning with a hash sign ("#") are not taken into account in this file. All the newsgroups and descriptions mentioned in pathetc/localgroups are appended to the processed checkgroups.

If exclude-pattern is given, include-pattern should also be given before (you can use an empty string ("") if you want to include all the newsgroups). Be that as it may, docheckgroups will only check newsgroups in the top-level hierarchies which are present in the checkgroups.

Then, docheckgroups checks the active and newsgroups files and displays on its standard output a list of changes, if any. It does not change anything by default; it only points out what should be changed:

- Newsgroups which should be removed (they are in the active file but not in the checkgroups) and the relevant ctlinnd commands to achieve that;

- Newsgroups which should be added (they are not in the active file but in the checkgroups) and the relevant ctlinnd commands to achieve that;

- Newsgroups which are incorrectly marked as moderated or unmoderated (they are both in the active file and the checkgroups but their status differs) and the relevant ctlinnd commands to fix that;

- Descriptions which should be removed (they are in the newsgroups file but not in the checkgroups);

- Descriptions which should be added (they are not in the newsgroups file but in the checkgroups).

The output of docheckgroups can be fed into mod-active (it will pause the news server, update the active file accordingly, reload it and resume the work of the news server) or into the shell (commands for ctlinnd will be processed one by one). In order to update the newsgroups file, the -u flag must be given to docheckgroups.

When processing a checkgroups manually, it is always advisable to first check the raw output of docheckgroups. Then, if everything looks fine, use mod-active and the -u flag.

## OPTIONS
-u

If this flag is given, docheckgroups will update the newsgroups file: it removes obsolete descriptions and adds new ones. It also sorts this file alphabetically and improves its general format (see newsgroups(5) for an explanation of the preferred number of tabulations).

## EXAMPLES
So as to better understand how docheckgroups works, here are examples with the following active file:

```
    a.first 0000000000 0000000001 y
    a.second.announce 0000000000 0000000001 y
    a.second.group 0000000000 0000000001 y
    b.additional 0000000000 0000000001 y
    b.third 0000000000 0000000001 y
    c.fourth 0000000000 0000000001 y
```

the following newsgroups file (using tabulations):

```
    a.first             First group.
    a.second.announce   Announce group.
    a.second.group      Second group.
    b.third             Third group.
    c.fourth            Fourth group.
```

and the following localgroups file (using tabulations):

```
    b.additional        A local newsgroup I want to keep.
```

The checkgroups we process is in the file test which contains:

```
    a.first             First group.
    a.second.announce   Announce group. (Moderated)
    a.second.group      Second group.
    b.third             Third group.
    c.fourth            Fourth group.
```

If we run:

```
    cat test | docheckgroups
```

docheckgroups will output that a.second.announce is incorrectly marked as unmoderated and that its description is obsolete. Besides, two new descriptions will be mentioned for addition (the new one for a.second.announce and the missing description for b.additional -- it should indeed be in the newsgroups file and not only in localgroups). Now that we have checked the output of docheckgroups and that we agree with the changes, we run it with the -u flag to update the newsgroups file and we redirect the standard output to mod-active to update the active file:

```
    cat test | docheckgroups -u | mod-active
```

That's all!

Now, suppose we run:

```
    cat test | docheckgroups "^c\..*$"
```

Nothing is output (indeed, everything is fine for the c.* hierarchy). It would have been similar if the test file had only contained the checkgroups for the c.* hierarchy (docheckgroups would not have checked a.* and b.*, even if they had been in include-pattern).

In order to check both a.* and c.*, you can run:

```
    cat test | docheckgroups "^a\..*$|^c\..*$"
```

And if you want to check a.* but not a.second.*, you can run:

```
    cat test | docheckgroups "^a\..*$" "^a\.second\..*$"
```

In our example, docheckgroups will then mention a.second.announce and a.second.group for removal since they are in the active file (the same goes for their descriptions). Notwithstanding, if you do want to keep a.second.announce, just add this group to localgroups and docheckgroups will no longer mention it for removal.

## FILES
pathbin/docheckgroups

The Shell script itself used to process checkgroups.

pathetc/localgroups

The list of local newsgroups along with their descriptions.

## HISTORY
Documentation written by Julien Elie for InterNetNews.

$Id: docheckgroups.pod 8357 2009-02-27 17:56:00Z iulius $

## SEE ALSO
active(5), controlchan(8), ctlinnd(8), mod-active(8), newsgroups(5).


domain

title: domain(8)

summary: nnrpd domain resolver

text:
# domain(8)

## NAME
domain - nnrpd domain resolver

## SYNOPSIS
domain domainname

## DESCRIPTION
This program can be used in readers.conf to grant access based on the subdomain part of the remote hostname. In particular, it only returns success if the remote hostname ends in domainname. (A leading dot on domainname is optional; even without it, the argument must match on dot-separated boundaries). The "username" returned is whatever initial part of the remote hostname remains after domainname is removed. It is an error if there is no initial part (that is, if the remote hostname is exactly the specified domainname).

## EXAMPLE
The following readers.conf(5) fragment grants access to hosts with internal domain names:

```
    auth internal {
        res: "domain .internal"
        default-domain: "example.com"
    }
    access internal {
        users: "*@example.com"
        newsgroups: example.*
    }
```

Access is granted to the example.* groups for all connections from hosts that resolve to hostnames ending in ".internal"; a connection from "foo.internal" would match access groups as "foo@example.com".

## BUGS
It seems the code does not confirm that the matching part is actually at the end of the remote hostname (e.g., "domain: example.com" would match the remote host "foo.example.com.org" by ignoring the trailing ".org" part).

Does this resolver actually provide any useful functionality not available by using wildcards in the readers.conf(5) hosts parameter? If so, the example above should reflect this functionality.

## HISTORY
This documentation was written by Jeffrey M. Vinocur <jeff@litech.org>.

$Id: domain.pod 8200 2008-11-30 13:31:30Z iulius $

## SEE ALSO
nnrpd(8), readers.conf(5)


expire

title: expire(8)

text:
# expire(8)

## NAME
expire - Usenet article and history expiration program

## SYNOPSIS
expire [-iNnptx] [-d dir] [-f file] [-g file] [-h file] [-r reason] [-s size] [-v level] [-w number] [-z file] [expire.ctl]

## DESCRIPTION
expire scans the history(5)-format text file pathdb/history and uses the information recorded in it to purge itself of old news articles. Articles stored using a storage method that has self-expire functionality are by default not affected by expire's primary behavior (but see the -N flag to disable this). In this case, expire.ctl is ignored except the "/remember/" line for that article; expire does still probe to see if the article still exists and purges the relevant history and overview entries if appropriate. However, if groupbaseexpiry in inn.conf is true, expire acts on all articles as specified by expire.ctl regardless of whether their storage methods have self-expire functionality.

Note that expire never purges articles which do not match any entry in expire.ctl.

## OPTIONS
-d dir

If the -d flag is used, then the new history file and database is created in the specified directory dir. This is useful when the filesystem does not have sufficient space to hold both the old and new history files. When this flag is used, expire leaves the server paused and creates a zero-length file named after the new history file, with an extension of ".done" to indicate that it has successfully completed the expiration. The calling script should install the new history file and unpause the server. The -r flag should be used with this flag.

-f file

To specify an alternate history file, use the -f flag. This flag is valid when used with the -d flag, and the output will be written to the specified file. The default without -f is "history".

-g file

If the -g flag is given, then a one-line summary equivalent to the output of -v 1, except preceded by the current time, will be appended to the specified file.

-h file

To specify an alternate input text history file, use the -h flag. expire uses the old dbz(3) database to determine the size of the new one. (If the -d flag is not used, the output filename will be the same as the input filename with an extension of ".n".) The default without the -h flag is pathdb/history.

-i

To ignore the old database, use the -i flag.

-N

The control file is normally ignored for articles in storage methods which have self-expire functionality. If the -N flag is used, expire still uses the control file for these articles.

-n

If innd is not running, use the -n flag and expire will not send the "pause" or "go" commands. (For more details on the commands, see ctlinnd(8)). Note that expire only needs exclusive access for a very short time -- long enough to see if any new articles arrived since it first hit the end of the file, and to rename the new files to the working files.

-p

expire makes its decisions on the time the article arrived, as found in the history file. This means articles are often kept a little longer than with other expiration programs that base their decisions on the article's posting date. To use the article's posting date, use the -p flag.

-r reason

expire normally sends a "pause" command to the local innd daemon when it needs exclusive access to the history file, using the string "Expiring" as the reason. To give a different reason, use the -r flag. The process ID will be appended to the reason. When expire is finished and the new history file is ready, it sends a "go" command. See also the -n flag.

-s size

Optimize the new history database for approximately size pairs (lines in history). Accurately specifying the size will create a more efficient database. (The size should be the estimated eventual size of the file, typically the size of the old file.)

-t

If the -t flag is used, then expire will generate a list of the tokens that should be removed on its standard output, and the new history file will be left in history.n, history.n.dir, history.n.index and history.n.hash. This flag is useful for debugging when used with the -n flag. Note that if the -f flag is used, then the name specified with that flag will be used instead of history.

-v level

The -v flag is used to increase the verbosity of the program, generating messages to standard output. The level should be a number, where higher numbers result in more output. Level one will print totals of the various actions done (not valid if a new history file is not written), level two will print a report on each individual file, while level five results in multiple lines of output for every history line processed.

-w number

Use the -w flag to "warp" time so that expire thinks it is running at some time other then the current time. The value should be a signed floating point number indicating the number of days to use as the offset.

-x

If the -x flag is used, then expire will not create any new history files. This is most useful when combined with the -n and -t flags to see how different expiration policies would change the amount of disk space used.

-z file

If the -z flag is used, then articles are not removed, but their names are appended to the specified file. See the description of delayrm in news.daily(8). If a filename is specified, it is taken as the control file and parsed according to the rules in expire.ctl. A single dash ("-") may be used to read the file from standard input. If no file is specified, the file pathetc/expire.ctl is read.

## HISTORY
Written by Rich $alz <rsalz@uunet.uu.net> for InterNetNews. Converted to POD by Julien Elie.

$Id: expire.pod 8573 2009-08-18 13:49:54Z iulius $

## SEE ALSO
ctlinnd(8), dbz(3), expire.ctl(5), history(5), inn.conf(5), innd(8), inndcomm(3), news.daily(8).


expireover

title: expireover(8)

text:
# expireover(8)

## NAME
expireover - Expire entries from the news overview database

## SYNOPSIS
expireover [-ekNpqs] [-f file] [-w offset] [-z rmfile] [-Z lowmarkfile]

## DESCRIPTION
expireover expires old entries from the news overview database. It reads in a list of newsgroups (by default from pathdb/active, but a different file can be specified with the -f option) and then removes from the overview database mentions of any articles that no longer exist in the news spool.

If groupbaseexpiry in inn.conf is true, expireover also removes old articles from the news spool according to the expiration rules in expire.ctl. Otherwise it only removes overview entries for articles that have already been removed by some other process, and -e, -k, -N, -p, -q, -w, and -z are all ignored.

When groupbaseexpiry is set, the default behavior of expireover is to remove the article from the spool once it expires out of all of the newsgroups to which it was crossposted. The article is, however, removed from the overview database of each newsgroup as soon as it expires out of that individual newsgroup. The effect is that an article crossposted to several groups will be removed from the overview database from each group one-by-one as its age passes the expiration threshold for that group as set in expire.ctl, and then when it expires out of the last newsgroup, it will be deleted from the news spool.

Articles that are stored in self-expiring storage backends such as CNFS are normally treated differently and not expired until they expire out of the backend regardless of expire.ctl. See -N, however.

By default, expireover purges all overview information for newsgroups that have been removed from the server; this behavior is suppressed if -f is given.

## OPTIONS
-e

Remove articles from the news spool and all overview databases as soon as they expire out of any newsgroup to which they are posted, rather than retain them until they expire out of all newsgroups. -e and -k cannot be used at the same time. This flag is ignored if groupbaseexpiry is false.

-f file

Use file as the newsgroup list instead of pathdb/active. file can be "-" to indicate standard input. Using this flag suppresses the normal purge of all overview information from newsgroups that have been removed from the server.

-k

Retain all overview information for an article, as well as the article itself, until it expires out of all newsgroups to which it was posted. This can cause articles to stick around in a newsgroup for longer than the expire.ctl rules indicate, when they're crossposted. -e and -k cannot be used at the same time. This flag is ignored if groupbaseexpiry is false.

-N

Apply expire.ctl rules to expire articles even from storage methods that have self-expire functionality. This may remove articles from self-expiring storage methods before the articles "naturally" expire. This flag is ignored if groupbaseexpiry is false.

-p

By default, expireover bases decisions on whether to remove an article on the arrival time on the server. This means that articles may be kept a little longer than if the decision were based on the article's posting date. If this option is given, expiration decisions are based on the article posting date instead. This flag is ignored if groupbaseexpiry is false.

-q

expireover normally prints statistics at the end of the expiration process. -q suppresses this report. This flag is ignored if groupbaseexpiry is false.

-s

expireover normally only checks the existence of articles in the news spool if querying the storage method for that article to see if it still exists is considered "inexpensive". To always check the existence of all articles regardless of how resource-intensive this may be, use the -s flag. See storage.conf(5) for more information about this metric.

-w offset

"Warps" time so that expireover thinks that it's running at some time other than the current time. This is occasionally useful to force groups to be expired or not expired without changing expire.ctl for the expire run. offset should be a signed floating point number specifying the number of days difference from the current time to use as "now". This flag is ignored if groupbaseexpiry is false.

-z rmfile

Don't remove articles immediately but instead write the path to the article or the token of the article to rmfile, which is suitable input for fastrm(1). This can substantially speed up deletion of expired articles for those storage methods where each article is a single file (such as tradspool and timehash). See the description of the delayrm keyword in news.daily(8) for more details. This flag is ignored if groupbaseexpiry is false.

-Z lowmarkfile

Write the lowest article numbers for each newsgroup as it's expired to the specified file. This file is then suitable for "ctlinnd lowmark". See ctlinnd(8) for more information.

## EXAMPLES
Normally expireover is invoked from news.daily(8), which handles such things as processing the rmfile and lowmarkfile if necessary. Sometimes it's convenient to manually expire a particular newsgroup, however. This can be done with a command like:

```
    echo example.test | expireover -f - -Z <pathtmp in inn.conf>/lowmark
    ctlinnd lowmark <pathtmp>/lowmark
```

This can be particularly useful if a lot of articles in a particular group have expired but the overview information is still present, causing some clients to see a lot of "this article may have been cancelled" messages when they first enter the newsgroup.

## HISTORY
Written by Rob Robertson <rob@violet.berkeley.edu> and Rich $alz <rsalz@uunet.uu.net> (with help from Dave Lawrence <tale@uunet.uu.net>) for InterNetNews.

$Id: expireover.pod 8571 2009-08-17 19:10:07Z iulius $

## SEE ALSO
active(5), ctlinnd(8), expire(8), expire.ctl(5), inn.conf(5), news.daily(8).


expirerm

title: expirerm(8)

summary: Remove articles that have been expired

text:
# expirerm(8)

## NAME
expirerm - Remove articles that have been expired

## SYNOPSIS
expirerm file

## DESCRIPTION
expirerm is a script that removes a list of files. The specified file lists the files to be removed. It is usually created by expire -z. This file is sorted, and then fed into a pipeline responsible for doing the removal, normally fastrm. (You may want to edit expirerm to change the flags passed to fastrm.)

If there seemed to be a problem removing the files, then a mail is sent to the news administrator. If there were no problems, then file is renamed to pathlog/expire.list where it is kept (for safety) until the next time expiration is done.

## HISTORY
Written by Landon Curt Noll <chongo@toad.com> and Rich $alz <rsalz@uunet.uu.net>. Converted to POD by Julien Elie.

$Id: expirerm.pod 8573 2009-08-18 13:49:54Z iulius $

## SEE ALSO
expire(8), fastrm(8), newslog(5).


filechan

title: filechan(8)

summary: file-writing backend for InterNetNews

text:
# filechan(8)

## NAME
filechan - file-writing backend for InterNetNews

## SYNOPSIS
filechan [ -d directory ] [ -f num_fields ] [ -m mapfile ] [ -p pidfile ]

## DESCRIPTION
Filechan reads lines from standard input and copies certain fields in each line into files named by other fields within the line. Filechan is intended to be called by innd(8) as a channel feed. (It is not a full exploder and does not accept commands; see newsfeeds(5) for a description of the difference, and buffchan(8) for an exploder program.)

Filechan input is interpreted as a sequence of lines. Each line contains a fixed number of initial fields, followed by a variable number of filename fields. All fields in a line are separated by whitespace. The default number of initial fields is one.

For each line of input, filechan writes the initial fields, separated by whitespace and followed by a newline, to each of the files named in the filename fields. When writing to a file, filechan opens it in append mode and tries to lock it and change the ownership to the user and group who owns the directory where the file is being written.

Because the time window in which a file is open is very small, complicated flushing and locking protocols are not needed; a mv(1) followed by a sleep(1) for a couple of seconds is sufficient.

## OPTIONS
-f num_fields

The ``-f'' flag may be used to specify a different number of initial fields.

-d directory

By default, filechan writes its output into the directory <pathoutgoing in inn.conf>. The ``-d'' flag may be used to specify a directory the program should change to before starting.

-p pidfile

If the ``-p'' flag is used, the program will write a line containing its process ID (in text) to the specified file.

-m mapfile

A map file may be specified by using the ``-m'' flag. Blank lines and lines starting with a number sign (``#'') are ignored. All other lines should have two host names separated by a colon. The first field is the name that may appear in the input stream; the second field names the file to be used when the name in the first field appears. For example, the following map file may be used to map the short names used in the example below to the full domain names:

```
# This is a comment
uunet:news.uu.net
foo:foo.com
munnari:munnari.oz.au
```

## EXAMPLES
If filechan is invoked with ``-f 2'' and given the following input:

```
news/software/b/132 <1643@munnari.oz.au> foo uunet
news/software/b/133 <102060@litchi.foo.com> uunet munnari
comp/sources/unix/2002 <999@news.foo.com> foo uunet munnari
```

Then the file foo will have these lines:

```
news/software/b/132 <1643@munnari.oz.au>
comp/sources/unix/2002 <999@news.foo.com>
```

the file munnari will have these lines:

```
news/software/b/133 <102060@litchi.foo.com>
comp/sources/unix/2002 <999@news.foo.com>
```

and the file uunet will have these lines:

```
news/software/b/132 <1643@munnari.oz.au>
news/software/b/133 <102060@litchi.foo.com>
comp/sources/unix/2002 <999@news.foo.com>
```

## HISTORY
Written by Robert Elz <kre@munnari.oz.au>, flags added by Rich $alz <rsalz@uunet.uu.net>. This is revision 5909, dated 2002-12-03.

## SEE ALSO
buffchan(8), inn.conf(5), innd(8), newsfeeds(5).


ident

title: ident(8)

summary: nnrpd ident resolver

text:
# ident(8)

## NAME
ident - nnrpd ident resolver

## SYNOPSIS
ident [-p port] [-t]

## DESCRIPTION
This program attempts to resolve usernames for nnrpd by using the ident protocol to query the remote host. It contacts the remote host using either IPv4 or IPv6 depending on which protocol was used for the incoming NNTP connection.

## OPTIONS
-p port

If this option is given, attempt to contact identd on the specified remote port (which can be a numeric or symbolic specification). Non-numeric values will be looked up using getservbyname(3). The default value is the result of "getservbyname("ident")" if available, or port 113 otherwise.

-t

If this option is given, the identity returned will never have a domain part. That is, if the remote server returns a result containing an "@" character, ident truncates the response at the "@". This is useful to allow the default-domain parameter in reaers.conf to override the domain supplied by the remote host (particularly if the supplied domain part is an unqualified local machine name rather than a full domain name).

## EXAMPLE
The following readers.conf(5) fragment tells nnrpd to trust ident information for hosts on a local network, but to replace the domain returned from the ident query:

```
    auth LAN {
        hosts: "192.168/16"
        res: "ident -t"
        default-domain: "internal.example.com"
    }
    access LAN {
        users: "*@internal.example.com"
        newsgroups: example.*
    }
```

Access is granted to the example.* groups for all users on the local network whose machines respond to ident queries.

## HISTORY
This documentation was written by Jeffrey M. Vinocur <jeff@litech.org>.

$Id: ident.pod 8200 2008-11-30 13:31:30Z iulius $

## SEE ALSO
nnrpd(8), readers.conf(5)


innbind

title: innbind(8)

text:
# innbind(8)

## NAME
innbind - Helper program to bind sockets to privileged ports

## SYNOPSIS
innbind [-p] fd,family,address,port [...]

## DESCRIPTION
innbind is a helper program that's not meant to be run directly. Instead, innd and nnrpd use it internally to bind to ports that require root privileges to bind to.

This program must be installed setuid root in order for innd or nnrpd to bind to ports under 1024. The only functions that it's willing to perform are to bind an open file descriptor to a given address and port or to create a new socket, bind it, and return the bound socket to its caller. It can only be run as the news user (as specified at configure time), and will only bind to ports 119, 433, 563, an additional port specified with the --with-innd-port argument to configure, or ports numbered 1024 or higher.

Each argument to innbind must be a comma-separated list of four elements. The first is the file descriptor number that should be bound, the second is the numeric family of the socket (AF_INET or AF_INET6), the third is the local address to bind to (in dotted-quad format for IPv4 and in colon-separated address format for IPv6), and the fourth is the port number. To bind to all addresses with IPv4, use 0.0.0.0 as the address. To bind to all addresses with IPv6, use "::" as the address.

Multiple arguments can be specified to tell innbind to bind multiple sockets at the same time. Any errors (other than permission denied -- see below) encountered will cause innbind to abort, and error messages will be sent both to syslog and to standard error.

By default, innbind attempts to just bind the already open file descriptor that it inherits from its caller. For each successfully bound file descriptor (in the order given on the command line), innbind prints "ok" and a newline to its standard output.

On some systems (apparently just STREAMS-based systems), however, even a setuid root program cannot bind a socket to a privileged port that was created by a process that didn't have permissions. If innbind gets permission denied when trying to bind a socket, it will print "no" and a newline to its standard output. It will then create a new socket, bind it as specified, and then attempt to pass that socket back to its caller using the I_SENDFD STREAMS ioctl. The caller should receive that file descriptor with I_RECVFD and use it instead of the one that it created.

Note that file descriptor passing is only supported on STREAMS-based systems since it is done with ioctls over a pipe. However, it is believed that those systems are exactly the systems that can't simply bind the inherited file descriptor. If this assumption proves to be incorrect, traditional BSD file descriptor passing over a Unix domain socket will have to be added.

## OPTIONS
-p

If given as the first command-line argument, no attempt will be made to bind the inherited file descriptor and innbind will only try creation of a new file descriptor and passing it back via standard output. This option is primarily useful for testing.

## SECURITY
As innbind is normally installed setuid root, security is even more of an issue for it than for other parts of INN. It is a fairly short program, and if you understand C, you are encouraged to audit it yourself to be certain that it does only what it is supposed to do. The only INN library functions it uses are the vector functions, the message functions for error reporting, and xstrdup.

The ports that will be bound are restricted to prevent potential attacks made possible by the ability to bind low-numbered ports, such as exploits of the rsh(1) family of commands on some systems. If innbind is installed setuid root, it can only be executed by the news user to prevent other users on the system from being able to bind to even those few privileged ports that it allows.

innbind uses no external configuration files; the only files it might open are through the system getpwnam(3) service to get the UID of the news user. The only user input that it accepts are its command-line arguments.

## DIAGNOSTICS
innbind may log the following messages to syslog and print them to standard error.

cannot create socket for %s: %s

(Fatal) innbind fell back on attempting to create a new socket to bind for the given argument, and the socket creation failed.

cannot bind socket for %s: %s

(Fatal) Calling bind for the socket corresponding to the given argument failed with a system error. If the error indicates permission denied, make sure that innbind is setuid root. This can also be caused by trying to use IPv6 on a system whose kernel does not support it.

cannot bind to restricted port %hu in %s

(Fatal) The port number portion of the given command-line argument is for a port below 1024 which is not 119, 433, 563, or a port given to --with-innd-port at configure time. Other ports are not allowed for security reasons.

cannot get socket options for file descriptor %d: %s

(Fatal) innbind was unable to get the socket options for that file descriptor. The most likely cause of this error is passing the wrong file descriptor number to innbind (a file descriptor that isn't open, or that corresponds to a regular file rather than a network socket).

cannot get UID for %s

(Fatal) innbind was unable to get the UID for the news user specified during configure (and defaulting to "news"). This normally means that user isn't in the system passwd file.

cannot mark socket reusable for %s: %s

(Fatal) innbind created a new socket for the given argument but was unable to mark its bind address reusable (the SO_REUSEADDR socket option).

cannot pass file descriptor: %s

(Fatal) innbind created and bound a new file descriptor but was unable to pass it back to its caller via its standard output, using the I_SENDFD STREAMS ioctl.

invalid file descriptor %d: not SOCK_STREAM

(Fatal) The given file descriptor is not a SOCK_STREAM socket. innbind can only bind SOCK_STREAM sockets.

invalid IPv4 address %s in %s

(Fatal) The IPv4 address specified in the given command-line option could not be parsed by inet_aton(3). IPv4 addresses should be specified in the standard dotted-quad format (10.2.3.4).

invalid IPv6 address %s in %s

(Fatal) The IPv6 address specified in the given command-line option could not be parsed by inet_pton(3). IPv6 addresses should be specified in RFC 4291 format (1080:0:0:0:8:800:200C:417A or 1080::8:800:200C:417A).

invalid command-line argument %s

(Fatal) The specified command-line argument could not be parsed or was not in the correct format.

invalid file descriptor %s in %s

(Fatal) The file descriptor portion of the given command-line argument is not a non-negative integer.

invalid port number %s in %s

(Fatal) The port number portion of the given command-line argument is not a non-negative integer.

invalid protocol family %s in %s

(Fatal) The protocol family portion of the given command-line argument is not a non-negative integer. It should be equal to either AF_INET or AF_INET6 on the system where innbind is run.

must be run by user %s (%lu), not %lu

(Fatal) When setuid root, innbind may only be run by the news user as specified at configure time ("news" by default), for security reasons.

no addresses specified

(Fatal) No arguments were given on the command line (except maybe -p).

port may not be zero in %s

(Fatal) The port number portion of the given command-line argument was zero.

unknown protocol family %s in %s

(Fatal) The protocol number portion of the given command-line argument is neither AF_INET nor AF_INET6.

## EXAMPLES
As mentioned above, innbind is never run directly, only by innd and other programs that need to bind to and listen to network ports. Sample invocations by innd would be:

```
    innbind 3,10,::,119
```

to bind the IPv6 socket on file descriptor 3 to port 119, all addresses, or:

```
    innbind 6,2,10.0.0.3,433
```

to bind the IPv4 socket on file descriptor 6 to port 433 in the address 10.0.0.3.

## HISTORY
Written by Russ Allbery <eagle@eyrie.org> for InterNetNews.

$Id: innbind.pod 9767 2014-12-07 21:13:43Z iulius $

## SEE ALSO
inet_aton(3), inet_pton(3), innd(8), nnrpd(8).


inncheck

title: inncheck(8)

text:
# inncheck(8)

## NAME
inncheck - Check INN configuration and database files

## SYNOPSIS
inncheck [-afqv] [--noperm | --perm] [--pedantic] [file | file=path ...]

## DESCRIPTION
inncheck examines various configuration files and databases and verifies things about them. Things verified depend on the file being checked, but generally are things like permissions, ownership, syntax errors in config files, etc.

inncheck does not make changes to any files -- it just reports what it thinks may be wrong, and it is up to the operator to fix the problem

The set of files checked may be restricted by using file or file=path arguments. For example, putting "incoming.conf" causes only the incoming.conf file to be checked. Using "incoming.conf=/tmp/incoming.conf" on the command line will cause inncheck to only verify the incoming.conf file, and it will perform the checks on the /tmp/incoming.conf file instead of the default one. Setting a file path to an empty value like "incoming.conf=" will skip the check for that file (this only makes sense with -a, or no files will be checked at all).

Valid values for file are:

```
    active
    control.ctl
    control.ctl.local
    expire.ctl
    incoming.conf
    inn.conf
    innfeed.conf
    moderators
    newsfeeds
    nntpsend.ctl
    passwd.nntp
    readers.conf
    storage.conf
```

## OPTIONS
-a, --all

If any file value or file=path pairs (see below) are given, then normally only the files they refer to are checked. Use the -a (or --all) flag to specify that all files should be checked regardless. In this case the form file=path will be the more useful.

-f, --fix

Use the -f flag (or --fix) to have inncheck print the appropriate chown/chgrp/chmod command necessary to fix a problem that it reports. Any other output lines will be prefixed with a hash sign ("#") to make the output be valid input for a shell. Note that the --perm flag must be used as well when using this flag.

--noperm

To avoid doing any checking of file permissions or ownership, use the --noperm option.

--pedantic

Use the --pedantic option to get reports on things that are not necessarily wrong, but may indicate a bad configuration, such as inn.conf missing a key.

--perm

inncheck checks all files for permission problems. If the --perm flag is used, then only the files specified by the file or file=path command line arguments will be checked for problems other than permission problems.

-q, --quiet

Use the -q option (or --quiet) to get less output.

-v, --verbose

Use the -v option (or --verbose) to get more verbose output.

## EXAMPLES
To have inncheck check all files for syntax and permission problems simply run:

```
    inncheck
```

It is recommended to run the following command to be aware of all the potential problems inncheck can detect:

```
    inncheck -a --perm --pedantic
```

To have inncheck check all files for permission problems and to verify the syntax of the active and incoming.conf files, do:

```
    inncheck --perm active incoming.conf
```

To fix the permissions problems noted in the output of the above command, modify it as follows:

```
    inncheck -f --perm | sh
```

(Note that it is useless to mention the name of the two files since permission problems are checked on all files.)

To have inncheck check the test newsfeeds file in /var/tmp/newsfeeds.testing, do:

```
    inncheck newsfeeds=/var/tmp/newsfeeds.testing
```

To have inncheck check all the files as it normally does, but to specify a different location for the newsfeeds file and omit checking of the innfeed.conf file, do:

```
    inncheck -a newsfeeds=/var/tmp/newsfeeds.testing innfeed.conf=
```

## BUGS
If the -f and --perm options are used together, along with -a or some file or file=path arguments that refer to a file with a syntax problem, then the output will no longer be valid input for a shell.

In most cases, inncheck currently does not correctly understand option values spanning multiple lines. If you get error messages about runaway quotes, you either have to ignore them and check the correctness of the relevant lines yourself, or merge the value into a single line.

## HISTORY
Written by Brendan Kehoe <brendan@cygnus.com> and Rich Salz <rsalz@uunet.uu.net> for InterNetNews. Converted to POD by Julien Elie.

$Id: inncheck.pod 9428 2012-06-15 18:18:45Z iulius $

## SEE ALSO
active(5), control.ctl(5), expire.ctl(5), history(5), incoming.conf(5), inn.conf(5), innfeed.conf(5), moderators(5), newsfeeds(5), nntpsend.ctl(5), passwd.nntp(5), readers.conf(5), storage.conf(5).


innd

title: innd(8)

summary: InterNetNews daemon

text:
# innd(8)

## NAME
innd - InterNetNews daemon

## SYNOPSIS
innd [-aCdfNrsSu] [-4 address] [-6 address] [-c days] [-H count] [-i count] [-l size] [-m mode] [-n flag] [-o count] [-P port] [-t timeout] [-T count] [-X seconds]

## DESCRIPTION
innd, the InterNetNews daemon, handles all incoming NNTP feeds, coordinates the storage, retransmission, and overview generation for all accepted articles, and manages the active(5) and history(5) databases. It handles incoming connections on the NNTP port, and also creates and listens to a local Unix-domain stream socket in order to receive articles from local processes such as nnrpd(8) and rnews(1).

As the master daemon, innd should generally be started at boot and be always running. It listens to a Unix-domain datagram socket for commands to control its activities, commands that can be sent using ctlinnd(8). The current status of innd can be obtained by running "ctlinnd mode", or for more detailed output, innstat(8).

innd can be in one of three operating modes: running, paused, or throttled. Running is the normal mode; when the server is throttled, it closes connections and rejects new ones. Paused is like a temporary throttle, suspending innd's activities but not causing the server to shut down existing connections. The mode is normally changed via ctlinnd(8), either by various automated processes (such as nightly article expiration) or manually by the news administrator, but innd will also throttle itself if it encounters ENOSPC errors in writing data or an excessive number of I/O errors (among other problems).

innd normally takes care of spawning nnrpd(8) to handle connections from news reading clients, but it can be run on a separate port from nnrpd(8) so that feed connections and news reading connections are handled separately (this can often be faster). Normally, innd listens on port 119, the assigned port for NNTP; if it is desirable to run innd and nnrpd(8) on separate ports, it's recommended that nnrpd(8) be given port 119 (since many news reading clients connect only to that port) and that port 433 be used for innd.

The primary configuration files that control innd's activities are incoming.conf, which specifies what remote sites innd will accept connections from, newsfeeds, which specifies what is to be done with incoming articles besides storing them, and inn.conf, which sets a wide variety of configuration parameters. Some parameters in inn.conf(5) can also be set with command-line flags; for these, the command-line flags take precedence if used.

innd must be run as the news user and news group. It will check for this at startup and fail to start if not run properly. Normally it should be started via rc.news(8) as part of the system boot up process. It relies on the setuid root helper program innbind(8) to listen on a privileged port (119, 433 or 563).

## OPTIONS
For the options below that override inn.conf settings, see inn.conf(5) for the default values if neither the inn.conf setting nor the command-line option is given.

-4 address

Normally, innd binds to all local IP addresses (unless bindaddress is set in inn.conf). If this option is given, it specifies the IP address that INN should bind as. This is only relevant for servers with multiple local IP addresses. The IP address must be in dotted-quad ("nnn.nnn.nnn.nnn") format. If this option is specified, it's the same as setting bindaddress in inn.conf and may cause changes in whether INN binds to an IPv6 address as well. See inn.conf(5) for more details and also the -6 flag for innd.

This option has no effect when systemd socket activation is used.

-6 address

Only applies when INN has been built with IPv6 support. Normally innd binds to all local IP addresses (unless bindaddress6 is set in inn.conf). If this option is given, it specifies the IPv6 address that INN should bind to. The IPv6 address must be in colon-separated RFC 4291 format ("n:n:n:n:n:n:n:n"). If this option is specified, it's the same as setting bindaddress6 in inn.conf and may cause changes in whether INN binds to an IPv4 address as well. See inn.conf(5) for more details and also the -4 flag for innd.

This option has no effect when systemd socket activation is used.

-a

By default, if a host connects to innd but is not listed in incoming.conf, the connection is handed off to nnrpd (or rejected if noreader is set in inn.conf). If -a is given, incoming.conf is ignored and any host can connect and transfer articles. This flag should never be used with an accessible server connected to Usenet; it would open the server up for all sorts of abuse.

-c days

innd normally rejects any article that is older (in days) than the value of artcutoff in inn.conf. This option, if given, overrides the value of that setting. If days is 0, this check is suppressed and innd will accept articles regardless of how old they are.

-C

This flag tells innd to accept and propagate but not actually process cancel or supersedes messages. This is intended for sites concerned about abuse of cancels, or that wish to use another cancel mechanism with stronger authentication.

-d, -f

innd normally puts itself into the background, points its standard output and error to log files, and disassociates itself from the terminal. Using -d prevents all of this, resulting in log messages being written to standard output; this is generally useful only for debugging. Using -f prevents the backgrounding and disassociation but still redirects output; it may be useful if you want to monitor innd with a program that would be confused by forks.

-H count, -T count, -X seconds

These flags control the number of connections per seconds seconds that are allowed. This code is meant to protect your server from newsreader clients that make too many connections per minute (and therefore these flags are probably only useful when innd is spawning nnrpd). You probably should not use these options unless you're having problems. The table used for this check is fixed at 128 entries and is used as a ring; the size was chosen to make calculating the index easy and to be fairly sure that it won't run out of space. In practice, it is unlikely that even half the table will be used at any given moment. The -H flag limits the number of times a host is allowed to connect to the server per the time interval given by -X. The default is 2.

The -T flag limits the total number of incoming connections per the time interval given by -X. The maximum value is 128, and the default is 60.

Note that the time interval given by -X is set to 0 by default, that is to say no control is done on the number of connections.

-i count

innd normally allows a maximum number of concurrent NNTP connections given by the value of maxconnections in inn.conf. This option, if given, overrides the value of that setting. If count is 0, this check is suppressed.

-l size

innd normally rejects any article larger than the value of maxartsize in inn.conf. This option, if given, overrides the value of that setting and specifies a maximum article size of size. If size is 0, this check is suppressed.

-m mode

Normally, innd starts in the "running" mode. If this option is given, it specifies what mode innd should start in. mode should begin with one of "g", "p", or "t", and the starting mode will be set to "running", "paused", or "throttled", respectively, based on that initial letter. ("g" is short for "go".)

-N

If this option is given, any filters (Perl or Python) are disabled before innd starts (normally, filters default to being enabled). The filters can be enabled after innd has started with ctlinnd(8).

-n flag

Whether innd allows (and hands off to nnrpd) reader connections while paused or throttled is normally determined by the value of readerswhenstopped in inn.conf. This option, if given, overrides that value. If flag is "n", innd will not allow readers if it is paused or throttled. If flag is "y", readers will be allowed regardless of innd's operating mode.

-o count

This flag limits the number of file descriptors that are available for outgoing file feeds. The default is the number of available file descriptors minus some reserved for internal use (which could potentially starve innd of descriptors to use for accepting new connections). If innd has more file feeds than count, some of them will be buffered and only written out periodically. Normally you never need to use this option, since the number of outgoing feeds is fixed, being the number of file feeds configured in newsfeeds, and is generally small (particularly given that innfeed(8) is now used for most outgoing feeds at large sites).

-P port

The port innd should listen on is normally given by the value of port in inn.conf. This option, if given, overrides that value and specifies the port that innd should bind to.

-r

Instructs innd to renumber the active file after starting, just as if a "ctlinnd renumber" command were sent.

-s

Just check the syntax of the newsfeeds file and exit. innd will exit with a non-zero status if any errors are found; the actual errors will be reported via syslog(3).

-S

Report errors found in incoming.conf via syslog(3) and exit normally. (Yes, this is less useful than it should be.)

-t seconds

Normally, innd will flush any changes to history and the active file after 300 seconds of inactivity. This option changes that timeout to seconds.

-u

The news log (the trace information for every article accepted by innd) is normally buffered. This option changes the log to be unbuffered.

## CONTROL MESSAGES
Arriving articles that have a Control: header are called "control messages". Except for cancel messages, these messages are handled by controlchan(8) via a feed set up in newsfeeds.

(Cancel messages update the history database, so they must be handled internally; the cost of syncing, locking, then unlocking would be too high given the number of cancel messages that are received. Note that if an article is cancelled before it is received by the news server, it will be rejected when it arrives since the history database has been updated; it is useful for rejecting spam before it arrives.)

The distribution of control messages is different than that of standard articles. Control messages are normally filed into the pseudo-newsgroup named "control" regardless of which newsgroup they were actually posted to. If, however, a "control."command newsgroup exists that matches the control command, the control message will be filed into that group instead. For example, a newgroup control message will be filed in "control.newgroup" if that group exists; otherwise, it will be filed in "control".

If you want to specifically feed all control messages to a given site regardless of whether the control messages would affect the newsgroups you're feeding that site, you can put the appropriate control newsgroup in the subscription list. For example, to feed all cancel messages to a given remote site (normally a bad idea), add "control.cancel" to its subscription list. Normally it's best to exclude the control newsgroups from feeds to keep from sending your peers more control messages than they care about. That's why the newsfeeds pattern "!control,!control.*" is as often as not specified (adding this pattern do not prevent control messages which affect the newsgroups fed to a site from being sent to it).

checkgroups, newgroup and rmgroup control messages receive additional special treatment. If one of these control messages is approved and posted to the newsgroup being created or removed (or to the admin group to which the checkgroups is posted), the message will be sent to all sites whose subscription patterns would cause them to receive articles posted to that group. For example, if a newgroup control message for a nonexistent newsgroup "news.admin.meow" is received, it will be sent to any site whose subscription pattern would cause it to receive "news.admin.meow" if that newsgroup existed (such as a pattern of "news.admin.*"). For this reason, it is correct to post newgroup messages to the newsgroup that the control message would create. It is not generally correct to crosspost newgroup messages to some "well-propagated" newsgroup; not only will this not actually improve their propagation to sites that want such control messages, but it will also cause sites that do not want those control messages to receive them. Therefore, assuming that a newgroup control message is sent to the group "news.admin.meow" (specified in the Newsgroups: header) in order to create the group "news.admin.meow", the sites with the following subscription patterns will receive it:

```
    *,@news.*
    news.*
    news.*,!control,!control.*
    control,control.*
```

As a matter of fact, for the first pattern, "control.newgroup" (or "control") is included in "*". However, the sites with the following subscription patterns will not receive it:

```
    *,@news.*,!control,!control.*
    comp.*,@news.*
```

If a control message is posted to a group whose name ends with the four characters ".ctl", this suffix is stripped off and the control message is propagated as if it were posted to the base group. For example, a cancel message posted to "news.admin.ctl" will be sent to all sites that subscribe to "control.cancel" (or "control" if that newsgroup doesn't exist) or "news.admin". This behavior is present for historical compatibility reasons and should be considered obsolete; support for the ".ctl" suffix may be removed in a future version of INN.

Finally, articles posted to newsgroups beginning with "to." are treated specially. Provided that either that newsgroup exists in the active file or mergetogroups is set in inn.conf, the remainder of the newsgroup is taken to be a site name, as configured in newsfeeds, and the article is sent to that site. If mergetogroups is set, the article will be filed in the group named "to" (which must exist in the active file). For example, with mergetogroups set, an article posted to "to.uunet" will be filed in "to" and sent to the site "uunet".

## PROTOCOL DIFFERENCES
innd implements the NNTP commands defined in RFC 3977 (NNTP), RFC 4643 (NNTP authentication), RFC 4644 (streaming NNTP feeds) and RFC 6048 (NNTP LIST additions) with the following differences:

1.

A batch transfer command, XBATCH byte-count, is provided. This command will read byte-count bytes and store them for later processing by rnews(1) (which must be run separately, probably from cron). See innxbatch(8) and sendxbatches for more details on this extension.

2.

As INN is a mode-switching news server, innd implements a limited subset of the protocol useful for transferring news. The remaining commands are mostly only useful for readers and are implemented by nnrpd(8). Use of the MODE READER command will cause innd to pass the connection to nnrpd.

3.

innd allows a wider syntax for wildmats.

4.

Three commands (IHAVE, CHECK and TAKETHIS) will continue, for interoperability reasons, to return a reject code (respectively 435, 438 and 439) when the command contains a syntax error (which normally leads to 501).

## HEADER MODIFICATIONS
innd modifies as few article headers as possible, although it could be better in this area.

Empty headers and headers that consist of nothing but whitespace are dropped.

The local site's name (as set with the pathhost parameter in inn.conf) and an exclamation point are prepended to the Path: header, provided the first site name in the Path: header is different from the local one. In addition, pathalias and pathcluster may be similarly respectively prepended and appended to the Path: header; see inn.conf(5) for the details.

The Xref: header is removed and a new one created.

innd does not rewrite incorrect headers. For example, it will not replace an incorrect Lines: header, though it may reject such an article depending on the value of linecountfuzz in inn.conf.

## CANCEL FEEDS
In order to efficiently apply a large number of local cancels (such as from processing NoCeMs or from some other external source), INN supports a special feed mode available only to connections to the local Unix-domain socket (not to connections to any network sockets).

To enter this mode, connect to the Unix-domain socket (pathrun/nntpin) and send the command MODE CANCEL. The response will have code 284. Every subsequent line sent on that connection should consist of a single message-ID. An attempt will be made to cancel that message-ID, and the server will reply 289 for success or 484 for failure. (Failure can occur, for example, if the server is paused or throttled, or the message-ID is corrupt. Failure does not occur if the article to be cancelled does not exist.)

## LOGGING
innd reports all incoming articles in its log file (pathlog/news). This is a text file with a variable number of space-separated fields in one of the following formats:

```
    mon dd hh:mm:ss.mmm + feed <message-id> site ...
    mon dd hh:mm:ss.mmm j feed <message-id> site ...
    mon dd hh:mm:ss.mmm c feed <message-id> Cancelling <message-id>
    mon dd hh:mm:ss.mmm - feed <message-id> reason
    mon dd hh:mm:ss.mmm ? feed <message-id> reason
```

There may also be hostname and/or size fields after the message-ID depending on the settings of nntplinklog and logartsize in inn.conf.

The first three fields are the date and time to millisecond resolution. The fifth field is the site that sent the article (based on the Path: header) and the sixth field is the article's message-ID; they will be a question mark if the information is not available.

The fourth field indicates whether the article was accepted or not. If it is a plus sign, then the article was accepted. If it is the letter "j", then the article was accepted, providing all of the newsgroups to which the article was posted were set to status "j" in the active file (or not listed in the active file and wanttrash was set in inn.conf), and then the article was filed into the "junk" newsgroup. In both of these cases, the article has been accepted and the "site ..." field contains the space-separated list of sites to which the article is being sent.

If the fourth field is the letter "c", then a cancel message was accepted before the original article arrived, and a history entry for the cancelled message was created so that innd will reject that message if it arrives later.

If the fourth field is a minus sign, then the article was rejected. The reasons for rejection generated by innd include:

```
    "%s" header too long
    Article exceeds local limit of %s bytes
    Article posted in the future -- "%s"
    Bad "%s" header
    Can't write history
    Duplicate
    Duplicate "%s" header
    EOF in headers
    Linecount %s != %s +- %s
    Missing %s header
    No body
    No colon-space in "%s" header
    No matching newsgroups in cancel <%s>
    No space
    Space before colon in "%s" header
    Too old -- "%s"
    Unapproved for "%s"
    Unwanted newsgroup "%s"
    Unwanted distribution "%s"
    Whitespace in "Newsgroups" header -- "%s"
```

where %s, above, is replaced by more specific information. (The Perl and Python filters, if used, may reject articles with other reasons.)

If the fourth field is the letter "?", the article contains strange strings, such as CR without LF or LF without CR. (These characters should never occur in isolation, only together as CRLF to indicate the end of a line.) This log message is just informational, to give an idea of how widespread such articles are; innd does not reject such articles.

Note that when wanttrash is set to true in inn.conf and an article is received that isn't posted to any valid newsgroups, it will be accepted and logged with two lines, a "j" line and a minus sign line, unless the logtrash parameter is set to false (in which case only the "j" line is written).

innd also makes extensive reports through syslog(3). The first word of the log message will be the name of the site if the entry is site-specific (such as a "connected" message). The first word will be "SERVER" if the message relates to the server itself, such as when a read error occurs.

If the second word is the four letters "cant", then an error is being reported. (The absence of an apostrophe is intentional; it makes it easier to grep from the command line and easier to find error messages in FAQs using a search engine. However, "can't" is also used at a few places.) In this case, the next two words generally name the system call or library routine that failed and the object upon which the action was being performed. The rest of the line may contain other information.

In other cases, the second word attempts to summarize what change has been made, while the rest of the line gives more specific information. The word "internal" generally indicates an internal logic error.

## SIGNALS
innd will catch SIGTERM and SIGHUP and shut down. If -d is used, SIGINT will also be caught and will result in an orderly shutdown.

innd will catch the SIGUSR1 signal and recreate the control channel used by ctlinnd(8).

## BUGS
innd normally attempts to strip IP options from incoming connections, since it uses IP-based authentication and source routing can confuse that. However, this doesn't work on all systems, and it doesn't work at all in the presence of IPv6 support (and is disabled in that case). Hence, if using innd with IPv6 support, make sure that your kernel or router disables source routing.

## HISTORY
Written by Rich $alz <rsalz@uunet.uu.net> for InterNetNews.

$Id: innd.pod 10523 2021-01-17 21:52:00Z iulius $

## SEE ALSO
active(5), ctlinnd(8), dbz(3), history(5), incoming.conf(5), inn.conf(5), innbind(8), innfeed(8), innstat(8), newsfeeds(5), nnrpd(8), rnews(1), syslog(3).


inndf

title: inndf(8)

text:
# inndf(8)

## NAME
inndf - Report free disk, inodes, and overview information

## SYNOPSIS
inndf [-Fhi] [-f filename] directory [directory ...]

inndf -n

inndf -o

## DESCRIPTION
inndf was originally a replacement for "df | awk" in innwatch.ctl(5) and innstat(8), and now also reports various other usage information about INN's storage that df(1) doesn't understand. inndf doesn't sync, forks less, and is generally less complicated than df(1).

Its default behavior is to report free kilobytes (not disk blocks), or free inodes if -i is used, in the file systems holding the directories given on the command line. (A kilobyte in this case is 1024 bytes.) If only one directory is given, the output will be a simple number; if more than one directory is given, the output will be formatted for human readability.

If enableoverview is set to true in inn.conf, inndf can also be used to get information about the overview database. With the -n option, it reports a count of the total number of overview records stored. With -o, it reports the percentage of space used in the overview database (for those overview methods where this is meaningful data).

## OPTIONS
-f filename

filename should contain a list of directories to use in addition to those given by the arguments, one per line. Blank lines and anything after "#" on any line are ignored.

-F

Like -f except that the filename is pathetc/filesystems and it is not an error if this file doesn't exist. (This option is used primarily by such things as innstat(8), so that the news administrator can add additional file systems to check to pathetc/filesystems without having to modify the script.)

-h

Print a usage message and exit.

-i

Report the number of free inodes rather than the amount of free disk space.

-n

Report the total number of records in the overview database. Note that crossposted articles will have one overview record for each newsgroup they're posted to.

-o

Report the percentage usage of the overview database space. This is only meaningful for overview methods that pre-allocate a certain amount of space rather than grow to accommodate more records. Currently, this flag is only useful for the buffindexed overview method.

## EXAMPLES
Print the free kilobytes in pathspool as a simple number:

```
    inndf <pathspool in inn.conf>
```

Report the free inodes in pathnews and pathspool in a format designed for human readability:

```
    inndf -i <pathnews> <pathspool>
```

The same, but also add in all file systems in pathetc/filesystems:

```
    inndf -i -F <pathnews> <pathspool>
```

Print out the number of overview records and the percentage space used by a buffindexed overview database:

```
    inndf -no
```

## HISTORY
inndf was written by Ian Dickinson <idickins@fore.com>. This manual page was written by Swa Frantzen <Swa.Frantzen@belgium.eu.net>. Thanks also to the following folks for ports, patches, and comments:

```
    Mahesh Ramachandran <rr@eel.ufl.edu>
    Chuck Swiger <chuck@its.com>
    Sang-yong Suh <sysuh@kigam.re.kr>
    Brad Dickey <bdickey@haverford.edu>
    Taso N. Devetzis <devetzis@snet.net>
    Wei-Yeh Lee <weiyeh@columbia.edu>
    Jeff Garzik <jeff.garzik@spinne.com>
```

and to all the other folks I met and worked with during my 10 years as a newsadmin.

Katsuhiro Kondou added the -n and -o options. Russ Allbery added reporting of percentage free disk space. Support for -f and -F was added by Fabien Tassin <fta@sofaraway.org>.

$Id: inndf.pod 10283 2018-05-14 12:43:05Z iulius $

## SEE ALSO
df(1), innwatch.ctl(5), innstat(8).