innuendod R2 Install                     Copyright (C) 2001 Arafura Connect
--------------------                    By Jason Nunn <jsno@arafura.net.au>
                                           This program comes under the GNU
                                                    General Public License.


                              =NNTP proxy/spy=

                       This project has been funded by
                 Arafura Connect & Arafura Internet Services
                    Darwin, Northern Territory, Australia

                             71, Mcminn Street
                              Darwin, NT 0810
                                 Australia

                     http://www.arafuraconnect.com.au
                         http://www.arafura.net.au
                     http://jsno.arafuraconnect.com.au


synopsis:
---------

hello again..

This "quick hack" was written to fullfil our carrier obligations to
track/log our users who post articles on usenet. before innuendod,
everything that went on usenet (via hellstra's NNTP server) appeared to
come from 203.3.38.140. This program provides us with this needed logging.
Primarily, it's so we can nail those people who post "kiddy porn" onto
various groups-- we can then hand them to the feds with the needed
evidence etc. that's innuendod's real reason for existence, hence it's
name- "to indirectly remark/accuse" ;).


how it works:
-------------

this program acts like an NNTP socket proxy- it will accept connections on
119 as though it were a news server. when a client connects, it does a
straight thru connection to an NNTP server (hellstra's NNTP server in our
case).

nb/ later, i might implement multiplexed streaming and caching, but for
now though, i've only implemented the basics to get us out of the shit.

however... any posts are "captured" and saved to the fs in date order
(/var/innuendo/<YY.MM.DD>/). it also inserts a few "X-innuendod: "
directives into the NNTP header as it's being streamed to the NNTP server,
which gives usenet readers origin information.

all reads and writes to the NNTP are logged. the logging information
contains newgroups, usernames, dates, and subject titles. innuendod
resolves usernames by querying a "gossip" daemon (a RADIUS mezzianne).
hmmm, what's a gossip daemon you ask ?. please download peter greens
gossip distribution that's located on
http://w3w.arafuraconnect.com.au/~peter. this distribution contains
information on gossip and it's installation instructions.

here is an example of a captured post-

/var/innuendod/01.11.16/3bf4a0f2.203.39.3.196
--$---------------------------------------------------------
From: Fred Kroft <fred01@yahoo.com>
Subject: test
Date: Fri, 16 Nov 2001 14:45:30 +0930
Newsgroups: aus.test
Path: not-for-mail
Message-ID: <pan.2001.11.16.14.45.30.552036.1079@yahoo.com>
User-Agent: Pan/0.11.0 (Unix)
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Comment-To: ALL
X-innuendod: innuendod R0. NNTP proxy/spy. By Jason Nunn/Arafura Connect
X-innuendod: proxy- cleanhacks.arafura.net.au
X-innuendod: src IP- 203.39.3.157, user- frednurk
X-innuendod: date- Fri Nov 16 14:45:30 2001

this is a text

--$---------------------------------------------------------


and here is a sample of the generated log-

/var/innuendod/01.11.16/log
--$---------------------------------------------------------
Nov16 14:45:10 I @20 read- From: Joe Tutti <joe.tutti@gmx.de>
Nov16 14:45:10 I @20 read- ip=203.39.3.157, user=frednurk
Nov16 14:45:10 I @20 read- Newsgroups: alt.comp.periphs.mainboard.giga-byte
Nov16 14:45:10 I @20 read- Subject: VIA 686B-bug with GA-6VX7B-4x ?
Nov16 14:45:30 I @19 write- From: Fred Kroft <fred01@yahoo.com>
Nov16 14:45:30 I @19 write- Subject: test
Nov16 14:45:30 I @19 write- ip=203.39.3.157, user=frednurk
Nov16 14:45:30 I @19 write- Newsgroups: aus.test
Nov16 14:45:30 I @19 post captured. saving- 3bf4a0f2.203.39.3.196
Nov16 14:45:34 I @19 read- From: Fred Kroft <fred01@yahoo.com>
Nov16 14:45:34 I @19 read- Subject: test
Nov16 14:45:34 I @19 read- ip=203.39.3.157, user=frednurk
Nov16 14:45:34 I @19 read- Newsgroups: aus.test
--$---------------------------------------------------------

posts and logs are saved by date order (in /var/innuendod). so you have a
day by day account of what happens.


installation
------------

requirements- none to speak of really. this program doesn't use anything 
flash. it's been implemented on linux 2.4.x, using glibc 2.2.x. it 
implements posix threads and talks to a gossip daemon.

- install gossip if desired (download from w3w.arafuraconnect.com.au/~peter)
- edit the make.config
- make
- make install. this will copy innuendod to /usr/local/sbin by default,
  create a /var/innuendod directory and move conf.sample to that 
  directory, renaming it to conf.
- edit /var/innuendod/conf to suit. see following for an example-


less /var/innuendod/conf
--$---------------------------------------------------------
# innuendod R0 configuration file
#
proxy_port:     119
nntp_server:    news.telstra.net.au
nntp_port:      119
gossip_server:  gossip.arafura.net.au
gossip_port:    8008
dynamic_range:  203.39.3.151 203.39.3.190
--$---------------------------------------------------------

"dynamic_range:" is your dialin modem range. for those of you that have a
segmented modem pool, too bad. it hasn't been implemented hahaha.

nb/ if you don't have a gossip daemon running, or you don't want one
running, then just comment out the "gossip_server:" entry.

#gossip_server:  gossip.arafura.net.au
#gossip_port:    8008


- run- ./innuendo
- edit any necessary init scripts so that it automatically starts

done.


                          *     *     *     *

i've written a few other projects for this company which are commercial.  
they may be relevant to your business. check out
http://jsno.arafuraconnect.com.au/proj_comm/ for more details.


:jason

--
Jason Nunn- Electronics Technician / Un*x Specialist
Arafura Connect & Arafura Internet Services - 1300 137 363
Email: jsno@arafura.net.au, Mobile: 0418 813426, Fax: 08 89412278
Personal: http://jsno.arafuraconnect.com.au
