News (NNTP)

PBNntp turns your message areas into newsgroups, so callers can read and post with a newsreader instead of a terminal program. It was written for PBMessages, the desktop reader and editor, but any newsreader works: Thunderbird, Pan, slrn, tin, gnus and others.

• Login. The caller's BBS user name (or alias) and password. Level 0 users and deleted accounts never get in. The account's level and flags decide which areas it sees, exactly as on the board.
• Newsgroups. One newsgroup for each JAM message area of kind Local or Echo. The name is a prefix plus the area name split on spaces: “DOVE-Net General” becomes pb.dove-net.general. The prefix is pb unless you change it, or blank it for names like dove-net.general. Areas the caller may not read are not listed. Areas in other formats (Hudson, Squish, *.MSG) and private or net areas are not served.
• Reading. Articles are the messages in the area's JAM base, in message-number order. The headers (From, Subject, Date, Message-ID, References, Newsgroups) are built from the message. A FidoNet MSGID and REPLY become the Message-ID and References, so threads work.
• Posting. A post to a Local area is stored as a local message. A post to an Echo area is stored with the echo attribute, the area's AKA as the origin address, a tearline and an origin line, and PBNntp touches TOSS.SEM so the next PBToss scan sends it out like any other echo message. Each area's own write level and flags still apply.
• Login Guard. Wrong passwords count toward Login Guard.
• Security. Two ways to encrypt, with one certificate: STARTTLS on the news port (119), where the reader connects in plain text and switches to TLS before logging in; and NNTPS on the TLS port (563), encrypted from the first byte. NNTPS is the simplest choice for PBMessages and most readers: “Use TLS” on, port 563. A password is refused on an unencrypted connection unless you set allowplain yes.

PBDispatch owns the two ports and starts a PBNntp.exe for each caller, so a session survives restarting PBDispatch.

Figure 1. Network > NNTP Server in PBConfig.

On the left are News server (enable, plain logins, posting, guest reading, the two ports with their On boxes, session limits, lowest level, wrong passwords, greeting name) and Certificate (TLS). On the right are Newsgroups and posting (prefix, host name for IDs, clock offset, echo origin line, largest post), Users who may not use news (one name per line) and Folders and log. Allow posting and Let callers who have not logged in read the open areas are the allowpost and guestread settings in the reference below.

1. Open Network > NNTP Server in PBConfig and tick Enable the news server. Defaults: news port 119, NNTPS port 563, 16 sessions, 6 per address, minimum level 1. Set a port to 0 to turn that one off.
2. Certificate (needed for STARTTLS and NNTPS). Type the name your callers will use into Name on the certificate and click Create self-signed certificate, or put a certificate from a certificate authority, in PEM format, into the two file boxes. The newsreader shows a self-signed certificate's fingerprint the first time and asks you to trust it.
3. Newsgroup prefix. Changing it renames every group, so newsreaders must subscribe again.
4. Host name for IDs. The part after the @ in the Message-IDs PBNntp makes for messages that have no FidoNet MSGID. Your domain name is a good choice, but any plain name works. Pick one and leave it alone, or newsreaders may show articles as new.
5. BBS clock vs UTC. auto uses this PC's current time zone; or enter minutes (-300 for US Eastern standard time). The board stores local time and news wants UTC.
6. Echo origin line. Used for echo posts in areas that have none of their own. Empty means the board's name.
7. Click Save, then Test settings, then restart PBDispatch. The log shows NNTP enabled, listening on port 119 and NNTPS listening on port 563.
8. Behind a router, forward the news port and/or the NNTPS port and allow them in Windows Firewall. There is only one connection, so no passive range.

Tools > NNTP Sessions… in PBDispatch lists who is connected and whether each port is really open.

In PBMessages choose Tools > Accounts and add an NNTP account. Set the server to your board's host name or address, the port to 563 with “Use TLS” on (or 119 with STARTTLS), and use the caller's BBS user name and password. Accept the certificate the first time if it is self-signed. The newsgroup list then shows one group for each area the caller may read.

Figure 2. PBMessages connected to a board over TLS. Names have been blurred.

• Toolbar: Connect, Refresh, Stop, New, Reply, Forward, Next unread, Mark all read, Accounts and Options.
• Left: the account (named after the board) with one newsgroup for each message area the caller may read. Groups with unread messages are in bold, with the number in brackets.
• Centre: the messages in the selected group, with Subject, From, To and Date. Replies are indented under the message they answer. The box at the top, Find in this area, searches the list.
• Bottom: the selected message.
• Status bar: the number of messages and unread messages, and the connection: here “TLSv1.3, trusted certificate”.

PBConfig writes the file. No file means news is off. A mistake means the log names the line and news stays off.

• Only JAM Local and Echo areas appear. The group list is re-read from MESSAGES.PB every 20 seconds, so a new area shows up without a restart.
• A message posted through news gets its FidoNet MSGID when posted, and a message typed in the board's editor keeps the MSGID the editor wrote, so Message-IDs do not change when PBToss later scans the message out.
• Message times are the board's local time. With auto, articles written in the other half of a daylight-saving year can be an hour off.
• Posting uses the logged-in user's permissions: the From name is their BBS name, and each area's write level and flags are checked on every post.
• A post is stored at once in the JAM base, with the usual locking. It does not go through ProBoard.exe.
• Passwords are never written to any log.

PBNntp.exe -cfg Configs\PBNNTP.CFG -test
netstat -ano | findstr ":119 :563"
openssl s_client -connect localhost:563
openssl s_client -connect localhost:119 -starttls nntp

You should get a 200 greeting. Type CAPABILITIES, then AUTHINFO USER name and AUTHINFO PASS password, then LIST ACTIVE, GROUP pb.local.chat, HEAD 1 and QUIT. Post a test message into a Local area from PBMessages and check it on the board. For an Echo area, run PBToss -scan and look for the message in the outbound packet.