<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://www.big-8.org/w/index.php?action=history&amp;feed=atom&amp;title=Usenet_administration_administration_FAQ</id>
	<title>Usenet administration administration FAQ - Revision history</title>
	<link rel="self" type="application/atom+xml" href="https://www.big-8.org/w/index.php?action=history&amp;feed=atom&amp;title=Usenet_administration_administration_FAQ"/>
	<link rel="alternate" type="text/html" href="https://www.big-8.org/w/index.php?title=Usenet_administration_administration_FAQ&amp;action=history"/>
	<updated>2026-06-06T17:30:57Z</updated>
	<subtitle>Revision history for this page on the wiki</subtitle>
	<generator>MediaWiki 1.43.1</generator>
	<entry>
		<id>https://www.big-8.org/w/index.php?title=Usenet_administration_administration_FAQ&amp;diff=2274&amp;oldid=prev</id>
		<title>Jason Evans: Created page with &quot;Last-modified: 2018-07-16 Posted-by: postfaq 1.17 (Perl 5.28.1) Archive-name: usenet/hierarchy-admin URL: https://www.eyrie.org/~eagle/faqs/usenet-hier.html Posting-frequency:...&quot;</title>
		<link rel="alternate" type="text/html" href="https://www.big-8.org/w/index.php?title=Usenet_administration_administration_FAQ&amp;diff=2274&amp;oldid=prev"/>
		<updated>2020-07-15T11:27:17Z</updated>

		<summary type="html">&lt;p&gt;Created page with &amp;quot;Last-modified: 2018-07-16 Posted-by: postfaq 1.17 (Perl 5.28.1) Archive-name: usenet/hierarchy-admin URL: https://www.eyrie.org/~eagle/faqs/usenet-hier.html Posting-frequency:...&amp;quot;&lt;/p&gt;
&lt;p&gt;&lt;b&gt;New page&lt;/b&gt;&lt;/p&gt;&lt;div&gt;Last-modified: 2018-07-16 Posted-by: postfaq 1.17 (Perl 5.28.1)&lt;br /&gt;
Archive-name: usenet/hierarchy-admin URL:&lt;br /&gt;
https://www.eyrie.org/~eagle/faqs/usenet-hier.html Posting-frequency:&lt;br /&gt;
monthly&lt;br /&gt;
&lt;br /&gt;
This FAQ attempts to provide help to Usenet hierarchy administrators, the&lt;br /&gt;
people who try to maintain the canonical lists of newsgroups in managed&lt;br /&gt;
hierarchies.  It is aimed at the hierarchy administrators rather than at&lt;br /&gt;
news admins and tries to summarize the issues to consider in making it&lt;br /&gt;
easy for news admins to carry the hierarchy.&lt;br /&gt;
&lt;br /&gt;
If you&amp;#039;re reading this on Usenet, this FAQ is formatted as a minimal&lt;br /&gt;
digest, so if your news or mail reader has digest handling capabilities&lt;br /&gt;
you can use them to navigate between sections.  In rn variants, you can&lt;br /&gt;
use Ctrl-G to skip to the next section; in Gnus, press Ctrl-D to break&lt;br /&gt;
each section into a separate article.&lt;br /&gt;
&lt;br /&gt;
Please send any comments, suggestions, or updates to eagle@eyrie.org.&lt;br /&gt;
Bear in mind when sending me e-mail that I receive upwards of 800 mail&lt;br /&gt;
messages a day and sometimes have a large backlog of personal e-mail.&lt;br /&gt;
&lt;br /&gt;
This FAQ is posted monthly to news.admin.hierarchies, and is available on&lt;br /&gt;
the web at &amp;lt;https://www.eyrie.org/~eagle/faqs/usenet-hier.html&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
------------------------------&lt;br /&gt;
&lt;br /&gt;
Subject: Contents&lt;br /&gt;
&lt;br /&gt;
1.  Introduction and Terms 2.  Basic Hierarchy Administration 3. &lt;br /&gt;
PGP-Signing Control Messages 4.  Maintaining Moderated Groups 5.  About&lt;br /&gt;
the ftp.isc.org Newsgroup Lists 6.  Other Resources&lt;br /&gt;
&lt;br /&gt;
------------------------------&lt;br /&gt;
&lt;br /&gt;
Subject: 1. Introduction and Terms&lt;br /&gt;
&lt;br /&gt;
This FAQ assumes a basic familiarity with Usenet (there are other&lt;br /&gt;
documents that explain the fundamentals better), but there are a few&lt;br /&gt;
additional concepts that are specifically important for Usenet hierarchy&lt;br /&gt;
administrators.&lt;br /&gt;
&lt;br /&gt;
A Usenet hierarchy is, reduced to its essence, a set of Usenet newsgroups&lt;br /&gt;
that share a common naming prefix, such as all groups starting with&lt;br /&gt;
&amp;quot;comp.&amp;quot; or all groups starting with &amp;quot;de.&amp;quot;.  The names of Usenet newsgroups&lt;br /&gt;
define a hierarchy of names, with &amp;quot;.&amp;quot; used as the separator between the&lt;br /&gt;
levels of the hierarchy, like host names.  Unlike host names, the most&lt;br /&gt;
significant part of the name is given first.  The first component of the&lt;br /&gt;
name is special and more significant than the rest of the name, since it&lt;br /&gt;
defines the top-level Usenet hierarchy to which that group belongs.&lt;br /&gt;
&lt;br /&gt;
Generally, every top-level hierarchy is completely independent of the&lt;br /&gt;
others (although there are a few exceptions where multiple hierarchies&lt;br /&gt;
share the same management procedures).  How the list of newsgroups in that&lt;br /&gt;
hierarchy should be maintained varies very widely between hierarchies,&lt;br /&gt;
from the complete anarchy of alt.* to the highly formal system used by&lt;br /&gt;
comp.*, or simply by fiat of the organization running the hierarchy as&lt;br /&gt;
with microsoft.*.  Which maintenance methods you should use for your&lt;br /&gt;
hierarchy is out of scope for this FAQ; this document is about how to&lt;br /&gt;
publish the results of those methods, assuming that you want to have a&lt;br /&gt;
single canonical list of newsgroups that everyone carrying that hierarchy&lt;br /&gt;
can agree on.  If you don&amp;#039;t want that (if your hierarchy is like alt.*,&lt;br /&gt;
for example), most of this document will not apply.&lt;br /&gt;
&lt;br /&gt;
Usenet newsgroups are created and removed via specially formatted messages&lt;br /&gt;
called control messages that tell news servers to do something.  A&lt;br /&gt;
hierarchy should have a hierarchy administrator who is responsible for&lt;br /&gt;
following whatever procedures were agreed on for changing the list of&lt;br /&gt;
groups in that hierarchy and then publishing the results using control&lt;br /&gt;
messages.  The structure of control messages is explained in the Usenet&lt;br /&gt;
news standards and in many FAQs and web pages, so it won&amp;#039;t be explained&lt;br /&gt;
here.  (Some sites don&amp;#039;t use control messages for various reasons, and&lt;br /&gt;
it&amp;#039;s therefore best to also publish the results via other methods, as will&lt;br /&gt;
be explained.)&lt;br /&gt;
&lt;br /&gt;
Besides newgroup (create a newsgroup) and rmgroup (remove a newsgroup)&lt;br /&gt;
control messages, there is also a control message called a checkgroups&lt;br /&gt;
which provides a complete list of newsgroups in a hierarchy complete with&lt;br /&gt;
short descriptions.  A &amp;quot;checkgroups&amp;quot; is therefore also used to mean a&lt;br /&gt;
complete list of newsgroups in a hierarchy.  The checkgroups format is a&lt;br /&gt;
list of groups, one per line, with the name of the group, a tab, and a&lt;br /&gt;
short description.  If the newsgroup is moderated, the description must&lt;br /&gt;
end in the literal text &amp;quot; (Moderated)&amp;quot;.  (Sadly, you can&amp;#039;t translate the&lt;br /&gt;
word to another language.  It&amp;#039;s an ugly wart on the protocol.)&lt;br /&gt;
&lt;br /&gt;
Originally, control messages were authenticated only by the (easily&lt;br /&gt;
forged) address of the sender of the message, which worked when Usenet was&lt;br /&gt;
small but broke down badly as it got larger.  As a result, most&lt;br /&gt;
hierarchies now sign their control messages using PGP, an open standard&lt;br /&gt;
for public key cryptography, allowing receiving sites to verify that the&lt;br /&gt;
control message was issued by the person it claims to be from.&lt;br /&gt;
&lt;br /&gt;
------------------------------&lt;br /&gt;
&lt;br /&gt;
Subject: 2. Basic Hierarchy Administration&lt;br /&gt;
&lt;br /&gt;
A hierarchy administrator has three separate audiences who should be kept&lt;br /&gt;
in mind when publishing information about a Usenet hierarchy:  users who&lt;br /&gt;
may be interested in reading or posting to the hierarchy, news&lt;br /&gt;
administrators who are not currently carrying the hierarchy on their&lt;br /&gt;
servers and want to, and news administrators who are already carrying the&lt;br /&gt;
hierarchy and want to keep current with changes to it.&lt;br /&gt;
&lt;br /&gt;
The most important audience is probably the users, but that&amp;#039;s also the&lt;br /&gt;
audience that&amp;#039;s the hardest to make general statements about, since how&lt;br /&gt;
you communicate with potential users varies quite a bit by hierarchy.  The&lt;br /&gt;
users will primarily be interested in a description of what the hierarchy&lt;br /&gt;
is for, a list of groups in the hierarchy, any hierarchy-wide policies,&lt;br /&gt;
the charters of the newsgroups, and the newsgroup creation procedure.&lt;br /&gt;
They&amp;#039;ll generally speak the same language as the hierarchy (since if they&lt;br /&gt;
don&amp;#039;t, they probably won&amp;#039;t be interested in reading it).&lt;br /&gt;
&lt;br /&gt;
News administrators who aren&amp;#039;t currently carrying the hierarchy likely&lt;br /&gt;
won&amp;#039;t be as interested in detail like particuliar policies or group&lt;br /&gt;
charters, but will also be interested in the overall purpose for the&lt;br /&gt;
hierarchy and any policies that specifically affect sites carrying the&lt;br /&gt;
groups.  They will specifically need the list of newsgroups in the&lt;br /&gt;
hierarchy in checkgroups format, however, and preferrably as a plain-text&lt;br /&gt;
file that they can download and feed into their news software.  They&amp;#039;ll&lt;br /&gt;
also need instructions for processing control messages to pick up changes&lt;br /&gt;
to the hierarchy, generally as an INN control.ctl fragment.  Finally, news&lt;br /&gt;
administrators may not speak the language of your hierarchy (they may be&lt;br /&gt;
running a news server for a large international ISP, for example), so you&lt;br /&gt;
may want to provide instructions specifically for news administrators in&lt;br /&gt;
English if the language of your hierarchy isn&amp;#039;t English.&lt;br /&gt;
&lt;br /&gt;
News administrators who are already carrying the hierarchy are mostly&lt;br /&gt;
interested in being notified of changes to it (usually via control&lt;br /&gt;
messages).  They also want ways of checking their group list against the&lt;br /&gt;
current one so that they can get back into sync if they&amp;#039;ve missed some&lt;br /&gt;
updates.&lt;br /&gt;
&lt;br /&gt;
So, given that, here are a few specific recommendations:&lt;br /&gt;
&lt;br /&gt;
 * Have a web site.  Try to make sure that the URL for your hierarchy web&lt;br /&gt;
   site is stable and doesn&amp;#039;t change, since the URL makes it into various&lt;br /&gt;
   FAQs and configuration files that live for years.  Put all of the&lt;br /&gt;
   hierarchy information on the web site, and make sure that the web site&lt;br /&gt;
   stays up to date.  &amp;lt;http://www.news-admin.org/&amp;gt; may be available as a&lt;br /&gt;
   hosting site for your web site.&lt;br /&gt;
&lt;br /&gt;
 * Every time you create a group, remove a group, rename a group (which&lt;br /&gt;
   can be done with a creation and removal), or change the moderation&lt;br /&gt;
   status of a group, send the appropriate control message.  By looking&lt;br /&gt;
   for it in &amp;lt;ftp://ftp.isc.org/pub/usenet/control/&amp;gt; under your hierarchy,&lt;br /&gt;
   you can check that the control message has propagated.  Control&lt;br /&gt;
   messages should have, in the Newsgroups header, the group being created&lt;br /&gt;
   or removed (even for newgroup messages; they&amp;#039;ll propagate correctly&lt;br /&gt;
   even though the group hasn&amp;#039;t been created yet because newgroup messages&lt;br /&gt;
   have special propagation rules).  The exception is checkgroups&lt;br /&gt;
   messages, which should normally be posted to the administrative group&lt;br /&gt;
   of your hierarchy and possibly crossposted to news.admin.hierarchies.&lt;br /&gt;
   Don&amp;#039;t put a Distribution header in your control messages unless you&lt;br /&gt;
   really intend to limit the availability of the groups to sites&lt;br /&gt;
   configured to accept that distribution (which mostly doesn&amp;#039;t work&lt;br /&gt;
   anyway).&lt;br /&gt;
&lt;br /&gt;
 * Send a checkgroups control message periodically.  If you do this, you&lt;br /&gt;
   don&amp;#039;t really need to send duplicate control messages for changes; if&lt;br /&gt;
   someone misses a change, they&amp;#039;ll catch it with the next checkgroups&lt;br /&gt;
   message.  In the checkgroups control message (and ideally in your other&lt;br /&gt;
   control messages as well), include an X-* header pointing to your&lt;br /&gt;
   hierarchy web site so that people can get more information about the&lt;br /&gt;
   hierarchy.  Do not put a Supersedes header on your checkgroups&lt;br /&gt;
   messages; some sites will filter out any message that contains both a&lt;br /&gt;
   Control header and a Supersedes header.&lt;br /&gt;
&lt;br /&gt;
 * Put the *current* checkgroups on your web site as a plain-text file&lt;br /&gt;
   (ending the file name with .txt will give this hint to most web&lt;br /&gt;
   servers) so that it can be easily downloaded by news administrators.&lt;br /&gt;
   Make sure that this file is kept current.  Having a separate pretty&lt;br /&gt;
   HTMLified list of groups is often useful for users, but please be sure&lt;br /&gt;
   to provide the plain text checkgroups message as well since the HTML&lt;br /&gt;
   version is nearly useless for news administrators trying to add your&lt;br /&gt;
   hierarchy.&lt;br /&gt;
&lt;br /&gt;
 * Write a guide for news administrators on how to carry the hierarchy,&lt;br /&gt;
   including an overall description.  Make sure that it clearly indicates&lt;br /&gt;
   where to find the checkgroups for the hierarchy.  Put this guide on&lt;br /&gt;
   your web site, and it doesn&amp;#039;t hurt to put a URL for it in the headers&lt;br /&gt;
   of your control messages as well.  If your hierarchy uses a language&lt;br /&gt;
   other than English, write this guide both in that language and in&lt;br /&gt;
   English, since English seems to be the de facto international language&lt;br /&gt;
   for news administration right now.  (At the least, try to use the&lt;br /&gt;
   literal word &amp;quot;checkgroups&amp;quot; on the web site on the top page for a link&lt;br /&gt;
   to the current checkgroups; that&amp;#039;s the main thing that people will be&lt;br /&gt;
   looking for, and that way news admins can find it even if they can&amp;#039;t&lt;br /&gt;
   read the rest of the site.)&lt;br /&gt;
&lt;br /&gt;
 * Write a control.ctl entry for your hierarchy and publish it on your web&lt;br /&gt;
   site in the section for news admins and in the guide.  For a hierarchy&lt;br /&gt;
   that doesn&amp;#039;t PGP-sign control messages, this will look like:&lt;br /&gt;
&lt;br /&gt;
       ## EXAMPLE (Example Hierarchy, Olympus Mons)&lt;br /&gt;
       # Contact: news@example.org # URL: http://www.usenet.example.org/&lt;br /&gt;
       checkgroups:news@example.com:example.*:doit&lt;br /&gt;
       newgroup:news@example.com:example.*:doit&lt;br /&gt;
       rmgroup:news@example.com:example.*:doit&lt;br /&gt;
&lt;br /&gt;
   The first line contains your hierarchy name in all caps and then in&lt;br /&gt;
   parens a description of your hierarchy, including the applicable&lt;br /&gt;
   location if the hierarchy is regional.  Then comes information about&lt;br /&gt;
   who to contact about the hierarchy and the URL for your web site.&lt;br /&gt;
   Finally, the uncommented lines specify the type of control message, the&lt;br /&gt;
   sender (which should match the From and Sender headers of your control&lt;br /&gt;
   message), the pattern matching the groups in your hierarchy, and the&lt;br /&gt;
   word &amp;quot;doit&amp;quot; saying to act on those control messages.&lt;br /&gt;
&lt;br /&gt;
   News administrators can then just cut and paste this entry into their&lt;br /&gt;
   news server configuration files and start honoring your control&lt;br /&gt;
   messages.  If you&amp;#039;re using PGP, see the section on that below.&lt;br /&gt;
&lt;br /&gt;
 * Use PGP to sign all your control messages.  This isn&amp;#039;t necessary for&lt;br /&gt;
   small hierarchies, but if there end up being any fights over your&lt;br /&gt;
   hierarchy or it draws hostile attention for some reason, people can&lt;br /&gt;
   easily cause a lot of confusion if your control messages aren&amp;#039;t signed.&lt;br /&gt;
   There&amp;#039;s more information later about this.&lt;br /&gt;
&lt;br /&gt;
 * Make sure the information on your web site stays up to date!  In&lt;br /&gt;
   particular, be *sure* that the checkgroups on the web site is accurate,&lt;br /&gt;
   since that&amp;#039;s the list most people will start with.  It&amp;#039;s also sometimes&lt;br /&gt;
   more convenient for someone to process a checkgroups from a web site&lt;br /&gt;
   than process a control message (one can use tools like actsync to do&lt;br /&gt;
   that, for example), so if it&amp;#039;s not accurate, a news administrator may&lt;br /&gt;
   undo all your control messages by getting information from the web site&lt;br /&gt;
   instead.&lt;br /&gt;
&lt;br /&gt;
 * Check &amp;lt;http://usenet.trigofacile.com/hierarchies/&amp;gt; for your hierarchy&lt;br /&gt;
   and make sure the information is accurate.  The information here is&lt;br /&gt;
   based on the information kept at &amp;lt;ftp://ftp.isc.org/pub/usenet/CONFIG/&amp;gt;&lt;br /&gt;
   and &amp;lt;ftp://ftp.isc.org/pub/usenet/control/&amp;gt; and provides a quick way to&lt;br /&gt;
   check on recent changes to your hierarchy and ensure that nothing is&lt;br /&gt;
   out of date.&lt;br /&gt;
&lt;br /&gt;
Some hierarchies also have a publically available news server that carries&lt;br /&gt;
that hierarchy (this is particularly common for hierarchies intended for&lt;br /&gt;
support of the products of a particular company).  If you do, make sure to&lt;br /&gt;
point both users and news administrators at it.  Users can use that server&lt;br /&gt;
if their local server doesn&amp;#039;t carry your hierarchy, and news&lt;br /&gt;
administrators can use that server to get an up-to-date list of newsgroups&lt;br /&gt;
in the hierarchy using tools like actsync.  If you do have such a server,&lt;br /&gt;
add the line:&lt;br /&gt;
&lt;br /&gt;
    # Syncable server: news.example.org&lt;br /&gt;
&lt;br /&gt;
pointing to that server to your control.ctl entry.&lt;br /&gt;
&lt;br /&gt;
Be careful about running open servers like this, as they have frequently&lt;br /&gt;
been abused to damage the rest of Usenet.  At the least, it&amp;#039;s best to not&lt;br /&gt;
allow users to crosspost to groups not carried by the server or add&lt;br /&gt;
Supersedes or Control headers, and ideally you should have some sort of&lt;br /&gt;
spam filtering or posting rate limits in place.&lt;br /&gt;
&lt;br /&gt;
------------------------------&lt;br /&gt;
&lt;br /&gt;
Subject: 3. PGP-Signing Control Messages&lt;br /&gt;
&lt;br /&gt;
Most hierarchies now PGP-sign all control messages.  The PGP signature is&lt;br /&gt;
visible in the X-PGP-Sig header of the control message.  Background&lt;br /&gt;
information and (now somewhat outdated) instructions are at:&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;ftp://ftp.isc.org/pub/pgpcontrol/README.html&amp;gt;&lt;br /&gt;
&lt;br /&gt;
and the exact format of the signature is at:&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;ftp://ftp.isc.org/pub/pgpcontrol/FORMAT&amp;gt;&lt;br /&gt;
&lt;br /&gt;
You don&amp;#039;t need to understand the information in the last link, though, at&lt;br /&gt;
least if you&amp;#039;re using Unix and can use the existing tools for generating&lt;br /&gt;
signed control messages.&lt;br /&gt;
&lt;br /&gt;
In order to sign control messages, you&amp;#039;ll need three things:  A PGP key&lt;br /&gt;
pair that you&amp;#039;ll use for signing and verifying the messages, a PGP&lt;br /&gt;
implementation you can use, and some software to generate the right type&lt;br /&gt;
of signatures for Usenet control messages.&lt;br /&gt;
&lt;br /&gt;
If you&amp;#039;re not already familiar with public key cryptography, here&amp;#039;s a&lt;br /&gt;
brief primer:  A PGP key pair consists of two keys, a public one and a&lt;br /&gt;
private one.  You sign messages with the private key, which you have to&lt;br /&gt;
keep secret and protect since anyone with possession of it can pretend to&lt;br /&gt;
be the hierarchy administrator.  You give out the public key to anyone and&lt;br /&gt;
everyone, and anyone with the public key can check a signature and verify&lt;br /&gt;
that it was signed by the private key (without being able to sign messages&lt;br /&gt;
themselves).&lt;br /&gt;
&lt;br /&gt;
Most Usenet news sites that honor control messages are set up to verify&lt;br /&gt;
messages signed with an algorithm called RSA, which was the algorithm used&lt;br /&gt;
by the original PGP implementation.  Unfortunately, this is now fairly&lt;br /&gt;
obsolete.  Current PGP implementations use a newer, more secure algorithm&lt;br /&gt;
for generating signatures (although the additional security is probably&lt;br /&gt;
overkill for Usenet control messages, at least for right now).  While this&lt;br /&gt;
doesn&amp;#039;t pose a problem for signing messages (current PGP implementations&lt;br /&gt;
can still use old RSA keys to sign things), it does cause problems if&lt;br /&gt;
you&amp;#039;re starting fresh, since the keys generated by current implementations&lt;br /&gt;
will not work with old versions of PGP.&lt;br /&gt;
&lt;br /&gt;
What all this means is that you have a few hard choices when it comes to&lt;br /&gt;
choosing a PGP implementation and generating your initial key pair.  You&lt;br /&gt;
can use GnuPG &amp;lt;http://www.gnupg.org/&amp;gt;, which is probably the best&lt;br /&gt;
available PGP implementation, and not bother with a RSA key at all.  This&lt;br /&gt;
will mean, unfortunately, that only sites that are also using GnuPG or&lt;br /&gt;
another current PGP implementation will be able to verify your control&lt;br /&gt;
messages.  Or you can go to &amp;lt;http://www.pgpi.org/&amp;gt;, download an older&lt;br /&gt;
version of PGP (something of the 2.6 vintage), and use it to sign your&lt;br /&gt;
control messages, which will work with all versions of PGP but may be more&lt;br /&gt;
of a pain.  (You can also use an old version of PGP only to generate the&lt;br /&gt;
initial key, and then import it into GnuPG and use GnuPG to sign control&lt;br /&gt;
messages, but this is complex and not recommended for people who have&lt;br /&gt;
never touched PGP before.  There are some instructions on the GnuPG web&lt;br /&gt;
site, though.)&lt;br /&gt;
&lt;br /&gt;
Whatever choice you make, follow the documentation of your PGP&lt;br /&gt;
implementation to generate a key pair.  Pay careful attention to the user&lt;br /&gt;
ID that you put on your key.  In order to work with Usenet, that user ID&lt;br /&gt;
must not contain any spaces.  The two most common key IDs used for signing&lt;br /&gt;
Usenet control messages are the name of the administrative group in the&lt;br /&gt;
hierarchy (like example.config) or the sender of the control message (like&lt;br /&gt;
news@example.org).  The latter is better practice and is recommended for&lt;br /&gt;
new hierarchies, although make sure that e-mail address is stable and is&lt;br /&gt;
one that you will be able to use for decades to come.&lt;br /&gt;
&lt;br /&gt;
If you&amp;#039;re using GnuPG, in order to not get any spaces into the user ID,&lt;br /&gt;
you need to use gpg --gen-key --allow-freeform-uid, enter the desired user&lt;br /&gt;
ID as the name, and then press Enter when asked for an e-mail address or&lt;br /&gt;
comment.  The recommended user ID is the e-mail address of the sender, but&lt;br /&gt;
it has to be entered as the name or GnuPG will not generate the right user&lt;br /&gt;
ID.  A later version of pgpverify will hopefully make this unnecessary,&lt;br /&gt;
but older versions will be around for quite some time.&lt;br /&gt;
&lt;br /&gt;
Resist the temptation to put any additional user IDs on your key.  Your&lt;br /&gt;
key should only have one user ID, the one that will be used in control.ctl&lt;br /&gt;
entries.  If it has any additional user IDs, this can confuse the&lt;br /&gt;
pgpverify process with some PGP implementations and cause your control&lt;br /&gt;
messages to be ignored.&lt;br /&gt;
&lt;br /&gt;
If you&amp;#039;re using a modern PGP implementation, it will automatically sign&lt;br /&gt;
the public key (this is called a self-signature).  If you&amp;#039;re using an&lt;br /&gt;
older PGP implementation, make sure that you do this, following the&lt;br /&gt;
instructions for your software.  Keys that aren&amp;#039;t self-signed can be&lt;br /&gt;
tampered with in various ways, and modern PGP implementations will refuse&lt;br /&gt;
to import or honor them.&lt;br /&gt;
&lt;br /&gt;
Now, you&amp;#039;re ready to create and sign a control message.  I&amp;#039;m aware of&lt;br /&gt;
several major implementations of the glue software to do the signing:&lt;br /&gt;
&lt;br /&gt;
signcontrol &amp;lt;ftp://ftp.isc.org/pub/pgpcontrol/&amp;gt;&lt;br /&gt;
    This is the original implementation by David Lawrence of the signed&lt;br /&gt;
    control message protocol.  The signcontrol script is a Perl script&lt;br /&gt;
    that works with pgp.  It will require some editing to set information&lt;br /&gt;
    about your hierarchy.  There is also a shell implementation in the&lt;br /&gt;
    same directory.&lt;br /&gt;
&lt;br /&gt;
signcontrol&lt;br /&gt;
&amp;lt;http://www.trigofacile.com/divers/usenet/clefs/signcontrol.htm&amp;gt;&lt;br /&gt;
    A different implementation in Python that may be somewhat easier to&lt;br /&gt;
    use.  It similarly will require some editing to add information for&lt;br /&gt;
    your particular hierarchy and requires that GnuPG be available.&lt;br /&gt;
&lt;br /&gt;
News::Article &amp;lt;http://search.cpan.org/~agierth/&amp;gt;&lt;br /&gt;
    A Perl module, and therefore mostly useful if you&amp;#039;re writing your own&lt;br /&gt;
    software for your hierarchy in Perl.  It makes fewer checks than&lt;br /&gt;
    signcontrol and in general does less (just the signing) which can be&lt;br /&gt;
    more convenient.  It requires the PGP::Sign module from CPAN; see your&lt;br /&gt;
    Perl documentation for how to install it.&lt;br /&gt;
&lt;br /&gt;
cmsg-tools &amp;lt;http://www.linux.it/~md/software/cmsg-tools.tgz&amp;gt;&lt;br /&gt;
    A Perl script which uses News::Article and GnuPG (but not PGP::Sign)&lt;br /&gt;
    to automatically generate control messages.  It can be used to manage&lt;br /&gt;
    multiple hierarchies.&lt;br /&gt;
&lt;br /&gt;
Pointers to additional implementations, particularly instructions for&lt;br /&gt;
Windows users, are very welcome.&lt;br /&gt;
&lt;br /&gt;
Once you have a signed control message, verify it to make sure that it&lt;br /&gt;
verifies properly.  You can do that with the pgpverify program that comes&lt;br /&gt;
with INN or is available in the same directory as signcontrol above.&lt;br /&gt;
&lt;br /&gt;
If you got all of that working, you should put the PGP public key into&lt;br /&gt;
your guide for news administrators.  To see examples of PGP public keys&lt;br /&gt;
for various hierarchies, see:&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;ftp://ftp.isc.org/pub/pgpcontrol/PGPKEYS&amp;gt;&lt;br /&gt;
&lt;br /&gt;
You should also make the public key available for download on your web&lt;br /&gt;
site, preferrably as a plain text file (ending the file name in .txt will&lt;br /&gt;
give this hint to most web servers) that can be easily downloaded.  It&amp;#039;s&lt;br /&gt;
best to also submit it to the keyservers (see &amp;lt;http://pgp.mit.edu/&amp;gt;).&lt;br /&gt;
Also change your control.ctl entry that you have on your web site to look&lt;br /&gt;
like:&lt;br /&gt;
&lt;br /&gt;
    ## EXAMPLE (Example Hierarchy, Olympus Mons)&lt;br /&gt;
    # Contact: news@example.org # URL: http://www.usenet.example.org/&lt;br /&gt;
    # Key URL: http://www.usenet.example.org/pgpkey.txt # Key fingerprint&lt;br /&gt;
    = G7 11 96 E8 34 32 7E 78  01 0D 69 99 A3 8F 34 B8 # *PGP*   See&lt;br /&gt;
    comment at top of file.&lt;br /&gt;
    checkgroups:news@example.com:example.*:verify-news@example.org&lt;br /&gt;
    newgroup:news@example.com:example.*:verify-news@example.org&lt;br /&gt;
    rmgroup:news@example.com:example.*:verify-news@example.org&lt;br /&gt;
&lt;br /&gt;
The key URL field is the URL of the plain-text PGP public key available&lt;br /&gt;
from your web site.  The fingerprint is the output of gpg --fingerprint or&lt;br /&gt;
pgp -kvc (depending on what version of PGP that you&amp;#039;re using) and is used&lt;br /&gt;
as a check to be sure that the key downloaded is the right one.  The *PGP*&lt;br /&gt;
comment makes sense in the context of the standard control.ctl file, which&lt;br /&gt;
has information about PGP-signed control messages at the top.  And note&lt;br /&gt;
that the &amp;quot;doit&amp;quot; string to act on the control messages has been replaced by&lt;br /&gt;
&amp;quot;verify-&amp;quot; followed by the user ID of your PGP key (whatever that may be).&lt;br /&gt;
&lt;br /&gt;
Now, just use your new signing procedure whenever you send a control&lt;br /&gt;
message for your hierarchy.  Oh, and if you&amp;#039;re changing to signing control&lt;br /&gt;
messages from not signing them, be sure to announce that in&lt;br /&gt;
news.admin.hierarchies.&lt;br /&gt;
&lt;br /&gt;
------------------------------&lt;br /&gt;
&lt;br /&gt;
Subject: 4. Maintaining Moderated Groups&lt;br /&gt;
&lt;br /&gt;
If there are moderated newsgroups in your hierarchy, this involves a bit&lt;br /&gt;
of additional hassle over unmoderated groups.  Rather than just checking&lt;br /&gt;
whether the newsgroup is there are not, news administrators also have to&lt;br /&gt;
make sure that the moderation status is set correctly so that users can&lt;br /&gt;
post, and news servers need to know to which e-mail address to send posts&lt;br /&gt;
so that they&amp;#039;ll reach the moderator.&lt;br /&gt;
&lt;br /&gt;
When managing moderated groups, be sure to always include the correct&lt;br /&gt;
moderation flag in your newgroup control messages, and make sure that your&lt;br /&gt;
checkgroups lines for moderated groups end in &amp;quot; (Moderated)&amp;quot;.  (Yes,&lt;br /&gt;
literally.  It can&amp;#039;t be translated; news software actually looks for&lt;br /&gt;
this.)  It&amp;#039;s sometimes useful to send a few duplicate control messages if&lt;br /&gt;
you ever convert an unmoderated group to a moderated group or vice versa,&lt;br /&gt;
since it&amp;#039;s harder to get this change to take than a simple newsgroup&lt;br /&gt;
creation.  Expect to have a few frustrated users who&amp;#039;s news providers just&lt;br /&gt;
cannot get this right.  You may want to put together a form message to&lt;br /&gt;
send to those providers explaining who you are and that they have groups&lt;br /&gt;
in your hierarchy configured incorrectly.&lt;br /&gt;
&lt;br /&gt;
Finally, you have to deal with getting the posts to the moderator.  There&lt;br /&gt;
are two main ways of handling this, which can be combined.  One is to keep&lt;br /&gt;
the central moderators.isc.org relay systems up to date, and the other is&lt;br /&gt;
to set up your own relay system that accepts mail addressed to the&lt;br /&gt;
newsgroup name with all periods replaced by hyphens @ some system you&lt;br /&gt;
control and then forwards that mail along to the real moderator.&lt;br /&gt;
&lt;br /&gt;
Nearly all news servers that try to handle moderated groups default to&lt;br /&gt;
forwarding any message posted to a moderated group to the name of the&lt;br /&gt;
group with periods replaced by hyphens @moderators.isc.org.  The relay&lt;br /&gt;
systems behind that DNS record then forward those messages along to the&lt;br /&gt;
real moderator.  To have one of those addresses created or to change where&lt;br /&gt;
it forwards to, mail moderators-request@isc.org.  These changes have to be&lt;br /&gt;
made manually and there&amp;#039;s often a backlog; to save time, please identify&lt;br /&gt;
yourself as the hierarchy administrator for the hierarchy and preferrably&lt;br /&gt;
send the mail from your hierarchy contact address (and you may also want&lt;br /&gt;
to PGP-sign the message if you can do that easily).  Even still, be&lt;br /&gt;
prepared for this to sometimes take a while.&lt;br /&gt;
&lt;br /&gt;
It&amp;#039;s possible to configure news servers to forward mail somewhere other&lt;br /&gt;
than to moderators.isc.org, and easiest to do that as wildcard entries for&lt;br /&gt;
hierarchies that forward all posts to moderated groups in that hierarchy&lt;br /&gt;
to a particular host instead of moderators.isc.org (again with the period&lt;br /&gt;
to hyphen change).  Some hierarchies do this instead so that they don&amp;#039;t&lt;br /&gt;
have to wait for moderators.isc.org changes, but it makes things harder&lt;br /&gt;
for news administrators who have to keep track of those special cases.  If&lt;br /&gt;
you do do this, you have to tell all news administrators to add a line&lt;br /&gt;
like:&lt;br /&gt;
&lt;br /&gt;
    example.*:%s@example.org&lt;br /&gt;
&lt;br /&gt;
to their moderators file, where the first part is the pattern that matches&lt;br /&gt;
groups in your hierarchy and the second part is the e-mail address to send&lt;br /&gt;
postings to (%s will be replaced by the group name with periods changed to&lt;br /&gt;
hyphens).  If that forwarding host ever goes away, or if you ever have to&lt;br /&gt;
change this, it will be a major hassle and it will take a very long time&lt;br /&gt;
to catch all the stragglers.&lt;br /&gt;
&lt;br /&gt;
What many hierarchy administrators do is combine these two approaches.&lt;br /&gt;
They set up their own forwarding system that they have direct control&lt;br /&gt;
over, so that they can change the moderators for an existing group without&lt;br /&gt;
having to contact moderators-request@isc.org, and they ask the&lt;br /&gt;
moderators.isc.org sites to just forward to the appropriate address at&lt;br /&gt;
that host.  Then, the only things they have to let moderators-request know&lt;br /&gt;
about are new moderated groups or removal of moderated groups.  This does&lt;br /&gt;
mean that posts to moderated groups go through two hops before reaching&lt;br /&gt;
the moderator instead of just one, though, which can make problems&lt;br /&gt;
slightly more difficult to diagnose.&lt;br /&gt;
&lt;br /&gt;
Unfortunately, due to the way that they&amp;#039;re distributed and used, the alias&lt;br /&gt;
lists for moderators.isc.org cannot contain wildcard entries, so you&lt;br /&gt;
cannot ask them to just forward all posts to any moderated example.* group&lt;br /&gt;
to example.org.  Each group still has to be configured separately and each&lt;br /&gt;
new moderated group still has to be sent to moderators-request@isc.org for&lt;br /&gt;
manual processing.  Hopefully in the future there will be some more easily&lt;br /&gt;
automated system for handling this.&lt;br /&gt;
&lt;br /&gt;
------------------------------&lt;br /&gt;
&lt;br /&gt;
Subject: 5. About the ftp.isc.org Newsgroup Lists&lt;br /&gt;
&lt;br /&gt;
Maintained at:&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;ftp://ftp.isc.org/pub/usenet/CONFIG/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
is a copy of a control.ctl file with as many public hierarchies as&lt;br /&gt;
possible with active maintainers listed in it, along with lists of&lt;br /&gt;
newsgroups in active file and checkgroups format maintained by processing&lt;br /&gt;
control messages using those control.ctl rules.  Also maintained from the&lt;br /&gt;
same information is a collection of hierarchy public keys for news&lt;br /&gt;
administrators to get from one source, in:&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;ftp://ftp.isc.org/pub/pgpcontrol/PGPKEYS&amp;gt;&lt;br /&gt;
&lt;br /&gt;
A unified view of this information, including logs of recent changes, is&lt;br /&gt;
at:&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;http://usenet.trigofacile.com/hierarchies/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
These can be valuable resources for you as a hierarchy administrator in a&lt;br /&gt;
couple of different ways.&lt;br /&gt;
&lt;br /&gt;
First, some users and some news sites use these lists of newsgroups to&lt;br /&gt;
determine what newsgroups to carry, either using the list verbatim,&lt;br /&gt;
checking the list to see if a newsgroup is listed before being willing to&lt;br /&gt;
add it, or synchronizing particular hierarchies against that list.  Having&lt;br /&gt;
your hierarchy there may therefore increase the number of sites that carry&lt;br /&gt;
your hierarchy and may make it easier for interested users to get the&lt;br /&gt;
groups added at their local site.&lt;br /&gt;
&lt;br /&gt;
Second, particularly if you&amp;#039;re using PGP-signed control messages, this&lt;br /&gt;
list can serve as a check that your control messages are working properly.&lt;br /&gt;
The list updates once an hour, so if you send a control message and in a&lt;br /&gt;
few hours the result isn&amp;#039;t reflected in the ftp.isc.org lists, something&lt;br /&gt;
may have gone wrong (maybe you forgot an Approved header, or the PGP&lt;br /&gt;
signature wasn&amp;#039;t valid for some reason).&lt;br /&gt;
&lt;br /&gt;
Finally, many news administrators, even if they don&amp;#039;t use the newsgroup&lt;br /&gt;
lists, use the control.ctl file and PGPKEYS file to configure their own&lt;br /&gt;
news servers.  This control.ctl file is also included in INN releases.&lt;br /&gt;
&lt;br /&gt;
To get your hierarchy listed in these files, send mail to&lt;br /&gt;
usenet-config@isc.org.  Please include your control.ctl entry, as&lt;br /&gt;
described above, along with your PGP public key or a URL from which it can&lt;br /&gt;
be obtained (preferrably the latter).  Also provide a pointer to a current&lt;br /&gt;
list of newsgroups in checkgroups format so that they can be added to the&lt;br /&gt;
list at the same time.  usenet-config@isc.org sometimes has a bit of a&lt;br /&gt;
backlog, so please allow a couple of weeks for a response.&lt;br /&gt;
&lt;br /&gt;
------------------------------&lt;br /&gt;
&lt;br /&gt;
Subject: 6. Other Resources&lt;br /&gt;
&lt;br /&gt;
Here are some other resources to be aware of if you&amp;#039;re maintaining a&lt;br /&gt;
hierarchy:&lt;br /&gt;
&lt;br /&gt;
news.admin.hierarchies&lt;br /&gt;
    Most discussion of new hierarchies and of hierarchy administration in&lt;br /&gt;
    general takes place here.  There isn&amp;#039;t a lot of discussion normally,&lt;br /&gt;
    just hierarchy FAQs, but a lot of people read the group and can&lt;br /&gt;
    provide help and suggestions if you post.&lt;br /&gt;
&lt;br /&gt;
news.software.nntp&lt;br /&gt;
    The technical discussion group for news software and the news&lt;br /&gt;
    protocols, the readers of this group may be able to help if you have&lt;br /&gt;
    questions about news server configuration or about the details of the&lt;br /&gt;
    PGP signature system for control messages.&lt;br /&gt;
&lt;br /&gt;
Control message archive &amp;lt;ftp://ftp.isc.org/pub/usenet/control/&amp;gt;&lt;br /&gt;
    An archive of all newgroup and rmgroup control messages, used by some&lt;br /&gt;
    sites to check to see whether a requested group had a valid control&lt;br /&gt;
    message and useful as a check to be sure that your control messages&lt;br /&gt;
    are getting out.&lt;br /&gt;
&lt;br /&gt;
Newsgroup list archive &amp;lt;ftp://ftp.isc.org/pub/usenet/CONFIG/&amp;gt;&lt;br /&gt;
    A collected control.ctl file (which is also included in INN) and lists&lt;br /&gt;
    of newsgroups maintained by those rules.  Also includes a file&lt;br /&gt;
    describing the checkgroups format, providing some guidelines for&lt;br /&gt;
    newsgroup naming, and describing how to write newsgroup descriptions.&lt;br /&gt;
&lt;br /&gt;
Usenet hierarchy information &amp;lt;http://usenet.trigofacile.com/hierarchies/&amp;gt;&lt;br /&gt;
    A merged view of the information maintained at ftp.isc.org and the&lt;br /&gt;
    easiest way to view the information together and check it for&lt;br /&gt;
    accuracy.&lt;br /&gt;
&lt;br /&gt;
pgpcontrol &amp;lt;ftp://ftp.isc.org/pub/pgpcontrol/&amp;gt;&lt;br /&gt;
    Mentioned many times above, this is the central site for the reference&lt;br /&gt;
    implementations of the PGP control message signing protocol.  It also&lt;br /&gt;
    has a list of public keys of hierarchy administrators and information&lt;br /&gt;
    about how to enable PGP verification of control messages.&lt;br /&gt;
&lt;br /&gt;
news-admin.org &amp;lt;http://www.news-admin.org/&amp;gt;&lt;br /&gt;
    A hosting service for hierarchy administrators and Usenet hierarchies&lt;br /&gt;
    that you may want to consider using, as well as a good collection of&lt;br /&gt;
    examples of web sites for various hierarchies.&lt;/div&gt;</summary>
		<author><name>Jason Evans</name></author>
	</entry>
</feed>