Retro Guy wrote:

> Next, importing a key from a newsgroup message post '@@RSL MAILKEY notice' can easily be done automatically. I'm at the point in the code to write that right now, but do I want to?

Automatic key retrieval is done and is working.

Below you can see the log. If we already have the key, and the signature
matches, we're ok. It shows: "GOOD signature..."

If we do not have the key or it's bad, we try to retrieve it.

Once retrieved, we verify the domain against the info in the MAILKEY post
to make certain it is a match. If it does NOT match, we immediately delete
the new key.

Below you can see a new key being retrieved, then in the lines below it,
the next messages show as 'GOOD signature' because we now have the key.

This is all done by rslight, no admin intervention:

GOOD signature in: "bbsmail-MAILKEY notice 1248ecc9d507f77d"
BAD or UNKNOWN signature in: "bbsmail-MAILKEY notice 6b5e915a7cef7e75"
Let's try to get the key
Domain: rocksolidbbs.com
Location: rocksolidbbs.com/pubkey/server_pubkey.txt
IMPORTED: EF45763C5701CD5A776F2A4733A8072D8E9B9D1C
Domain Match: rocksolidbbs.com
GOOD signature in: "bbsmail-MAILKEY notice 6b5e915a7cef7e75a"
GOOD signature in: "bbsmail-MAILKEY notice 6c817a6367adcb52"

--
Retro Guy

> GOOD signature in: "bbsmail-MAILKEY notice 1248ecc9d507f77d"
> BAD or UNKNOWN signature in: "bbsmail-MAILKEY notice 6b5e915a7cef7e75"
> Let's try to get the key
> Domain: rocksolidbbs.com
> Location: rocksolidbbs.com/pubkey/server_pubkey.txt
> IMPORTED: EF45763C5701CD5A776F2A4733A8072D8E9B9D1C
> Domain Match: rocksolidbbs.com
> GOOD signature in: "bbsmail-MAILKEY notice 6b5e915a7cef7e75a"
> GOOD signature in: "bbsmail-MAILKEY notice 6c817a6367adcb52"

VERY cool. I'm starting to understand the process a little better now.

--
Posted on Rocksolid Light

Admin notifications are now working:

Subject: New PGP Key added for: rocksolidbbs.com
From: retro guy
To: retro guy
Date: Sun, 30 Jul 2023 15:25

Domain: rocksolidbbs.com
Fingerprint: EF45763C5701CD5A776F2A4733A8072D8E9B9D1C
Reply

My Messages:
Subject From To Date
New PGP Key added for: rocksolidbbs.com retro guy retro guy Sun, 30 Jul 2023 15:25

Notices like this will be mailed to the local 'admin' user. To have 'admin' alias to another username, add to $config_dir/aliases.conf (or however you're doing it in tomo :)

--
Retro Guy

Retro Guy wrote:

> Admin notifications are now working:
> My Messages:
> Subject From To Date
> New PGP Key added for: rocksolidbbs.com retro guy retro guy Sun, 30 Jul 2023 15:25

> Notices like this will be mailed to the local 'admin' user. To have 'admin' alias to another username, add to $config_dir/aliases.conf (or however you're doing it in tomo :)

Looking fantastic. What's left on the todo list for encrypted messaging?

--
Posted on Rocksolid Light

vga256 wrote:

> Retro Guy wrote:

>> Admin notifications are now working:
>> My Messages:
>> Subject From To Date
>> New PGP Key added for: rocksolidbbs.com retro guy retro guy Sun, 30 Jul 2023 15:25

>> Notices like this will be mailed to the local 'admin' user. To have 'admin' alias to another username, add to $config_dir/aliases.conf (or however you're doing it in tomo :)

> Looking fantastic. What's left on the todo list for encrypted messaging?

Right now I'm working on the function to write incoming mail (from encrypted post) to the local user. We'll deal with notifications of "no such user" or whatever later, just getting it working now.

Sending just needs a simple function to drop it into an 'outbox' (like regular posting). The function to encrypt/sign it is already done.

So, not a whole lot left, but still not complete. Once all features are done, then lots of testing. Then nice things like error notifications to users, etc. can be done.

--
Retro Guy

Retro Guy wrote:

> So, not a whole lot left, but still not complete. Once all features are done, then lots of testing. Then nice things like error notifications to users, etc. can be done.

Awesome!! That's coming along surprisingly fast.

Today I finally solved the visual threading problem with nothing but a whole lot of guess'n'test.

https://tomo.dialup.cafe/tomonet/article-flat.php?id=36&group=tomonet.abcd#36

This is a very different look than RSL, but this should give you a sense for where I'm going with the front end design. I'll be adding some light JS to allow people to show/hide the threads in an accordion fashion by clicking on the minus button to the left of the thread.

--
Posted on Rocksolid Light

vga256 wrote:

> Retro Guy wrote:

>> So, not a whole lot left, but still not complete. Once all features are done, then lots of testing. Then nice things like error notifications to users, etc. can be done.

> Awesome!! That's coming along surprisingly fast.

> Today I finally solved the visual threading problem with nothing but a whole lot of guess'n'test.

> https://tomo.dialup.cafe/tomonet/article-flat.php?id=36&group=tomonet.abcd#36

> This is a very different look than RSL, but this should give you a sense for where I'm going with the front end design. I'll be adding some light JS to allow people to show/hide the threads in an accordion fashion by clicking on the minus button to the left of the thread.

I like it! I have thought about doing this in the past, but was concerned with how much JS I might need to use. None is my preference, but as you can see in the code, I do use a small bit, but the site should run "almost" the same with JS disabled.

How will tomo perform in thread or article display if JS is disabled in the client?

I did work out how to handle the "View all headers" drop down in CSS, no JS, but I don't think it would work well for threading as it overwrites what is below it instead of pushing it down. But since CSS handles the Headers feature, I wonder if CSS could do it properly for threading. I have no idea, but throwing the thought out there.

I'm really looking forword to both of us getting to our next stable points, then I would like to pick and choose some features from tomo (steal them, lol :)

--
Retro Guy

vga256 wrote:

> Retro Guy wrote:

>> So, not a whole lot left, but still not complete. Once all features are done, then lots of testing. Then nice things like error notifications to users, etc. can be done.

> Awesome!! That's coming along surprisingly fast.

> Today I finally solved the visual threading problem with nothing but a whole lot of guess'n'test.

guess'n'test! That's how I roll also.

> https://tomo.dialup.cafe/tomonet/article-flat.php?id=36&group=tomonet.abcd#36

> This is a very different look than RSL, but this should give you a sense for where I'm going with the front end design. I'll be adding some light JS to allow people to show/hide the threads in an accordion fashion by clicking on the minus button to the left of the thread.

I like it! I have thought about doing this in the past, but was concerned with how much JS I might need to use. None is my preference, but as you can see in the code, I do use a small bit, but the site should run "almost" the same with JS disabled.

How will tomo perform in thread or article display if JS is disabled in the client?

I did work out how to handle the "View all headers" drop down in CSS, no JS, but I don't think it would work well for threading as it overwrites what is below it instead of pushing it down. But since CSS handles the Headers feature, I wonder if CSS could do it properly for threading. I have no idea, but throwing the thought out there.

I'm really looking forword to both of us getting to our next stable points, then I would like to pick and choose some features from tomo (steal them, lol :)

--
Retro Guy

Retro Guy wrote:

> I like it! I have thought about doing this in the past, but was concerned with how much JS I might need to use. None is my preference, but as you can see in the code, I do use a small bit, but the site should run "almost" the same with JS disabled.

yup I am a devout JS hater. :D so what i've done is maintained the non-JS/non-threaded branches of the page rendering code, and added a toggle so that the user can switch between traditional RSL style, and the nntp-forum style front end.

> How will tomo perform in thread or article display if JS is disabled in the client?

Thankfully, it fails over gracefully. Non-js users just won't be able to click on the expand/contract thread button - the threads still display nicely.

> I did work out how to handle the "View all headers" drop down in CSS, no JS, but I don't think it would work well for threading as it overwrites what is below it instead of pushing it down. But since CSS handles the Headers feature, I wonder if CSS could do it properly for threading. I have no idea, but throwing the thought out there.

Headers are something I'm jusssst trying to re-integrate. I noticed how JS-light you were in the scripts, and I'm trying to keep things that way.

My threading approach is a mix of CSS and JS - all stolen from nntp-forum. The CSS handles all of the visual display, and the JS just lets you hide/show the thread branches interactively.

> I'm really looking forword to both of us getting to our next stable points, then I would like to pick and choose some features from tomo (steal them, lol :)

same here. I'm getting closer every day with core functions. I still have a bunch of pages that need proper permissions & roles controls, but i'm getting there. Steal away! i've really tried to keep things RSL-compatible where possible, so hopefully merging in certain features won't be too onerus.

--
Posted on Rocksolid Light

*laugh* i just realized the new soft red theme wasn't visible at all, unless you were logged in as the sysop, because it wasn't the default theme.

i've now set it to be the default theme in tomo, and it should be visible without needing to login

--
Posted on Rocksolid Light

vga256 wrote:

> *laugh* i just realized the new soft red theme wasn't visible at all, unless you were logged in as the sysop, because it wasn't the default theme.

> i've now set it to be the default theme in tomo, and it should be visible without needing to login

The red looks nice!

Right now RSL only provides the default theme when not logged in. Once logged in, any user should be able to select a new theme. Does tomo still work that way? Not just sysop?

I have planned to add a drop down to change themes for non-logged in users, but have not done so yet obviously.

Are you using a symlink for the Default Theme?

--
Retro Guy

Yeah, tomo still works the same way as RSL with themes. I just forgot to change the default theme (via symlink) because I've been the only person testing it. :)

--
Posted on Rocksolid Light

vga256 wrote:

> Retro Guy wrote:

>> So, not a whole lot left, but still not complete. Once all features are done, then lots of testing. Then nice things like error notifications to users, etc. can be done.

> Awesome!! That's coming along surprisingly fast.

Ok, now automatically importing mail from a newsgroup message is working fine. So far I have not touched mail.php, but will need to for the last phase.

I'm trying to put in reduntant verification of domains (that mail really came from where it says it came from), and so far so good, but it will need some brute force testing once complete. Meaning, I need to try to spoof it.

What is complete right now:

Automatically generate your own pgp key for the server, and make it available by http link.

Automatically advertise your pgp key by newsgroup on a regular basis (default 30 days).

Automatically read incoming pgp key and MAIL newsgroup posts and decrypt and decipher them. Including verifying signatures. Also, domain is verified between the signature and post.

Automatically try to retrieve keys we do not have either from pgp key posts or MAIL posts (via http). So mail could be recieved even if you do not have the key, you may be able to solve that right then, without needing a pgp key post.

Automatically import MAIL messages into user mailbox. This is working well.

The last thing is posting the encrypted MAIL post. This is actually complete in a test script, I just need to apply it to mail.php, but the code is already written (it just needs to be turned into a function). This should be the last thing before implementation and heavy live testing.

--
Retro Guy

Retro Guy wrote:

> vga256 wrote:

>> Retro Guy wrote:

>>> So, not a whole lot left, but still not complete. Once all features are done, then lots of testing. Then nice things like error notifications to users, etc. can be done.

>> Awesome!! That's coming along surprisingly fast.

> Ok, now automatically importing mail from a newsgroup message is working fine. So far I have not touched mail.php, but will need to for the last phase.

> I'm trying to put in reduntant verification of domains (that mail really came from where it says it came from), and so far so good, but it will need some brute force testing once complete. Meaning, I need to try to spoof it.

> What is complete right now:

> Automatically generate your own pgp key for the server, and make it available by http link.

> Automatically advertise your pgp key by newsgroup on a regular basis (default 30 days).

> Automatically read incoming pgp key and MAIL newsgroup posts and decrypt and decipher them. Including verifying signatures. Also, domain is verified between the signature and post.

> Automatically try to retrieve keys we do not have either from pgp key posts or MAIL posts (via http). So mail could be recieved even if you do not have the key, you may be able to solve that right then, without needing a pgp key post.

> Automatically import MAIL messages into user mailbox. This is working well.

> The last thing is posting the encrypted MAIL post. This is actually complete in a test script, I just need to apply it to mail.php, but the code is already written (it just needs to be turned into a function). This should be the last thing before implementation and heavy live testing.

WooHoo! It works!

Doing some testing right now for anything really obvious that might be failing, then I'll apply to a couple more sites for live testing. Right now I'm testing between one live site and a test site.

--
Retro Guy

Retro Guy wrote:

> WooHoo! It works!

> Doing some testing right now for anything really obvious that might be failing, then I'll apply to a couple more sites for live testing. Right now I'm testing between one live site and a test site.

Oh man, I can't wait to implement the changes once you've given the green light!

--
Posted on Rocksolid Light

vga256 wrote:

> Retro Guy wrote:

>> WooHoo! It works!

>> Doing some testing right now for anything really obvious that might be failing, then I'll apply to a couple more sites for live testing. Right now I'm testing between one live site and a test site.

> Oh man, I can't wait to implement the changes once you've given the green light!

There are some known issues (unhandled situations), but it should be ready for real testing. The directories are just the default. I think you know where to find the files.
Here's where to start:

Latest files are in the 'messaging' branch of rslight on github:
https://github.com/novabbs/rocksolid-light/tree/messaging

Required and/or changed files:

rocksolid/newsportal.php
ADD THIS FUNCTION (no, this is not the only verification of signatures):
function verify_gpg_signature($res, $signed_text) {
$result = gnupg_verify($res,$signed_text,false);
if ($result == false) {
return false;
}
if ((($result[0]['summary'] > 3)) || $result[0]['validity'] == 2){
return false; // Bad signature
} else {
return true; // Good signature
}
}

spoolnews/mail.php

/etc/rslight/gpg.conf

/etc/rslight/scripts/create_gpg_keys.sh
/etc/rslight/scripts/cron.php
/etc/rslight/scripts/interBBS_mail.php
/etc/rslight/scripts/nocem.php
/etc/rslight/scripts/spoolnews.php

Configure gpg.conf first. Make sure that 'domain' makes your public key available. So:
http(s)://<domain>/pubkey/server_pubkey.txt must be available. The directory and .txt file will be generated later, just make sure that files in that dir are accessible.

<domain> will be the @<domain> part of mail addresses, and must match where the pubkey can be accessed. So if it must be 'www.domain.com', that's fine, just realize that addresses will be @www.domain.com.

Right now I am testing in rocksolid.test.test, but plan to move to rocksolid.shared.encryption after testing. It's just necessary to use the same newsgroup that another site you want to send/retrieve mail is using.

There are bugs right now:

There is no real error checking right now before posting a MAILKEY message. If site has not yet generated a key, it will try to post a blank message, which will be rejected by an inn2 server.

For now, let it post, and once you see the link 'server_pubkey.txt' at the bottom of the site, delete /var/spool/rslight/bbs-mail-update-timer and it will post again.

Make certain that the link on the bottom of the site brings up a PGP Key (click on it to see). It should start with '-----BEGIN PGP PUBLIC KEY BLOCK-----'.

There are more bugs, but this should get you started.

--
Retro Guy

Retro Guy wrote:

> Latest files are in the 'messaging' branch of rslight on github:
> https://github.com/novabbs/rocksolid-light/tree/messaging

> Required and/or changed files:

I forgot tail.inc. Either replace or modify to display link for server_pubkey.txt
in <webdir>/pubkey/server_pubkey.txt

--
Retro Guy

I could use a clarification on configuring gpg.conf since I've never used it before. Are there any changes necessary to the conf's keyserver entry, etc?

--
Posted on Rocksolid Light

vga256 wrote:

> I could use a clarification on configuring gpg.conf since I've never used it before. Are there any changes necessary to the conf's keyserver entry, etc?

Do you mean '$rslight_gpg['gnupghome']'? (There is no specific keyserver entry) If so, that just sets the environment variable 'GNUPGHOME' to point to the directory. The dir can be wherever you like, as long as your web user can read/write to it.

--
Retro Guy

Doh! Yes, I just realized that as I was browsing through the rest of your source tree. I was confusing it with ~/.gnupg/gpg.conf which has an identical name.

--
Posted on Rocksolid Light

okay, I *believe* I've got it implemented in tomo now!

TIL: gpg1 does not support the quick-generate-key command, only gpg2 does

--
Posted on Rocksolid Light

vga256 wrote:

> okay, I *believe* I've got it implemented in tomo now!

Sounds good. Have you done any testing yet? Do you have a private key (did it generate a key)?

You can check your keys (yours and imported, if any) from the command line:

First, become www user, then set your environ var:
export GNUPGHOME=/etc/rslight/.gnupg or wherever you set it in gpg.conf

They, you can type 'gpg --list-secret-keys' to show your private key, or
'gpg --list-keys' to show all keys.

> TIL: gpg1 does not support the quick-generate-key command, only gpg2 does

Correct.

Also, do you see the mail I sent yesterday to you at Rocksolid Light? I assume you haven't checked for it, but it "should" notify you in the motd line that you have mail. Is that working?

--
Retro Guy