Mailman 3 December 2001 - Mailman-Developers

Re: [Mailman-Developers] Mailman password and administrative reminders
by Dan Mick Aug. 13, 2003

Aug. 13, 2003

? This very message came to me with the following header: Errors-To: mailman-developers-admin(a)python.org All my bounces come to the list admin address, set in the admin webpage, in the second field of General Options. Do you have that set to something, and bounces still come to root? > 2. Bounces are sent to the poor postmaster instead of a -admin address. > I'm not entirely certain, but I think an Errors-To: header or something > like that in all Mailman messages might allow one to distribute that load > somewhat.

8 11

External subscriber lists in 2.1
by J C Lawrence Aug. 23, 2002

Aug. 23, 2002

Barry, In 2.1 when used with external subscriber storage (eg SQL), will the new equivalent of qrunner request and load the entire subscriber DB onto the heap prior to broadcast? <<Yeah, I'm cheating and being lazy on not checking the source myself>> Reason: This poses scaling problems for lists with very large numbers of subscribers. I'd suggest paging thru the set in blocks. ObExcuse: Chap on -users asking about millions of subscribers. -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

3 4

[ANNOUNCE] Mailman 2.1 alpha 2
by barry＠digicool.com March 25, 2002

March 25, 2002

This the official announcement for Mailman 2.1 alpha 2. Because it's an alpha, this announcement is only going out to the mailman-* mailing lists. I'll make two warnings: you probably should still not use this version for production systems (but TIA for any and all testing you do with it!), and I've already had a couple of bug fixes from early adopters. 2.1a2 should still be useful, but you might want to keep an eye on cvs and the mailman-checkins list for updates. I am only making the tarball available on SourceForge, so you'll need to go to http://sf.net/projects/mailman to grab it. You'll also need to upgrade to mimelib-0.4, so be sure to go to http://sf.net/projects/mimelib to grab and install that tarball first. To view the on-line documentation, see http://www.list.org/MM21/index.html or http://mailman.sf.net/MM21/index.html Below is an excerpt from the NEWS file for all the changes since 2.1alpha1. There are a bunch of new features coming down the pike, and I hope to have an alpha3 out soon. I'm also planning on doing much more stress testing of this version with real list traffic, and I'm hoping we'll start to get more languages integrated into cvs. Enjoy, -Barry -------------------- snip snip -------------------- 2.1 alpha 2 (11-Jul-2001) - Building o mimelib 0.4 is now required. Get it from http://mimelib.sf.net. If you've installed an earlier version of mimelib, you must upgrade. o /usr/local/mailman is now the default installation directory. Use configure's --prefix switch to change it back to the default (/home/mailman) or any other installation directory of your choice. - Security o Better definition of authentication domains. The following roles have been defined: user, list-admin, list-moderator, creator, site-admin. o There is now a separate role of "list moderator", which has access to the pending requests (admindb) page, but not the list configuration pages. o Subscription confirmations can now be performed via email or via URL. When a subscription is received, a unique (sha) confirm URL is generated in the confirmation message. Simply visiting this URL completes the subscription process. o In a similar manner, removal requests (via web or email command) no longer require the password. If the correct password is given, the removal is performed immediately. If no password is given, then a confirmation message is generated. - Internationalization o More I18N patches. The basic infrastructure should now be working correctly. Spanish templates and catalogs are included, and English, French, Hungarian, and Big5 templates are included. o Cascading specializations and internationalization of templates. Templates are now search for in the following order: list-specific location, domain-specific location, site-wide location, global defaults. Each search location is further qualified by the language being displayed. This means that you only need to change the templates that are different from the global defaults. Templates renamed: admlogin.txt => admlogin.html Templates added: private.html - Web UI o Redesigned the user options page. It now sits behind an authentication so user options cannot be viewed without the proper password. The other advantage is that the user's password need not be entered on the options page to unsubscribe or change option values. The login screen also provides for password mail-back, and unsubscription w/ confirmation. Other new features accessible from the user options page include: ability to change email address (with confirmation) both per-list and globally for all list on virtual domain; global membership password changing; global mail delivery disable/enable; ability to suppress password reminders both per-list and globally; logout button. [Note: the handle_opts cgi has gone away] o Color schemes for non-template based web pages can be defined via mm_cfg. o Redesign of the membership management page. The page is now split into three subcategories (Membership List, Mass Subscription, and Mass Removal). The Membership List subcategory now supports searching for member addresses by regular expression, and if necessary, it groups member addresses first alphabetically, and then by chunks. Mass Subscription and Mass Removal now support file upload, with one address per line. o Hyperlinks from the logos in the footers have been removed. The sponsors got too much "unsubscribe me!" spam from desperate user of Mailman at other sites. o New buttons on the digest admin page to send a digest immediately (if it's non-empty), to start a new digest volume with the next digest, and to select the interval with which to automatically start a new digest volume (yearly, monthly, quarterly, weekly, daily). DEFAULT_DIGEST_VOLUME_FREQUENCY is a new configuration variable, initially set to give a new digest volume monthly. o Through-the-web list creation and removal, using a separate site-wide authentication role called the "list creator and destroyer" or simply "list creator". If the configuration variable OWNERS_CAN_DELETE_THEIR_OWN_LISTS is set to 1 (by default, it's 0), then list admins can delete their own lists. This feature requires an adaptor for the particular MTA you're using. An adaptor for Postfix is included, as is a dumb adaptor that just emails mailman@yoursite with the necessary Sendmail style /etc/alias file changes. Some MTAs like Exim can be configured to automatically recognize new lists. The adaptor is selected via the MTA option in mm_cfg.py - Email UI o In email commands, "join" is a synonym for "subscribe". "remove" and "leave" are synonyms for "unsubscribe". New robot addresses are support to make subscribing and unsubscribing much easier: mylist-join@mysite mylist-leave@mysite o Confirmation messages have a shortened Subject: header, containing just the word "confirm" and the confirmation cookie. This should help for MUAs that like to wrap long Subject: lines, messing up confirmation. o Mailman now recognizes an Urgent: header, which, if it contains the list moderator or list administrator password, forces the message to be delivered immediately to all members (i.e. both regular and digest members). The message is also placed in the digest. If the password is incorrect, the message will be bounced back to the sender. - Performance o Refinements to the new qrunner subsystem which preserves FIFO order of messages. o The qrunner is no longer started from cron. It is started by a Un*x init-style script called bin/mailmanctl (see below). cron/qrunner has been removed. - Command line scripts o bin/mailmanctl script added, which is used to start, stop, and restart the qrunner daemon. o bin/qrunner script added which allows a single sub-qrunner to run once through its processing loop. o bin/change_pw script added (eases mass changing of list passwords). o bin/update grows a -f switch to force an update. o bin/newlang renamed to bin/addlang; bin/rmlang removed. o bin/mmsitepass has grown a -c option to set the list creator's password. The site-wide `create' web page is linked to from the admin overview page. o bin/newlist's -o option is removed. This script also grows a way of spelling the creation of a list in a specific virtual domain. o The `auto' script has been removed. o bin/dumpdb has grown -m/--marshal and -p/--pickle options. o bin/list_admins can be used to print the owners of a mailing list. o bin/genaliases regenerates from scratch the aliases and aliases.db file for the Postfix MTA. - Archiver o New archiver date clobbering option, which allows dates to only be clobber if they are outrageously out-of-date (default setting is 15 days on either side of received timestamp). New configuration variables: ARCHIVER_CLOBBER_DATE_POLICY ARCHIVER_ALLOWABLE_SANE_DATE_SKEW The archived copy of messages grows an X-List-Received-Date: header indicating the time the message was received by Mailman. o PRIVATE_ARCHIVE_URL configuration variable is removed (this can be calculated on the fly, and removing it actually makes site configuration easier). - Miscellaneous o Several new README's have been added. o Most syslog entries for the qrunner have been redirected to logs/error. o On SIGHUP, qrunner will re-open all its log files and restart all child processes. See "bin/mailmanctl restart". - Patches and bug fixes o SF patches and bug fixes applied: 420396, 424389, 227694, 426002, 401372 (partial), 401452. o Fixes in 2.0.5 ported forward: Fix a lock stagnation problem that can result when the user hits the `stop' button on their browser during a write operation that can take a long time (e.g. hitting the membership management admin page). o Fixes in 2.0.4 ported forward: Python 2.1 compatibility release. There were a few questionable constructs and uses of deprecated modules that caused annoying warnings when used with Python 2.1. This release quiets those warnings. o Fixes in 2.0.3 ported forward: Bug fix release. There was a small typo in 2.0.2 in ListAdmin.py for approving an already subscribed member (thanks Thomas!). Also, an update to the OpenWall security workaround (contrib/securelinux_fix.py) was included. Thanks to Marc Merlin.

17 38

a problem in upgrading with moderated lists
by Fil March 10, 2002

March 10, 2002

Hi, when you upgrade Mailman to 2.1a3 from 2.0, moderated lists correctly take on the attributes generic_nonmember_action = Hold default_member_moderation = Yes However the latter is valid only for NEW subscribers. Subscribers already registered have their moderation bit set to 0 (not moderated) whereas it should be set to 1 (moderated) to conform to the previous settings. And, by the way, these settings are not given through config_list -o -- Fil

2 1

my top 3 wishlist for mailman cvs
by Marc MERLIN Feb. 21, 2002

Feb. 21, 2002

First, of all, I'd like to say that I really like many of the changes in improvements in mailman cvs, some of them will same me a lot of time with not having to deal with confused users anymore :-) I however, have 3 items left on my wishlist :-) #1 Very big feature request: The main list admin's cookie should be valid for all the lists. Having to retype the list password over and over again as I hop from list to list is very tiring. #2 Is there any way to have mailman still understand admin password in crypt/md5 format? It could read them and only generate the new kind. Resetting 16,000+ list admin passwords on sourceforge.net is going to be a major showstopper (I know, you can regenerate all of them and Email them automatically, but still...) #3 I'd really like to see a nomail field and a disabled field (one settable by the user, one set by mailman when it disables a member) Thanks, Marc -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f(a)merlins.org for PGP key

4 6

bin/update: "cannot import name SimpleCookie" in mailman cvs
by Marc MERLIN Jan. 10, 2002

Jan. 10, 2002

So, when updating from 2.0 to cvs, make install ran fine up to update: Compiling /var/local/mailman/Mailman/pythonlib/StringIO.py ... Compiling /var/local/mailman/Mailman/pythonlib/__init__.py ... Compiling /var/local/mailman/Mailman/pythonlib/cgi.py ... Compiling /var/local/mailman/Mailman/pythonlib/mailbox.py ... Compiling /var/local/mailman/Mailman/pythonlib/rfc822.py ... Compiling /var/local/mailman/Mailman/versions.py ... Traceback (most recent call last): File "bin/update", line 47, in ? from Mailman import MailList File "/var/local/mailman/Mailman/MailList.py", line 58, in ? from Mailman.SecurityManager import SecurityManager File "/var/local/mailman/Mailman/SecurityManager.py", line 62, in ? from Cookie import SimpleCookie as Cookie ImportError: cannot import name SimpleCookie make: *** [update] Error 1 I have python 2.1.1 I move the lists off, completed the install, brought a list back, ran update by hand, and it worked. Marc -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f(a)merlins.org for PGP key

4 4

RELEASE Mailman 2.1 alpha 4
by barry＠zope.com Jan. 8, 2002

Jan. 8, 2002

Hi all, Just wanted to let you know that I've released Mailman 2.1 alpha 4. Below is the big list of changes with this release. This will be the last alpha release for 2.1, but this still leaves open the possibility of a few new features in MM2.1. I've got everything in that I intend to get in. If you've got a pet new feature -- and have code that implements it -- please do remind me about it now and I'll work on getting in what I can for the first beta. Apologies for falling so far behind in the mailing list traffic. This is admittedly a bit of a rushed release. I really wanted to get this out before the end of the year (in my timezone at least ;). Depending on my other real-job commitments, I'll be spending all my spare time getting bugs fixed and moving toward the 2.1 final release. I'm shooting for release by the Python conference in February, but I don't know if I'll make it. Cheers, and happy new year to you all. I-swear-the-X-Oblique-Strategy-was-chosen-random-ly y'rs, -Barry -------------------- snip snip -------------------- 2.1 alpha 4 (31-Dec-2001) - The administrative requests database page (admindb) has been redesigned for better usability when there are lots of held postings. Changes include: o A summary page which groups held messages by sender email address. On this page you can dispose of all the sender's messages in one action. You can also view the details of all the sender's messages, or the details of a single message. You can also add the sender to one of the list's sender filters. o A details page where you can view all messages, just those for a particular sender, or just a single held message. This details page is laid out the same as the old admindb page. o The instructions have been shorted on the summary and details page, with links to more detailed explanations. - Bounce processing o Mailman now keeps track of the reason a member's delivery has been disabled: explicitly by the administrator, explicitly by the user, by the system due to excessive bounces, or for (legacy) unknown reasons. o A new bounce processing algorithm has been implemented (we might actually understand this one ;). When an address starts bouncing, the member gets a "bounce score". Hard (fatal) bounces score 1.0, while soft (transient) bounces score 0.5. List administrators can specify a bounce threshold above which a member gets disabled. They can also specify a time interval after which, if no bounces are received from the member, the member's bounce score is considered stale and is thrown away. o A new cron script, cron/disabled, periodically sends notifications to members who are bounce disabled. After a certain number of warnings the member is deleted from the list. List administrators can control both the number of notifications and the amount of time between notifications. Notifications include a confirmation cookie that the member can use to re-enable their subscription, via email or web. o New configuration variables to support the bounce processing are DEFAULT_BOUNCE_SCORE_THRESHOLD, DEFAULT_BOUNCE_INFO_STALE_AFTER, DEFAULT_BOUNCE_YOU_ARE_DISABLED_WARNINGS, DEFAULT_BOUNCE_YOU_ARE_DISABLED_WARNINGS_INTERVAL. - Privacy and security o Sender filters can now be regular expressions. If a line starts with ^ it is taken as a (raw string) regular expression, otherwise it is a literal email address. o Fixes in 2.0.8 ported forward: prevent cross-site scripting exploits. - Mail delivery o Aliases have all been changed so that there's more consistency between the alias a message gets delivered to, and the script & queue runner that handles the message. I've also renamed the mail wrapper script to `mailman' from `wrapper' to avoid collisions with other MLM's. You /will/ need to regenerate your alias files with bin/genaliases, and you may need to update your smrsh (Sendmail) configs.a Bounces always go to listname-bounces now, since administration has been separated from bounce processing. listname-admin is obsolete. o VERP support! This greatly improves the accuracy of bounce detection. Configuration variables which control this feature include VERP_DELIVERY_INTERVAL, VERP_PERSONALIZED_DELIVERIES, VERP_PASSWORD_REMINDERS, VERP_REGEXP, and VERP_FORMAT. The latter two must be tuned to your MTA. o A new alias mailman-loop(a)dom.ain is added which directs all output to the file $prefix/data/owner-bounces.mbox. This is used when sending messages to the site list owners, as the final fallback for bouncing messages. o New configuration variable POSTFIX_STYLE_VIRTUAL_DOMAINS which should be set if you are using the Postfix MTA and want Mailman to play nice with Postfix-style virtual domains. - Miscellaneous o Better interoperability with Python 2.2. o MailList objects now record the date (in seconds since epoch) that they were created. This is in a hidden attribute `created_at'. o bin/qrunner grows a -s/--subproc switch which is usually used only when it's started from mailmanctl. o bin/newlist grows a -l/--language option so that the list's preferred language can be set from the command line. o cron changes: admin reminders go out at 8am local time instead of 10pm local time. - Pipermail archiver o MIME attachments are scrubbed out into separate files which can be viewed by following a link in the original article. Article contains an indication of the size of the attachment, its type, and other useful information. o New script bin/cleanarch which can be used to `clean' an .mbox archive file by fixing unescaped embedded Unix From_ lines. o New configuration variable ARCHIVE_SCRUBBER in Defaults.py.in which names the module that Pipermail should use to scrub articles of MIME attachments. o New configuration variable ARCHIVE_HTML_SANITIZER which describes how the scrubber should handle text/html attachments. o PUBLIC_ARCHIVE_URL has change its semantics. It is now an absolute url, with the hostname and listname parts interpolated into it on a per-list basis. o Pipermail should now provide the proper character set in the Content-Type: header for archived articles. - Internationalization o Czech translations by Dan Ohnesorg. o The Hungarian charset has be fixed to be iso-8859-2. o The member options login page now has a language selection widget. - Building, configuration o email-0.96 package is required (see the misc directory). o New recipes for integrating Mailman and Sendmail, contributed by David Champion.

5 6

New Bounce system
by Dan Mick Jan. 2, 2002

Jan. 2, 2002

looks interesting, but a warning: when you upgrade, all your previous "nomails" will appear to revert to "off". Not exactly what I expected. (the value is actually "UNKNOWN", which still disables delivery...but it doesn't show up.) Barry, do you plan to change the option display in the membership list and/or personal pages to something multivalued?...

4 8

Patch: securelinux_fix update (now check_perms_grsecurity)
by Marc MERLIN Jan. 1, 2002

Jan. 1, 2002

I've updated the docs, updated my script to work with grsecurity and with the new scripts in mailman cvs, and I've renamed it to reflect the changes diff -urN mailman.orig/README.LINUX mailman/README.LINUX --- mailman.orig/README.LINUX Mon Dec 10 01:00:52 2001 +++ mailman/README.LINUX Mon Dec 10 01:03:19 2001 @@ -8,18 +8,12 @@ GNU/Linux seems to be the most popular platform on which to run Mailman. Here are some hints on getting Mailman to run on Linux: - If you are running secure_linux, you probably have restricted - hardlinks turned on. Gergely Madarasz says that this not only - restricts hardlinks in /tmp, but also in any non +t directory. This - can cause "Operation not permitted" errors in MailList.Save() -- you - will see a traceback. You must turn restricted hardlinks off. This - is also known under the name of Openwall Security Patches. - - There is a workaround for this problem, you can use securelinux_fix.py - in the contrib directory (see the README.securelinux_fix.py). Note - that the script will not work until you move it in your installed - Mailman tree in the bin directory. + If you are getting errors with hard link creations and/or you are using + a special secure kernel (securelinux/openwall/grsecurity), see + contrib/README.check_perms_grsecurity. + Note that if you are using Linux Mandrake in secure mode, you are probably + concerned by this Local Variables: diff -urN mailman.orig/contrib/README.check_perms_grsecurity mailman/contrib/README.check_perms_grsecurity --- mailman.orig/contrib/README.check_perms_grsecurity Wed Dec 31 16:00:00 1969 +++ mailman/contrib/README.check_perms_grsecurity Mon Dec 10 01:00:08 2001 @@ -0,0 +1,14 @@ +The check_perms_grsecurity.py script, if copied in your installed +~mailman/bin/ directory and run from there will modify permissions of +files so that Mailman with extra restrictions imposed by linux kernel security +patches like securelinux/openwall in 2.2.x or grsecurity in 2.4.x + +The way it works is that it makes sure that the UID of any script that +touches config.pck is `mailman'. What this means however is that +scripts in ~mailman/bin will now only work if run as user mailman or +root (the script then changes its UID and GID to mailman). +To make grsecurity happy, we remove the group writeable bit on a directories +that contain binaries + +Enjoy +Marc MERLIN <marc_soft(a)merlins.org>/<marc_bts(a)vasoftware.com> - 2001/12/10 diff -urN mailman.orig/contrib/README.securelinux_fix mailman/contrib/README.securelinux_fix --- mailman.orig/contrib/README.securelinux_fix Mon Mar 12 11:28:45 2001 +++ mailman/contrib/README.securelinux_fix Wed Dec 31 16:00:00 1969 @@ -1,12 +0,0 @@ -The securelinux_fix.py script, if copied in your installed -~mailman/bin/ directory and run from there will modify permissions of -files so that Mailman works despite the securelinux (aka openwall) -symbolic and hard link restrictions. - -The way it works is that it makes sure that the UID of any script that -touches config.db is `mailman'. What this means however is that -scripts in ~mailman/bin will now only work if run as user mailman or -root (the script then changes its UID and GID to mailman). - -Enjoy -Marc MERLIN <marcsoft(a)merlins.org>/<marc_bts(a)valinux.com> diff -urN mailman.orig/contrib/check_perms_grsecurity.py mailman/contrib/check_perms_grsecurity.py --- mailman.orig/contrib/check_perms_grsecurity.py Wed Dec 31 16:00:00 1969 +++ mailman/contrib/check_perms_grsecurity.py Mon Dec 10 00:56:55 2001 @@ -0,0 +1,173 @@ +#! @PYTHON@ +# +# Copyright (C) 1998,1999,2000,2001 by the Free Software Foundation, Inc. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + +"""Fixes for running Mailman under the `secure-linux' patch or grsecurity. + +Run check_perms -f and only then check_perms_grsecurity.py -f +Note that you will have to re-run this script after a mailman upgrade and +that check_perms will undo part of what this script does + +If you use Solar Designer's secure-linux patch, it prevents a process from +linking (hard link) to a file it doesn't own. +Grsecurity (http://grsecurity.net/) can have the same restriction depending +on how it was built, including other restrictions like preventing you to run +a program if it is located in a directory writable by a non root user. + +As a result Mailman has to be changed so that the whole tree is owned by +Mailman, and the CGIs and some of the programs in the bin tree (the ones +that lock config.pck files) are SUID Mailman. The idea is that config.pck +files have to be owned by the mailman UID and only touched by programs that +are UID mailman. +At the same time, We have to make sure that at least 3 directories under +~mailman aren't writable by mailman: mail, cgi-bin, and bin + +Binary commands that are changed to be SUID mailman are also made unreadable +and unrunnable by people who aren't in the mailman group. This shouldn't +affect much since most of those commands would fail work if you weren't part +of the mailman group anyway. +Scripts in ~mailman/bin/ are not made suid or sgid, they need to be run by +user mailman or root to work. + +Marc <marc_soft(a)merlins.org>/<marc_bts(a)vasoftware.com> +2000/10/27 - Initial version for secure_linux/openwall and mailman 2.0 +2001/12/09 - Updated version for grsecurity and mailman 2.1 +""" + +import sys +import os +import paths +import re +import glob +from Mailman import mm_cfg +from Mailman.mm_cfg import MAILMAN_UID, MAILMAN_GID +from stat import * + +# Directories that we don't want writable by mailman. +dirstochownroot= ( 'mail', 'cgi-bin', 'bin' ) + +# Those are the programs that we patch so that they insist being run under the +# mailman uid or as root. +binfilestopatch= ( 'add_members', 'change_pw', 'check_db', 'clone_member', + 'config_list', 'newlist', 'qrunner', 'remove_members', + 'rmlist', 'sync_members', 'update', 'withlist' ) + +def main(argv): + binpath = paths.prefix + '/bin/' + droplib = binpath + 'CheckFixUid.py' + + if len(argv) < 2 or argv[1] != "-f": + print __doc__ + sys.exit(1) + + print "Making select directories owned and writable by root only" + for dir in dirstochownroot: + dirpath = paths.prefix + '/' + dir + os.chown(dirpath, 0, MAILMAN_GID) + os.chmod(dirpath, 02755) + print dirpath + + print + + file = paths.prefix + '/data/last_mailman_version' + print "Making" + file + "owned by mailman (not root)" + os.chown(file, MAILMAN_UID, MAILMAN_GID) + print + + if not os.path.exists(droplib): + print "Creating " + droplib + fp = open(droplib, 'w', 0644) + fp.write("""import sys +import os +from Mailman.mm_cfg import MAILMAN_UID, MAILMAN_GID + +class CheckFixUid: + if os.geteuid() == 0: + os.setgid(MAILMAN_GID) + os.setuid(MAILMAN_UID) + if os.geteuid() != MAILMAN_UID: + print "You need to run this script as root or mailman because it was configured to run" + print "on a linux system with a security patch which restricts hard links" + sys.exit() +""") + fp.close() + else: + print "Skipping creation of " + droplib + + + print "\nMaking cgis setuid mailman" + cgis = glob.glob(paths.prefix + '/cgi-bin/*') + + for file in cgis: + print file + os.chown(file, MAILMAN_UID, MAILMAN_GID) + os.chmod(file, 06755) + + print "\nMaking mail wrapper setuid mailman" + file= paths.prefix + '/mail/wrapper' + os.chown(file, MAILMAN_UID, MAILMAN_GID) + os.chmod(file, 06755) + print file + + print "\nEnsuring that all config.db/pck files are owned by Mailman" + cdbs = glob.glob(paths.prefix + '/lists/*/config.db*') + cpcks = glob.glob(paths.prefix + '/lists/*/config.pck*') + + for file in cdbs + cpcks: + stat = os.stat(file) + if (stat[ST_UID] != MAILMAN_UID or stat[ST_GID] != MAILMAN_GID): + print file + os.chown(file, MAILMAN_UID, MAILMAN_GID) + + print "\nPatching mailman scripts to change the uid to mailman" + + for script in binfilestopatch: + filefd = open(script, "r") + file = filefd.readlines() + filefd.close() + + patched = 0 + try: + file.index("import CheckFixUid\n") + print "Not patching " + script + ", already patched" + except ValueError: + file.insert(file.index("import paths\n")+1, "import CheckFixUid\n") + for i in range(len(file)-1, 0, -1): + object=re.compile("^([ ]*)main\(").search(file[i]) + # Special hack to support patching of update + object2=re.compile("^([ ]*).*=[ ]*main\(").search(file[i]) + if object: + print "Patching " + script + file.insert(i, + object.group(1) + "CheckFixUid.CheckFixUid()\n") + patched=1 + break + if object2: + print "Patching " + script + file.insert(i, + object2.group(1) + "CheckFixUid.CheckFixUid()\n") + patched=1 + break + + if patched==0: + print "Warning, file "+script+" couldn't be patched." + print "If you use it, mailman may not function properly" + else: + filefd=open(script, "w") + filefd.writelines(file) + +main(sys.argv) diff -urN mailman.orig/contrib/securelinux_fix.py mailman/contrib/securelinux_fix.py --- mailman.orig/contrib/securelinux_fix.py Thu Oct 4 07:45:36 2001 +++ mailman/contrib/securelinux_fix.py Wed Dec 31 16:00:00 1969 @@ -1,134 +0,0 @@ -#! @PYTHON@ -# -# Copyright (C) 1998,1999,2000,2001 by the Free Software Foundation, Inc. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of the GNU General Public License -# as published by the Free Software Foundation; either version 2 -# of the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -"""Fixes for running Mailman under the `secure-linux' patch. - -If you use Solar Designer's secure-linux patch, it prevents a process from -linking (hard link) to a file it doesn't own. As a result Mailman has to be -changed so that the whole tree is owned by Mailman, and the CGIs and some of -the programs in the bin tree (the ones that lock config.pck files) are SUID -Mailman. The idea is that config.pck files have to be owned by the mailman -UID and only touched by programs that are UID mailman. - -If you have to run check_perms -f, make sure to also run securelinux_fix.py --f, which applies the necessary permission fixes. - -As a result, to prevent anyone from running privileged Mailman commands (since -the scripts are suid), binary commands that are changed to be SUID are also -unreadable and unrunnable by people who aren't in the mailman group. This -shouldn't affect much since most of those commands would fail work if you -weren't part of the mailman group anyway. - -Marc <marcsoft(a)merlins.org>/<marc_bts(a)valinux.com> 2000/10/27 -""" - -import sys -import os -import paths -import re -import glob -from Mailman import mm_cfg -from Mailman.mm_cfg import MAILMAN_UID, MAILMAN_GID -from stat import * - -# Those are the programs that we patch so that they insist being run under the -# mailman uid or as root. -binfilestopatch= ( 'add_members', 'check_db', 'clone_member', - 'config_list', 'move_list', 'newlist', 'remove_members', 'rmlist', - 'sync_members', 'update', 'withlist' ) - -def main(argv): - binpath = paths.prefix + '/bin/' - droplib = binpath + 'CheckFixUid.py' - - if len(argv) < 2 or argv[1] != "-f": - print __doc__ - sys.exit(1) - - if not os.path.exists(droplib): - print "Creating " + droplib - fp = open(droplib, 'w', 0644) - fp.write("""import sys -import os -from Mailman.mm_cfg import MAILMAN_UID, MAILMAN_GID - -class CheckFixUid: - if os.geteuid() == 0: - os.setgid(MAILMAN_GID) - os.setuid(MAILMAN_UID) - if os.geteuid() != MAILMAN_UID: - print "You need to run this script as root or mailman because it was configured to run" - print "on a linux system with the secure-linux patch which restricts hard links" - sys.exit() -""") - fp.close() - else: - print "Skipping creation of " + droplib - - - print "\nMaking cgis setuid mailman" - cgis = glob.glob(paths.prefix + '/cgi-bin/*') - - for file in cgis: - print file - os.chown(file, MAILMAN_UID, MAILMAN_GID) - os.chmod(file, 06755) - - print "\nMaking mail wrapper setuid mailman" - os.chown(paths.prefix + '/mail/wrapper', MAILMAN_UID, MAILMAN_GID) - os.chmod(paths.prefix + '/mail/wrapper', 06755) - - print "\nEnsuring that all config.pck files are owned by Mailman" - cdbs = glob.glob(paths.prefix + '/lists/*/config.pck*') - - for file in cdbs: - stat = os.stat(file) - if (stat[ST_UID] != MAILMAN_UID or stat[ST_GID] != MAILMAN_GID): - print file - os.chown(file, MAILMAN_UID, MAILMAN_GID) - - print "\nPatching mailman scripts to change the uid to mailman" - - for script in binfilestopatch: - filefd = open(script, "r") - file = filefd.readlines() - filefd.close() - - patched = 0 - try: - file.index("import CheckFixUid\n") - print "Not patching " + script + ", already patched" - except ValueError: - file.insert(file.index("import paths\n")+1, "import CheckFixUid\n") - for i in range(len(file)-1, 0, -1): - object=re.compile("^([ ]*)main\(").search(file[i]) - if object: - print "Patching " + script - file.insert(i, - object.group(1) + "CheckFixUid.CheckFixUid()\n") - patched=1 - break - - if patched==0: - print "Warning, file "+script+" couldn't be patched." - print "If you use it, mailman may not function properly" - else: - filefd=open(script, "w") - filefd.writelines(file) - -main(sys.argv) -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f(a)merlins.org for PGP key

2 1

[RELEASED] Mailman 2.1 alpha 3
by barry＠zope.com Jan. 1, 2002

Jan. 1, 2002

I've finally decided to put a fork in it and release the third, and hopefully last alpha in the Mailman 2.1 series. If you want to see a description of all the new stuff, please see http://sourceforge.net/project/shownotes.php?release_id=58074 There's quite a lot there! Everything should be up on SourceForge now, with updates to www.list.org hopefully tomorrow some time. See also http://mailman.sf.net/MM21/ for updated pages about Mailman 2.1. Note that you no longer need to install the mimelib package. This has been replaced by the email package, which comes with Python 2.2b1, or for Python 2.1.1 or 2.0.1, you'll need to install email-0.93 which is available in the misc/ directory. See the INSTALL file for details. Below is an excerpt from the NEWS file for all the changes since 2.1 alpha 2. I'm hoping that this will be the last alpha release. That means there's one more release in which we have an opportunity for new features, so I suggest that you grab 2.1a3 and give it a good workout (in a non-production environment <wink>). If there are glaring things missing, as always, let me know. Please, all discussion about 2.1 alpha should be conducted on the mailman-developers(a)python.org mailing list. I will be creating some test lists on python.org an you'll be able to subscribe to them to try things out. I'd like to have a short cycle for alpha3->beta1, with bug fixes only once beta1 comes out. Language translators: I've updated the langpack on SourceForge with the latest catalogs and templates. I've also uploaded the latest README-I18N.en file if you'd like to contribute new languages. If you've been holding off contributing new language files, please consider finishing them off so that I can integrate them in time for beta1. Enjoy, -Barry -------------------- snip snip -------------------- 2.1 alpha 3 (22-Oct-2001) - Realname support o Mailman now tracks a member's Real Name in addition to their email address. o List members can now supply their Real Names when subscribing via the web. Their Real Names are parsed from any thru-email subscriptions. o Members can change their Real Names on their options page, and admins can change members' Real Names on the membership pages. Mass subscribing accepts "email(a)dom.ain (Real Name)" entries, for both in-text-box and file-upload mass subscriptions. - Filtering and Privacy o Reply-To: munging has been enhanced to allow a wider range of list policies. You can now pre-strip any Reply-To: headers before adding list-specific ones (i.e. you can override or extend existing Reply-To: headers). If stripping, the old headers are no longer saved on X-Reply-To: o New sender moderation rules. The old `posters', `member_only_posting', `moderated' and `forbidden_posters' options have been removed in favor of a new moderation scheme. Each member has a personal moderation bit, and non-member postings can be automatically accepted, held for approval, rejected (bounced) or discarded. o When membership rosters are private, responses to subscription (and other) requests are made more generic so that these processes can't be covertly mined for hidden addresses. If a subscription request comes in for a user who is already subscribed, the user is notified of potential membership mining. o When a held message is approved via the admindb page, an X-Moderated: header is added to the message. o List admins can now set an unsubscribe policy which requires them to approve of member unsubscriptions. - Web U/I o All web confirmations now require a two-click procedure, where the first click gives them a page that allows them to confirm or cancel their subscription. It is bad form for an email click (HTTP GET) to have side effects. o Lots of improvements for clarity. o The Privacy category has grown three subcategories. o The General options page as a number of subsection headers. o The Passwords and Languages categories are now on separate admin pages. o The admin subcategories are now formated as two columns in the top and bottom legends. o When creating a list through the web, you can now specify the initial list of supported languages. o The U/I for unsubscribing a member on the admin's membership page should be more intuitive now. o There is now a separate configuration option for whether the goodbye_msg is sent when a member is unsubscribed. - Performance o misc/mailman is a Unix init script, appropriate for /etc/init.d, and containing chkconfig hooks for systems that support it. o bin/mailmanctl has been rewritten; the `restart' command actually works now. It now also accepts -s, -q, and -u options. o bin/qrunner has been rewritten too; it can serve the role of the old cron/qrunner script for those who want classic cron-invoked mail delivery. o Internally, messages are now stored in the qfiles directory primarily as pickles. List configuration databases are now stored as pickles too (i.e. config.pck). bin/dumpdb knows how to display both pickles and marshals. - Mail delivery o If a user's message is held for approval, they are sent a notification message containing a confirmation cookie. They can use this confirmation cookie to cancel their own postings (if they haven't already been approved). o When held messages are forwarded to an explicit address using the admindb page, it is done so in a message/rfc822 encapsulation. o When a message is first held for approval, the notification sent to the list admin is a 3-part multipart/mixed. The first part holds the notification message, the second part hold the original message, and the third part hold a cookie confirmation message, to which the admin can respond to approve or discard the message via email. o In the mail->news gateway, you can define mail headers that must be modified or deleted before the message can be posted to the nntp server. o The list admin can send an immediate urgent message to the entire list membership, bypassing digest delivery. This is done by adding an Urgent: header with the list password. Urgent messages with an invalid password are rejected. o Lists can now optionally personalize email messages, if the site admin allows it. Personalized messages mean that the To: header includes the recipient's address instead of the list's address, and header and footer messages can contain user-specific information. Note that only regular deliveries can currently be personalized. o Message that come from Usenet but that have broken MIME boundaries are ignored. o If the site administrator agrees, list owners have the ability to disable RFC 2369 List-* headers. - Building/testing/configuration o mimelib is no longer required, but you must install the email package (see the tarball in the misc directory). o An (as yet) incomplete test suite has been added. Don't try running it in a production environment! o Better virtual host support by adding a mapping from the host name given in cgi's HTTP_HOST/SERVER_NAME variable to the email host used in list addresses. (E.g. www.python.org maps to @python.org). o Specifying urls to external public archivers is more flexible. o The filters/ subdirectory has been removed. o There is now a `site list' which is a mailing list that must be created first, and from which all password reminders appear to come from. It is recommended that this list be called "mailman(a)your.site". o bin/move_list is no longer necessary (see the FAQ for detailed instructions on renaming a list). o A new script bin/fix_url.py can be used with bin/withlist to change a list's web_page_url configuration variable (since it is no longer modifiable through the web). - Internationalization o Support for German, Hungarian, Italian, Japanese, and Norwegian have been added. - Miscellaneous o Lots of new bounce detectors. Bounce detectors can now discard temporary bounce messages by returning a special Stop value. o bin/withlist now sports a -q/--quiet flag. o bin/add_members has a new -a/--admin-notify flag which can be used to inhibit list owner notification for each subscription. - Membership Adaptors o Internally, mailing list memberships are accessed through a MemberAdaptor interface. This would allow for integrating membership databases with external sources (e.g. Zope or LDAP), although the only MemberAdaptor currently implemented is a "classic" adaptor which stores the membership information on the MailList object. o There's a new pipeline handler module called FileRecips.py which could be used to get all regular delivery mailing list recipients from a Sendmail-style :include: file (see List Extensibility bullet below). This work was sponsored by Control.com - List Extensibility o A framework has been added which can be used to specialize and extend specific mailing lists. If there is a file called lists/<yourlist>/extend.py, it is execfile()'d after the MailList object is instantiated. The file should contain a function extend() which will be called with the MailList instance. This function can do all sorts of deep things, like modify the handler pipeline just for this list, or even strip out particular admin GUI elements (see below). o All the admin page GUI elements are now separate components. This provides greater flexibility for list customization. Also, each GUI element will be given an opportunity to handle admin CGI form data. This work was sponsored by Control.com - Topic Filters o A new feature has been added called "Topic Filters". A list administrator can create topics, which are essentially regular expression matches against Subject: and Keyword: headers (including such pseudo-headers if they appear in the first few lines of the body of a message). List members can then `subscribe' to various topics, which allows them to filter out any messages that don't match a topic, or to filter out any message that does match a topic. This can be useful for high volume lists where not everyone will be interested in every message. This work was sponsored by Control.com

5 11