Mailman 3 July 2003 - Mailman-Developers

Mailman and a clustered mail server.
by Mike Lucas July 11, 2003

July 11, 2003

We are setting up a new clustered/load balanced mail system using postfix. We want to run mailman as part of this cluster for all our mailing lists. My question is this, If we run mailman on just 1 box in this system and it does the web and script stuff. Is there a problem with it pointing to the rest of the cluster for the MTA part? Also if this is possible will mail commands still work or will we have to only use the web interface? Has anyone done any clustering of mailman? Any info would be great, Mike

1 0

Fw: [Mailman-Developers] Archive problem
by Marco Antonio Reis Henriques July 11, 2003

July 11, 2003

Hi, I solved that problem. The interesting thing about this problem was that the first, second and third messages didn't appear in the archive html interface, only the following messages (forth, ...). Thanks for anyone that didn't help me. :-) Cheers, Marco ----- Original Message ----- From: "Marco Antonio Reis Henriques" <marco_henriques(a)yahoo.com.br> To: <mailman-developers(a)python.org> Cc: <barry(a)python.org>; <barry(a)zope.com> Sent: Wednesday, July 09, 2003 9:44 AM Subject: Fw: [Mailman-Developers] Archive problem > Hi, > > I'm writing from Brazil and I need some help from you. I'm still having > problems when my list receives the first, second and third messages that > doesn't shown in html archive interface, but the following messages are ok. > I'm using Python 2.2.2 and Mailman 2.1 on a NetBSD 1.6 machine. I see in my > error log file the lines below for the first, second and third messages > received by my list: > > Jul 07 09:42:52 2003 (23058) Uncaught runner exception: unsupported format > character '(' (0x28) at index 2 > Jul 07 09:42:52 2003 (23058) Traceback (most recent call last): > File "/usr/local/mailman/Mailman/Queue/Runner.py", line 105, in _oneloop > self._onefile(msg, msgdata) > File "/usr/local/mailman/Mailman/Queue/Runner.py", line 155, in _onefile > keepqueued = self._dispose(mlist, msg, msgdata) > File "/usr/local/mailman/Mailman/Queue/ArchRunner.py", line 73, in _dispose > mlist.ArchiveMail(msg) > File "/usr/local/mailman/Mailman/Archiver/Archiver.py", line 207, in > ArchiveMail h.close() > File "/usr/local/mailman/Mailman/Archiver/pipermail.py", line 306, in close > self.write_TOC() > File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 1008, in > write_TOC toc.write(self.html_TOC()) > File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 701, in > html_TOC accum.append(self.html_TOC_entry(a)) > File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 732, in > html_TOC_entry textlink = templ % { > File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 118, in sizeof > out = _(' %(size)i bytes ') > File "/usr/local/mailman/Mailman/i18n.py", line 78, in _ return > _translation.gettext(s) % dict ValueError: unsupported format character '(' > (0x28) at index 2 > Jul 07 09:42:52 2003 (23058) SHUNTING: > 1057581770.414556+d6c1ae52a492b811c605bafb6607164b0261267e > > > > Hi ALL, > > > > I'm using Python 2.2.2 and Mailman 2.1 on a NetBSD 1.6 > > machine. > > > > I´m having trouble with Archive. My first message to > > my list is saved in > > /usr/local/mailman/archives/private/teste-l/2003-July.txt, > > the messages are still been send but no are save. And, > > my index.html file in > > /usr/local/mailman/archives/private/teste-l/ is empty. > > I see in my error log file the lines below: > > > > Jul 07 09:42:52 2003 (23058) Uncaught runner > > exception: unsupported format character '(' (0x28) at > > index 2 > > Jul 07 09:42:52 2003 (23058) Traceback (most recent > > call last): > > File "/usr/local/mailman/Mailman/Queue/Runner.py", > > line 105, in _oneloop > > self._onefile(msg, msgdata) > > File "/usr/local/mailman/Mailman/Queue/Runner.py", > > line 155, in _onefile > > keepqueued = self._dispose(mlist, msg, msgdata) > > File > > "/usr/local/mailman/Mailman/Queue/ArchRunner.py", line > > 73, in _dispose > > mlist.ArchiveMail(msg) > > File > > "/usr/local/mailman/Mailman/Archiver/Archiver.py", > > line 207, in ArchiveMail > > h.close() > > File > > "/usr/local/mailman/Mailman/Archiver/pipermail.py", > > line 306, in close > > self.write_TOC() > > File > > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > > line 1008, in write_TOC > > toc.write(self.html_TOC()) > > File > > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > > line 701, in html_TOC > > accum.append(self.html_TOC_entry(a)) > > File > > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > > line 732, in html_TOC_entry > > textlink = templ % { > > File > > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > > line 118, in sizeof > > out = _(' %(size)i bytes ') > > File "/usr/local/mailman/Mailman/i18n.py", line 78, > > in _ > > return _translation.gettext(s) % dict > > ValueError: unsupported format character '(' (0x28) at > > index 2 > > > > Jul 07 09:42:52 2003 (23058) SHUNTING: > > 1057581770.414556+d6c1ae52a492b811c605bafb6607164b0261267e > > > > > > Someone could help me ?!? > > > > Cheers, > > > > Marco > > > > > > > > _______________________________________________________________________ > > Yahoo! Mail > > Mais espaço, mais segurança e gratuito: caixa postal de 6MB, antivírus, > proteção contra spam. > > http://br.mail.yahoo.com/ > > > > _______________________________________________ > > Mailman-Developers mailing list > > Mailman-Developers(a)python.org > > http://mail.python.org/mailman/listinfo/mailman-developers > > > _______________________________________________ > Mailman-Developers mailing list > Mailman-Developers(a)python.org > http://mail.python.org/mailman/listinfo/mailman-developers

1 0

Storing additional user data
by Chris Boulter July 11, 2003

July 11, 2003

Hi, I'm hoping to use Mailman, but have a few requirements which may not be addressed 'out of the box'. In particular, I'm integrating with another system and would like to store the foreign system's user IDs in Mailman so that I can correlate our users with Mailman subscribers. This will then allow us to do things like replicate changes to users' email addresses, which they currently enter in the foreign system. I've considered using clone_member from the command line, but this seems like it might not be problem-free. For instance, a user could change his email address to match someone else's who's already subscribed to one or more lists, and then change it back, and thus hijack that user's identity (identifying only be email address, the users would become indistinguishable to us). Does Mailman support the storage of any sort of user metadata? If not, would it be easyish to add? I'm not terribly familiar with Python, but it looks like I could add attributes to a class and then have them persisted by Python's 'marshalling' into a (non-standard) Mailman database. Thanks, Chris -- Write friendlier email : http://www.math.fu-berlin.de/~guckes/mail/edit.html Certify your signature : http://sig.jellybaby.net/ [101f42d9ex623]

6 18

Injection duplicate removal
by Nigel Metheringham July 11, 2003

July 11, 2003

Occasionally a subscriber on a list has some mail problem which results in multiple copies being sent out to the list. Now this is annoying when it happens to a personal address, when a list address gets bombed in this way its seriously annoying - and in some cases has been a real problem for the originator who gets 1000's of messages complaining about the multiple sendings :-) Would it be advantageous to have a duplicate filter within Mailman which maintains a database of the last n messages sent, holding the sender, subject and a body hash. Duplicates could then be bounced before list injection. This is working round someone elses set of bugs, but could be a useful list defence mechanism. However it will not solve the looping mail problem where a mail gets bigger each time round as something is prepended/appended to it. Nigel. -- [ Nigel Metheringham Nigel.Metheringham(a)InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]

1 0

Re: [Mailman-Developers] Possible yahoogroups problem.
by Paul Hoffman / IMC July 11, 2003

July 11, 2003

At 9:19 AM -0400 7/8/03, Barry Warsaw wrote: >The data we use: > >- the str() of the output of random.random() >- the str() of the server's current time >- the str() of the "content" > >and we concatenate these three strings together before hashing them. I'm not sitting in front of the source code for Mailman right now (and I don't read Python), so this brings up a few questions. - Can random.random() run out of randomness? That is, if you bombard the machine with requests that call random.random(), will it start sending out predictable responses? - What is the granularity of the server's current time? If it is "seconds", this is becomes easily predictable to an attacker. Even if it is "hundredths of seconds", that only means that the attacker has to send one or two hundred attempts for each confirmation. Unless Mailman notes "failed attempt to confirm a subscription", this could be lost in the noise. - How many bits of the hash are used? I ask because many programs that use hashes will not use the whole hash. The answer to the above three (particularly the first) determines whether or not an attacker can sensibly forge confirmations. (Of course, watching the outgoing mail would make this attack easier too. :-) ) --Paul Hoffman, Director --Internet Mail Consortium

3 4

Re: Storing additional user data
by Charlie Clark July 10, 2003

July 10, 2003

On 2003-07-10 at 18:00:07 [+0200], mailman-developers-request(a)python.org wrote: > Hi, > > I'm hoping to use Mailman, but have a few requirements which may not be > addressed 'out of the box'. In particular, I'm integrating with another > system and would like to store the foreign system's user IDs in Mailman > so that I can correlate our users with Mailman subscribers. This will > then allow us to do things like replicate changes to users' email > addresses, which they currently enter in the foreign system. > > I've considered using clone_member from the command line, but this seems > like it might not be problem-free. For instance, a user could change his > email address to match someone else's who's already subscribed to one or > more lists, and then change it back, and thus hijack that user's identity > (identifying only be email address, the users would become > indistinguishable to us). > > Does Mailman support the storage of any sort of user metadata? If not, > would it be easyish to add? I'm not terribly familiar with Python, but it > looks like I could add attributes to a class and then have them persisted > by Python's 'marshalling' into a (non-standard) Mailman database. Any kind of cloning is bound to cause problems sooner or later. One thing would be to replace the Mailman database backend with another one and integrate via that. MembershipAdaptor makes this possible but you should be able to code in Python to do this. We've recently done this as have others, I believe. One think you might try is integrating Mailman with something like Zope and XUF which you can then use to integrate users. Just an idea. Charlie

1 0

Fw: [Mailman-Developers] Archive problem
by Marco Antonio Reis Henriques July 9, 2003

July 9, 2003

Hi, I'm writing from Brazil and I need some help from you. I'm still having problems when my list receives the first, second and third messages that doesn't shown in html archive interface, but the following messages are ok. I'm using Python 2.2.2 and Mailman 2.1 on a NetBSD 1.6 machine. I see in my error log file the lines below for the first, second and third messages received by my list: Jul 07 09:42:52 2003 (23058) Uncaught runner exception: unsupported format character '(' (0x28) at index 2 Jul 07 09:42:52 2003 (23058) Traceback (most recent call last): File "/usr/local/mailman/Mailman/Queue/Runner.py", line 105, in _oneloop self._onefile(msg, msgdata) File "/usr/local/mailman/Mailman/Queue/Runner.py", line 155, in _onefile keepqueued = self._dispose(mlist, msg, msgdata) File "/usr/local/mailman/Mailman/Queue/ArchRunner.py", line 73, in _dispose mlist.ArchiveMail(msg) File "/usr/local/mailman/Mailman/Archiver/Archiver.py", line 207, in ArchiveMail h.close() File "/usr/local/mailman/Mailman/Archiver/pipermail.py", line 306, in close self.write_TOC() File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 1008, in write_TOC toc.write(self.html_TOC()) File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 701, in html_TOC accum.append(self.html_TOC_entry(a)) File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 732, in html_TOC_entry textlink = templ % { File "/usr/local/mailman/Mailman/Archiver/HyperArch.py", line 118, in sizeof out = _(' %(size)i bytes ') File "/usr/local/mailman/Mailman/i18n.py", line 78, in _ return _translation.gettext(s) % dict ValueError: unsupported format character '(' (0x28) at index 2 Jul 07 09:42:52 2003 (23058) SHUNTING: 1057581770.414556+d6c1ae52a492b811c605bafb6607164b0261267e > Hi ALL, > > I'm using Python 2.2.2 and Mailman 2.1 on a NetBSD 1.6 > machine. > > I´m having trouble with Archive. My first message to > my list is saved in > /usr/local/mailman/archives/private/teste-l/2003-July.txt, > the messages are still been send but no are save. And, > my index.html file in > /usr/local/mailman/archives/private/teste-l/ is empty. > I see in my error log file the lines below: > > Jul 07 09:42:52 2003 (23058) Uncaught runner > exception: unsupported format character '(' (0x28) at > index 2 > Jul 07 09:42:52 2003 (23058) Traceback (most recent > call last): > File "/usr/local/mailman/Mailman/Queue/Runner.py", > line 105, in _oneloop > self._onefile(msg, msgdata) > File "/usr/local/mailman/Mailman/Queue/Runner.py", > line 155, in _onefile > keepqueued = self._dispose(mlist, msg, msgdata) > File > "/usr/local/mailman/Mailman/Queue/ArchRunner.py", line > 73, in _dispose > mlist.ArchiveMail(msg) > File > "/usr/local/mailman/Mailman/Archiver/Archiver.py", > line 207, in ArchiveMail > h.close() > File > "/usr/local/mailman/Mailman/Archiver/pipermail.py", > line 306, in close > self.write_TOC() > File > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > line 1008, in write_TOC > toc.write(self.html_TOC()) > File > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > line 701, in html_TOC > accum.append(self.html_TOC_entry(a)) > File > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > line 732, in html_TOC_entry > textlink = templ % { > File > "/usr/local/mailman/Mailman/Archiver/HyperArch.py", > line 118, in sizeof > out = _(' %(size)i bytes ') > File "/usr/local/mailman/Mailman/i18n.py", line 78, > in _ > return _translation.gettext(s) % dict > ValueError: unsupported format character '(' (0x28) at > index 2 > > Jul 07 09:42:52 2003 (23058) SHUNTING: > 1057581770.414556+d6c1ae52a492b811c605bafb6607164b0261267e > > > Someone could help me ?!? > > Cheers, > > Marco > > > > _______________________________________________________________________ > Yahoo! Mail > Mais espaço, mais segurança e gratuito: caixa postal de 6MB, antivírus, proteção contra spam. > http://br.mail.yahoo.com/ > > _______________________________________________ > Mailman-Developers mailing list > Mailman-Developers(a)python.org > http://mail.python.org/mailman/listinfo/mailman-developers

1 0

Re: [Mailman-Developers] Possible yahoogroups problem.
by Nigel Metheringham July 9, 2003

July 9, 2003

On Tue, 2003-07-08 at 15:32, Barry Warsaw wrote: > [Removing list-managers from the recipients] You took off mailman-developers too... I've put that one back. :-) > > On Tue, 2003-07-08 at 08:54, Nigel Metheringham wrote: > > Since it looks like the attacker in this case generated an initial > > subscribe request, and then the confirmation, he will have had access to > > the UserDesc data - after all its all from data he sent to them in the > > subscribe request. > > Except that in an email request, we auto-generate the password, so > there's a little more randomness there. I had missed that. > > So it comes down to how good is the output of random.random() since the > > receipt time could be guessed within a few minutes giving a small number > > of hundreds of seconds to work with. > > time.time() is a float with precision equal to the system clock > precision, probably closer to microseconds than 100s of secs on Linux > <wink>. So that means to guess the subscription cookie, given a mailed subscription, you need to guess:- * the account password - basically a few characters of base64, so say 2^24 (16 million) * time.time() - so the real clock resolution over 100 seconds - which is probably 5000 (50 (Hz) * 100) on older Linux, up to 102400 on more modern versions. [Load of assumptions here...] call it around 2^12 being conservative * random.random() - since its a stringified real I guess thats probably not much better than 10^6 (say 2^20). So that gives us around 2^56 for mailed requests, 2^32 for web requests (password is known - and the time is known better, maybe should reduce that by 2^7 or so). Thats a fair amount to attack. One thing that could be considered to protect ourselves against such attacks if there was a way of reducing the complexity to reasonable levels, would be to drop pending subscription requests after a couple (think of an appropriate number) of failed cookie cracking attempts. That of course transforms this into a denial of service attack :-( > > > BTW, is there something we can do to prevent Mailman addresses from > > > getting subscribed to Yahoo! or other listservs? I'd rather not > > > hardcode in Yahoo! brain damage, so I'm looking for a more principled > > > approach. > > > > List-* headers? > > I.e. never respond to messages with List-* headers? Probably > Precedence: bulk|junk|list too. Nigel. -- [ Nigel Metheringham Nigel.Metheringham(a)InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]

3 3

Re: [Mailman-Developers] Bugs in Mailman 2.1.2
by J C Lawrence July 9, 2003

July 9, 2003

On Mon, 30 Jun 2003 09:25:45 -0600 John W M Stevens <john(a)betelgeuse.us> wrote: > TypeError: __init__() got an unexpected keyword argument 'errors' Install the Python email package. -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

2 1

Re: [Mailman-Developers] strange behavior with EXTERNAL_PUBLIC_ARCHIVER
by J C Lawrence July 8, 2003

July 8, 2003

On Tue, 08 Jul 2003 09:48:15 -0400 J C Lawrence <J> wrote: > On Sat, 28 Jun 2003 18:16:55 +0200 Jonas Meurer > <jonas(a)freesources.org> wrote: >> why does user list member different lists in the two cases? same uid, >> same gid, only the lists it members are different. > Because Mailman is run by a server which was started as root and which > then setuid'ed down to a lower privilege level. Uhh, I should have read more carefully. My error, I was wrong. -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

1 0