Mailman 3 September 2004 - Mailman-Developers

Re: [Mailman-Developers] Possible spam attack against MM lists
by J C Lawrence 01 Sep '04

01 Sep '04

On Thu, 02 Sep 2004 14:30:19 +0900 Stephen J Turnbull <stephen(a)xemacs.org> wrote: >> I use TMDA as a C/R system in front of all my lists and then remove >> all posting controls on the lists at the Mailman level. Given that >> the majority of list members never even try to post, this has been >> proven a particularly effective control. > Since the majority of spam uses faked addresses all around, except on > the envelope, I can see why. Yup. > I'm afraid you may be in for a nasty surprise in the near future (at > least if you run open-subscribe lists, even with confirmation) as I've > witnessed two recent incidents where the spammer subscribed to a > members-only-post list, then spammed. Given the ubiquity of Mailman it is only a matter of time. Turing tests are a bitch. > Since the confirmation for the subscription requires a valid address, > the TMDA challenge would go there, too! There's a minor detail of the envelope continuing to agree with the From: which can hurt there, but that's a detail. -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

1 0

Scrubber Question
by Kory Wheatley 01 Sep '04

01 Sep '04

Does Scrubber have the capibility of allowing attachments through that are a certain size? I know once you configure Scrubber and put it in action in Mailman, it will strip every attachment. This will not work for me, I would like to have Scrubber only strip attachments if there over a certain size. How can I grab the size of the attachment and check that right at the very beginning of the Scrubber.py script and if it's under a certain size don't run Scrubber and if it's over, run scrubber. Has anyone developed this in Mailman yet? I would really appreciate a response, this is something that our managers would really like to have working. -- Kory Wheatley Academic Computing Analyst Sr. Phone 282-3874 ######################################### Everything must point to him.

2 1

Addition to FAQ re: List of available customization fields
by Adam Boettiger 01 Sep '04

01 Sep '04

I've read both FAQ's and used the FAQ Search Tool and it came up empty, so this is something else you may want to add to the FAQ: I see that you can insert customized fields into outgoing messages by using the <MM-Field-Name> tag. Where can I find a list of all field names available for insertion in this tag? AB

3 4

Re: [Mailman-Developers] Possible spam attack against MM lists
by J C Lawrence 01 Sep '04

01 Sep '04

On Wed, 01 Sep 2004 15:55:47 +0100 Nigel Metheringham <Nigel.Metheringham(a)dev.intechnology.co.uk> wrote: > On Wed, 2004-09-01 at 10:41 -0400, J C Lawrence wrote: >> On Wed, 01 Sep 2004 11:16:05 +0100 Nigel Metheringham >> <Nigel.Metheringham(a)dev.intechnology.co.uk> wrote: >> I use TMDA as a C/R system in front of all my lists and then remove >> all posting controls on the lists at the Mailman level. Given that >> the majority of list members never even try to post, this has been >> proven a particularly effective control. > I am wondering about switching to the Mailman members initially > moderated policy, although I don't really want to increase the load on > the moderators. Quite. I implemented the TMDA system for my lists initially just to get the SPAM load off me as moderator. There's quite a relief in running a fully moderated list and getting single digit SPAM at the moderation interface per year. > Since in this case (which may be isolated or co-incidental) the > address forged as the sender address is a frequent list poster, using > TMDA would not seem to add much. TMDA uses the envelope sender rather than the From: address, which successfully traps most forged spam/virus mail. > What might add something would be an option where posters get a > response back on postings similar to the current message held for > moderation where they have a choice of actions - post or cancel at a > minimum. Yup, and in fact TMDA can be setup to do precisely this: just configure it to not add confirmants to the whitelist and reword the confirm request message to read as a posting check. >> I also put mimefilter (a MIME stripper) in front of the lists to >> remove dangerous payloads, and then auto-junk messages which end up >> too short (this doesn't catch much, but just enough to glad of). In >> 3 years of using this system or earlier variants of it I've had only >> 12 spam make it through the system. Not ideal, but certainly a >> tolerable rate. > Its recently been requested that we start allowing some MIME parts > through - especially PGP signature types and patch files. This is precisely why I use mimefilter instead of demine: it can be configured to leave specific MIME types untouched. I also wrapped mimefilter in a procmail recipe that skips the mimefilter step if a special X-header is present. In this way some MIME types can always get through, and individual members can special case specific messages to get a particular MIME construct onto the list. So far it has worked perfectly. > Loosening the current paranoid content posting policy (which is > actually there because historically pipermail didn't MIME and I want > the archives to be sane) is going to open the cracks wider and allow > some slime to lever things open further... Yeah, that's always the problem. As I keep telling a few people at work: Security (and accounting for that matter) is all about making sure that people don't do things. Doing our jobs done is all about actually doing things... -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

1 0

Possible spam attack against MM lists
by Nigel Metheringham 01 Sep '04

01 Sep '04

There has always been a stream of attempted SPAM to the lists I host, and to date, touch wood, its been caught by MTA address checking and MM member only post checking. I seem now to be getting posts to the list forged from addresses of list members (or in one case a list itself). The rejection of these so far has been pretty much by sheer luck (they failed the content policy checks). Are other people seeing this? I am starting to think that my advocacy of mandatory death sentences for spammers is far too liberal and wishy-washy. Nigel. -- [ Nigel Metheringham Nigel.Metheringham(a)InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]

1 0