Mailman 3 February 2005 - Mailman-Developers

PGP and Mailman
by Joost van Baal 22 Jul '05

22 Jul '05

Hi, I will write and publish a patch which integrates PGP signature validation and re-encryption of encrypted posts to mailman. Specs are: - A post will be distributed only if the PGP signature on the post is from one of the list members. - For sending encrypted email, a list member encrypts to the public key of the list. The post will be decrypted and re-encrypted to the public keys of all list members. (Later, the patch will handle RFC 2633 (S/MIME) messages too, next to RFC 2440 (OpenPGP)). I've taken a look at the NAH6 secure list patch #646989 at http://sourceforge.net/tracker/index.php?func=detail&aid=646989&group_id=10… and at Ben Laurie's patch #645297 at http://sourceforge.net/tracker/index.php?func=detail&aid=645297&group_id=10… , but I believe none of these completely implements the listed requirements (although these will help me implementing, of course). I am asking you to take a look at my plan for implementation. Am I on the right track? So, the plan: I think one way to implement it would be to add two modules to GLOBAL_PIPELINE: in front, before SpamDetect, there would be 'PGPCheck'. PGPCheck would check wether the message is encrypted, and, if so, make a temporary decrypted copy in order to verify with which key is was signed. If the message is unencrypted, it would check the signature. It would store this information in new properties of the Mailman Message object. A second new module in GLOBAL_PIPELINE would be 'PGPRecrypt', to be called after CookHeaders' and before 'ToDigest'. This would, if needed, decrypt the message and reencrypt it to all recipients, and would sign it. If for instance a list member erroneously signs a post with a wrong public key, and encrypts the message, this message should be handled carefully. I believe the Hold module should be adapted for this. A copy of the original encrypted message should be kept. The message should be decrypted, signed with the listkey, encrypted to the list moderator key, and sent for acknowledgement. If the moderator chooses to deny the message, the poster should get her original message back. (I guess.) For all PGP handling, I plan to use Frank J. Tobin's GnuPGInterface ( http://py-gnupg.sourceforge.net/ ). I plan to write the patch against current stable Mailman. Any insight to share on this? Thanks! Bye, Joost -- Joost van Baal http://abramowitz.uvt.nl/ Tilburg University j.e.vanbaal(a)uvt.nl The Netherlands

4 12

RE: [Mailman-Developers] Min requirements for running Mailman?
by John.Airey＠rnib.org.uk 31 May '05

31 May '05

> -----Original Message----- > From: mailman-developers-bounces+john.airey=rnib.org.uk(a)python.org > [mailto:mailman-developers-bounces+john.airey=rnib.org.uk@pyth > on.org]On > Behalf Of Tollef Fog Heen > Sent: Monday, 06 September 2004 16:47 > To: mailman-developers(a)python.org > Subject: Re: [Mailman-Developers] Min requirements for > running Mailman? > > > * Nigel Metheringham > > | I'd tend to take this as:- > | * Mailman is a bitch to package > > Not really. It's fairly well-behaved in my experience. It's a > semi-large web application with some requirements, but nothing > unreasonable. > > | * RH have packaged it for a while > | * RH found a good few of the gotchas in packaging Mailman > | * RH have subsequently learnt from their mistakes and recently > | have produced good packages. > | * Other distros may do better, or may yet have to > learn from their > | mistakes :-) > > Mailman has been in Debian since June 1998 (1.0b4), so we've been > working on it for a while as well. I think our packages are of good > quality (far from perfect, but making perfect packages is _a lot_ of > work. ;) > Just to throw my tuppence worth in... I've used mailman since Red Hat 7.2. I found that the version that came with Red Hat 9.0 wouldn't work for me (ie I couldn't upgrade to it) so I stuck with the 7.2 version (2.0.13) till the end of Red Hat 9 support. We are now running the 2.1.5 version that comes with Fedora but running it on Red Hat Enterprise Linux (RHEL). I did however have to recreate all the lists by hand in an overnight shift (what fun that was...) a few days before leaving the country (hence the rush). At that time I didn't know I could export the configuration (Doh!). Red Hat have taken some packages out of RHEL eg arpwatch and mysql-server (although this is in the "extras" channel) even though these are in the source RPM. Mailman is currently not included but might be being put back in to RHEL 4.0. I would like to hope so, as I find 2.1.5 far superior to 2.0.13. -- John Airey, BSc (Jt Hons), CNA, RHCE Internet systems support officer, ITCSD, Royal National Institute of the Blind, Bakewell Road, Peterborough PE2 6XU, Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey(a)rnib.org.uk To truly believe in Evolution requires complete faith that life has no meaning. Fortunately there are billions of people who aren't that stupid. -- DISCLAIMER: NOTICE: The information contained in this email and any attachments is confidential and may be privileged. If you are not the intended recipient you should not use, disclose, distribute or copy any of the content of it or of any attachment; you are requested to notify the sender immediately of your receipt of the email and then to delete it and any attachments from your system. RNIB endeavours to ensure that emails and any attachments generated by its staff are free from viruses or other contaminants. However, it cannot accept any responsibility for any such which are transmitted. We therefore recommend you scan all attachments. Please note that the statements and views expressed in this email and any attachments are those of the author and do not necessarily represent those of RNIB. RNIB Registered Charity Number: 226227 Website: http://www.rnib.org.uk

6 11

Hashing member passwords in config.pck
by Barry Warsaw 05 Mar '05

05 Mar '05

I think CAN-2005-0202 gives us the opportunity to finally implement what we have long considered an embarrassing exposure in Mailman's config.pck databases. Member passwords are kept in this database in the clear. The obvious fix is to hash member passwords and keep only the hash in the database. We haven't changed this before now for two reasons: 1. We would have to regenerate all member passwords, which is an administrative burden. We might also need to implement checks to see if the passwords were cleartext or hashed and do the password comparison accordingly. 2. This breaks all password reminders. To fully address CAN-2005-0202 we're recommending sites regenerate their member passwords anyway, so this gives us an opening to fix this properly. And we have a better internal password generator now too. As for #2, well, I think most people hate those password reminders anyway, and we've decided that they are going away for MM3. I don't think many people would shed too many tears if we killed off monthly password reminders for 2.1.6. Doing that would also eliminate the requirement for the site list, since its primary purpose is to function as the sender of the reminder messages. To do this for 2.1.6, we'd have to change the "Email My Password To Me" feature in the options page and in the member login page. These would have to become a "create a new password for me" feature. Also, crontab.in should not call mailpasswds anymore, or that script should turn into a simple "here's the lists you are on" reminder, without the password information in it. This will require i18n updates too. The downside to doing this now is that it's more coding work for 2.1.6 and I'd like to get the new version out asap. Still, this seems like an opportunity that we shouldn't lightly dismiss. What do you all think? Is anybody willing to take a crack at a patch for this? -Barry

28 91

Mailman 2.1.6b4
by Barry Warsaw 04 Mar '05

04 Mar '05

Okay, I've pushed the 2.1.6b4 tarball out to SourceForge (now that file uploads are working again ;). I will likely be off-line until Tuesday. -Barry

4 3

High Availability
by Preston Wade 28 Feb '05

28 Feb '05

Hello, I read some old post back in 2002 on this list about Load balancing. In my scenario I don't have near the volume to warrant load balancing but I am interested in fail over capabilities. Would it cause Mailman any heartburn if I simply wrote an rsync script to keep the trees in sync? And then use the heartbeat package to do automatic fail over. I realize depending on my sync cycle I will potentially loose some data. Is there a better alternative to this? Also I saw there are plans to move to a user store were users would have one password for all list. Have there been any considerations for LDAP as that user store? Thanks, Preston

2 1

when is "driver" script invoked?
by John Dennis 28 Feb '05

28 Feb '05

In the scripts subdirectory is a file called "driver", the comments at the top of the file say its used to run CGI scripts. In a standard 2.1.5 installation I don't see anything that actually invokes "driver", but perhaps I've overlooked something. When is driver invoked? Is it only for optional third party cgi scripts? -- John Dennis <jdennis(a)redhat.com>

3 2

SMTPDeliver.py still can't do MTA VERP?
by Dan Mick 27 Feb '05

27 Feb '05

a long long *long* time ago now, I made a small hack to SMTPDeliver.py to add options to the sendmail connection EHLO, to enable VERP generation in the MTA (so that the sending system didn't have to send N messages to the MTA to accomplish VERP, but rather let the MTA deal with it). For Postfix, this is as simple as adding the XVERP option. I still don't see any facility for doing this in a generic way; has anyone addressed the problem, and if so can someone point me at the solution?..

6 7

ping
by pabs 25 Feb '05

25 Feb '05

Hi, Is this list broken, or has everyone left? -- bye, pabs

3 2

Re: [Mailman-Developers] ping
by J C Lawrence 25 Feb '05

25 Feb '05

On Fri, 25 Feb 2005 11:03:34 +0800 pabs <pabs(a)cat.org.au> wrote: > Is this list broken, or has everyone left? <Looks up from his editor that's wrapping libproc into a python modules...> Wha? <goes back to hacking> -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

1 0

withlist and RFC 2606
by DIG 19 Feb '05

19 Feb '05

Hi, mailman-dev! Shouldn't the host name in the example be made compliant with the RFC 2606 (Reserved Top Level DNS Names)? ,--[ cvs diff ]-- | Index: withlist | =================================================================== | RCS file: /cvsroot/mailman/mailman/bin/withlist,v | retrieving revision 2.11 | diff -u -r2.11 withlist | --- withlist 17 Apr 2003 03:52:08 -0000 2.11 | +++ withlist 19 Feb 2005 09:26:56 -0000 | @@ -115,7 +115,7 @@ | print 'No address matched:', addr | | and run this from the command line: | -%% bin/withlist -l -r changepw mylist somebody(a)somewhere.org foobar | +%% bin/withlist -l -r changepw mylist name(a)example.org foobar | """ | | import sys `--[ ]-- Best regards, -- DIG (Dmitri I GOULIAEV) 1024D/63A6C649: 26A0 E4D5 AB3F C2D4 0112 66CD 4343 C0AF 63A6 C649

1 0

bin/update slowness fix
by pabs 19 Feb '05

19 Feb '05

Hi mailman devs, listworkers, We recently upgraded lists.indymedia.org from version 2.1.4 to 2.1.5[0]. We soon found that update_pending in the update script was a little slow [1] (taking a couple of minutes to complete each list, for a total of 22 hours or so - we have > 1000 lists). Long story short, here[2] is a patch that we used to speed that up to 0-2 seconds per list (against mm 2.1.6b3). It isn't exactly correct, because I wasn't able to work out how to call private members of MailList subclasses quickly and the priority was just to get the upgrade done, but it does work. I really think that either it, or a properly done patch (with no code duplication) should go into the upcoming release of 2.1.6. 0. This was debian 2.1.4-5 to 2.1.5-6 btw. 1. A quote from the script: # This is not the most efficient way to do this because it loads and # saves the pending.pck file each time. :( 2. http://sf.net/tracker/?func=detail&aid=1124510&group_id=103&atid=300103 PS: We've some other patches too that may or may not be useful, please visit http://lists.indymedia.org/patches/index.en.html and let us know if you would like us to update them for 2.1.7/2.2 (and non-debian). -- bye, pabs http://docs.indymedia.org/view/Main/PaulWise

1 0

Re: [Mailman-Users] How to get Sender Id from the Mailing List where the annoymous option is set
by Brad Knowles 17 Feb '05

17 Feb '05

At 3:57 AM -0800 2005-02-08, vijayan p wrote: > Can anyone tell me how to obtain the statistics of > which member has posted how many messages. I think you'd have to look at the incoming messages in the MTA logs, before they get handed off to Mailman. But keep in mind that Mailman does not have any facility for creating or monitoring statistics, unless you want to create a script to do that. > Also is there a way to know who has posted a > particular mail. Basically the same issue. -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

1 0

new on list.
by Maat 17 Feb '05

17 Feb '05

hi all, I'm new on this list. hope i will be able to help (little and very humble patches). first i'm wondering : the cvs tree @sourceforge seems to be out of date... have i smoked something too stong for me or am i right ? if i'm right where is the true tree please ? grtx Pascal -- Pascal Vilarem <maat(a)vilarem.net> "Alterius non sit qui suus esse potest"

2 1

Fwd: [NOSI discussion] Same planet, different worlds
by Tobias Eigen 17 Feb '05

17 Feb '05

As promised - a message I posted this morning to the Nonprofit Open Source Initiative discussion list (see http://www.nosi.net for details on NOSI). Let me know, perhaps off-list if this discussion is starting to seem a bit off-topic, if you are interested in getting involved in this. Check out http://www.penguinday.org for info about Penguin Day, which is taking place this year a day after the Nonprofit Technology Conference (http://www.nten.org/ntc). I will be at both events and look forward to opportunities to talk to people about Mailman usability and replicating Yahoogroups-like functionality using open source. Best wishes, Tobias -- Tobias Eigen Executive Director Kabissa - Space for Change in Africa http://www.kabissa.org * Kabissa's vision is for a socially, economically, politically, and environmentally vibrant Africa, supported by a strong network of effective civil society organizations. * Begin forwarded message: > From: Tobias Eigen <tobias(a)kabissa.org> > Date: February 17, 2005 11:51:45 AM EST > To: nosi-discussion(a)nosi.net > Subject: Re: [NOSI discussion] Same planet, different worlds > >> On a related note, how many of you will be at NTC next month and the >> associated Penguin Day Chicago on the following Saturday? > > Ah! So that's when it's going to be! I've been waiting for news via > penguinday.org... now I can book my flight! > >> Anyone got something really profound or eye-poppingly cool that you >> want to demo, discuss, or proclaim at PD? > > For Kabissa, I've been tracking and actively participating in lots of > discussions about yahoogroups and replicating the best aspects of it > using open source. I would be really interested in taking advantage of > Penguin Day to raise awareness of the need for this and to generate > momentum to raise funds, find partners and recruit developers to work > on it. > > While alot of great work is being done on open source list managers > and on discussion forums/web collaboration tools, there is not much > progress being made on bringing the two together in an open source > project that can be replicated and made broadly useful by many > organizations. It's happening, but piecemeal and in the meantime it's > a shame to subject ordinary people to Mailman's web interfaces (try > accessing the private archives for the NOSI discussion list and you'll > see what I'm talking about) and to not properly take advantage of the > dynamic and empowering effect of connecting people through their > mailboxes as well as through a beautiful community Web site. For > Kabissa it's incredibly important because the people in Africa we > serve pay dearly for their Internet connection and we want to empower > them to make the most of their limited time oline. > > Now there seems to be a particularly grand opportunity because a bunch > of things are coming together at the same time: > > 1) Mambo was awarded a Product Excellence Award at LinuxWorld this > week (http://www.mamboserver.com) - one of the things that makes Mambo > excellent is that it can be easily extended using optional components, > and it's easy to create and share components > 2) Opendgroups is being developed to share the functionality of the > already successful dgroups.org service using open source (see > http://www.opendgroups.net). One of the models being considered is a > Mailman/Drupal integration. > 3) Mailman developers are recognizing the need for making its web > interfaces more usable (see > http://www.mail-archive.com/mailman-developers%40python.org/ > msg08628.html and subsequent onslaught of messages). > 4) Mail2forum, a phpbb add-on that provides bidirectional email/list > support, is now at v1.0 RC2. (http://www.mail2forum.com) - m2f > developers claim it can be easily ported to other forums and welcome a > project team to port it to another forum that integrates better with > Mambo (see http://www.mail2forum.com/forums/viewtopic.php?t=796). > 5) Alot of reputable, open source friendly web developers are using > Mambo - i.e. Sangonet in South Africa (http://www.sn.apc.org) and > Picnet (http://www.picnet.net - also will be at NTC). Picnet is > interested in developing a CAN-SPAM act compliant Mambo newsletter > component (http://www.picnet.net). This could complement an integrated > forum component nicely and share code with it to interact with a list > manager like Mailman. > 6) Kabissa's interest in all of this is that we want to deepen the > impact of our programs by integrating and improving our existing > online offerings through the development of a new integrated Web site. > We have 850 member organizations throughout Africa that are seeking to > make better use of ICT for the benefit of their communities, and many > of them are hosting their Web sites and domain names on Kabissa, > participating in our Time To Get Online training program, and finding > each other online through our member contact directory, bulletin board > and mailing lists. Having bidirectional functionality for newsletters > and discussion groups integrated into our site will really help us to > deliver on our promise to the African civil society sector. This user > group also provides a great source of willing volunteers for pilot > testing. > 7) Kabissa is also involved in developing a community Web site for the > Africa Democracy Forum (http://www.africademocracyforum) which > currently interacts primarily through a Yahoo Group and face-to-face > meetings. We are planning to work with the ADF to move their Yahoo > Group to a Mambo-integrated forum, where we can then do alot more to > help ADF members to interact online, discuss key topics and share > information about opportunities. One of the key requirements for the > forum is to have bidirectional email support, in part also to ease the > pain of migrating from yahoogroups. > > Sorry for the lengthy list - I'm throwing this out there for > discussion. I'm sure I and others on this list could come up with even > more ideas. :-) If we could bring together a group at Penguin Day to > discuss some of these different pieces of the puzzle perhaps we could > come up with a collaborative plan for producing a very useful and > broadly replicable open source product. > > Cheers, > > Tobias

1 0

Re: [Mailman-Users] from field with real name
by Tokio Kikuchi 17 Feb '05

17 Feb '05

Hi, Mark Sapiro wrote: > Stefan Hofmeir wrote: > >>the sender (from field) of a newsletter list should be the address of >>the list (anonymous_list = yes). >> >>previous from field (of the test list "mailman"): >>From: mailman(a)testdomain.de >> >>How it is possible to sent also a real name like >>From: "list ABC <mailman(a)testdomain.de>" in every newsletter? > > > You have to hack Mailman/Handlers/Cleanse.py to do this. > It sounded like a reasonablly small and nice hack request so I inserted a few steps of code in Cleanse.py. I used internal_name instead of real_name though. It was checked in CVS and will be in 2.1.6 soon. Cheers, -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

1 0

Re: [Mailman-Users] How to get the sender id when the list is set to annoymous mode
by Tokio Kikuchi 17 Feb '05

17 Feb '05

Hi, Brad Knowles wrote: > At 3:06 AM -0800 2005-02-15, vijayan p wrote: > >> I would like to know if as a administrator, is there a >> way i can get the senders email id for the messages >> posted. > > > If you have access to the server logs, you can track them by > message-id. It should be easy to track the original poster of anonymous list, so I added a function to log anonymizing action in post log. Cheers, -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

1 0

[Fwd: Fwd: Re: [Mailman-Announce] Critical security update for Mailman 2.1.5 and earlier [origin: mailman-developers-owner@python.org]]
by Barry Warsaw 17 Feb '05

17 Feb '05

2 1

Sprinting at Pycon 2005
by Barry Warsaw 16 Feb '05

16 Feb '05

I encourage everyone who wants to help speed Mailman3 progress to join us at Pycon 2005 for a Mailman 3 sprint. Here's the sprint page: http://www.python.org/moin/Mailman3Sprint If you're coming, please add your name to the list. I think we can make some significant progress if we get enough people. I'm willing to talk about how to improve the process so more people can contribute. Pycon2005 is in Washington DC March 23-25, 2005. While there is a fee for the main conference, there are 4 days of planned sprints from March 19-22 and these are free. I am currently planning on attending the entire conference, including all 4 sprint days, and I'd be happy to sprint on MM3 the whole time. -Barry

1 0

RE: making Mailman CAN-SPAM compliant (was Re:[Mailman-Developers] Hashing member passwords in config.pck)
by Brad Knowles 16 Feb '05

16 Feb '05

At 11:28 AM -0400 2005-02-16, Adrian Bye wrote: > We've previously had conversations about some Yahoo groups >functionality which > you said wasn't possible: > > http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq04.039.htp Indeed, we have. > Yesterday I contributed patches which enables Mailman to have this exact > functionality which we borrowed from Yahoo Groups. Yet I've seen no response > from you yet, and only one half dismissive response from another mailman > developer. I've been waiting to see what Barry, Tokio, or one of the other core developers think of these patches. Keep in mind that they are exceptionally busy people, and it may take a long time for them to be able to take a look at them. I have not yet had a chance to look at them myself. I've been focused on putting together my own little script to assist in the day-to-day site administration tasks for running a Mailman mailing list server, one of the few areas where I can see that Mailman can use improvement, and where my previous experience and limited scripting skills can be put to good use in helping to make this situation better. Well, at least better for me, and then contribute the patch to SourceForge so that others can take a look at it and see if it's useful for them. My hope is that this might be able to be incorporated into future versions of Mailman as well. So, you take me to task for not having yet posted an exhaustive analysis of your patch, but I don't see a comment from you on my script. Can we call it even? > Mailman CAN be as good - and better - than Yahoo Groups. It doesn't > have to take lots of money and resources. Just being willing to accept > our code a piece at a time, and encouraging those who contribute will > go a long way towards getting there. You are right that Mailman can be better than Yahoo!Groups. I don't think you're going to make Mailman better than Yahoo!Groups in every respect, at least not without spending a lot of money. But we can continue to take steps towards that goal. That said, we do gladly accept contributions, but since this is a non-profit open source project which is maintained in what little spare time that people have, you have to accept that it may take a while for the contributions to be reviewed and analyzed by the appropriate people. As for Tobias' contributions to Mailman, he has already given us quite a lot, and has a great deal more that has been done for his own site and which I believe he is happy to contribute to the project. I look forward to continuing to work with him in the future. However, just because I've agreed to work with him in doing Mailman administration for his site and I will try to do what I can to help him get better integration between Mailman and an amazingly wide variety of other projects, and hopefully be able to bring this experience back to the Mailman project, that doesn't necessarily mean that I will always agree with him 100% -- either in private or public. You should not make any assumptions about general attitudes towards all possible future contributions from the community or third parties, based on a single response. In this particular matter, I was talking about the current capabilities of Mailman, not where we hope to ultimately be able to take it. > There may be some disagreement on the unsubscribe styff, but the > header/footer handling only benefits everyone. I certainly hope that > the mailman team will be responsive, and accept these patches and > integrate them into the codebase. From my side we'll do whatever it > takes to make that happen. Just tell us what we have to do. That's great news! However, we do ask that you give the core developers a little time to look over your contribution and make their analysis. -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

1 0

bug in mailman 2.1.6b2
by Fil 16 Feb '05

16 Feb '05

Hi, I just installed Mailman from CVS two days ago, and on a new list I just created I'm hit by a bug : http://listes.rezo.net/mailman/admin/spip-trac/privacy/sender Bug in Mailman version 2.1.6b2 We're sorry, we hit a bug! Please inform the webmaster for this site of this problem. Printing of traceback and other system information has been explicitly inhibited, but the webmaster can find this information in the Mailman error logs. the error log is attached -- Fil

3 4

mmdsr -- Mailman Daily Status Reports script...
by Brad Knowles 15 Feb '05

15 Feb '05

Folks, I just posted a patch for this at <https://sourceforge.net/tracker/index.php?func=detail&aid=1123383&group_id=…>. I'd appreciate any feedback that you may have. Thanks! -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

1 0

Html headers & footers, unsubscribe
by Adrian Bye 15 Feb '05

15 Feb '05

Hi guys, I have had patches made for two issues: 1. HTML headers & footers handling 2. 1 click list unsubscribe You can get our patches here: https://sourceforge.net/tracker/index.php?func=detail&aid=1121257&group_id=… tid=300103 Or also here: http://tasdevil.com/mailman_developers.zip Installation instructions are found in readme.txt What we did: 1. Reasonably good handling of HTML headers & footers The issue we wanted to address is this one: http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq04.039.htp I wanted to be able to put html headers and footers into messages. I did not like the current mailman style of adding an attachment. I knew this must be possible to do because yahoo groups is doing it. So we spent a LOT of time testing how yahoo groups adds footers to mails. We tested multipart messages with varying numbers of attachments, badly formed html and a bunch of other stuff. We have documented our testing process in mime.txt. Our implementation is about 95% perfect, and works identical to yahoo groups, which is sending millions of emails/day. It will correctly handle badly formed html, and various mimetypes. Sometimes, depending on the colors of a message, it will not be possible to view the headers & footers. Otherwise it works really well. 2. 1-click unsubscribe with the URL under 60 characters. I've been involved in some discussions on this topic on the developers list. The current unsubscribe process was not clear to me, and I wanted it to be very easy for my users. I also wanted the URLs to be short, so they would never get broken by various mail clients. We made some small changes to encode the users email address and listnames to the footer, along with the user password. When a user wishes to unsubscribe, they click on the link, it passes this information to mailman, and a confirmation page is then shown. The user can choose to unsubscribe by clicking on the "yes, I want to unsubscribe" button. I work with users who are less advanced than your average AOL customer, so both of these points were extremely important to solve. While many do feel its important to continue requiring passwords for mailman accounts, I would strongly advocate that those passwords become hidden just for access to archives. I'd like to see mailman become capable of handling millions of messages/day, and it is only when simple unsubscribe functionality is incorporated that the resources will start to appear to make that possible. Yes, this may represent some change, but I believe it can be done in a way which leaves everyone happy. Anyways, those are our modifications. If you have code questions, all coding was done by Bushmanov Efim, who can be reached at binworkers(a)dcemail.com. He is available for more work of this kind if you need it, and I would highly recommend him as a great programmer. For other questions drop me a line. Cheers, Adrian

2 1

Mail-to-news gatewaying?
by Brad Knowles 15 Feb '05

15 Feb '05

Folks, Okay, so we know about the issue of munging Message-ID: (if you don't know what I'm talking about, see <http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq04.059.htp>). The latest crisis that has me wondering is the subject prefix stuff. Looking in NewsRunner.py, starting at line 104, we have: # Should we restore the original, non-prefixed subject for gatewayed # messages? origsubj = msgdata.get('origsubj') if not mlist.news_prefix_subject_too and origsubj is not None: del msg['subject'] msg['subject'] = origsubj However, we still have a problem. If mail clients reply to the message to the list (which will include the subject prefix), then this will result in a new message with a subject prefix for the list already present. Now, Mailman is smart and avoids adding a second subject prefix, but it doesn't strip out the subject prefix if one already exists. For the mailing list, this subject prefix stripping isn't necessary. But for gatewaying to the newsgroup, it might be desirable. This would also resolve the issue of restoring the original subject when gatewaying -- don't bother, and just let the subject prefix stripper deal with it. If this were sed or Perl, I could quickly put together a one-line hack to implement this feature. For example, just doing something off the top of my head, you might be able to use something like: subject=y/\w*$prefix\w*/ /; But this is Python, and I don't really grok Python. Can someone help me out here? Looking at <http://www.python.org/doc/2.3.4/lib/module-string.html>, I'm imagining some sort of permutation of find(), split(), either lstrip() or rstrip(), and then join(), should be sufficient to do the job. But I'm not quite able to figure out how to put them all together. Of course, the reason why I ask is that I'm getting complaints about the mail-to-news gateway I'm running at another site, and I don't want this to blow up into an ugly situation. Sigh.... -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

5 9

Userdefined HELO with SMTPDirect
by Palomäki Kai 15 Feb '05

15 Feb '05

Hello, It would be useful in some situations (for example Mailman and Postfix running on same host) to define custom HELO when using Mailman SMTPDirect delivery module. I made simple patch to achieve this. But since my experience with Python is minimal I don't know if this is "the right way(tm)". diff -u -r mailman-2.1.6b3/Mailman/Defaults.py.in mailman-2.1.6b3-patched/Mailman/Defaults.py.in --- mailman-2.1.6b3/Mailman/Defaults.py.in 2005-01-22 08:55:28.000000000 +0200 +++ mailman-2.1.6b3-patched/Mailman/Defaults.py.in 2005-02-13 12:59:28.000000000 +0200 @@ -422,6 +422,11 @@ SMTPHOST = 'localhost' SMTPPORT = 0 # default from smtplib +# SMTP HELO sent by Mailman, when DELIVERY_MODULE is 'SMTPDirect'. Default +# is FQDN of localhost (as returned by socket.getfqdn()) +# SMTPHELO = 'my.own.fqdn.hostname' +SMTPHELO = None + # Command for direct command pipe delivery to sendmail compatible program, # when DELIVERY_MODULE is 'Sendmail'. SENDMAIL_CMD = '/usr/lib/sendmail' diff -u -r mailman-2.1.6b3/Mailman/Handlers/SMTPDirect.py mailman-2.1.6b3-patched/Mailman/Handlers/SMTPDirect.py --- mailman-2.1.6b3/Mailman/Handlers/SMTPDirect.py 2004-01-23 01:02:07.000000000 +0200 +++ mailman-2.1.6b3-patched/Mailman/Handlers/SMTPDirect.py 2005-02-13 12:29:59.000000000 +0200 @@ -59,7 +59,7 @@ self.__conn = None def __connect(self): - self.__conn = smtplib.SMTP() + self.__conn = smtplib.SMTP('', 0, mm_cfg.SMTPHELO) self.__conn.connect(mm_cfg.SMTPHOST, mm_cfg.SMTPPORT) self.__numsessions = mm_cfg.SMTP_MAX_SESSIONS_PER_CONNECTION

1 0

Re: [Mailman-Users] security heads up - path traversal with 2.1.5
by Tokio Kikuchi 15 Feb '05

15 Feb '05

Hi, Ron Brogden wrote: > Hey folks. I haven't see an official post here yet but as this has already > gone out on at least one full-disclosure list I thought it worth mentioning > since this will be an actively exploited 0 day: > > http://lists.netsys.com/pipermail/full-disclosure/2005-February/031562.html Barry and I are notified on this subject but both are busy on their job so he requested for delay in the disclosure. > > Basically, there is a path traversal issue with mailman 2.1.5 which will let > you access any file that the Mailman user has read access to (at least under > Apache 1.3, can't speak for other web servers). I have tested this on a > personal box and it does indeed work as advertised. I've tested with my 1.3.29 installation and verified apache PATH_INFO does convert '//' to '/'. Barry also wanted to clarify which apache version/installation (combination with mailman) is valnerable. Return code of 200 doesn't mean sucessful exploit. You should check mailman logs/error also. (If there is none chances are succesful exploit.) > > One temporary workaround is to stop access to "/mailman/private" via your web > server configuration. I would wait for a formal patch notice from the > developers before patching the actual Mailman code. Also newly introduced script bin/reset_pw.py may be useful if your list has been really exploited. (It should be veiwable from SourceForge CVS but it looks like currently in trouble.) -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

2 2

Re: [Mailman-Users] security heads up - path traversal with 2.1.5
by Brad Knowles 14 Feb '05

14 Feb '05

At 2:09 PM +0100 2005-02-14, Florian Weimer wrote: > The underlying assumption seems to be that Mailman security bugs can > only be disclosed by posting them on the Mailman lists. In response to this issue, FAQ 1.27 has been updated, and the mailman-users and mailman-developers mailing lists have likewise been modified to include suitable text at the bottom of every message, as well as on the "listinfo" page, and in the "welcome" message that is sent to all new subscribers. This matter is now closed. -- Brad Knowles <brad(a)python.org> Python.org Postmaster Team

3 2

Re: [Mailman-Announce] Critical security update for Mailman 2.1.5 and earlier
by Michael Janssen 14 Feb '05

14 Feb '05

On Thu, 10 Feb 2005, Axel Beckert wrote: > Am Thu, Feb 10, 2005 at 09:41:05AM -0500, Barry Warsaw schrieb: > > Until Mailman 2.1.6 is released, the longer term fix is to apply > > this patch: > > > > http://www.list.org/CAN-2005-0202.txt > > Which unfortunately only works with Python 2. Python 1 (respective at > least 1.5.2) complains about syntax errors. (Which, in fact, also > helps against the vulnerability by displaying the "You've found a > Mailman bug" page. ;-) > > Is there any patch which complies with Python 1 syntax? not as a patch, cause I haven't got a CVS repository available but you can change the line safe = [x for x in parts if x not in ('.', '..')] which is list comprehension syntax into: safe = [] for x in parts: if x not in ('.', '..'): safe.append(x) which does obviously the same: Append to safe every x in parts which are not "." or ".." regards Michael

1 0

mailman email harvester
by Bernhard Kuemel 12 Feb '05

12 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Valdis.Kletnieks(a)vt.edu wrote: | On Sat, 12 Feb 2005 02:48:56 +0100, Bernhard Kuemel said: | | |>If hashcash (http://www.hashcash.org/) gets integrated in our mail |>systems we no longer need to hide or obfuscate our email addresses. | | | On the other hand, widespread distribution of hashcash will probably mean | the end of many mailing lists, because you can't trust users to actually | whitelist everything they subscribe to. If a user choses to use hashcash he must understand it. If he doesn't and subscribes to a mailing list all the list mail will go to his spam folder. He will learn from that and whitelist list mail. | And remember that the whole *idea* | of hashcash is that you make it impractical for somebody to send 3,000 pieces | of mail. I'm sure netsys.com wouldn't want to keep full-disclosure if they had | to do hashcash for even 10% of their users. They would not hashcash every mail, but sign each incoming mail so spammers can't spam suscribers whose addresses then can be published again. | I'll overlook the issues caused when you *dont know* what to whitelist. | For instance - many mailing lists (including this one) have a "confirmation | of subscription" check. For bonus points - should you have whitelisted: | | a) full-disclosure(a)lists.netsys.com (the actual list name) | b) full-disclosure-request(a)lists.netsys.com (the rfc822 header on my confirm) | c) full-disclosure-admin(a)lists.netsys.com (the rfc821 MAIL FROM:) | d) mailman@ | e) majordomo@ | f) listserv@ Subscribing to mailing lists has always been a process of following instructions. If you subscribe via a web page, this web page will tell you which addresses to whitelist. If you subscribe via email firstly there will also be some source of instructions how to subscribe, and secondly you can whitelist replies that reference (private) emails you sent recently. | There's also all the stuff that things like amazon, ebay, your bank, | your insurance company, your utility companies, etc... all send out, | that users will forget to whitelist. They can send hashcashed requests for being whitelisted which will pop up a window similar to message receipt requests. | Hashcash really sucks if you're a mail server admin who has to crank 50,000 | hash cashes a day at 5 CPU seconds a pop because people forgot to whitelist | your server. I don't understand the situation. Human edited mail is usually created on a workstation that is capable of making hashcash while the mail is edited. Mass mail generated on a server falls into several categories: 1) spam: let them make hashcash 2) solicited recurring mail: send hashcashed whitelist request and follow up with unpaid mail. If unpaid mail gets rejected stop sending mail. Actually, there is little reason not to make the whitelisting part of the service subscription process. 3) Replies should be whitelisted automatically. 4) legitimate systems that initiate mail conversation must make hashcash. Can you think of any examples? | Hashcash isn't even a tiny speed bump if you're a spammer and have 50,000 | zombies - each one only takes a 5 second hiccup and continues spamming.... Configure your system to require more. 1 minute. Or 10. Or 20. The amount of hashcash can be put in an email address comment or if insufficient cash is sent, the receiving system can automatically request more. | But yeah, other than all those minor details, hashcash is a fine solution. ;) ecash may be even better. You don't have to accept the postage. Only take it from unwanted mail. Bernhard -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) Comment: Using GnuPG with Debian - http://enigmail.mozdev.org iD8DBQFCDfJ89zL78+QhnUgRAu+pAJ95pzHYaMatinzyQ3wtIIeQqGb/uwCgi+4o 4I44MDzL2TeHQ1KLQGW7kts= =HCYs -----END PGP SIGNATURE-----

1 0

mailman email harvester
by Bernhard Kuemel 12 Feb '05

12 Feb '05

This mail got blocked at first because I was not subscribed with my current email address. Some of you may remember that I announced the release of the harvester script. We discussed the issue and as the result was, not to change mailman, I now released the script to raise public awareness of the problem. Bernhard -------- Original Message -------- Subject: mailman email harvester Date: Mon, 07 Feb 2005 23:48:44 +0100 From: Bernhard Kuemel <bernhard(a)bksys.at> To: full-disclosure(a)lists.netsys.com, bugtraq(a)securityfocus.com, mailman-developers(a)python.org Hi! Tons of email addresses from mailman mailing lists are vulnerable to be collected by spammers. They are "protected" by obfuscation (user(a)example.com -> user at example.com) and access to the subscriber list can be restricted to subscribers. The obfuscation is trivially reversed and harvester scripts can subscribe to gain access to restricted lists. I suggested a graphical turing test that would bar scripts but the mailman developers argued spammers might hire a couple of temps that would solve the test as it already happened for the creation of email accounts. The only solution would be not to have the desired information available. This is already an option by restricting access to the member list to the list administrator. However, still many lists either have the member list openly published, or available to the list members. To raise awareness to this issue I wrote a script that collects addresses from openly accessible lists. It stops after processing 1000 (the maximum allowed) search results from google and collects 76772 email addresses (61124 unique). It is attached as mmxp1. An improved version that collects addresses that are restricted to subscribers, processes more lists and works more parallelized is planned. Bye, Bernhard #!/usr/bin/perl -w #http://www.google.com/search?q=%22list+is+only+available+to+the+list+members%22+mailman/listinfo&start=600&num=100 #2.1.4 "current archive" "private list which" mailman/listinfo site:org $n=0; $u=0; for ($i=0;1;$i+=10) { $#urls=-1; $google=`wget -qO - -U 'any browser' 'http://www.google.com/search?q=%22Click+here+for+the+list%22+mailman%2Flist…'`; # print $google; @urls=($google=~m*<p class=g><a href=(http://\S+?)>*g); # print join("\n",@urls); if ($#urls==-1) {last;} # print "\naoeu $#urls\n"; foreach $url (@urls) { $u++; $url=~s*/listinfo/*/roster/*; print STDERR "$url...\n"; $roster=`lynx -connect_timeout=10 -dump $url`; # print $roster; @mails=$roster=~/^ +\* $?\[\d+\](.* at .*?)$?$/mgo; foreach $mail (@mails) { $mail=~s/ at /@/; print "$mail\n"; $n++; } print STDERR "mails=".($#mails+1).", total=$n, url=$u, google=$i\n"; # exit; } #foreach url } #while google

5 6

Mailman 2.1.6 beta 3 released
by Tokio Kikuchi 11 Feb '05

11 Feb '05

Hi, I put together a tarball for Mailman 2.1.6 beta 3 and placed on my Japanese Mailman site at: http://mm.tkikuchi.net/mailman-2.1.6b3.tgz This is the third beta release of 2.1.6 which are roughly scheduled to be released by the end of February. Please grab it from above site and upgrade your mailman. Change from 2.1.6b2 are mainly to fix the directory traversal vulnerability CVE number CAN-2005-0202 http://www.list.org/security.html Here is excerpt from NEWS file: 2.1.6 (XX-XXX-200X) - Critical security patch for path traversal vulnerability in private archive script (CAN-2005-0202). - Date and Message-Id headers are added for digests. (1116952) - List owners can now cusomize the non-member rejection notice from admin/<listname>/privacy/sender page. (1107169) - Most of the installation instructions have been moved to a latex document. See admin/www/mailman-install/index.html for details. - VERP_PROBES is disabled by default. - bin/withlist can be run without a list name, but only if -i is given. Also, withlist puts the directory it's found in at the end of sys.path, making it easier to run withlist scripts that live in $prefix/bin. - bin/newlist grew two new options: -u/--urlhost and -e/--emailhost which lets the user provide the web and email hostnames for the new mailing list. This is a better way to specify the domain for the list, rather than the old 'mylist@hostname' syntax (which is still supported for backward compatibility, but deprecated). - Added the ability for Mailman generated passwords (both member and list admin) to be more cryptographically secure. See new configuration variables USER_FRIENDLY_PASSWORDS, MEMBER_PASSWORD_LENGTH, and ADMIN_PASSWORD_LENGTH. Also added a new bin/withlist script called reset_pw.py which can be used to reset all member passwords. Passwords generated by Mailman are now 8 characters by default for members, and 10 characters for list administrators. - Allow editing of the welcome message from the admin page (1085501). - A potential cross-site scripting hole in the driver script has been closed. Thanks to Florian Weimer for its discovery. Also, turn STEALTH_MODE on by default. - Chinese languages moved from 'big5' and 'gb' to 'zh_TW' and 'zh_CN' respectively for compliance to the IANA spec. Note that neither language is supported yet. - Python 2.4 compatibility issue: time.strftime() became strict about the 'day of year' range. (1078482) - New feature: automatic discards of held messages. List owners can now set how many days to hold the messages in the moderator request queue. cron/checkdb will automatically discard old messages. (790494) - Improved mail address sanity check. (1030228) - SpamDetect.py now checks attachment header. (1026977) - New feature: subject_prefix can be configured to include a sequence number which is taken from the post_id variable. Also, the prefix is always put at the start of the subject, i.e. "[list-name] Re: original subject", if mm_cfg.OLD_STYLE_PREFIXING is set No. The default style is "Re: [list-name]" if numbering is not set, for backward compatibility. If the list owner is using numbering feature by "%d" directive, the new style, "[list-name 123] Re:", is always used. - List owners can now use Scrubber to get the attachments scrubbed (held in the web archive), if the site admin permits it in mm_cfg.py. New variables introduced are SCRUBBER_DONT_USE_ATTACHMENT_FILENAME and SCRUBBER_USE_ATTACHMENT_FILENAME_EXTENSION in Defaults.py for scrubber behavior. (904850) - Filter attachments by filename extensions. (1027882) - Bugs and patches: 955381 (older Python compatibility), 1020102/1013079/ 1020013 (fix spam filter removed), 665569 (newer Postfix bounce detection), 970383 (moderator -1 admin requests pending), 873035 (subject handling in -request mail), 799166/946554 (makefile compatibility), 872068 (add header/footer via unicode), 1032434 (KNOWN_SPAMMERS check for multi-header), 1025372 (empty Cc:), 789015 (fix pipermail URL), 948152 (Out of date link on Docs), 1099138 (Scrubber.py breaks on None part), 1099840/1099840 (deprecated % insertion), 880073/933762 (List-ID RFC compliance), 1090439 (passwd reminder shunted), 1112349 (case insensitivity in acceptable_aliases) -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

2 1

Re: Please confirm your message
by Ian Eiloart 11 Feb '05

11 Feb '05

--On February 11, 2005 05:02:00 -0500 Bob Puff <bob(a)nleaudio.com> wrote: > Hello iane(a)sussex.ac.uk, > > ** IMPORTANT! Please Read! ** > In an effort to reduce spam, a message filtering service called TMDA has > been implemented on this mailbox. Bob, Can you please remove your TMDA protected email address from this list. Imagine if everyone on a thousand member list used TMDA. Every time you posted a message, you'd get a thousand requests to click on a link. For the list to work properly, a million clicks would be required, followed by another two thousand for every new member. > The purpose of this message is to verify that you, a live human, did > indeed sent a message (shown below) to this mailbox. > > It is IMPORTANT that you do one of the following two things: > > > 1. Simply reply to THIS message (you don't need to type anything, just > send a blank message), or > > 2. Click on this link: > http://nleaudio.com/cgi-bin/tmda.cgi?501.1108116120.3176.21a674 > > > After doing so, your messages will go through automatically, and you will > not see this message again. If you do not reply to this email within > three weeks, your original message may be lost. > > Thank you for your patience. This one small step saves this user from a > ton of spam. > -- Ian Eiloart Servers Team Sussex University ITS

1 0

www.python.org back online...
by Brad Knowles 11 Feb '05

11 Feb '05

Folks, The power problem has been resolved. It turns out that the machine itself was not down, but the switch it was connected to was. So, as far as it was concerned, it was the rest of the world that went away. ;) Anyway, www.python.org now points back to the original server, and everything should be as it was. Sorry for any confusion that may have been caused. -- Brad Knowles <brad(a)python.org> Python.org Postmaster Team

1 0

Website www.python.org down...
by Brad Knowles 11 Feb '05

11 Feb '05

Folks, Just to let you know, the machine that normally provides service for www.python.org is currently down. The facility that provides the co-location is having power problems, and they are working on solving it. We have temporarily moved the www.python.org hostname to a different machine, which does not include any of the original content from www.python.org, and ftp.python.org and other non-mail or mailing list related services are still down. However, the temporary home for www.python.org does have a list of known mirrors, so you should hopefully be able to access the content you need from one of them. I'll post more information as I get it. -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

1 0

Re: [Mailman-Developers] mailman email harvester
by Thien Vu 10 Feb '05

10 Feb '05

[whoops, meant to send to the whole list] def roster_privatize(mlist): mlist.private_roster = 1 m.Save() m.Unlock() Put that into your mailman/bin/roster_privatize.py and then run withlist -a -l -r roster_privatize Yeah I haven't tested that code but that's the rough idea. Take a look at setting mm_cfg.DEFAULT_PRIVATE_ROSTER also. Thien On Thu, 10 Feb 2005 19:08:51 +0100, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > At 11:40 AM -0500 2005-02-10, Tobias Eigen wrote: > > > Is there a way to change the setting to restrict access to the roster for > > all lists, globally? > > That should be possible to do using "withlist". However, I don't > know the specifics of how to do that. > > -- > Brad Knowles, <brad(a)stop.mail-abuse.org> > > "Those who would give up essential Liberty, to purchase a little > temporary Safety, deserve neither Liberty nor Safety." > > -- Benjamin Franklin (1706-1790), reply of the Pennsylvania > Assembly to the Governor, November 11, 1755 > > SAGE member since 1995. See <http://www.sage.org/> for more info. > _______________________________________________ > Mailman-Developers mailing list > Mailman-Developers(a)python.org > http://mail.python.org/mailman/listinfo/mailman-developers > Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py > Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ > Unsubscribe: http://mail.python.org/mailman/options/mailman-developers/thien.vu%40gmail.… >

1 0

Critical security update for Mailman 2.1.5 and earlier
by Barry Warsaw 10 Feb '05

10 Feb '05

There is a critical security flaw in Mailman 2.1.5 and earlier Mailman 2.1 versions which can allow remote attackers to gain access to member passwords under certain conditions. The extent of the vulnerability depends on what version of Apache you are running, and (possibly) how you have configured your web server. However, the flaw is in Mailman and has been fix in CVS and will be included in the Mailman 2.1.6 release. This issue has been assigned CVE number CAN-2005-0202. We currently believe that Apache 2.0 sites are not vulnerable, and that many if not most Apache 1.3 sites are. In any event, the safest approach is to assume the worst and take the remediation steps indicated below as soon as possible. The quickest fix is to remove the /usr/local/mailman/cgi-bin/private executable. This will disable all access to all private archives on your system. While this is the quickest and easiest way to close the hole, it will also break all your private archives. If all the lists on your site only run public archives, this won't matter to you. Until Mailman 2.1.6 is released, the longer term fix is to apply this patch: http://www.list.org/CAN-2005-0202.txt For additional piece of mind, it is recommended that you regenerate your member passwords. Instructions on how to do this, and more information about this vulnerability are available here: http://www.list.org/security.html My thanks to Tokio Kikuchi, Mark J Cox, and the folks on vendor-sec. This issue was found by Marcus Meissner. -Barry

3 3

Fwd: [SourceForge.net Release] m2f : m2f
by Tobias Eigen 10 Feb '05

10 Feb '05

fyi - maybe I was wrong.. release candidate of m2f has been released today. Begin forwarded message: > From: "SourceForge.net" <noreply(a)sourceforge.net> > Date: February 9, 2005 8:22:13 PM EST > To: noreply(a)sourceforge.net > Subject: [SourceForge.net Release] m2f : m2f > > Project: mail2forum (m2f) > Package: m2f > Date : 2005-02-09 22:22 > > Project "mail2forum" ('m2f') has released the new version of package > 'm2f'. > You can download it from SourceForge.net by following this link: > <https://sourceforge.net/project/showfiles.php? > group_id=68964&release_id=303790> > or browse Release Notes and ChangeLog by visiting this link: > <https://sourceforge.net/project/shownotes.php?release_id=303790> > > You receive this email because you requested to be notified when new > versions > of this package were released. If you don't wish to be notified in the > future, > please login to SourceForge.net and click this link: > <https://sourceforge.net/project/filemodule_unmonitor.php? > filemodule_id=67748> > If you lost your SourceForge.net login name or password, refer to this > document: > <https://sourceforge.net/docman/display_doc.php?docid=760&group_id=1> > > Note that you may receive this message indirectly via one of your > mailing list > subscriptions. Please review message headers before reporting > unsolicited > mailings. > -- Tobias Eigen Executive Director Kabissa - Space for Change in Africa http://www.kabissa.org * Kabissa's vision is for a socially, economically, politically, and environmentally vibrant Africa, supported by a strong network of effective civil society organizations. *

1 0

Re: [Mailman-Users] Subject_prefix doesn't get added for posts from one domain - Solved
by Chris Malatesta 09 Feb '05

09 Feb '05

So here is the answer, The domain that I used to setup the mailman server used to be managed by the domain/server that was sending the problem posts. They still had this domain in the virtualdomain file for their qmail server. Now why the email was even getting out of their qmail server and actually posted to the list is beyond me as these are 2 different servers on different networks, but just removing this domain from virtualdomains solved the problem. Thanks, Chris On 2/7/05 11:51 AM, "Mark Sapiro" <msapiro(a)value.net> wrote: > Chris Malatesta wrote: > >> So here is the issue, posts from this one domain don't get mailman header >> information added to the email, although they get posted to the list. >> >> What would cause a post to go to the list and not get header info and the >> Subject_prefix added to that post? > > The message is not being processed by CookHeaders which is the module > that adds the subject prefix and headers X-BeenThere, > X-Mailman-Version, Precedence and maybe others depending on list > options. > > CookHeaders must be in the list pipeline since it is there for messages > from other domains. I can't see how it would be avoided for just the > messages from this one domain. Presumably the rest of the pipline is > processed since without CalcRecips and ToOutgoing or at least > ToDigest, the message wouldn't be sent to anyone. > > This is really puzzling. > > -- > Mark Sapiro <msapiro(a)value.net> The highway is for gamblers, > San Francisco Bay Area, California better use your sense - B. Dylan >

1 0

Fwd: Volunteer sought to code Mailman/Plesk integration script for use by African organizations
by Tobias Eigen 08 Feb '05

08 Feb '05

Dear Mailman developers - Below is a message I attempted to post to the Python jobs board, but which never appeared there. As it is directly relevant to Mailman, I hope you don't mind that I also share it with you all directly. I am quite keen on solving this problem as soon as possible. Please let me know if you're interested and I'll give you the gory details. Any useful scripts or lessons learned shared back to the community, of course. Cheers, Tobias +1-202-265-6116 -- Tobias Eigen Executive Director Kabissa - Space for Change in Africa http://www.kabissa.org * Kabissa's vision is for a socially, economically, politically, and environmentally vibrant Africa, supported by a strong network of effective civil society organizations. * Begin forwarded message: > From: Tobias Eigen <tobias(a)kabissa.org> > Date: January 12, 2005 6:21:46 AM EST > To: jobs(a)python.org > Subject: Volunteer sought to code Mailman/Plesk integration script for > use by African organizations > > `Kabissa - Space for Change in Africa <http://www.kabissa.org>`_ > (Washington DC, USA) > =================================================================== > > **Job Description**: Volunteer sought to code Mailman/Plesk > integration script for use by African organizations > > Kabissa helps African organizations to put the Internet to > work for the people they serve. A key aspect of this is > maintaining a server which our member organizations in > Africa use to host Websites, mailboxes - and mailing lists. > > We need one-off help from a Linux/open source coder, > which might turn into more regular volunteering if there is > interest, to write code that integrates our existing > Mailman (http://www.list.org) installation with the new > version of Plesk (http://www.plesk.com) server > administration tool. The goal is to empower our members > to use Plesk to create, manage and then delete their own > lists autonomously. > > We know it is possible and have tested it on a manual > basis on specific lists, but need some additional coding > done to make it work on a turnkey basis for all lists on the > server. > > Any work done to be released (with credit where due) to > the open source community. > > You will need to have your own testing server. > > **What Python is used for**: Mailman. The integration script could be > a python script but doesn't need to be. > > * **Contact**: Tobias Eigen > * **E-mail contact**: tobias(a)kabissa.org > * **Other Contact Info**: +1-202-265-6116 > * **Web**: http://www.kabissa.org > >

3 4

MACE, Internet2, mailing lists etc
by J C Lawrence 07 Feb '05

07 Feb '05

Middleware-Enabled Mailing List Working Group (MACE-MLIST): http://middleware.internet2.edu/mlist/ --<cut>-- Charter The I2 MACE-MLIST working group intends to address the following sets of issues: - The WG will research the issues surrounding middleware-enablement of mailing list services. Where possible, the WG will document how to perform this integration and provide forums where people can learn and help each other in addressing these integration issues within campus contexts. Where appropriate, the WG will collaborate with open source communities to consider needed modifications or other techniques for achieving better integration with the enterprise/federation. - The WG will consider and implement a survey of current university mailing list users to identify favorite features, needed improvements, and notable warts. We will map existing mailing list capabilities to a matrix of available functionality. - The WG will include persons who are actively working on integration with the enterprise/federation using non-proprietary technology; experiences will be shared regarding application designs best supporting infrastructure. Working group members will test-drive pilot/prototype solutions. Outcomes / Deliverables 1. Survey results, identifying best features, absent features, and desired improvements from users of mailing list software, along with a mapping of this feature set to existing mailing list software. 2. A simple model of mailing list management software operations, with middleware enablement points identified. 3. At least one open-source list software prototype (Sympa is a likely candidate) using federated authN/Z. 4. Documentation describing methods for modifying open source list software for use in federated environments. --<cut>-- -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

1 0

Subject_prefix doesn't get added for posts from one domain
by Chris Malatesta 07 Feb '05

07 Feb '05

I posted this to the mailman-users list and no one seemed to have any idea, so I thought I'd give you all a shot. Appreciate anything that you come up with... Chris ------ Forwarded Message > From: Chris Malatesta <chris(a)digital-waves.net> > Date: Fri, 04 Feb 2005 20:17:03 -0800 > To: "mailman-users(a)python.org" <mailman-users(a)python.org> > Subject: Subject_prefix doesn't get added for posts from one domain > > Hopefully someone has an answer for this one, I haven¹t been able to find it > anywhere... > > I have setup a new mailman server for a client (RHE3/netmail 1.0.5/Mailman > 2.1.5) when people from one domain running qmail post to a newly created list > with the default options, the subject_prefix doesn¹t get added to the subject > line, but it does for everyone else??? > > The only thing I can think could be different is the header of the email, > There are some differences with mail from this domain, but I don¹t believe > they are necessarily wrong, but it is the only thing I can see would be different... > > Any ideas would be appreciated. > > Chris > > > I.e. Here is a header from this domain, with the actual address names and ip's > changed. > > Received: from domain.com ([55.255.255.255]) by otherdomain.com with Microsoft > SMTPSVC(6.0.3790.211); > Wed, 2 Feb 2005 17:30:07 -0800 > Received: (qmail 508 invoked by uid 14282); 3 Feb 2005 01:33:53 -0000 > Received: from user(a)domain.com by domain.com by uid 505 with > qmail-scanner-1.22 > (avp: 5.0.2.0. f-prot: 3.12/. Clear:RC:1(10.250.100.83):. > Processed in 0.557572 secs); 03 Feb 2005 01:33:53 -0000 > Received: from in.domain.com (HELO usersname) (10.250.100.83) > by 0 with SMTP; 3 Feb 2005 01:33:53 -0000 > Reply-To: <user(a)domain.com> > From: "First Last" <user(a)domain.com> > To: "'First Last'" <sender(a)domain.com> > Subject: Same Problem > Date: Wed, 2 Feb 2005 17:34:44 -0800 > Organization: Company Name > > Message-ID: <012b01c50990$8cf42bc0$a764fa0a@usersname> > > MIME-Version: 1.0 > Content-Type: multipart/mixed; > boundary="----=_NextPart_000_012C_01C5094D.7ED0EBC0" > X-Priority: 3 (Normal) > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook, Build 10.0.2627 > Importance: Normal > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 > X-Bogosity: No, tests=bogofilter, spamicity=0.500000, version=0.17.5 > Return-Path: user(a)domain.com > X-OriginalArrivalTime: 03 Feb 2005 01:30:08.0062 (UTC) > FILETIME=[E53905E0:01C5098F] > ------ End of Forwarded Message

1 0

Re: [Mailman-Users] complete personalisation
by Mark Sapiro 07 Feb '05

07 Feb '05

Stefan Hofmeir wrote: > >each subscriber of a newsletter list should see his email address in >the "to" field, so I have set "personalize: complete >personalisation". > >But why is every newsletter sent in "cc" to the list address? >To: Subscriber123 <subscriber123(a)provider.tld> >CC: mailmanlist <mailmanlist(a)serveraddress.tld> The Cc is added so the recipient can reply to the list with the reply-all feature of his/her MUA. I gather from your other post that your list is also anonymous and in this case the Cc is redundant as the list posting address is already in From and Reply-To: >How can I delete the "cc" field? I have submitted a patch for this at http://sourceforge.net/tracker/index.php?func=detail&aid=1117618&group_id=1… This patch will supress adding the Cc if the list is anonymous. -- Mark Sapiro <msapiro(a)value.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 1

Hacking pipermail...
by Brad Knowles 06 Feb '05

06 Feb '05

Folks, I've just had to rebuild an archive for a list, thus causing pipermail to regenerate message numbers and breaking all the links that previously used to work. I'd like to try to figure out a way to avoid that problem. Looking at pipermail.py in processUnixMailbox, around lines 565-568, the critical code appears to be: msgid = m.get('message-id', 'n/a') self.message(_('#%(counter)05d %(msgid)s')) a = self._makeArticle(m, self.sequence) self.sequence += 1 Am I missing something here? Could we simply rip out the references to "self.sequence" and instead drop in a call to "md5(m)"? Of course, we'd also have to adjust the initialization of "sequence" to be the empty string and make sure that all other references to it are as a string instead of a number, but I don't think that would be too hard. Certainly, it seems that this would be an easy way to avoid having to break all existing links because the sequence number arbitrarily changed when the archive was regenerated. Or does Python not have an internal implementation of MD5, or even a shim to a library function that does MD5? -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

2 5

Patch 1107169: Re-use member_moderation_notice for generic_nonmember_action
by Brad Knowles 06 Feb '05

06 Feb '05

Folks, I asked a couple of questions about this a while back, and got a bit of help that allowed me to develop a patch, which I've now had on SourceForge for a while (see <http://sourceforge.net/tracker/index.php?func=detail&aid=1107169&group_id=1…>). However, I haven't heard any further commentary on this. I'm not a programmer in any language, especially Python, but I hope that I've been able to at least hack something together without causing too much collateral damage. Feedback would be appreciated. Tokio -- can I get you to take a look at this and consider it for inclusion in your next beta roll-up for 2.1.6? This would solve some problems for us on the mailman-users and mailman-developers mailing lists, and without at least some commentary from you or Barry, I'm hesitant to just go ahead and apply this to the mailing list server for python.org. Thanks! -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

2 4

Re: [Pydotorg] Volunteer sought to code Mailman/Plesk integration script for use by African organizations
by Tobias Eigen 04 Feb '05

04 Feb '05

Hi Skip, Thanks for the reply. To tell you the truth, I looked at the volunteer opportunities wiki and it took me just a little bit too much effort to figure out at the brief moment I took to look at it so I gave it up! Also had the bad luck of writing a lengthy email to the mailman-developers list which I then lost through a glitch in my mac email client. Proof, really, that I am completely useless with email and should never be allowed to administrate a mailman server. <grin> In the meanwhile, since I've not managed to get a volunteer to help out with this particular problem, I have decided to go ahead and pay a Rackspace (our hosting provider) technician to take care of it for me. When I have it I'll share the code. I'll keep you all posted. Cheers, Tobias -- Tobias Eigen Executive Director Kabissa - Space for Change in Africa http://www.kabissa.org * Kabissa's vision is for a socially, economically, politically, and environmentally vibrant Africa, supported by a strong network of effective civil society organizations. * On Jan 29, 2005, at 10:04 AM, Skip Montanaro wrote: > > Tobias> I'll post my problem in more detail on the mailman-dev > list and > Tobias> perhaps someone will come forward. > > Also, check out the new (and so far empty) VolunteerOpportunities wiki > page: > > http://www.python.org/moin/VolunteerOpportunities > > There's a link from the existing jobs page to try and increase > visibility. > > Skip >

2 2

Re: [Mailman-checkins] mailman/templates/de admlogin.html, 1.2, 1.2.2.1 bounce.txt, 1.3, 1.3.2.1 verify.txt, 1.2.2.2, 1.2.2.3
by Martin Mewes 03 Feb '05

03 Feb '05

Hi Peer, pheinlein(a)users.sourceforge.net wrote : > Modified Files: > Tag: Release_2_1-maint > admlogin.html bounce.txt verify.txt There is a inconsistency in bounce.txt and verify.txt in the german translation. > Index: bounce.txt [...] > - Abonnent: %(addr)s > + Mitglied: %(addr)s > Index: verify.txt [...] > -Abonnenmentsbest�tigung f�r die Mailing-Liste %(listname)s > +Abonnenmentsbestätigung für die Mailing-Liste %(listname)s If you say "Mitglied" in first and "Abonnement" in the second place, wouldn't it be better to say "Mitgliedsbestätigung" in the second place? Sorry if not all english readers can follow this ;-) bis dahin/kind regards Martin Mewes -- I am on holiday. Your e-mail has been deleted.

1 0

Status of www.list.org?
by Mark Sapiro 03 Feb '05

03 Feb '05

Does anyone know the status of www.list.org? I have been unable to get a ping response or a response from port 80 for a day or two now? -- Mark Sapiro <msapiro(a)value.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

3 2

Possible error in Mailman/Cgi/confirm.py
by Thien Vu 02 Feb '05

02 Feb '05

I think I found a bug in mailman. If you get an email confirmation for a pending request and you go to the web page. If you hit 'cancel' it will to to Mailman/Cgi/confirm.py will call subscription_cancel : def subscription_cancel(mlist, doc, cookie): # Discard this cookie userdesc = mlist.pend_confirm(cookie)[1] lang = userdesc.language i18n.set_language(lang) doc.set_language(lang) doc.AddItem(_('You have canceled your subscription request.')) The problem is in mlist.pend_confirm: def pend_confirm(self, cookie, expunge=True): """Return data for cookie, or None if not found. If optional expunge is True (the default), the record is also removed from the database. """ db = self.__load() # If we're not expunging, the database is read-only. if not expunge: return db.get(cookie) # Since we're going to modify the database, we must make sure the list # is locked, since it's the list lock that protects pending.pck. assert self.Locked() content = db.get(cookie, _missing) if content is _missing: return None # Do the expunge del db[cookie] del db['evictions'][cookie] self.__save(db) return content There is an assert self.Locked() which will always fail because we've never locked the list. The question is what's the correct thing to do here? It seems the safe thing to do is the wrap a lock the call to pend_confirm in subscription_cancel, but is pending.pck even used anymore? If not do we still need the lock? It seems like we would because we're going to be updating whereever the db is... Just asking because I'm not very familiar with this part of the code. Thien

2 1

Mailman Qrunner Sleep Time Option
by Kory Wheatley 02 Feb '05

02 Feb '05

If I change the configuration variable in Mailman: qrunner_sleep_time = 1 to qrunner_sleep_time = 60 Will this slow the delivery of Mailman's Queue to outgoing recipients. I'm looking for a way to slow the number of emails or connections to Postfix, because of rate control issues. I've already slowed the performance of Postfix I think. -- Kory Wheatley Academic Computing Analyst Sr. Phone 282-3874 ######################################### Everything must point to him.

2 1

[OT] mailman-devel mbox/maildir - download
by Martin Mewes 02 Feb '05

02 Feb '05

Hi folks, I am new to this list and need to start with a a one time ever off-topic post to this list. As mailman-devel does not provide the full mbox-archive for download I kindly ask if someone can provide me with a tar of the posts up to one year back in time from now. This would make things easier for me to read and understand the background here instead of browsing the searchable archive online. Sorry for any inconvinience if any ... bis dahin/kind regards Martin Mewes -- Hi. I'm thinking about what you've just sent me. Please wait by your PC for my response.

1 0

MAX_RESTARTS
by Ian Eiloart 02 Feb '05

02 Feb '05

Hi, mailmanctl has a mechanism for restarting failed qrunners. Very handy, but I just got bit by MAX_RESTARTS. A resource problem on our mail server meant that the virgin runner was failing every half hour or so - so after a few hours Mailman stopped sending notifications of various things. What is the purpose of MAX_RESTARTS? I can see that we might want to stop if a runner is restarted ten times a minute, but not ten times a day, surely? Could we get an mm_cfg setting to control this please? That would give an easy workaround. More principled, perhaps, would be to store not the number of restarts, but the time of the last restart. If this restart is occuring less than one minute after the last, AND MAX_RESTARTS has been exceeded..... or something.... then we stop. -- Ian Eiloart Servers Team Sussex University ITS

1 0

Re: [Mailman-Users] Sendmail Milter subsystem telling sendmail todiscard Mailman digests
by Tokio Kikuchi 02 Feb '05

02 Feb '05

Jeff Groves wrote: > So, I'm going to have to learn python and figure out where it's not > putting the Date: header and make it do it myself. > Hi, I think I can fix this in Handlers/ToDigest.py The digests don't go through Message.py which was fixed in 2.1 beta 1. # I think someone posted the patch but it slipped off from my search paths. -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

1 0

Re: [Mailman-Users] respond_to_post_requests and header_filter_rules
by Tokio Kikuchi 01 Feb '05

01 Feb '05

Hi again, Ivan Fetch wrote: > Hello, > > Thank you for your reply -- I'm using Mailman 2.1.5 (sorry for not > mentioning this previously). We'd rather be able to configure the > filters to hold (not discard) spam, at least for those lists where the > list administrators prefer to double check what is being tagged as spam. > You can create two or more new header_filter_rules. I suggest you create one for hold and another for discard. You can add a test regex into the first box and when you learn that it works right then move it to the second one to discard the spam silently. > Is the help text of respond_to_post_requests inaccurate in how it > claims that notifying posters of held messages excludes spam filtering? Historically, it was right statement once upon a time in 2.0.x era. -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

1 0

Re: [Mailman-Users] respond_to_post_requests and header_filter_rules
by Tokio Kikuchi 01 Feb '05

01 Feb '05

Hi, Ivan Fetch wrote: > Hello, > > I'm wondering whether there is a way to have respond_to_post_requests > set to yes (so that senders will be notified if their message is held > due to posting to a members-only list, their message exceeds mailman's > size limit, Etc), yet not send notifications to senders who's messages > are held because they match a filter rule (privacy | spam ). > > The help section of respond_to_post_requests says the following, > which leads me to believe that it will not notify senders of messages > which match spam filter rules: > "Approval notices are sent when mail triggers certain of the limits > except routine list moderation and spam filters, for which notices are > not sent. This option overrides ever sending the notice." > Looks like this detail is outdated. I think new spam filters should be used to silently discard the known spams. Ivan, what version are you using? Newer version has more generic header_filter_rules to hold/reject/discard such messages. Developers, I think I will remove 'spam filters' from the detailed description above but what is the 'routine list moderation'? I think list-wide moderation was replaced by per-member moderation, right? > > However when I send a message to a list and it matches against a spam > filter, I receive an email back notifying me that my message was held > because a filter was matched. It would be nice to be able to avoid > responding to messages which Mailman matches against the spam filters, > as often the From address is forged anyhow... > > IS there something I'm missing which will give me the behavior I'm > looking for RE: spam filtering? > > > Thank you - Ivan Fetch. > > -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

1 0