Re: [Mailman-Developers] MailMan-Traffic
On Tue, 23 Apr 2002 10:26:11 +0200 h huelsebusch <Henning> wrote:
Hi ! Is it possible that you insert Traffic-Accounting in Mailman ? Don't know, but I think it's not so difficult, Mailman has to do something like "(MailSize) * (actually members of the list)", stored in a PLAIN-textfile, so it will also be possible to parse the total traffic, monthly oder daily traffic.
Several points:
Mailman does not store the membership list in a text file. Further, under 2.1 Mailman may not store the membership list at all, but depending on local configuration may only have the ability to query (LDAP, SQL, whatever) an external service for the membership to apply to a specific message.
Outbound traffic in a bandwidth sense is not a product of number of list members times size of message. That ignores bounces, RCPT TO bundling, and remote exploders (many companies subscribe a central account to popular lists and then explode that account to all internal interested parties and/or gate it to an internal newsgroup).
All the data you seem to want is currently available from both the Mailman logs and your MTA logs. You just have to take it out and parse it.
--
J C Lawrence
---------(*) Satan, oscillate my metallic sonatas.
claw@kanga.nu He lived as a devil, eh?
http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.
On 4/23/02 11:22 AM, "J C Lawrence" <claw@kanga.nu> wrote:
Mailman does not store the membership list in a text file. Further, under 2.1 Mailman may not store the membership list at all, but depending on local configuration may only have the ability to query (LDAP, SQL, whatever) an external service for the membership to apply to a specific message.
This, FWIW, is turning into a crucial issue for me. We've come ot realize the subscriber lists are a corporate asset that needs protecting, so a big To Do item for me now is to get them into a system inside the firewall and off the mail list machine in the border zone, so if there's a break-in, the data is cloistered.
Those of you who run corporate list servers ought to stop and think about what the loss or leakage of your subscriber lists might do to you. I sat down with my security guys last week to go over issues, and that was THE top issue in their mind... (it started out as a "how do we protect our archives better" meeting, actually).
-- Chuq Von Rospach, Architech chuqui@plaidworks.com -- http://www.chuqui.com/
Yes, I am an agent of Satan, but my duties are largely ceremonial.
--On Tuesday, April 23, 2002 11:29 AM -0700 Chuq Von Rospach <chuqui@plaidworks.com> wrote:
This, FWIW, is turning into a crucial issue for me. We've come ot realize the subscriber lists are a corporate asset that needs protecting, so a big To Do item for me now is to get them into a system inside the firewall and off the mail list machine in the border zone, so if there's a break-in, the data is cloistered.
Speaking as someone who has just a few years of computer security experience, the above proposal accomplishes just about nothing, security-wise. If the mail list system in the DMZ can get the subscriber data from the system inside your firewall, then so can any attacker that compromises the mail list system. If you have some sort of read-only access to the datastore, then you may be protected from corruption, but not disclosure.
-- Carson Gaspar - carson@taltos.org Queen Trapped in a Butch Body
On 4/25/02 3:11 AM, "Carson Gaspar" <carson@taltos.org> wrote:
Speaking as someone who has just a few years of computer security experience, the above proposal accomplishes just about nothing, security-wise.
Speaking as someone who also does, who lives with someone who did it for a living for a while, and went over this with some really sharp security folks, you're not correct.
To start, you've forgotten the issue of multi-pronged attacks. The more services a single box supports, the more chances you have that a cracker can find a multi-service attack mode.
But by moving the data from the list machine in the border zone inside the main firewall, it also makes that data less prone to attack from cracked machines elsewhere in the DMZ. If the data is on the box, a cracker could potentially get it by cracking into the DMZ anywhere and then cracking the database. By moving it and configuring the firewalls properly, they'd have to crack ONTO the list machine and then crack the data connection through the firewall.
So it does far from nothing. It significantly limits the ability to get at that data, both by simplifying the services on the DMZ box, limiting attack angles, and by requiring they crack ONTO that box to have possible access to it, not just cracking ANY box on the DMZ (most of which I don't control).
Huge improvements in security, because it removes a lot of variables, especially in areas where you don't have control
Chuq
-- Chuq Von Rospach, Architech chuqui@plaidworks.com -- http://www.chuqui.com/
Very funny, Scotty. Now beam my clothes down here, will you?
On Thu, 2002-04-25 at 10:33, Chuq Von Rospach wrote:
On 4/25/02 3:11 AM, "Carson Gaspar" <carson@taltos.org> wrote:
But by moving the data from the list machine in the border zone inside the main firewall, it also makes that data less prone to attack from cracked machines elsewhere in the DMZ. If the data is on the box, a cracker could potentially get it by cracking into the DMZ anywhere and then cracking the database. By moving it and configuring the firewalls properly, they'd have to crack ONTO the list machine and then crack the data connection through the firewall.
Don't forget, however, that since the list machine must get at the data somehow, you now have one more opening through your main firewall that must be secured/monitored/etc... So, basically, it's a trade off.
Tanner
Tanner Lovelace | lovelace@wayfarer.org | http://wtl.wayfarer.org/ --*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*-- GPG Fingerprint = A66C 8660 924F 5F8C 71DA BDD0 CE09 4F8E DE76 39D4 GPG Key can be found at http://wtl.wayfarer.org/lovelace.gpg.asc --*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*-- He who receives an idea from me, receives instruction himself without lessening mine; as he who lights his taper at mine, receives light without darkening me. -- Thomas Jefferson
On 4/25/02 10:23 AM, "Tanner Lovelace" <lovelace@wayfarer.org> wrote:
Don't forget, however, that since the list machine must get at the data somehow, you now have one more opening through your main firewall that must be secured/monitored/etc... So, basically, it's a trade off.
I'll take one extra port over leaving the data open to multi-layer attacks from elsewhere in the border zone any day. You go from having to make sure the DBMS isn't cracked to having to monitor what traffic goes out of the database. Either way, you're monitoring, and it's a lot easier to monitor this way.
-- Chuq Von Rospach, Architech chuqui@plaidworks.com -- http://www.chuqui.com/
Stress is when you wake up screaming and you realize you haven't fallen asleep yet.
participants (5)
-
Carson Gaspar -
Chuq Von Rospach -
Chuq Von Rospach
-
J C Lawrence -
Tanner Lovelace