Mailman 3 October 2000 - Mailman-Users

Fw: [Mailman-Users] Re: The Password Feature.
by Gary Wilson 02 Oct '00

02 Oct '00

----- Original Message ----- From: "Gary Wilson" <wilsong(a)sergievsky.cpmc.columbia.edu> To: "Jeme A Brelin" <jeme(a)brelin.net> Sent: Monday, October 02, 2000 6:24 PM Subject: Re: [Mailman-Users] Re: The Password Feature. > Well, this isn't commercial software and threatening to leave the > user-base doesn't exactly carry any weight with the developers. If you > think you'd like to turn off passwords, turn them off. Go into the code > and kill the authentication routines and let anybody do anything to > anyone's account. Then see what happens when a listmember gets > hostile. And how many more admin requests you get from users to fix > problems they could've otherwise fixed themselves (or were created by a > lack of security on the admin pages). > I am not threatening. The developers may want to know why users are leaving. They probably care. Most open source software developers I've worked with like to get feedback. Your comments are not helpful and they don't offer any solution. There was a very elegent solution just suggested by Chuq, a solution that would work for everyone. Your comments indicate to me that at best your experience with mail lists is limited. All the features you are talking about are available on other list servers without the limiting password required by Mailman. Most use a confirm/password option for changes that is sent to the mail address. This is a much better solution and I have never heard anyone explain why Mailman rejected the industry-standard for what to me is a quirky solution. Gary

2 1

admin password
by Krzysztof Wychowalek 02 Oct '00

02 Oct '00

When the subscriber forget his/her password, it is easy just to click into "mail me the password" button and the password is sent immediatelly. But what should the list-admin do if he forgot the list password? :-o Krzysztof Wychowalek ICQ# 34184303 GSM +48602824334 PGP Key ID 0xEA9D2A3C

1 0

Re: [Mailman-Users] Re: cleartext passwords
by J C Lawrence 02 Oct '00

02 Oct '00

On Mon, 2 Oct 2000 11:20:42 -0700 Chuq Von Rospach <chuqui(a)plaidworks.com> wrote: > At 11:11 AM -0700 10/2/00, J C Lawrence wrote: >> Currently Mailman defaults to making things easy for casual and >> neophyte users, making Mailman lists easy to approach and use, > Except I don't think passwords does that. I think passwords work > in conflict with this. <slap> Chauq, you are accused of unrepresentative quoting to make your point. <poke in ribs> The compleat sentence for the above was: Currently Mailman defaults to making things easy for casual and neophyte users, making Mailman lists easy to approach and use, and places a small lock on the gate to deter casual attacks. Admittedly I could have harped a bit more on the line of, "You get to trade security for eas of use. You can't get both. You chose your sweet spot and then live with it." That said, I'm not fond of Mailman's current setup. What I'd prefer: -- List commands generate an email response which contains a confirm token (reply to this to make it happen) AND a custom URL (got to this page to make it happen). The user gets to choose which he wants. -- Web-originated commands (subscribe, unsubscribe, settings etc) are exactly the same. They reply with a confirm message just like the above UNLESS they are additionally authenticated with a previously established password. -- It would be nice if the account/password relastionship were abstracted, so tha things like LDAP could be plugged in. Not a requirement tho. This of course makes all changes a two step affair (change then confirm). To achieve the one step business you can then use the normal password business as Mailman does it now. What's this mean? For 90% of operations no passwords are required, nothing needs to be remembered or tracked by users, and everybody sleeps comfortably. For the odd guy who is on the road away from his normal accounts or who is facile enough to know exactly what he wants and how to do it, well, he can remember and use his password. -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

5 9

Re: [Mailman-Users] Re: cleartext passwords
by J C Lawrence 02 Oct '00

02 Oct '00

On Mon, 2 Oct 2000 14:28:35 -0700 Chuq Von Rospach <chuqui(a)plaidworks.com> wrote: > At 1:03 PM -0700 10/2/00, J C Lawrence wrote: >> As to how many, I don't know and I suspect the number would be >> extremely small (but would enclude me). As to admin help, I >> don't believe that a list server should encourage traffic to the >> list owner, or even make it ever so slightly easier. >> >> My standard and rote policy is to always refuse all requests for >> help from me as the list owner. I will not unsubscribe anyone, >> or change their list options for them. I answer questions and >> point to things they can do for themselves. I will point them at >> the list pages, and help them understand what they need to do, >> and that's about it. > thinking about it, if this is your policy, then you should be > screaming for a way for users to change their addresses without > unsubscribing and starting over, because that's easily 50% of the > requests I get sent. Everything else is a trivial priority > compared to that... Umm, well, yes, almost. Somehow, and I don't really understand this, I've got such a nice userbase that they never pop and ask about that. It just doesn't come up in the corporate setting (only corporate addresses are used), and for the public lists I run I get roughly 2 posts a month asking for list-owner help (lotsa emppty months, I got 3 so far this month, so its an odds game), and circa 20 posts a month discussing my moderation decisions for those lists. So, no, its just not a problem for me. OTOH I'm thinking I should bottle and sell this stuff I'm smoking for list members. People kill for subsciber bases like this. > There's a lot of things we want to do with mailman. I think it's > important we figure out which ones are important and best affect > the users, and do those first... That is, I guess, the point I was > trying to make. Not that a feature like this isn't worthy, but > that other features are more worthy... <nod> I like the URL/ack concept. Its damned elegant and extremely non-user invasive. Further, given the current support for token on subscribe commands, implementation shouldn't (yeah right) be that intrusive. -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

2 1

Re: [Mailman-Users] Re: cleartext passwords
by J C Lawrence 02 Oct '00

02 Oct '00

On Mon, 2 Oct 2000 15:25:22 -0400 Gary Wilson <wilsong(a)sergievsky.cpmc.columbia.edu> wrote: > I wish one of the Mailman developers would make it clear whether > or not passwords will be made optional, and if so when it will be > implemented. Loosely: Nobody who is writing code for Mailman has popped up and said they would do it. Nobody else has proposed a patch for Mailman. Nobody has been sufficiently convincing that it is a MUST-HAVE for v2.0 (I don't recommend this argument). This is Open Source after all. -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

1 0

Re: [Mailman-Users] Re: cleartext passwords
by J C Lawrence 02 Oct '00

02 Oct '00

On Mon, 2 Oct 2000 12:17:55 -0700 Chuq Von Rospach <chuqui(a)plaidworks.com> wrote: > At 11:48 AM -0700 10/2/00, J C Lawrence wrote: >> -- Web-originated commands (subscribe, unsubscribe, settings etc) >> are exactly the same. They reply with a confirm message just >> like the above UNLESS they are additionally authenticated with a >> previously established password. > I don't think you need the password here. Mailback validation is > fine, because it proves ownership (or at least access to) the > email address. If you're being attacked, and they can read your > e-mail, being subscribed to a mail list is the LEAST of your > problems. No sense making the mail list service more secure than > your e-mail account. Its purely there so that someone away from their normal accounts can continue to operate. Look at it this way: Given the confirm business: Authentication is two level: you know the subscription address and you get mail sent to it. Given a password: Authentication is two level: you know the subscription address and the password associated with it. -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

2 1

Re: [Mailman-Users] Re: cleartext passwords
by J C Lawrence 02 Oct '00

02 Oct '00

On Mon, 2 Oct 2000 11:27:55 -0400 Tom Neff <tneff(a)bigfoot.com> wrote: > I do NOT think that cleartext passwords should be mailed out en > masse as part of a monthly reminder cycle. That is, over time, > going to degrade security and user confidence in the product. There are several conflicting problems here: 1) Security for sensitive lists and list settings 2) Ease of use for neophyte and cavalier users 3) Barrier to entry for users Currently Mailman defaults to making things easy for casual and neophyte users, making Mailman lists easy to approach and use, and places a small lock on the gate to deter casual attacks. Bigger locks, and more rigorous systems would demand compromises in ease of use, and barriers to entry for list use. Less rigorous systems than mailman of course abound. A more telling question: Are you running Mailman under SSL? Why not? "Anybody" could snoop your user's passwords off the wire as they authenticate. Are you doing SSL client key authentication? Why not? "Anybody" could claim to be that user and not be. The first question is actually serious. Are you running the Mailman CGIs under SSL? Do you have an SSL key signed by a known/trusted CA (ie not SnakeOil)? ObNote: Carefyl web watchers will note that I'm using a SnakeOil SLL cert at Kanga.Nu. Yes, its open to man-in-the-middle attacks. However, it also is a minor but effective dissuasion to casual attacks -- which is about all Mailman promises in the first place. Security is not a game of absolutes. Its a game of intelligent assessment of risks and of the costs of assuaging those risks. Mailman makes the choice that "something is better than nothing, but anything more is just not worth it". Its a fair position. Its better than the typical wide-open list servers, but not as good as say RSA key authentication. Its also more annoying to use than wide-open list servers, and far easier to use and remember than RSA key authentication (What? I have to track *ANOTHER* key pair?) How difficult do you want your services to be to use? > Passwords should only be sent in response to an explicit user > request. Mailman is of course configurable to do this. > The monthly reminder (which is a trifle annoying - I now get a > flock of them every first on the month) should, at most, contain a > URL for the user profile page, which includes a button to request > an emailed password if the user has forgotten it. As a list owner I like them for the simplest of reasons: Every month, just after the reminders go out, I get a rash of unsubscribes. I like this. It keeps my subscriber bases clean and gives me a (more) accurate tally of my membership base. As a list member, well, procmail is my friend. -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

3 2

Re: [Mailman-Users] Re: cleartext passwords
by J C Lawrence 02 Oct '00

02 Oct '00

On Mon, 2 Oct 2000 12:10:25 -0700 Dan Wilder <dan(a)ssc.com> wrote: > Now if there were a way (well maybe there is by now, please pardon > the noise if so) to turn off password reminders. I hate to take > up internet bandwidth, and annoy our users, with several tens of > thousands of emails per month that nobody's going to make any use > of whatsoever. Its on the General Options page: -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

1 0

Error Report (re-send)
by Randal D. Pinkett 02 Oct '00

02 Oct '00

Hey folks... here is my error again. I just installed Mailman 1.1 with Python 1.5.2 on a Redhat Linux 6.2 machine, and receive the following error when I visited http://myserver/listinfo --- beginning of output --- Bug in Mailman version 1.1 Traceback: Traceback (innermost last): File "/home/mailman/scripts/driver", line 112, in run_main main() File "/home/mailman/Mailman/Cgi/listinfo.py", line 40, in main FormatListinfoOverview() File "/home/mailman/Mailman/Cgi/listinfo.py", line 124, in FormatListinfoOverview welcome_items = (welcome_items + File "/home/mailman/Mailman/Utils.py", line 424, in GetNestingLevel if path[0] <> '/': IndexError: string index out of range Environment variables: Variable Value HTTP_ACCEPT_ENCODING gzip REMOTE_HOST 18.85.12.131 SERVER_PORT 80 HTTP_ACCEPT image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */* GATEWAY_INTERFACE CGI/1.1 CONTENT_TYPE HTTP_ACCEPT_LANGUAGE en REMOTE_ADDR 18.85.12.131 SERVER_NAME 18.85.1.82 HTTP_CONNECTION Keep-Alive HTTP_USER_AGENT Mozilla/4.61 (Macintosh; I; PPC) HTTP_ACCEPT_CHARSET iso-8859-1,*,utf-8 CONTENT_LENGTH PATH /ora8/m01/app/oracle/product/8.1.6/bin:/ora8/m01/app/oracle/product/8.1.6/ctx/li b:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin QUERY_STRING SERVER_PROTOCOL HTTP/1.0 PATH_INFO HTTP_HOST www.camfieldestates.net REQUEST_METHOD GET SCRIPT_NAME /mailman/listinfo SERVER_SOFTWARE AOLserver/3.0 REMOTE_USER PYTHONPATH /home/mailman HTTP_COOKIE ad_browser_id=18; last_visit=970468954; second_to_last_visit=970468933; ad_session_id=95%2c3%2cpV2kN%2exGGdQC3UTJMojhkgIvw%2fXd6W%2ey%2c970468932; ad_user_login=3%2cuMfW5qXZ5X2ox17g2a%2fIe61WN47K0lB6 AUTH_TYPE Basic --- end of output Any assistance would be greatly appreciated. Randal Pinkett

1 0

Virtual Domains
by William R. Dickson 02 Oct '00

02 Oct '00

Hi all, There's been lots of talk about setting up virtual domains in Mailman. Here's how I did it. Let's assume two domains, foo.com and bar.com. First, I do a separate mailman installation for each. Mailman's not very big, so the disk overhead's not a problem. I create a /usr/local/mailman directory. I create two subdirectories in there, named for each domain, so I have /usr/local/mailman/foo.com and /usr/local/mailman/bar.com. I then do (logged in as the mailman user): configure --prefix=/usr/local/mailman/foo.com --with-mail-gid=31 make make install crontab -e (then, in vi): :r /usr/local/src/mailman/cron/crontab.in :wq make clean configure --prefix=/usr/local/mailman/bar.com --with-mail-gid=31 make make install crontab -e (then, in vi): shift-g :r /usr/local/src/mailman/cron/crontab.in :wq make clean Let's figure on a list named "test" in each domain: test(a)foo.com and test(a)bar.com. In the virtusertable, I set up virtual addresses like so: test(a)foo.com test-foo.com test-request(a)foo.com test-request-foo.com test-admin(a)foo.com test-admin-foo.com owner-test(a)foo.com owner-test-foo.com test-owner(a)foo.com owner-test-foo.com test(a)bar.com test-bar.com test-request(a)bar.com test-request-bar.com test-admin(a)bar.com test-admin-bar.com owner-test(a)bar.com test-admin-bar.com test-owner(a)bar.com test-admin-bar.com Now, I set up the aliases. I keep each domain's mailman aliases in its own file, cumbersomely named aliases-mailman-foo.com and aliases-mailman-bar.com. Sendmail obviously needs to be set up to read these alias files. (Please excuse the pine wrapping here; naturally, there would be no carriage returns in the alias entries.) in aliases-mailman-foo.com: test-foo.com: "|/usr/local/mailman/foo.com/mail/wrapper post test" test-request-foo.com: "|/usr/local/mailman/foo.com/mail/wrapper mailcmd test" test-admin-foo.com: "|/usr/local/mailman/foo.com/mail/wrapper mailowner test" in aliases-mailman-bar.com: test-bar.com: "|/usr/local/mailman/bar.com/mail/wrapper post test" test-request-bar.com: "|/usr/local/mailman/bar.com/mail/wrapper mailcmd test" test-admin-bar.com: "|/usr/local/mailman/bar.com/mail/wrapper mailowner test" Finally, you need virtual domains set up in apache: <VirtualHost 10.0.1.1> ServerAdmin listmaster(a)foo.com DocumentRoot /usr/local/mailman/www ServerName lists.foo.com ScriptAlias /mailman/ "/usr/local/mailman/foo.com/cgi-bin/" Alias /pipermail/ "/usr/local/mailman/foo.com/archives/public/" Alias /icons/ "/usr/local/mailman/img/" ErrorDocument 404 http://lists.foo.com/mailman/listinfo ErrorDocument 403 http://lists.foo.com/mailman/listinfo <Directory "/usr/local/mailman/foo.com/archives/public/"> Options FollowSymLinks AllowOverride None </Directory> </VirtualHost> <VirtualHost 10.0.1.1> ServerAdmin listmaster(a)bar.com DocumentRoot /usr/local/mailman/www ServerName lists.bar.com ScriptAlias /mailman/ "/usr/local/mailman/bar.com/cgi-bin/" Alias /pipermail/ "/usr/local/mailman/bar.com/archives/public/" Alias /icons/ "/usr/local/mailman/img/" ErrorDocument 404 http://lists.bar.com/mailman/listinfo ErrorDocument 403 http://lists.bar.com/mailman/listinfo <Directory "/usr/local/mailman/bar.com/archives/public/"> Options FollowSymLinks AllowOverride None </Directory> </VirtualHost> I think that about covers how I do it. I'm sure somebody can point out things that could be done more efficiently, but this works pretty darn well. I'd be happy to answer questions, but be patient for answers :). -Bill -- William R. Dickson -- Consuming the Earth's limited resources since 1968 wrd(a)awenet.com http://www.awenet.com/~wrd/ (PGP public key available) Burns: That's right...keep eating...Little do you know you're drawing ever closer to the poison donut! There is a poison one, isn't there, Smithers? Smithers: Ah, no sir, I discussed this with our lawyers. They consider it murder. Burns: Damn their oily hides!

1 0