Mailman 3 October 2000 - Mailman-Users

Need Help with a Bug in Mailman Version 1.1
by Randal D. Pinkett 03 Oct '00

03 Oct '00

Can anyone recommend someone I can e-mail to help troubleshoot an installation problem with Mailman 1.1 on Linux 6.2 with Python 1.5.2? I sent a message yesterday, but it seems possible that noone has seen the problem before. Randal

1 0

Re: [Mailman-Users] Re: cleartext passwords
by J C Lawrence 03 Oct '00

03 Oct '00

On Mon, 2 Oct 2000 08:54:29 -0700 alex wetmore <alex(a)phred.org> wrote: > I do wish that Mailman had the option to just have confirmation > email for any list configuration changes. This would be simpler > for most users (especially since most of my users do the "send my > password to me" to unsub anyway). Agreed. Another feature which I've seen on a couple list servers now is that they reply with a custom URL to configuration commend. Simply loading that custom URL verifies and commits the requested change. Very nice, especially for neophyte and casual users as there is *zero* surprise or incomprehension response to the instruction, "Go to this web page to finish your XXXX." An example BTW are the security lists hosted at SecurityPortal. A sample confirmation message looks something lie the following (URL keys slightly munged): --<cut>-- Date: Mon, 25 Sep 2000 18:22:47 -0400 (15:22 PDT) From: "L-Soft list server at LISTSERV.SECURITYPORTAL.COM (1.8d)" <LISTSERV(a)LISTSERV.SECURITYPORTAL.COM> Subject: Command confirmation request (3af9edff) To: claw(a)KANGA.NU Your command: SUBSCRIBE LINUX-SECURITY J C Lawrence requires confirmation. To confirm the execution of your command, simply point your browser to the following URL: http://listserv.securityportal.com/SCRIPTS/WA-SECURITYPORTAL.EXE?OK=Ceg2966… Alternatively, if you have no WWW access, you can reply to the present message and type "ok" (without the quotes) as the text of your message. Just the word "ok" - do not retype the command. This procedure will work with any mail program that fully conforms to the Internet standards for electronic mail. If you receive an error message, try sending a new message to LISTSERV(a)LISTSERV.SECURITYPORTAL.COM (without using the "reply" function - this is very important) and type "ok CC2296F2" as the text of your message. Finally, your command will be cancelled automatically if LISTSERV does not receive your confirmation within 48h. After that time, you must start over and resend the command to get a new confirmation code. If you change your mind and decide that you do NOT want to confirm the command, simply discard the present message and let the request expire on its own. --<cut>-- Good stuff. -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

1 0

Re: cleartext passwords
by Tom Neff 03 Oct '00

03 Oct '00

I do NOT think that cleartext passwords should be mailed out en masse as part of a monthly reminder cycle. That is, over time, going to degrade security and user confidence in the product. Passwords should only be sent in response to an explicit user request. If it has to be sent in cleartext, well, you asked for it. If it is possible to send it encrypted instead (perhaps using a key that the user pastes into a textarea box on the password request page) then that should be supported. The monthly reminder (which is a trifle annoying - I now get a flock of them every first on the month) should, at most, contain a URL for the user profile page, which includes a button to request an emailed password if the user has forgotten it.

3 6

Re: [Mailman-Users] A funny thing happened...
by Nigel Metheringham 03 Oct '00

03 Oct '00

chuqui(a)plaidworks.com said: > 1) has anyone else ever run into something like this? My philosophy > is that you're more than welcome to get upset about things I think > are silly (but I don't promise to take it as seriously as you do, > just to try to not snicker in your hearing), but I just don't get it. > Especially since the site is pretty good at telling you NOT to use > sensitive passwords. But -- is this guy off the chart, or have I just > been lucky? I got one last month. I'm expecting to get a complaint from the same guy today when the US wakes up and he gets to work. [I less than tactfully copied my reply to their postmaster suggesting they may need a security audit if this guy has put a password he cares about into a web page] > 2) this probably should be chalked up as a vote for "making passwords > optional" for lists. Personally, I think the added security passwords > add is overwhelmed by the confusion and complexity they cause the > user, so I'd like to turn them off. There are lists where they could > be useful, but I could live without them... In most cases I want them. However I keep thinking about a change in terminology, and wondered if calling these things cookies (which unfortunately has privacy and similar negative connotations) or something other than a password, maybe we could help people understand that these are very minimal security procedures. Nigel. -- [ - Opinions expressed are personal and may not be shared by VData - ] [ Nigel Metheringham Nigel.Metheringham(a)VData.co.uk ] [ Phone: +44 1423 850000 Fax +44 1423 858866 ]

2 1

Re: [Mailman-Users] List creation
by Silk 02 Oct '00

02 Oct '00

Not that I've found. ~cHris -- Chris Naden - chris at gwydion dot net " Sometimes, home is just where you pour your coffee... " - Bruno Baldwin

1 0

Config errors
by Chris Hedemark 02 Oct '00

02 Oct '00

I made mention of it on this mailing list last week. Version 2.0beta6. -----Original Message----- From: Chuq Von Rospach [mailto:chuqui@plaidworks.com] Sent: Monday, October 02, 2000 10:45 AM To: Chris Hedemark; 'mailman-users(a)python.org' Subject: RE: [Mailman-Users] Config errors At 9:22 AM -0400 10/2/00, Chris Hedemark wrote: >check-perms doesn't do the job 100%. I've had errors with the permissions >in my dir structure, and check-perms comes up squeaky clean. What version? Any time you find this, please file a bug detailing it so it can get fixed. -- Chuq Von Rospach - Plaidworks Consulting (mailto:chuqui@plaidworks.com) Apple Mail List Gnome (mailto:chuq@apple.com) You seem a decent fellow. I hate to die.

1 0

Re: [Mailman-Users] List creation
by Silk 02 Oct '00

02 Oct '00

> So, you found out how to create the lists? Let me know.... By command-line using newlist: I am, however, having a problem with it: it goes like this. The txt file attached is a log extract from /var/log/exim/mainlog showing the logged bits for two posts. One is the 'confirm' response required to subscribe to a list and the other is an attempt to post to that list. I've put, as you can tell from these logs, the correct lines generated by 'newlist' into /etc/aliases, however, this is what I get. What have I mis-configured? It looks like an exim misconfiguration, but mailman hasn't as yet told me to do anything more than what I've done to make it work... thanks, ~cHris -- Chris Naden - chris at gwydion dot net " Sometimes, home is just where you pour your coffee... " - Bruno Baldwin

1 0

RE: [Mailman-Users] Config errors
by Chris Hedemark 02 Oct '00

02 Oct '00

check-perms doesn't do the job 100%. I've had errors with the permissions in my dir structure, and check-perms comes up squeaky clean. -----Original Message----- From: Chuq Von Rospach [mailto:chuqui@plaidworks.com] Sent: Sunday, October 01, 2000 11:01 PM To: Rich Hall; mailman-users(a)python.org Subject: Re: [Mailman-Users] Config errors At 10:26 PM -0400 10/1/00, Rich Hall wrote: > File "/home/mailman/Mailman/LockFile.py", line 346, in __write > fp = open(self.__tmpfname, 'w') >IOError: [Errno 13] Permission denied: >'/home/mailman/locks/qrunner.lock.reality-studios.com.1124' you have a permission problem in your directory structure. did you run check_perms? -- Chuq Von Rospach - Plaidworks Consulting (mailto:chuqui@plaidworks.com) Apple Mail List Gnome (mailto:chuq@apple.com) You seem a decent fellow. I hate to die. ------------------------------------------------------ Mailman-Users maillist - Mailman-Users(a)python.org http://www.python.org/mailman/listinfo/mailman-users

2 1

List creation
by Scott D. Allen 02 Oct '00

02 Oct '00

Is the only way to create lists in Mailman from the command line? Also, is there a reference/docs on the command line utilities? Lastly, is there a way to interact with Mailman by email? The docs/archives are pretty sparse here. Thanks. --Scott

1 0

A funny thing happened...
by Chuq Von Rospach 02 Oct '00

02 Oct '00

on the ay to the mail list. Since it's the first of the month, my sites sent out the monthly subscription notice. And I had a user complain about the site sending out the list password in cleartext (my first thought was "how ELSE am I supposed to send you the password, given that the system has no encryption in it?" but I bit my tongue.) He demanded I fix this, and when I declined, he unsubscribed in a bit of a huff. I bring this up for a couple of reasons: 1) has anyone else ever run into something like this? My philosophy is that you're more than welcome to get upset about things I think are silly (but I don't promise to take it as seriously as you do, just to try to not snicker in your hearing), but I just don't get it. Especially since the site is pretty good at telling you NOT to use sensitive passwords. But -- is this guy off the chart, or have I just been lucky? 2) this probably should be chalked up as a vote for "making passwords optional" for lists. Personally, I think the added security passwords add is overwhelmed by the confusion and complexity they cause the user, so I'd like to turn them off. There are lists where they could be useful, but I could live without them... My feeling is this guy isn't something to overly worry about, but I bring it up in case someone else thinks of something I've missed... -- Chuq Von Rospach - Plaidworks Consulting (mailto:chuqui@plaidworks.com) Apple Mail List Gnome (mailto:chuq@apple.com) You seem a decent fellow. I hate to die.

2 1