Mailman 3 August 2000 - Mailman-Users

When a password gets lost
by David Oscroft 02 Aug '00

02 Aug '00

Hi :) I was wondering, is it possible to obtain the admin password for a list if some bright person changes it and forgets what it is ? I manage several lists under Mailman version 1.1 Cheers o---------------------------------------------------------:) < < David E Oscroft - Australia > > < < Do what thou wilt shall be the whole of the Law > > MGD/SH/SX S* W++ N@ PCE++ Ds/r A a C+ G* QH+ 666+++ Y <deoau(a)austnet.org> <root(a)deo.dhs.org> <deoau(a)wonk.net> o---------------------------------------------------------.)

2 1

Still Getting issues with windows clients and lockfiles
by John MacKenzie 02 Aug '00

02 Aug '00

Hey Folks , Just to let you know that Even after upgrading to 2.0b5 I'm still experiencing this issue. Incase you need a reminder of the issue... Basically lockfiles don't appear to be expiring, also Windows browsers attempting to view the lists are getting internal server error messages , while my Linux Netscape works fine (after I've manually deleted the lock) Barry, Not sure if you've got time to look at this but if you do , You're more than welcome to shell access. Regards - John -- John MacKenzie | Unix Systems Admin | e: mailto:jmackenzie@local.ie ___________________________________________________________________ Stay in touch your local area through Local Ireland http://chat.local.ie/chat/index.html ___________________________________________________________________ local ireland | dublin | new york | http://www.local.ie t: +353 1 676 8996 f: +353 1 283 9988

1 0

problems with installation
by linux 02 Aug '00

02 Aug '00

got problem with installation. i run ./configure then make install (linux, suse 6.1). afterwards /home/mailman/bin/.checks_perms. the i get 284 list of problems something like: /home..... bad gid (has users, expected mailman) /home..... .hotjava directory is not setgid(has: users, expected mailman) What did i wrong? i got a user account mailman and group mailman. i added the user mailman to group mailman. thanks for help

1 0

problem with installation
by linux 02 Aug '00

02 Aug '00

got problem with installation. i run ./configure then make install (linux, suse 6.1). afterwards /home/mailman/bin/.checks_perms. the i get 284 list of problems something like: /home..... bad gid (has users, expected mailman) /home..... .hotjava directory is not setgid(has: users, expected mailman) What did i wrong? i got a user account mailman and group mailman. i added the user mailman to group mailman. thanks for help

1 0

old 'cookie' problem
by Marco Borrini 02 Aug '00

02 Aug '00

i've checked sourceforge to see if there is a patch available for my mailmanbeta2.0b2, but i haven't seen one that deletes this little problem (only opera browser allow me to use administrative pages). i've heavily modified mailman so i think it's not the best solution for me to upgrade mailman to beta5. greetings marco borrini

1 0

Bug after update to 2.0b4 II
by Ralf Hildebrandt 01 Aug '00

01 Aug '00

PS: I found the mails all queued in /users2/mailman/qfiles What now? -- Ralf.Hildebrandt(a)innominate.de Dipl.-Informatiker innominate AG System Engineer networking people tel: +49.30.308806-62 fax: -77 web: http://innominate.de pgp: /pgp/rh

4 5

Subscription problem
by V Thiyagarajan (Sysadmin) 01 Aug '00

01 Aug '00

Hi I have created a list. From the "General Information page i'm subscriping the users but i'm getting an error --------------------------------------------------------------------------- Not Found The requested URL /mailman/subscribe/sysadmn was not found on this server. ---------------------------------------------------------------------------- Where should i change the url?

2 1

Advisory: mailman local compromise (fwd)
by John Ello 01 Aug '00

01 Aug '00

Can anyone vouch for the patch at the end? ---------- Forwarded message ---------- Date: Tue, 1 Aug 2000 13:14:20 -0400 From: Stan Bubrouski <secnet(a)CROSSWINDS.NET> To: BUGTRAQ(a)SECURITYFOCUS.COM Subject: Advisory: mailman local compromise Author : Stan Bubrouski Date : August 1, 2000 Package : mailman Versions affected : 2.0beta3 (released: 2000-Jun-28 23:25) 2.0beta4 (released: 2000-Jul-06 21:27) Severity : access to group mailman binaries are installed as which (usually mailman). Most directories in a mailman install are mode 2755 as are most of the binaries and scripts. Many configurations are 664 allowing a local user to change list ocnfigurations and even read the adm.pw passwd file. Additionally besides being able to read public and private data along with passwds, a malicious user could replace binaries and scripts in a mailman installation because they are writable by group mailman. Problem : The mailman package comes with a sgid program named wrapper. This program contains a function named fatal() which is used to display error messages. Unfortunately it fails to send the correct amount of arguments to the fprintf(3) function allowing users to add formatting which could be used to insert and execute code under group mailman. fatal() is called when invalid arguments are provided and in such a case, the invalid arguments are sent to fprintf without being formatted, the same goes for argv[0]. Example: [user@king user]$ ls -al /usr/share/mailman/mail/wrapper -rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48 /usr/share/mailman/mail/wrapper [user@king user]$ cd /usr/share/mailman/mail [user@king mail]$ ls -al total 39 drwxrwsr-x 2 mailman mailman 1024 Jul 12 19:29 . drwxrwsr-x 16 mailman mailman 1024 Jul 27 20:13 .. -rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48 wrapper [user@king mail]$ ./wrapper Usage: ./wrapper program [args...] [user@king mail]$ ./wrapper %s Illegal command: Illegal command: %s[user@king mail]$ ./wrapper %s%s Illegal command: Illegal command: %s%s��=@��X��>@[user@king mail]$ ./wrapper %s%s%s Segmentation fault [user@king mail]$ ./wrapper %s%u%p Illegal command: Illegal command: %s%u%p32212244600x656c6c49[user@king mail]$ [user@king mail]$ doexec ./wrapper %s Usage: Usage: %s program [args...] program [args...] [user@king mail]$ doexec ./wrapper %s%s Usage: Usage: %s%s program [args...] ��=@��X��>@ program [args...] [user@king mail]$ doexec ./wrapper %s%p Usage: Usage: %s%p program [args...] 0xbffffc0c program [args...] [user@king mail]$ doexec ./wrapper %s%S%u Usage: Usage: %s%S%u program [args...] [user@king mail]$ doexec ./wrapper %s%s Usage: Usage: %s%s program [args...] ��=@��X��>@ program [args...] [user@king mail]$ doexec ./wrapper %s%s%s Segmentation fault [user@king mail]$ Patch: diff -u -r ./cgi-wrapper.c.orig ./cgi-wrapper.c --- ./cgi-wrapper.c.orig Tue Mar 21 01:26:41 2000 +++ ./cgi-wrapper.c Fri Jul 28 00:17:42 2000 @@ -53,7 +53,7 @@ fake_argv[2] = script; status = run_script("driver", 3, fake_argv, env); - fatal(logident, status, "%s", strerror(errno)); + fatal(logident, status, "%s\n", strerror(errno)); return status; } diff -u -r common.c.orig ./common.c --- ./common.c.orig Mon May 22 14:59:31 2000 +++ ./common.c Thu Jul 27 23:58:12 2000 @@ -108,7 +108,7 @@ printf("</pre>\n"); } else - fprintf(stderr, log_entry); + fprintf(stderr, "%s", log_entry); #endif /* HELPFUL */ exit(exitcode); } diff -u -r ./mail-wrapper.c.orig ./mail-wrapper.c --- ./mail-wrapper.c.orig Tue Mar 21 01:26:41 2000 +++ ./mail-wrapper.c Fri Jul 28 00:16:34 2000 @@ -67,13 +67,13 @@ if (!check_command(argv[1])) fatal(logident, MAIL_ILLEGAL_COMMAND, - "Illegal command: %s", argv[1]); + "Illegal command: %s\n", argv[1]); check_caller(logident, parentgid); /* If we got here, everything must be OK */ status = run_script(argv[1], argc, argv, env); - fatal(logident, status, "%s", strerror(errno)); + fatal(logident, status, "%s\n", strerror(errno)); return status; } Patch info : The patch fixes fatal() and also adds newlines to some fatal() calls because fatal() does not tack them on and as you can see in the example above, the lack of newlines in some calls make errors harder to read. I made the patch using the latest CVS tree but it should apply to beta3 and beta4 releases as well.

3 3

Mailman = spam magnet?
by Chris Snyder 01 Aug '00

01 Aug '00

One thing I've noticed since I've installed Mailman, is I'm getting spam on my mailing lists. Before I moved to Mailman, I never even had spam attempt to hit these lists, as they are mostly for internal AOL use - they very rarely, if at all, touch the Internet. However, since I've set up Mailman lists (with 'do not advertise this list' turned on for all lists) I've gotten spam like you wouldn't believe. So the question is, when I set up a new Mailman list, is it advertising this list other than just the 'listinfo' URL? I find this really odd because I've set up a test list that never even was used, and it's taking spam now. Something's up with this. Anybody else seen anything like this? thx Chris. +-------------------------------------------------------------------------+ Chris Snyder -- gopher(a)aol.net -- WebOps SysAdmin -- America Online +-------------------------------------------------------------------------+ There is a very fine line between "hobby" and "mental illness".

2 1

users names in Mailman
by Chris Snyder 01 Aug '00

01 Aug '00

One thing my boss commented on when I showed him Mailman, was that it doesn't allow you to record your list memebers full names like Listserv. (Thus, he's not 100% sold on Mailman ;) After I think about it, I would love to do be able to do that - any possibility of adding a comment/name field as part of the subscription forms? thx Chris. +-------------------------------------------------------------------------+ Chris Snyder -- gopher(a)aol.net -- WebOps SysAdmin -- America Online +-------------------------------------------------------------------------+ There is a very fine line between "hobby" and "mental illness".

3 2