Mailman 3 August 2000 - Mailman-Users

Upgrade problem
by Aaryn Olsson 02 Aug '00

02 Aug '00

Dear mailman-users, I apologize for not giving more information in my last, panicked message. The problem seems to be that there is a reference to the old mailman-1.1 somewhere within the mailman-2.0 framework. There are no references to mailman-1.1 anywhere in the aliases files, nor in the passwd file. In my last message I asked why would members of a list be receiving endless digest messages. In the logs/error file, there are over 20,000 messages (each 20 lines each) indicating that mailman archives is looking in the old mailman-1.1 directory. The first one I found looks like this: Jul 31 17:20:00 2000 (3205) Archive file access failure: /usr/local/mail/mailman-1.1/archives/private/theclub.mbox/theclub.mbox [Errno 2] No such file or directory: '/usr/loc al/mail/mailman-1.1/archives/private/theclub.mbox/theclub.mbox' Jul 31 17:20:00 2000 (3205) Delivery exception: [Errno 2] No such file or directory: '/usr/local/mail/mailman-1.1/archives/private/theclub.mbox/theclub.mbox' Jul 31 17:20:00 2000 (3205) Traceback (innermost last): File "/usr/local/mail/mailman-2.0beta4/Mailman/Handlers/HandlerAPI.py", line 82, in do_pipeline func(mlist, msg, msgdata) File "/usr/local/mail/mailman-2.0beta4/Mailman/Handlers/ToArchive.py", line 31, in process mlist.ArchiveMail(msg, msgdata) File "/usr/local/mail/mailman-2.0beta4/Mailman/Archiver/Archiver.py", line 197, in ArchiveMail self.__archive_to_mbox(msg) File "/usr/local/mail/mailman-2.0beta4/Mailman/Archiver/Archiver.py", line 163, in __archive_to_mbox mbox = self.__archive_file(afn) File "/usr/local/mail/mailman-2.0beta4/Mailman/Archiver/Archiver.py", line 149, in __archive_file return Mailbox.Mailbox(open_ex(afn, "a+")) File "/usr/local/mail/mailman-2.0beta4/Mailman/Utils.py", line 567, in open_ex fd = os.open(filename, flags, perms) IOError: [Errno 2] No such file or directory: '/usr/local/mail/mailman-1.1/archives/private/theclub.mbox/theclub.mbox' The only reference I could find to mailman-1.1 was in the file archives/private/arid_gardener/pipermail.pck: S'/usr/local/mail/mailman-1.1/archives/private/arid_gardener' Why would this be so? Once again, thanks in advance for you help. Sincerely, Aaryn Olsson

2 1

Advisory: mailman local compromise (fwd)
by Trevor Johnson 01 Aug '00

01 Aug '00

---------- Forwarded message ---------- Date: Tue, 1 Aug 2000 13:14:20 -0400 From: Stan Bubrouski <secnet(a)CROSSWINDS.NET> To: BUGTRAQ(a)SECURITYFOCUS.COM Subject: Advisory: mailman local compromise Author : Stan Bubrouski Date : August 1, 2000 Package : mailman Versions affected : 2.0beta3 (released: 2000-Jun-28 23:25) 2.0beta4 (released: 2000-Jul-06 21:27) Severity : access to group mailman binaries are installed as which (usually mailman). Most directories in a mailman install are mode 2755 as are most of the binaries and scripts. Many configurations are 664 allowing a local user to change list ocnfigurations and even read the adm.pw passwd file. Additionally besides being able to read public and private data along with passwds, a malicious user could replace binaries and scripts in a mailman installation because they are writable by group mailman. Problem : The mailman package comes with a sgid program named wrapper. This program contains a function named fatal() which is used to display error messages. Unfortunately it fails to send the correct amount of arguments to the fprintf(3) function allowing users to add formatting which could be used to insert and execute code under group mailman. fatal() is called when invalid arguments are provided and in such a case, the invalid arguments are sent to fprintf without being formatted, the same goes for argv[0]. Example: [user@king user]$ ls -al /usr/share/mailman/mail/wrapper -rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48 /usr/share/mailman/mail/wrapper [user@king user]$ cd /usr/share/mailman/mail [user@king mail]$ ls -al total 39 drwxrwsr-x 2 mailman mailman 1024 Jul 12 19:29 . drwxrwsr-x 16 mailman mailman 1024 Jul 27 20:13 .. -rwxr-sr-x 1 mailman mailman 36290 Jul 1 06:48 wrapper [user@king mail]$ ./wrapper Usage: ./wrapper program [args...] [user@king mail]$ ./wrapper %s Illegal command: Illegal command: %s[user@king mail]$ ./wrapper %s%s Illegal command: Illegal command: %s%s��=@��X��>@[user@king mail]$ ./wrapper %s%s%s Segmentation fault [user@king mail]$ ./wrapper %s%u%p Illegal command: Illegal command: %s%u%p32212244600x656c6c49[user@king mail]$ [user@king mail]$ doexec ./wrapper %s Usage: Usage: %s program [args...] program [args...] [user@king mail]$ doexec ./wrapper %s%s Usage: Usage: %s%s program [args...] ��=@��X��>@ program [args...] [user@king mail]$ doexec ./wrapper %s%p Usage: Usage: %s%p program [args...] 0xbffffc0c program [args...] [user@king mail]$ doexec ./wrapper %s%S%u Usage: Usage: %s%S%u program [args...] [user@king mail]$ doexec ./wrapper %s%s Usage: Usage: %s%s program [args...] ��=@��X��>@ program [args...] [user@king mail]$ doexec ./wrapper %s%s%s Segmentation fault [user@king mail]$ Patch: diff -u -r ./cgi-wrapper.c.orig ./cgi-wrapper.c --- ./cgi-wrapper.c.orig Tue Mar 21 01:26:41 2000 +++ ./cgi-wrapper.c Fri Jul 28 00:17:42 2000 @@ -53,7 +53,7 @@ fake_argv[2] = script; status = run_script("driver", 3, fake_argv, env); - fatal(logident, status, "%s", strerror(errno)); + fatal(logident, status, "%s\n", strerror(errno)); return status; } diff -u -r common.c.orig ./common.c --- ./common.c.orig Mon May 22 14:59:31 2000 +++ ./common.c Thu Jul 27 23:58:12 2000 @@ -108,7 +108,7 @@ printf("</pre>\n"); } else - fprintf(stderr, log_entry); + fprintf(stderr, "%s", log_entry); #endif /* HELPFUL */ exit(exitcode); } diff -u -r ./mail-wrapper.c.orig ./mail-wrapper.c --- ./mail-wrapper.c.orig Tue Mar 21 01:26:41 2000 +++ ./mail-wrapper.c Fri Jul 28 00:16:34 2000 @@ -67,13 +67,13 @@ if (!check_command(argv[1])) fatal(logident, MAIL_ILLEGAL_COMMAND, - "Illegal command: %s", argv[1]); + "Illegal command: %s\n", argv[1]); check_caller(logident, parentgid); /* If we got here, everything must be OK */ status = run_script(argv[1], argc, argv, env); - fatal(logident, status, "%s", strerror(errno)); + fatal(logident, status, "%s\n", strerror(errno)); return status; } Patch info : The patch fixes fatal() and also adds newlines to some fatal() calls because fatal() does not tack them on and as you can see in the example above, the lack of newlines in some calls make errors harder to read. I made the patch using the latest CVS tree but it should apply to beta3 and beta4 releases as well.

1 0

access via https, some links use http
by Andreas Hasenack 01 Aug '00

01 Aug '00

I'm using mailman 2.0beta4 and I like to use the administrative pages via https rather than via http. It works, no problem with that. But some links in the pages have http://... hardcoded in them, for example, the membership management one. If I want to see next page of subscribed users, using the link gets me back to non-SSL. To use them, now I just paste them in the URL location in the browser and change http to https. Is there anyway those links could use what I am using at that moment, http or https? Could they be relative instead of absolute? -- Andreas Hasenack andreas(a)conectiva.com.br BIG Linux user!

4 3

Re: Ag.Arizona.Edu mailing list memberships reminder (fwd)
by Aaryn Olsson 01 Aug '00

01 Aug '00

Dear mailman-users, Is this possible for this list subscriber? Thanks, Aaryn Olsson ---------- Forwarded message ---------- Date: Tue, 1 Aug 2000 08:10:13 -0700 (MST) From: Kelly LeFevre <krl(a)U.Arizona.EDU> To: mailman-owner(a)Ag.Arizona.Edu Subject: Re: Ag.Arizona.Edu mailing list memberships reminder Can I turn off this monthly reminder? Can I do so for the entire membership of a list? Thanks. Kelly LeFevre GSO list owner On Tue, 1 Aug 2000 mailman-owner(a)Ag.Arizona.Edu wrote: > This is a reminder, sent out once a month, about your Ag.Arizona.Edu > mailing list memberships. It includes your subscription info and how > to use it to change it or unsubscribe from a list. > > You can visit the URLs to change your membership status or > configuration, including unsubscribing, setting digest-style delivery > or disabling delivery altogether (e.g., for a vacation), and so on. > > In addition to the URL interfaces, you can also use email to make such > changes. For more info, send a message to the '-request' address of > the list (for example, gso-request(a)Ag.Arizona.Edu) containing just the > word 'help' in the message body, and an email message will be sent to > you with instructions. > > If you have questions, problems, comments, etc, send them to > mailman-owner(a)Ag.Arizona.Edu. Thanks! > > Passwords for krl(a)email.arizona.edu: > > List Password // URL > ---- -------- > listadmins(a)Ag.Arizona.Edu udiM > http://Ag.Arizona.Edu/mailman/options/listadmins/krl@email.arizona.edu > > gso(a)Ag.Arizona.Edu ulRH > http://Ag.Arizona.Edu/mailman/options/gso/krl@email.arizona.edu >

2 1

Beta5 or final?
by Gregory Leblanc 01 Aug '00

01 Aug '00

Barry posted something about hoping to have a final beta or even a "stable" release out by a week after the O'Reilly conference. Anybody heard anything with regards to this? Greg P.S. Sorry to nag, but I'm putting a server in at work "real soon now", and I'd love to be able to run "stable" code, just so that it doesn't say "beta". :-)

1 0

urgent - digest out of control
by Aaryn Olsson 01 Aug '00

01 Aug '00

Dear mailman-users, There seems to be a digest out of control. The email I received earlier indicated over 100 messages, but the last message from an unhappy user indicated he had received over 800, so it looks like it's still going. What would cause users to receive endless copies of a message like this? TIA, Aaryn ---------- Forwarded message ---------- Date: Tue, 01 Aug 2000 08:53:17 -0700 From: Kathleen Peterson <kpetersn(a)Ag.Arizona.Edu> To: lab(a)Ag.Arizona.Edu Subject: Fwd: Arid_gardener digest, Vol 1 #1044 - 14 msgs >Return-Path: <arid_gardener-admin(a)Ag.Arizona.Edu> >Received: from post1.inre.asu.edu (post1.inre.asu.edu [129.219.13.100]) > by Ag.Arizona.Edu (8.9.3+Sun/8.9.3) with ESMTP id IAA10708 > for <kpetersn(a)Ag.Arizona.Edu>; Tue, 1 Aug 2000 08:28:34 -0700 (MST) >Received: from conversion.post1.inre.asu.edu by asu.edu (PMDF V5.2-31 #33824) > id <0FYM00K01DNIMD(a)asu.edu> for kpetersn(a)Ag.Arizona.Edu > (ORCPT rfc822;kathyp(a)asu.edu); Tue, 1 Aug 2000 08:28:31 -0700 (MST) >Received: from smtp.asu.edu (smtp.asu.edu [129.219.13.92]) > by asu.edu (PMDF V5.2-31 #33824) with ESMTP id <0FYM00B9NDNGVU(a)asu.edu> for > kpetersn(a)Ag.Arizona.Edu (ORCPT rfc822;kathyp(a)asu.edu); Tue, > 01 Aug 2000 08:28:30 -0700 (MST) >Received: from imap4.asu.edu (imap4.asu.edu [129.219.10.161]) > by smtp.asu.edu (8.9.3/8.9.3) with ESMTP id IAA24219 for > <kpetersn(a)Ag.Arizona.Edu>; Tue, 01 Aug 2000 08:28:32 -0700 (MST) >Received: from post3.inre.asu.edu (post3.inre.asu.edu [129.219.13.74]) > by imap4.asu.edu (8.9.3/8.9.1) with ESMTP id IAA25831 for > <kathyp(a)IMAP4.ASU.EDU>; Tue, 01 Aug 2000 08:28:21 -0700 (MST) >Received: from conversion.post3.inre.asu.edu by asu.edu (PMDF V5.2-31 #33824) > id <0FYM00K01DPGZC(a)asu.edu> for kathyp(a)IMAP4.ASU.EDU > (ORCPT rfc822;kathyp(a)asu.edu); Tue, 01 Aug 2000 08:29:40 -0700 (MST) >Received: from Ag.Arizona.Edu (AG.Arizona.EDU [128.196.42.70]) > by asu.edu (PMDF V5.2-31 #33824) with ESMTP id <0FYM00MIZDPFUK(a)asu.edu> for > kathyp(a)IMAP4.ASU.EDU (ORCPT rfc822;kathyp(a)asu.edu); Tue, > 01 Aug 2000 08:29:40 -0700 (MST) >Received: from Ag.Arizona.Edu (localhost [127.0.0.1]) > by Ag.Arizona.Edu (8.9.3+Sun/8.9.3) with ESMTP id IAA10642; Tue, > 01 Aug 2000 08:28:23 -0700 (MST) >Date: Tue, 01 Aug 2000 08:28:23 -0700 (MST) >From: arid_gardener-request(a)Ag.Arizona.Edu >Subject: Arid_gardener digest, Vol 1 #1044 - 14 msgs >Sender: arid_gardener-admin(a)Ag.Arizona.Edu >To: arid_gardener(a)Ag.Arizona.Edu >Errors-to: arid_gardener-admin(a)Ag.Arizona.Edu >Reply-to: arid_gardener(a)Ag.Arizona.Edu >Message-id: <200008011528.IAA10642(a)Ag.Arizona.Edu> >MIME-version: 1.0 >X-Mailer: Mailman v2.0beta4 >Content-type: text/plain >Content-transfer-encoding: 8BIT >Precedence: bulk >X-BeenThere: arid_gardener(a)Ag.Arizona.Edu >X-Mailman-Version: 2.0beta4 >List-Id: Gardening and Landscaping in Dry Climates > <arid_gardener.Ag.Arizona.Edu> >X-UIDL: dd1d8704dcdf885578d8bfa0dfbb7020 > >arid_gardenerSend Arid_gardener mailing list submissions to > arid_gardener(a)Ag.Arizona.Edu > >To subscribe or unsubscribe via the World Wide Web, visit > http://Ag.Arizona.Edu/mailman/listinfo/arid_gardener >or, via email, send a message with subject or body 'help' to > arid_gardener-request(a)Ag.Arizona.Edu > >You can reach the person managing the list at > arid_gardener-admin(a)Ag.Arizona.Edu > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Arid_gardener digest..." > > >arid_gardener digest > >Today's Topics: > > 1. Re: re pantry pests (Sue Bass) > 2. Salt in Soil - Brown Leaves - Soil Amendments for Arizona - Rain > Water (Ursula Miller) > 3. Question from Home-Hort WWW page (fscapellit(a)mindspring.com) > 4. Question from Home-Hort WWW page (bonnford(a)amug.org) > 5. Question from Home-Hort WWW page (archsoul(a)home.com) > 6. Fwd: (Marikelly Block) > 7. YUCCA (Sue Hakala) > 8. RE: Question from Home-Hort WWW page (Ursula Miller) > 9. Question from Home-Hort WWW page (kffrmw88(a)mindspring.com) > 10. Re: Flood of maillist posts (Sue Bass) > 11. Problems! (Sue Bass) > 12. Re: repeat, repeat, repeat (Sue Bass) > 13. Fw: [AG] Grape Vines Available (Olin Miller) > 14. Question from Home-Hort WWW page (icbcd(a)mainex1.asu.edu) > >--__--__-- > >Message: 1 >Date: Mon, 31 Jul 2000 19:52:40 -0700 >From: Sue Bass <sjbass(a)uswest.net> >To: Mapgoddess(a)aol.com [SNIP!!!]

1 0

Can I hide "restricted" lists on the main mailman html page?
by Brian J. Murrell 01 Aug '00

01 Aug '00

I have some lists that I would like to run on my mailman server which need to be "hidden" from general users. Meaning that when an "unknown somebody" goes to the http://.../mailman/listinfo/ page, I would like some of the lists not listed there. Having the list named on the page but requiring a password to follow the link is not workable because just the name of the list is too much of a leak of information. I envision a http://.../mailman/listinfo/ page that shows all of the "public" lists. I also envision on that page 2 boxes where a user puts in his e-mail account and password. Once the account and password are verified, the "list of lists" is updated so that any of the "hidden" lists he is a member of now show up. Obviously and of course if a given list that was named "hidden-list" was hidden, the page at http://.../mailman/listinfo/hidden-list should be password protected using the above mechanism to prevent security-thru-obscurity issues. "How does a user know that a list exists to subscribe to if he has to be a subscriber to see it" you might ask? The list would be by invitation only. Or even better, perhaps as an option the ability to see the "hidden" list on the main mailman page could be allowed or denied based on pattern matching of the user's *authenticiated* (with his password) e-mail address. So a rule could be attached to the list that says something like "*(a)some.domain.com and *(a)*.other.domain.com are permitted to see this list in the list of lists". Thots? b.

2 2

Re: [Mailman-Users] A Vote Against Passwords
by J C Lawrence 01 Aug '00

01 Aug '00

On Tue, 1 Aug 2000 23:12:04 +1000 Chuck Dale <bug(a)aphid.net> wrote: > I vote to have the password facilities in Mailman toned down. I > would like them removed but at least to make this optional. Configurable is Okay -- but they're too damned useful to remove. > And definitely to make the "Send Password Reminders Every > Month" option default to OFF. Choice. I prefer them on for the reasoning below. > I say this after another month of receiving more than 10 separate > password reminders. And mailman lists only account for about 1/3 > of the lists I am on! Password reminders are the most telling method to handle bounces from forwarded addresses without going for VERP. Handle the uncaught bounces from your password reminders every N months of so and you can maintain a pretty clean list without paying VERP's expense. -- J C Lawrence Home: claw(a)kanga.nu ---------(*) Other: coder(a)kanga.nu http://www.kanga.nu/~claw/ Keys etc: finger claw(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

1 0

Bug after update to 2.0beta4
by Ralf Hildebrandt 01 Aug '00

01 Aug '00

Prior to the update to 2.0beta4 (have been running 2.0beta2 or 1) everything has been running smoothly (except for the pending administrative requests -- thus I upgraded). I used identical options when configure'ing Beta 4 After the update, nothing (!) happens when I send mail to any of my three lists. From my maillog: Aug 1 12:43:50 stahlw06 postfix/local[10065]: 900E014554: to=<litquiz(a)stahlw06.stahl.bau.tu-bs.de>, relay=local, delay=72, status=sent ("|/users2/mailman/mail/wrapper post litquiz") (so /users2/mailman/mail/wrapper exits with status 0) I did a bin/check_perms -- everything ok. I then deleted the locks/* and logs/*, still nothing. Mail is just swallowed, never to be seen again. -- Ralf.Hildebrandt(a)innominate.de Dipl.-Informatiker innominate AG System Engineer networking people tel: +49.30.308806-62 fax: -77 web: http://innominate.de pgp: /pgp/rh

1 0

List of subscriptions
by David Champion 01 Aug '00

01 Aug '00

I've had users ask if there's any way to see a list of their subscriptions on my server. I know about the "Your other foo.mil subscriptions", but is there any access to that information (.../handle_opts/list/user) that does not require the user to know at least one list they're on? -- -D. dgc(a)uchicago.edu NSIT University of Chicago

1 0