Mailman 3 May 2004 - Mailman-Users

[Mailman-Users] Mail Lists, Authorized Posters and Virus/Worm Access
by Bob Bowers May 5, 2004

May 5, 2004

In my community last week, someone gained access to a mail list with hundreds of subscribers by mimicking an email address authorized to post to the list (moderation bit set OFF). In such a case, moderator approval was not required. What resulted was that a worm of the W32Beagle variety was sent to many hundreds of subscribers. I have changed all my mail lists to require active moderation of all posts (moderation bits are ON for all subscribers), and automatic rejection of all posts from non-members. It appears that it was just a matter of time for someone with ill intent to figure out that the "from" address in a message from a mail list might represent access to the mail list for mischief. It would not appear accidental that a virus or worm operating on some unsuspecting individual's computer accidentally sent itself to the posting address of a mail list as well as from an authorized email address. It is more likely that it was deliberate.

4 3

mail to my list -> mta result: user unknown
by walter.mauritz＠wu-wien.ac.at May 5, 2004

May 5, 2004

Hi, On sending a eMail to my mailing-list I get the following error. (from "tail -F -n 30 /var/log/maillog") May 5 15:44:03 smesrv sendmail[24051]: i45Di3D5024051: <mylist(a)smesrv.sme- union.org>... User unknown May 5 15:44:03 smesrv sendmail[24051]: i45Di3D5024051: from=<waltermauritz(a)gmx.at>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=pop.gmx.net [213.165.64.20] -> mylist(a)smesrv.sme-union.org --- user unknown I have set up - mailman - with sendmail - on redhat I have sticked to the manual of the distribution 1) INSTALL 2) README 3) README.SENDMAIL I use a "mailertable" smesrv.sme-union.org mailman:smesrv.sme-union.org ... which should put all mails not known (like "mylist" isnt a system user) to the Mail Delivery Agent, defined in sendmail.mc: #snip from /etc/mail/sendmail.mc Mmailman, P=/etc/mail/mm-handler, F=rDFMhlqSu, U=mailman:mailman, S=EnvFromL, R=EnvToL/HdrToL, A=mm-handler $h $u #end - mailertable has been done in db - sendmail.mc done to .fc - /etc/mail/mm-handler is executable to all But for some reason this does NOT WORK. --- user unknown What am I doing wrong? btw here my "mm_cfg.py" #########CODE from Defaults import * IMAGE_LOGOS = '/icons/' DEFAULT_EMAIL_HOST = 'smesrv.sme-union.org' DEFAULT_URL_HOST = 'smesrv.sme-union.org' add_virtualhost('smesrv.sme-union.org','smesrv.sme-union.org') ########## Questions to you: 1) Do you know what I have done wrong? 2) Or can you tell me how to set up the aliases manually? (Where does "mylist(a)smesrv.sme- union.org" has to point in virtuser.. Thanks for any help Regards Walter

2 1

Re: [Mailman-Users] Mail Lists, Authorized Posters and Virus/Worm Access
by Lloyd Tennison May 5, 2004

May 5, 2004

Set the mm_cfg.py and see Default.py for this info: # The envelope sender is set by the SMTP delivery and is thus less easily # spoofed than the sender, which is typically just taken from the From: header # and thus easily spoofed by the end-user. However, sometimes the envelope # sender isn't set correctly and this will manifest itself by postings being # held for approval even if they appear to come from a list member. If you # are having this problem, set this variable to No, but understand that some # spoofed messages may get through. USE_ENVELOPE_SENDER = No MAKE YES! This will help block some of your problem - unauthorized posts. The virus checker still goes. ----- Original Message --------------- >Return-path: <mailman-users-bounces(a)python.org> >Received: from mail.python.org (mail.python.org [12.155.117.29]) > by spf6.us4.outblaze.com (Postfix) with ESMTP id 3D823539AA > for <lloyd_tennison(a)whoever.com>; Wed, 5 May 2004 09:31:55 +0000 (GMT) >Received: from localhost.localdomain ([127.0.0.1] helo=mail.python.org) > by mail.python.org with esmtp (Exim 4.22) > id 1BLIqm-0005AH-BH; Wed, 05 May 2004 05:38:00 -0400 >Received: from ext-proxy-1.ftel.co.uk ([192.65.220.99]) > by mail.python.org with esmtp (Exim 4.22) id 1BLIqc-00054C-Ex > for mailman-users(a)python.org; Wed, 05 May 2004 05:37:50 -0400 >Received: from utility-2.ftel.co.uk (utility-2.ftel.co.uk [193.112.172.11]) > by ext-proxy-1.ftel.co.uk > (8.12.10/8.12.9/Revision:1.91/relay-in/ssl/db) with ESMTP id > i459baXi019160; Wed, 5 May 2004 10:37:40 +0100 >Received: from [172.16.3.104] (barrett-mac.ftel.co.uk [172.16.3.104]) > by utility-2.ftel.co.uk (8.12.9+Sun/8.12.9/Revision:1.90/db) with ESMTP > id i459bQEp012506; Wed, 5 May 2004 10:37:29 +0100 (BST) >In-Reply-To: <6.0.0.22.2.20040505011923.01f2d828(a)pop.west.cox.net> >References: <6.0.0.22.2.20040505011923.01f2d828(a)pop.west.cox.net> >Mime-Version: 1.0 (Apple Message framework v613) >Content-Type: text/plain; charset=US-ASCII; format=flowed >Message-Id: <CE96CC72-9E77-11D8-92AB-000A957C9A50(a)openinfo.co.uk> >Content-Transfer-Encoding: 7bit >From: Richard Barrett <r.barrett(a)openinfo.co.uk> >Subject: Re: [Mailman-Users] Mail Lists, > Authorized Posters and Virus/Worm Access >Date: Wed, 5 May 2004 10:37:21 +0100 >To: Bob Bowers <b-bowers(a)cox.net> >X-Mailer: Apple Mail (2.613) >X-Virus-Scanned: by amavisd-milter (http://amavis.org/) >X-Spam-Status: OK (lists-mailman 0.000) >Cc: mailman-users(a)python.org >X-BeenThere: mailman-users(a)python.org >X-Mailman-Version: 2.1.5c2 >Precedence: list >List-Id: Mailman mailing list management users <mailman-users.python.org> >List-Unsubscribe: <http://mail.python.org/mailman/listinfo/mailman-users>, > <mailto:mailman-users-request@python.org?subject=unsubscribe> >List-Archive: <http://mail.python.org/pipermail/mailman-users> >List-Post: <mailto:mailman-users@python.org> >List-Help: <mailto:mailman-users-request@python.org?subject=help> >List-Subscribe: <http://mail.python.org/mailman/listinfo/mailman-users>, > <mailto:mailman-users-request@python.org?subject=subscribe> >Sender: mailman-users-bounces(a)python.org >Errors-To: mailman-users-bounces(a)python.org > >On 5 May 2004, at 09:28, Bob Bowers wrote: > >> In my community last week, someone gained access to a mail list with >> hundreds of subscribers by mimicking an email address authorized to >> post to the list (moderation bit set OFF). In such a case, moderator >> approval was not required. What resulted was that a worm of the >> W32Beagle variety was sent to many hundreds of subscribers. I have >> changed all my mail lists to require active moderation of all posts >> (moderation bits are ON for all subscribers), and automatic rejection >> of all posts from non-members. >> >> It appears that it was just a matter of time for someone with ill >> intent to figure out that the "from" address in a message from a mail >> list might represent access to the mail list for mischief. It would >> not appear accidental that a virus or worm operating on some >> unsuspecting individual's computer accidentally sent itself to the >> posting address of a mail list as well as from an authorized email >> address. It is more likely that it was deliberate. > >I doubt that the virus writer was targeting mailing lists in this >considered fashion; to them, a mail alias is just a mail alias. > >I understand these virus types use the MUA address book on machines it >infects as a source of mail address to send its progeny on to. One of >your list's subscribers was probably the source of the infected message >and your list's address just one of a number pillaged from that user's >address book as destinations by a promiscuous virus. > >In my view, running effective virus (and spam) filtering on your >incoming MTA is the secret of happiness. It keeps viruses away from >your both your lists' and your real users' mail aliases, and it means >you do not have to moderate everything if the virus loaded messages are >being silently dropped in the bit bucket by the MTA. > > >------------------------------------------------------ >Mailman-Users mailing list >Mailman-Users(a)python.org >http://mail.python.org/mailman/listinfo/mailman-users >Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py >Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ >

1 0

Updated exim configuration
by Joerg Mauer May 5, 2004

May 5, 2004

Hi, there is a new exim doc. for mailman 2.1 : You probably want to update the link on the documentation page. http://www.exim.org/howto/mailman21.html regards, joerg

1 0

on mailing to my list: user (=listname) unknown; (sendmail-mailman config error?)
by walter.mauritz＠wu-wien.ac.at May 5, 2004

May 5, 2004

Hi, I have installed - mailman - apache - sendmail Successfully created a list, got a confirmation eMail from list. But on mailing to the list listname = "mylist", I get the following error: <mylist(a)smesrv.sme-union.org>: 217.136.223.232_does_not_like_recipient./Remote_host_said:_550_5.1.1_<mylist(a)smesrv.s me-union.org>..._User_unknown/Giving_up_on_217.136.223.232./ It seems to me like the mail delivery agent tries to put the mail to the correct user "mylist", who doesn't exist. So what can I do that mailman recognizes its for him. Further information: - smesrv.sme-union.org = 217.136.223.232 - On Configuration I followed the INSTALL and the README, being included in the mailman distribution. - Furthermore in sendmail, /etc/mail/access there is no "discard" ... which could falsly generate that 550 error message - mm_cfg.py: DEFAULT_EMAIL_HOST = 'smesrv.sme-union.org' DEFAULT_URL_HOST = 'smesrv.sme-union.org' add_virtualhost('smesrv.sme-union.org','smesrv.sme-union.org') Any help would be greatly appreciated. Is there any further information about the system which I should provide? Regards Walter

2 1

/usr/local/mailman/mail/wrapper doesn't exist
by Steve Schofield May 5, 2004

May 5, 2004

I installed mailman, trying to use Qmail as the MTA. The only thing that baffles me so far is the wrapper program doesn't exist in the /usr/local/mailman/mail/ directory. Where would I find documentation on this? I'm able to create lists, send notifcations to users but can't send messages to the newly created lists. It shouts something about a program called wrapper. Any advice on this? * ----------------------------------------- * * Steve Schofield * steve(a)deviq.com * ----------------------------------------- *

1 0

Weird domain action
by Brian O'Connor May 4, 2004

May 4, 2004

We have a web and mail server set up with the domain name osdlc.org. We are also trying to set up a mail list, but the server keeps adding "www." to our mail list address. For example, i want to set up a mail list entitled "ayp4sdoiep(a)osdlc.org," but the list comes out with the address, "ayp4sdoiep(a)www.osdlc.org." I have two questions: How do I get that "www" off the list address? If that can not be done: how can I alter my DNS to account for the "www" that is added? Thanks in advance. _________________________________________________________________ MSN Toolbar provides one-click access to Hotmail from any Web page FREE download! http://toolbar.msn.com/go/onm00200413ave/direct/01/

2 1

Footer Appended as Attachment in 2.1?
by Hunter Hillegas May 4, 2004

May 4, 2004

We're seeing the footer coming along as an attachment on some end-users systems. I saw a FAQ entry for this behavior with 2.0.x. We're running 2.1.4 and the FAQ article specifies that it is fixed in 2.1.x. Anyone know what is going on? Thanks, Hunter

5 13

Header.py, UnicodeDecodeError, and shunting
by David Vasil May 4, 2004

May 4, 2004

Software versions: Python 2.3.3 Mailman 2.1.4 After reading through the archives and applying the Scrubber.py patch from: http://sourceforge.net/tracker/index.php?func=detail&aid=891491&group_id=10… I still have UnicodeDecodeErrors within Header.py: --- May 04 14:49:11 2004 (6090) Uncaught runner exception: 'ascii' codec can't decode byte 0xb0 in position 13: ordinal not in range(128) May 04 14:49:11 2004 (6090) Traceback (most recent call last): File "/usr/local/mail/mailman/Mailman/Queue/Runner.py", line 110, in _oneloop self._onefile(msg, msgdata) File "/usr/local/mail/mailman/Mailman/Queue/Runner.py", line 160, in _onefile keepqueued = self._dispose(mlist, msg, msgdata) File "/usr/local/mail/mailman/Mailman/Queue/CommandRunner.py", line 223, in _dispose res = Results(mlist, msg, msgdata) File "/usr/local/mail/mailman/Mailman/Queue/CommandRunner.py", line 77, in __init__ subj = make_header(decode_header(subj)).__unicode__() File "/usr/local/mail/mailman/pythonlib/email/Header.py", line 144, in make_header h.append(s, charset) File "/usr/local/mail/mailman/pythonlib/email/Header.py", line 272, in append ustr = unicode(s, incodec, errors) UnicodeDecodeError: 'ascii' codec can't decode byte 0xb0 in position 13: ordinal not in range(128) May 04 14:49:11 2004 (6090) SHUNTING: 1083696551.06902+686403e653920540ba0135ba554ffa089554d286 May 04 14:59:10 2004 (6090) Uncaught runner exception: 'ascii' codec can't decode byte 0xb9 in position 26: ordinal not in range(128) May 04 14:59:10 2004 (6090) Traceback (most recent call last): File "/usr/local/mail/mailman/Mailman/Queue/Runner.py", line 110, in _oneloop self._onefile(msg, msgdata) File "/usr/local/mail/mailman/Mailman/Queue/Runner.py", line 160, in _onefile keepqueued = self._dispose(mlist, msg, msgdata) File "/usr/local/mail/mailman/Mailman/Queue/CommandRunner.py", line 223, in _dispose res = Results(mlist, msg, msgdata) File "/usr/local/mail/mailman/Mailman/Queue/CommandRunner.py", line 77, in __init__ subj = make_header(decode_header(subj)).__unicode__() File "/usr/local/mail/mailman/pythonlib/email/Header.py", line 144, in make_header h.append(s, charset) File "/usr/local/mail/mailman/pythonlib/email/Header.py", line 272, in append ustr = unicode(s, incodec, errors) UnicodeDecodeError: 'ascii' codec can't decode byte 0xb9 in position 26: ordinal not in range(128) May 04 14:59:10 2004 (6090) SHUNTING: 1083697150.3277359+511cb73c182e4a71854cf110a1ae50187c4c9b7a --- According to the python traceback in mailman/logs/error it looks as though it is failing while trying to decode the subject line of the message. Upon further inspection of the guilty messages the subject lines do indeed appear to contain characters that could not be decoded (SpamAssassin gave the messages high spam-levels as well as failing with test SUBJ_ILLEGAL_CHARS among others). Is there a patch which handles this problem in Header.py? I do not wish to have legitimate email shunted if I can avoid it. -- +------------------------------------------------------------+ | Dave Vasil vasil(a)cs.utk.edu | | University of Tennessee Computer Science Dept. | | UTKCS Systems Administrator 865-974-8364 | +------------------------------------------------------------+

1 0

request.db files
by Carl Parrish May 4, 2004

May 4, 2004

Okay while trying to find out was was wrong with my mailman server late at night I noticed that only two of my lists has a request.db file in it. In a move that I can only attribute to it being late/early morning, I then deleted the request.db in both lists that had them. (without backups). So now I'm trying to recreate them. how do I do that? -- Carl Parrish(cparrish(a)carlparrish.com) http://www.carlparrish.com -- Registered Linux User #295761 http://counter.li.org

1 0