Mailman 3 May 2008 - Mailman-Users

Re: [Mailman-Users] why do i keep getting awaiting approval messages ?
by Anant Maringanti May 28, 2008

May 28, 2008

>You have told us much, but you have not told us why the "message >awaiting approval" was issued. In that mail there should be a reason >why the mail was sent to the list moderator(s) for approval, such as > a) posting by a non-member to a member-only list > b) "implicit destination" >c) too many recipients > d) and others Hi Barry, thanks for responding. The message said: "posting from a member to a moderated group." As it turned out, I had left the newsgroup options unchanged because I assumed that it doesnt matter because I dont have a newsgroup associated with this list. But apparently, as the newsgroup was checked to be a moderated group, even if there is none associated with this list, it will behave as if the list itself is moderated. I just changed that and tried a test post. Everything is fine for now. Thanks again anant

1 0

How to make unsubscribe==ban ???
by Katy Eggering May 27, 2008

May 27, 2008

I've looked in the archives but didn't find anything about my situation. I have a customer that is implementing a mailing list for those that subscribe to their service. They plan to import the member list from their database and do a mass subscribe. Each mailing sent out will include unsubscribe info. When the user sends an "unsubscribe" message, we need to make sure that they aren't resubscribed with the next database/user sync. It looks like we can accomplish this by adding that user to the ban list. (I know in older versions a subscribe by the admin overruled the ban list, but not any more.) So my question is how to get the unsubscribed user into the list of banned users. I haven't found a command line version of ban. Does one exist? Other suggestions welcome. Thanks. Katy -- Katy Eggering Networks By Design katy(a)by-design.net 314.786.1000 x 114

2 1

Mailman FAQ: a call for help
by Terri Oda May 27, 2008

May 27, 2008

Ever wanted to help out with Mailman but didn't know how? Here's your chance! I've been trying to make the wiki into the one-stop-shop for Mailman documentation, and as part of that process, I made a script that moved the Mailman FAQ entries into the wiki. http://wiki.list.org/display/DOC/Frequently+Asked+Questions You'll see that there's around 200 entries in there now, organized into sections as they were originally in the FAQ Wizard: http://www.python.org/cgi-bin/faqw-mm.py I need some people who've got a few minutes to help out with cleaning up the wiki FAQ entries. You don't need to know the answers -- I just need some volunteers who can fix some links and maybe do some organization. I don't need any huge time commitment, just sign up for a wiki account and do an entry or two when you've got some spare time. Most of the pages just need someone to convert the FAQ Wizard links to internal wiki links (eg: in http://wiki.list.org/x/PIA9), maybe fix some other formatting (eg: look at http://wiki.list.org/x/p4A9 and how the preformatted stuff is inexplicably in three blocks rather than one). It's an easy job, it's just that at 200 pages, I could use some help! If you have any questions or need any help getting started, please let me know! Terri

2 1

Re: [Mailman-Users] sharing administrator passwords
by Laura Creighton May 27, 2008

May 27, 2008

In a message of Tue, 27 May 2008 03:19:42 +0900, "Stephen J. Turnbull" writes: >Cyndi Norwitz writes: > > > What is a pain for me to remember is the link to get to each interface >. I > > use a custom page for my new window/tab page in FF. It has them liste >d so > > I can click and go. > >What I do is to create a bookmark folder in FireFox containing a bookmark >for each list such as > > Name: NAME-OF-LIST > URL: http://HOST/cgi-bin/mailman/admindb/LIST?adminpw=PASSWORD > >(ISTR I first heard of this from Barry Warsaw.) If I wanted that to be >secure and/or portable, I'd put it in an HTML file on a USB stick. It >would be easy to generate such files, and any security risk would be >restricted to the lists managed by people who scatter such information >around for snoops to see, which is about the best you can do. I >believe that FireFox at least can import such pages as bookmark folders. Thank you. This is a good idea. > >I realize that this is less than what really *should* be possible in >this day and age, but I hope it helps. > > > I do like your idea though of having one main account per person which > will > > then give you allowed access to all the lists you own or moderate (and > > subscribe to). Don't know how doable it is though... > >This is definitely coming in Mailman 3, since user management will be >separated from individual lists. The same mechanism can surely be >adapted to admin account management. Any idea when Mailman 3 is coming? Laura

3 2

Re: [Mailman-Users] why do i keep getting awaiting approval messages ?
by b19141＠anl.gov May 27, 2008

May 27, 2008

"Anant Maringanti" <am72subs(a)gmail.com> wrote, in part: >I have looked up the archives and the FAQ but perhaps I dont even know >what I am looking for. I have recently set up a mailing list. I think >I have set up the list for not holding up any member's posting for >admin approval. But each time there is a posting, it gets held up and I >get a message saying "message awaiting approval" and it wont go through >until I approve of it. At first I thought it was because messages were >coming in with html in them -- so I sent a message in plain text >format to test but even that got held up. Where should I look? Here are >the main options which I think are relevant as I have set them. Any >suggestions in this regard will be greatly appreciated: You have told us much, but you have not told us why the "message awaiting approval" was issued. In that mail there should be a reason why the mail was sent to the list moderator(s) for approval, such as a) posting by a non-member to a member-only list b) "implicit destination" c) too many recipients d) and others Without knowing the reason, we can only guess at the reason and attempt to give you advice. I could tell you how to fix "implicit destination", but that will not help you if that is not the cause of your problem. ---------------------------------------------------------------------- Barry S. Finkel Computing and Information Systems Division Argonne National Laboratory Phone: +1 (630) 252-7277 9700 South Cass Avenue Facsimile:+1 (630) 252-4601 Building 222, Room D209 Internet: BSFinkel(a)anl.gov Argonne, IL 60439-4828 IBMMAIL: I1004994

1 0

Re: [Mailman-Users] sharing administrator passwords
by b19141＠anl.gov May 27, 2008

May 27, 2008

Laura Creighton <lac(a)openend.se> replied: >Right, what people want is a way to remember one password to administer >15 or so lists on one site, without having the site password, because >there is _nobody_ we trust to administer all the lists. So that password >is only used by sysadmins for rare emergencies. If you are the only admin for each of the 15 lists, then set the admin password to one string that you will remember. The problem arises when you are not the only admin, and each of the 15 lists has a different set of co-admins. Then every one of those co-admins will need to know the one admin password, and those co-admins will then have admin access to lists for which they are not administrators. ---------------------------------------------------------------------- Barry S. Finkel Computing and Information Systems Division Argonne National Laboratory Phone: +1 (630) 252-7277 9700 South Cass Avenue Facsimile:+1 (630) 252-4601 Building 222, Room D209 Internet: BSFinkel(a)anl.gov Argonne, IL 60439-4828 IBMMAIL: I1004994

2 1

Re: [Mailman-Users] sharing administrator passwords
by Laura Creighton May 27, 2008

May 27, 2008

Thanks Brad <snip> >But there's one and only one site admin password. And whoever has >site admin password can do anything at all that they want to your >Mailman installation -- if it can be done from the web, they can do >it. > > >You really don't want to be sharing the site admin password with >anyone that you don't trust to have full root level access to your >mail servers. > >Which brings us right back to where we were. Right, what people want is a way to remember one password to administer 15 or so lists on one site, without having the site password, because there is _nobody_ we trust to administer all the lists. So that password is only used by sysadmins for rare emergencies. Laura

1 0

Re: [Mailman-Users] Major problems with privacy and mailman lists and harvesters
by Steve Murphy May 27, 2008

May 27, 2008

----- "Brad Knowles" wrote: > Steve Murphy wrote: > > > I've noticed in the mailman-users archives, that if I view info > > by thread (using the mailman archives as an example,) > > which site is 2.1.10 based, > > that all email addresses are present, but with a simple obfuscation. > > (the "@" has been changed to " at ".) I can't help but to think > > that this simple obfuscation is a joke. Any harvester written in the > > past number of years would be smart enough to capture such accurately. > > This is a well-known weakness. Please feel free to upload a suggested patch > to <http://sourceforge.net/tracker/?atid=300103&group_id=103&func=browse>, > or at least file a Request For Enhancement at > <http://sourceforge.net/tracker/?atid=350103&group_id=103&func=browse>. > OK, I'll look into this. > > When viewing the developer's archives, I note that when a message is > > displayed singly, it is common to see [EMAIL PROTECTED]. > > That's the external searchable archives provided by mail-archive.com, which > is actually available for both mailman-users and mailman-developers. > Ah-ha! I had not noticed this. A third party was involved... hmmm! > > The gzip'd archives by month for both lists both show all email > > addresses, with the " at " obfuscation. > > Yup. That's part of the standard internal pipermail archiving process. > > > Within MINUTES of my first posting on asterisk-users, I was getting spam > > on an email address that was brand-new. Since then, the spam volume > > on that email addr just keeps growing. > > We've known that this weakness was a potential issue for years. However, I > don't recall our ever hearing a specific case where this weakness was > actually being exploited. > > If you look at those "patches" and "RFE" pages, you'll note that there are a > large number of things that people want from Mailman (200-300 things or more > per category), and since this is a 100% volunteer-supported project, our > developers have limited time and resources to be able to devote to fixing > each and every little thing that people have asked for. > Yes, I know. I'm working on Asterisk, another free-software package. I bet it's the same basic situation. I'll put my code where my mouth is, if everybody agrees that it's the way to go. > > We need to rethink how we can adequately keep emails out of spammers hands. > > Even with better obfuscation, the spammers will always be able to silently > subscribe to the lists and harvest addresses that way. There's no way to > stop them from doing that. > Agreed. But I'm not at all for any kind of obfuscation. I'm for removal. If we do a good job of subtracting email addresses from outgoing messages, and out of the archives, eventually the spammers will give up on lists so configured. Not worth the effort. But that's their choice. Personally, I'd love for them to waste tons of resources on harvesting addresses that are not there. > > And, yes, it's kinda unhandy not read a message and not be able to fire an email > > off to the author directly. But to make it easy for list subscribers, is to make it easy > > for spammers, who probably have already joined the list, and are delighted > > to get email addresses, any which way they can. > > We can't obscure messages that we send out. Otherwise, they wouldn't get > delivered. You do have to have some basic understanding of how Internet > e-mail works before you can talk intelligently about what could or should be > done. > I **thought"" I understood the basics of email workings. What I'm targeting is the "From ", and "From:" headers. Instead of them giving the actual email of the original submitter, they could simply say "whateverlist(a)lists.whateverdomain.com" -- in other words, set the from addr to the list address itself. All emails that might appear in the body of the message itself will be stripped (with [EMAIL REMOVED] type stuff to replace it, as a service to list members, to help protect them from being harvested. Again, No Obfuscations. It is common practice to say "John Doe <jdoe(a)something.org>", in which case, the name is left alone. It would be stripped to "John Doe <{REMOVED]>" What's not-doable about this? Am I missing something? I can be incredibly dense at times, and miss some pretty obvious laws of nature. Feel free to correct me. IIRC, the spammers forge the From addresses all the time, and the emails get delivered. > > We need to lock down mailman, or at least make it an option! Simply put, > > in messages sent to users, the only email that should be found anywhere > > in a recieved message, is the recipient's. > > If a list admin chooses, they can always enable anonymization. But there's > a reason why no one wants to do this. Go talk to the people running > anonymized lists to understand that problem more fully. > That I will do. But I'm not really into total anonymity. Just email addr removal. > On a more general note, the more you break Internet e-mail in order to try > to stop the spammers, the more the bastards win. > > You're continuing to make the critical mistake that everyone else does, > which is that you're trying to solve an inherently non-technical problem > with technical means. And that is a recipe for guaranteed disaster. Well, you are right to a degree. First, we could rate complete email address removal as the "Ultra" privacy option for a mailing list, and not everybody will opt for it, because taking a discussion "offline" will not be a 1-click process. Sorry. And users *could* use email-obfuscation to hide email addresses from the removal process, letting them leak into the list and archives to make it easier for people to reach the submitter. But I see this whole process as a way to reduce the chances that the spammers get your email address. No guarantees. One of your friends could go into an e-card site and use them to send you a nice birthday card. and a ton of spam. > > > Spam is just another form of con job. And if the "oldest profession" is > prostitute, then the second oldest profession has to be "con artist". Con > jobs have been going on for thousands of years, and there's no evidence that > they will ever stop being perpetrated, at least not so long as our species > continues to have at least one member still alive. > > So, you're not *EVER* going to get rid of spam. Give that fight up right > now. The best you can do is to try to cut it down to a dull roar, and make > sure that you're not one of the lower-hanging fruit. > > Then always keep in the back of your mind that a sufficiently determined > attacker can get through the deepest and most powerful defenses -- if they > can assassinate presidents and other government leaders, then they can > certainly get through any defenses that people like you and me can afford to > create. > Yes, I'm very aware of all this. I've done my fair share of scouring emails for web addresses, and calling hacked sites to inform them they were being used for a scam, among other activities to fight the cons that I won't go into. All I want to do is see if we can reduce the leakage of email addresses in mailman from firehose proportions to something less. murf > -- > Brad Knowles <brad(a)python.org> > Member of the Python.org Postmaster Team & Co-Moderator of the > mailman-users and mailman-developers mailing lists > -- Steve Murphy Software Developer Digium

3 2

why do i keep getting awaiting approval messages ?
by Anant Maringanti May 27, 2008

May 27, 2008

I have looked up the archives and the FAQ but perhaps I dont even know what I am looking for. I have recently set up a mailing list. I think I have set up the list for not holding up any member's posting for admin approval. But each time there is a posting, it gets held up and I get a message saying "message awaiting approval" and it wont go through until I approve of it. At first I thought it was because messages were coming in with html in them -- so I sent a message in plain text format to test but even that got held up. Where should I look? Here are the main options which I think are relevant as I have set them. Any suggestions in this regard will be greatly appreciated: ----------------------- (Administrivia filter) Check postings and intercept ones that seem to be administrative requests? YES Emergency moderation of all traffic to the list - No. Maximum length in kilobytes (KB) of a message body. Set to 40 KB. Should messages from this mailing list include the RFC 2369 (i.e. List-*) headers? (Yes is highly recommended) Set to NO. Set everyone's moderation bit, including those members not currently visible - OFF. SENDER FILTERS: By default, should new list member postings be moderated? NO Action to take for postings from non-members for which no explicit action is defined. HOLD Spam filters: I have left spam filter rule #1 blank. action : defer. Legacy anti spam filters: I have not changed anything in this. # Lines that *start* with a '#' are comments. to: friend(a)public.com message-id: relay.comanche.denmark.eu from: list(a)listme.com from: .*(a)uplinkpro.com Filter rules to match against the headers of a message. HOLD Content Filtering: Should Mailman filter the content of list traffic according to the settings below? YES Remove message attachments that don't have a matching content type. Leave this field blank to skip this filter test: multipart/mixed multipart/alternative text/plain Remove message attachments that have a matching filename extension: exe bat cmd com pif scr vbs cpl Should Mailman collapse multipart/alternative to its first part content? YES Should Mailman convert text/html parts to plain text? This conversion happens after MIME attachments have been stripped. YES Action to take when a message matches the content filtering rules: Forward to list owner.

1 0

Re: [Mailman-Users] Major problems with privacy and mailman lists and harvesters
by Steve Murphy May 26, 2008

May 26, 2008

----- "Jim Popovitch" wrote: > On Fri, May 23, 2008 at 1:03 PM, Steve Murphy <murf(a)digium.com> wrote: > > Within MINUTES of my first posting on asterisk-users, I was getting spam > > on an email address that was brand-new. > > How do you know that it was your archived post that the spammers > picked up on? It is also possible that the harvester is an address > subscribed to asterisk-users. I have not yet had the time to invest to scientifically prove that the spammers got my address from gleaning the list or archives. But it might be fun to do. Get an account at spamgourmet, or equiv. Sign up to a series of lists, having all list submissions go to unique-to-list throw-away addrs. Post a few messages, and then close down the mailman account, after the messages go out. Watch the throw-away accounts, and see if they get spammed. I **have** verified that the w3.org mailing list is responsible for one throw-way getting spammed. (and big-time, at that!) > > IMHO, obfuscating the archives achieves little effect other than a > false sense of hope. The fact is spammers don't want stale archived > email addresses, they want fresh active (i.e. poster's) addresses. > > Welcome to 2008, ;-) I totally agree. We need to filter out *all* addresses from the outgoing messages, to protect folks who like to include their email in message trailers and sigs, or who quote other emails from other users, and get them spammed, also. Obfuscation can/will be overcome and is not a solution. > > -Jim P. -- Steve Murphy Software Developer Digium

1 0