Mailman 3 June 2012 - Mailman-Users

Re: [Mailman-Users] AOL redacts user addresses even with VERP and full personalization enabled
by Russell Clemings June 20, 2012

June 20, 2012

I'm surprised to read in this thread that the terms of service for AOL's feedback loop forbid us from using its reports to identify users. The page where you sign up for the FBL seems to say just the opposite (end of third paragraph): "We suggest using opaque identifiers for the email recipient or a custom remove link in the body of the email to help you identify the original recipient of the message." http://postmaster.aol.com/Postmaster.FeedbackLoop.php rac

6 11

Possible (benign) typo in Mailman 2.1.15 file "UPGRADING"
by Rich Kulawiec June 20, 2012

June 20, 2012

This file has a section which describes the 2.1.14 to 2.1.15 upgrade process. It reads in part: "The bin/upgrade script, which is run automatically when you upgrade, should convert all the old style qfiles to the new style qfiles." However, I don't seem to have a bin/upgrade script; I've got a bin/update script. My guess is that it's just a typo in the documentation. ---rsk

2 1

Moderators approval
by rpschwar＠knology.net June 20, 2012

June 20, 2012

Moderators are not getting notices that messages are waiting for Moderators approval. Robert P. Schwartz

2 1

Setting bounce_notify_owner_on_disable not working
by Willy Janssen June 20, 2012

June 20, 2012

Hello, One user of a small mailing list was set to "no mail", reason: "B -- Delivery was disabled by the system due to excessive bouncing from the member's address". Ok, that's fine. The problem is that I, the list administrator, got no notification although "bounce_notify_owner_on_disable" is set. Any explanation? Mailman 2.1.13 Regards, Willy Janssen

2 1

cgi/create and local use - trouble...
by gene June 19, 2012

June 19, 2012

Hi All: I have a lan with several machines on it. I've installed MM 2.1.14 on the unix host 'genesis' which also runs my apache server. In order to browse to genesis' web server from within the lan, I have to use something like: "http://genesis/mailman/listinfo" Using the fqdn (genesis.domain.net or domain.net) just times out. So when I tried to use cgi/create (web) to create a list, I got: "Unknown virtual domain: genesis" So in mm_cfg.py I put the following: DEFAULT_EMAIL_HOST = '… [View More]

2 1

AES encryption and Resent-Message-ID
by Lindsay Haisley June 19, 2012

June 19, 2012

Here are a few tidbits pursuant to putting an encrypted copy of a list post recipient in a "Resent-Message-ID" header, as Stephen Turnbull suggested. There are four parts: 1. A patch to SMTPDirect.py 2. A secret key entry in mm_cfg.py 3. A utility, ~mailman/bin/aes_genkey, to manage key generation 4. A handler module to do encryption, decryption and key generation - AEScrypt.py Here's the patch to SMTPDirect.py (mm 2.1.15): --- SMTPDirect.py.orig 2012-06-17 17:16:25.000000000 -0500 ++… [View More]+ SMTPDirect.py 2012-06-18 23:29:58.000000000 -0500 @@ -43,6 +43,7 @@ from email.Utils import formataddr from email.Header import Header from email.Charset import Charset +import AEScrypt DOT = '.' @@ -307,6 +308,11 @@ 'host' : DOT.join(rdomain), } envsender = '%s@%s' % ((mm_cfg.VERP_FORMAT % d), DOT.join(bdomain)) + try: + skey = AEScrypt.encrypt(recip) + msgcopy["Resent-Message-ID"] = skey + "@" + DOT.join(bdomain) + except: + pass if mlist.personalize == 2: # When fully personalizing, we want the To address to point to the # recipient, not to the mailing list mm_cfg.py requires an AES key in AES_SECRET_KEY. Without this, the Resent-Message-ID header isn't inserted in outgoing posts and everything works as it does without this stuff. The AES key can be generated with aes_genkey which lives in ~mailman/bin and works like other scripts in this directory. Running it with -a appends AES_SECRET_KEY to mm_cfg.py with an appropriate comment. ~mailman/bin/aes_genkey ----------------------- #! /usr/bin/python """Generate an AES secret key on stdout for inclusion in mm_cfg.py as AES_SECRET_KEY. Usage: %(PROGRAM)s [options] Where: -a append AES secret key to mm_cfg.py -h / --help Print help and exit. """ import sys import getopt import os import paths from Mailman import mm_cfg from Mailman.Handlers import AEScrypt from Mailman.i18n import _ def usage(code, msg=''): if code: fd = sys.stderr else: fd = sys.stdout print >> fd, _(__doc__) if msg: print >> fd, msg sys.exit(code) def main(): try: opts, args = getopt.getopt(sys.argv[1:], 'ha', ['help']) except getopt.error, msg: usage(1, msg) for opt, arg in opts: if opt in ('-h', '--help'): usage(0) if opt in ('-a',): try: f = mm_cfg.AES_SECRET_KEY print "AES secret key already in mm_cfg.py" return(0) except: mm = open(os.getenv("HOME") + "/Mailman/mm_cfg.py", "a") ktxt = """ # Experimental address encryption key. To renew this key, # delete AES_SECRET_KEY and run 'aes_keygen -a' and restart # Mailman. AES_SECRET_KEY = '%s' """ % (AEScrypt.genkey(),) mm.write(ktxt) mm.close() print "AES secret key added to mm_cfg.py" return(0) print AEScrypt.genkey() if __name__ == '__main__': sys.exit(main()) The final part is the encryption/decryption module, AEScrypt.py For this to work the python-crypto ("Crypto") package must be installed. ~mailman/Mailman/Handlers/AEScrypt.py ------------------------------------- from Crypto.Cipher import AES from Crypto.Util import randpool from Mailman import mm_cfg import base64 block_size = 16 key_size = 32 mode = AES.MODE_CBC try: key_string = mm_cfg.AES_SECRET_KEY except: pass def genkey(): key_bytes = randpool.RandomPool(512).get_bytes(key_size) key_string = base64.urlsafe_b64encode(str(key_bytes)) return key_string def encrypt(plain_text): pad = block_size - len(plain_text) % block_size data = plain_text + pad * chr(pad) iv_bytes = randpool.RandomPool(512).get_bytes(block_size) encrypted_bytes = iv_bytes + AES.new(base64.urlsafe_b64decode(key_string), mode, iv_bytes).encrypt(data) return base64.urlsafe_b64encode(str(encrypted_bytes)) def decrypt(cypher_text): key_bytes = base64.urlsafe_b64decode(key_string) encrypted_bytes = base64.urlsafe_b64decode(cypher_text) iv_bytes = encrypted_bytes[:block_size] encrypted_bytes = encrypted_bytes[block_size:] plain_text = AES.new(key_bytes, mode, iv_bytes).decrypt(encrypted_bytes) pad = ord(plain_text[-1]) return plain_text[:-pad] The Resent-Message-ID header has the domain name of the server host appended to it and this will need to be stripped before decrypting the address string. Something like 'crypt, dn = full_header.split("@")' will pull the encrypted address from the header. A withlist script can easily extract the plain text content of the encrypted string. I hope this helps someone. -- Lindsay Haisley | "Real programmers use butterflies" FMP Computer Services | 512-259-1190 | - xkcd http://www.fmp.com | [View Less]

1 0

Personalisation: how long does it take?
by Andrew Hodgson June 18, 2012

June 18, 2012

Hi, Just wondering how long in the real world it takes to get all messages from a personalised list sent out and processed by the MTA on the same machine as Mailman? List is around 750 members. I did run this once and it took over 10 minutes to get all the messages delivered through the MTA, I am partially wondering whether that is because I am DKIM signing each message? If I use standard delivery the processing time is a lot shorter (around a minute). Just wondering, Andrew.

3 5

Personal patch
by Lindsay Haisley June 18, 2012

June 18, 2012

Can someone give me some feedback on the following patch to SMTPDirect.py - whatever I've overlooked, or done that might be dangerous? The purpose of this patch is to insert a header, "X-subdata" into VERPed emails which won't be flagged and redacted by AOL's brain-dead "Email Feedback Report" system, and will continue to allow my local scripts to unsubscribe subscribers who hit the "Report Spam" button on their AOL mail UI. The content of the header is an MD5 hash of the receiving subscriber'… [View More]

2 1

more questions about Yahoo feedback loop and abuse complaints
by David June 17, 2012

June 17, 2012

We received 23 Yahoo feedback loop notices this morning from one user. Supposedly these are abuse or complaint notices. The person joined us in Sept of last year. After we received these notices from Yahoo today, we contacted the member. She did not remember reporting us as spam. She didn't offer us any useful feedback because she didn't remember any details. However, she *does* wish to continue receiving emails from our list. So it seems clear this was not an actual case of abuse. … [View More]

16 31

what effect does mm_cfg.py setting VERP_PERSONALIZED_DELIVERIES have if personalize (nondigest) is set to NO?
by David June 17, 2012

June 17, 2012

In mm_cfg.py I have these settings: OWNERS_CAN_ENABLE_PERSONALIZATION=Yes VERP_PERSONALIZED_DELIVERIES=Yes VERP_PASSWORD_REMINDERS = Yes VERP_CONFIRMATIONS = Yes In a list with personalize (nondigest) set to NO, does that mean that all personalization options, including those above are not in effect? Next question: If I set VERP_DELIVERY_INTERVAL = 1 in mm_cfg.py, does that override any list-specific settings, or any of the other settings above? Last question: # Set this Yes to activate … [View More]

2 3