Mailman 3 January 2018 - Mailman-Users

Mailman CSRF Vulnerability
by Lindsay Haisley 12 Jan '18

12 Jan '18

I just installed a new list on MM 2.1.18-1 and one of the sharper folks on a related FB group noted that there is, or had been a CSRF vulnerability on some versions of MM2. A little research turned up <https://bugs.launchpad.net/mailman/+bug/775294> in which Mark states that this has been fixed since 2.1.15. For the record, could someone confirm this? -- Lindsay Haisley | "I felt a great disturbance in the Force, FMP Computer Services | as if millions of voices suddenly cried out 512-259-1190 | in terror and were suddenly silenced." http://www.fmp.com | - Obi-Wan Kenobi

3 7

Changing the List URL and email domain
by Andrew Hodgson 11 Jan '18

11 Jan '18

Hi, I want to change the list URL and email domain, is there any way of keeping the old domain and URL active? Using Mailman 2.1.24 here. Thanks. Andrew.

2 1

"[Errno 30] Read-only file system" error when accessing Mailman admin pages from outside of cPanel
by Jim Ratliff 09 Jan '18

09 Jan '18

When someone attempts to subscribe to the Mailman list at the public-information page, e.g., myserver.org/mailman/subscribe/listname <http://myserver.org/mailman/subscribe/listname> 1) the request for subscription DOES go through (shows up on pending subscription requests), BUT 2) the user is shown a page that says "Bug in Mailman version 2.1.23, We're sorry, we hit a bug! Please inform the webmaster for this site of this problem. Printing of traceback and other system information has been explicitly inhibited, but the webmaster can find this information in the Mailman error logs.” When I look in the error log, the most-relevant entry seems to be: OSError: [Errno 30] Read-only file system: '/usr/local/cpanel/3rdparty/mailman/archives/public/REDACTED_LISTNAME’ In case it’s helpful, here’s the traceback: > Traceback (most recent call last): > File "/usr/local/cpanel/3rdparty/mailman/scripts/driver", line 117, in run_main > main() > File "/usr/local/cpanel/3rdparty/mailman/Mailman/Cgi/subscribe.py", line 110, in main > mlist.Save() > File "/usr/local/cpanel/3rdparty/mailman/Mailman/MailList.py", line 607, in Save > self.CheckHTMLArchiveDir() > File "/usr/local/cpanel/3rdparty/mailman/Mailman/Archiver/Archiver.py", line 236, in CheckHTMLArchiveDir > breaklink(pubdir) > File "/usr/local/cpanel/3rdparty/mailman/Mailman/Archiver/Archiver.py", line 56, in breaklink > os.unlink(link) I ran “check_perms” and the only response was: > Warning: Private archive directory is other-executable (o+x). > This could allow other users on your system to read private archives. > If you're on a shared multiuser system, you should consult the > installation manual on how to fix this. which doesn’t seem like an explanation for my problem. In the subject line, I say I have this problem "when accessing Mailman admin pages from outside of cPanel.” What I mean is that I don’t get this error if I go through cPanel » Mailing Lists and access the admin pages through those links. Any ideas on what to do or check? Thanks! Jim

2 2

New Problems with AOL & DMARC
by Richard Damon 06 Jan '18

06 Jan '18

I use Mailman versioon 2.1.25 on a shared host, and in the past couple of days, something seems to have changed, as posts from AOL users are no longer getting their from address munged like they were a week ago, and I am getting massive bounces for DMARC rejection when a poster from AOL posts. Has something changed with their settings, and is their anything I can do about it? -- Richard Damon

2 4

Privacy Filter Unusual Behavior
by Chris PUCHALSKI 05 Jan '18

05 Jan '18

The privacy settings with concern to the moderation of nonmembers we have been seeing something odd happening. We have nonmembers set to reject on a list but it appears messages still get through to the list recipients. But the sender also get the rejection notification. That is both confirmed in the vette logs as well as in actual practice with test emails. Where does one begin to look for a reason why this is happening? No major changes have been made to the system and I have seen it happen once before but I thought it was a freak occurrence then because I have heard zero complaints since then. Chris P.

2 9

local recipient table
by Ruben Safir 05 Jan '18

05 Jan '18

I have a custom archive system that I have used for decades and I lost the ability to send mail through the mailing list to its user account. Jan 05 01:13:13 2018 (3042) delivery to archive(a)xxx.com failed the code 550: 5.1.1 <archive(a)xxx.com>: Recipient address rejected: User unknown in local recipient table I am using postfix I have delivery when I use mutt to just send email to the account. I tried to add this to postfix main.cf but no change in behavior # local_recipient_maps settings are OK. unknown_local_recipient_reject_code = 550 local_recipient_maps = unix:passwd.byname $alias_maps <<== the user is sitting in /etc/passwd www2:/var/lib/mailman/logs # grep archive /etc/passwd archive:x:1001:100::/home/archive:/bin/bash dns record looks good www2:/var/lib/mailman/logs # dig mx xxx.com ; <<>> DiG 9.9.2 <<>> mx xxx.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26171 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;xxx.com. IN MX ;; ANSWER SECTION: xxx.com. 86400 IN MX 10 www2.xxx.com. ;; AUTHORITY SECTION: xxx.com. 86400 IN NS www2.xxx.com. xxx.com. 86400 IN NS ns1.linuxmafia.com. xxx.com. 86400 IN NS www3.xxx.com. ;; ADDITIONAL SECTION: www2.xxx.com. 86400 IN A 96.57.23.82 www3.xxx.com. 86400 IN A 96.57.23.83 ;; Query time: 12 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Jan 5 09:13:42 2018 ;; MSG SIZE rcvd: 156 -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013 -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

2 9

mm_cfg
by Dimitri Maziuk 04 Jan '18

04 Jan '18

Hi all, I'd like to move a mailman install to a failover setup with drbd for shared storage. The way it works is active host mounts /dev/drbd filesystem and sets up syminks e.g. /var/spool/mailman -> /drbd/var/spool/mailman /etc/mailman -> /drbd/etc/mailman My questions are a) what to do /etc/mailman/mm_cfg.py that on my systems is a symlink to /usr/lib/mailman/Mailman/mm_cfg.py and b) are there any other special ones like this hiding in there? With mm_cfg, I guess I'll put it on /drbd and have the script link /usr/lib/mailman/Mailman/mm_cfg.py to /drbd/someplace/mm_cfg.py -- does that sound workable? Any other gotchas? (The setup is centos 6 with mailman 2.1.12 with whatever patches RedHat added without changing the version number.) TIA -- Dimitri Maziuk Programmer/sysadmin BioMagResBank, UW-Madison -- http://www.bmrb.wisc.edu

4 6