Mailman 3 June 2018 - Mailman-Users

Re: [Mailman-Users] Mailman-Users Digest, Vol 172, Issue 6
by Russell Clemings 05 Jun '18

05 Jun '18

They seem to be changing their tactics pretty much regularly now. Just tailing the subscribe log I see all of these: Jun 04 21:28:16 2018 (16689) LISTNAME1: pending Steven Lugo < support(a)quickbitcoin.co.uk> 159.203.88.55 Jun 04 21:30:06 2018 (17063) LISTNAME1: pending Steve Asher < support(a)bitcoin.com.au> 185.237.98.51 Jun 04 21:30:38 2018 (17503) LISTNAME2: pending Sterling Leng < support(a)vaultoro.com> 185.237.98.51 Jun 04 21:31:26 2018 (17651) LISTNAME3: pending Cristina Hibbard < support(a)vaultoro.com> 59.152.95.54 Jun 04 21:32:01 2018 (17754) LISTNAME3: pending Kirk Maddox < support(a)bitcoin.com.au> 185.237.98.51 Jun 04 21:33:58 2018 (18188) LISTNAME4: pending Jarrod Rand < support(a)vaultoro.com> 80.211.240.206 Jun 04 21:36:54 2018 (19212) LISTNAME5: pending Anna Glen < support(a)quickbitcoin.co.uk> 159.203.88.55 Jun 04 21:36:59 2018 (19231) LISTNAME1: pending John Savage < support(a)bitflyer.com> 39.137.69.9 Jun 04 21:38:21 2018 (19476) LISTNAME4: pending Sarah Adami < support(a)coindirect.com> 185.237.98.51 > ---------- Forwarded message ---------- > From: Mark Sapiro <mark(a)msapiro.net> > To: mailman-users(a)python.org > Cc: > Bcc: > Date: Sun, 3 Jun 2018 17:19:33 -0700 > Subject: Re: [Mailman-Users] Spam Subscriptions > On 06/03/2018 04:28 PM, Mark Dale wrote: > > > >> I use this regexp in the GLOBAL_BAN_LIST > >> > >> ^[0-9a-z.]{8,}\+[0-9a-z]{4,}(a)gmail\.com$ > > > > I'm getting errors with the above however it seems to do the job > > if I enclose it in quotes and remove the trailing $ - like so: > > > > GLOBAL_BAN_LIST = ['^[0-9a-z.]{6,}\+[0-9a-z]{4,}(a)gmail\.com'] > > > What you have done is correct. I don't know why you would have needed to > remove the '$'. Did you get an error and if so, what?. > > The regexp I gave was just intended to be an example regexp. The > BAN_LIST is actually a list of strings so regexps in the BAN_LIST have > to be quoted and enclosed in [] and comma separated if more than one. > > Also, it doesn't matter in this case because \+ and \. are not > meaningful string metacharacters, but it never hurts to define them as > raw strings like, e.g., > > GLOBAL_BAN_LIST = [r'^[0-9a-z.]{8,}\+[0-9a-z]{4,}(a)gmail\.com$'] > > -- > Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, > San Francisco Bay Area, California better use your sense - B. Dylan > >

4 7

Re: [Mailman-Users] Bogus Subscriptions
by Russell Clemings 05 Jun '18

05 Jun '18

I can add a few more: glacierponi+ (etc.) hanakage777+ icecreamkatana+ nasamok2+ oddjuice11+ and all of these (plus one that probably wouldn't make it past a spam filter): info(a)bitbroker.co.uk info(a)btcsolutions.ca oddjuice(a)yahoo.com s7g7j7(a)yahoo.com support(a)cryptopay.me > ---------- Forwarded message ---------- > From: Jim Popovitch <jimpop(a)domainmail.org> > To: mailman-users(a)python.org > Cc: > Bcc: > Date: Mon, 04 Jun 2018 18:10:57 -0400 > Subject: Re: [Mailman-Users] Bogus Subscriptions (was: Mailman-Users > Digest, Vol 172, Issue 6) > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > On Mon, 2018-06-04 at 14:48 -0700, Russell Clemings wrote: > > They seem to be changing their tactics pretty much regularly now. > > Just > > tailing the subscribe log I see all of these: > > > > Jun 04 21:28:16 2018 (16689) LISTNAME1: pending Steven Lugo < > > support(a)quickbitcoin.co.uk> 159.203.88.55 > > Jun 04 21:30:06 2018 (17063) LISTNAME1: pending Steve Asher < > > support(a)bitcoin.com.au> 185.237.98.51 > > Jun 04 21:30:38 2018 (17503) LISTNAME2: pending Sterling Leng < > > support(a)vaultoro.com> 185.237.98.51 > > Jun 04 21:31:26 2018 (17651) LISTNAME3: pending Cristina Hibbard < > > support(a)vaultoro.com> 59.152.95.54 > > Jun 04 21:32:01 2018 (17754) LISTNAME3: pending Kirk Maddox < > > support(a)bitcoin.com.au> 185.237.98.51 > > Jun 04 21:33:58 2018 (18188) LISTNAME4: pending Jarrod Rand < > > support(a)vaultoro.com> 80.211.240.206 > > Jun 04 21:36:54 2018 (19212) LISTNAME5: pending Anna Glen < > > support(a)quickbitcoin.co.uk> 159.203.88.55 > > Jun 04 21:36:59 2018 (19231) LISTNAME1: pending John Savage < > > support(a)bitflyer.com> 39.137.69.9 > > Jun 04 21:38:21 2018 (19476) LISTNAME4: pending Sarah Adami < > > support(a)coindirect.com> 185.237.98.51 > > > > Interesting, I see delimited email addrs for those same domains. > > Jun 04 20:57:11 2018 (5670) users: pending James Sturgill <support+qjrr > @quickbitcoin.co.uk> 111.13.56.16 > Jun 04 21:19:10 2018 (7469) users: pending John Heninger <support+qwnpn > @bitflyer.com> 152.231.81.122 > Jun 04 21:35:52 2018 (8894) users: pending Judith Route <support+xwwrk@ > vaultoro.com> 149.202.38.124 > Jun 04 21:42:25 2018 (9149) users: pending Donna Watts <support+yvdmgcn > @vaultoro.com> 212.73.137.45 > Jun 04 21:49:33 2018 (9323) users: pending Justin Rybij <support+jzmpfp > rm(a)bitflyer.com> 67.197.233.15 > > FWIW, > > here's the list I've accumulated so far: > alec768+kxqun(a)gmail.com > alec768+kyccjs(a)gmail.com > alec768+orfeij(a)gmail.com > alec768+tmtkl(a)gmail.com > alexmanalo76+engl(a)gmail.com > alexmanalo76+hrrfbr(a)gmail.com > alexmanalo76+nbkdtau(a)gmail.com > alexmanalo76+vhffieas(a)gmail.com > alexmanalo76+vlkpqi(a)gmail.com > alexmanalo76+vnsjpy(a)gmail.com > alexmanalo76+zasnfp(a)gmail.com > cybertuna94+cxrp(a)gmail.com > cybertuna94+gjuhtqwq(a)gmail.com > cybertuna94+jhitu(a)gmail.com > cybertuna94+wdlgmeq(a)gmail.com > cybertuna94+xgosrla(a)gmail.com > cybertuna94+xkon(a)gmail.com > desertkaiju+fylzc(a)gmail.com > desertkaiju+piurldte(a)gmail.com > desertkaiju+rvkvz(a)gmail.com > desertkaiju+tajkn(a)gmail.com > desertkaiju+vwsgneo(a)gmail.com > desertkaiju+wffbf(a)gmail.com > desertkaiju+zczm(a)gmail.com > khongthong94+baduvtj(a)gmail.com > khongthong94+bhctkgb(a)gmail.com > khongthong94+veyaqcw(a)gmail.com > spikedmauler+jlxz(a)gmail.com > sqrlyjack+hbqlyxc(a)gmail.com > sqrlyjack+hdhpu(a)gmail.com > sqrlyjack+nypxw(a)gmail.com > sqrlyjack+vamjnvg(a)gmail.com > sqrlyjack+vdfltrta(a)gmail.com > support+jzmpfprm(a)bitflyer.com > support+qjrr(a)quickbitcoin.co.uk > support+qwnpn(a)bitflyer.com > support+xwwrk(a)vaultoro.com > support+yvdmgcn(a)vaultoro.com > tinyowl94+dcjfcsq(a)gmail.com > tinyowl94+ftmydowx(a)gmail.com > tinyowl94+kffmkq(a)gmail.com > tinyowl94+pfayzh(a)gmail.com > tinyowl94+sdch(a)gmail.com > tinyowl94+zoqbn(a)gmail.com > yllwdg+gitvhnt(a)gmail.com > > >

1 0

Any scripting available for global site admin
by Parker, Michael D. 04 Jun '18

04 Jun '18

I have mailman 2.x and am specifically interested in knowing how to do the following two tasks: 1. List all users with all their mailing lists 2. Globally remove a user from all mailing lists Thanks. ***** ***** ***** Michael D. Parker - provisional CISSP General Atomics - ElectroMagnetics Systems Group (EMS) Michael.d.parker(a)ga.com<mailto:Michael.d.parker@ga.com> <<<<< NOTE: Remember to include my middle initial >>>>> ***************************************************************************************** The information contained in this electronic message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. This message may also contain technical data, export of which is restricted by the International Traffic in Arms Regulations (ITAR). Disclosure to foreign persons without prior U.S. Government approval is prohibited. Violations of these export laws and regulations are subject to severe civil and criminal penalties. This message may include Company Sensitive and/or Proprietary Information. If the reader of this message is not the intended recipient, you are informed that any dissemination, copying or disclosure of the material contained herein, in whole or in part, is strictly prohibited. If you received this message in error, please notify the sender by reply e-mail and delete all copies of this message. ******************************************************************************************

3 2

Fail2ban on the Mailman web interface
by Henrique Fagundes 04 Jun '18

04 Jun '18

Dear Colleagues, Good afternoon! I begin by apologizing for the fact that this text is difficult to interpret because I am Brazilian and I do not have many English language skills. I'm having a hard time using Fail2Ban along with MailMan mailing list management software. My idea is that when the attacker / attacker incorrectly enters the password of the login field in the web interface, it is blocked. But for this to work, it is necessary for MailMan to report unsuccessful login attempts in its log. I have already checked to see if there is a plugin or extension (just like it exists for Wordpress and PHPMyAdmin), but it seems like there is nothing developed for this. So I would like to know if anyone has ever had the need to do this implementation, so I can have some way. If anyone can help me, I will be very grateful. Regards, Henrique Fagundes Linux Support Analyst suporte(a)aprendendolinux.com Skype: magnata-br-rj Linux User: 475399 https://www.aprendendolinux.com https://www.facebook.com/AprendendoLinux https://youtube.com/AprendendoLinux https://twitter.com/AprendendoLinux https://telegram.me/AprendendoLinux ______________________________________________________________________ Join the Learning Linux Group https://listas.aprendendolinux.com/listinfo/aprendendolinux Or send an email to: aprendendolinux-subscribe(a)listas.aprendendolinux.com BRASIL acima de tudo, DEUS acima de todos!

3 5

Spam Subscriptions
by David Andrews 04 Jun '18

04 Jun '18

I have a mailman installation with over 300 lists. It is cPanel, but I am the administrator so have access to command line etc. I have just two lists that receive a bunch of spam subscribes each day -- hundreds of them, in fact. For some reason -- which is good, they are held, so don't go through, not quite sure why. Two questions -- first is there a file I can erase for each list that will get rid of all the held subscriptions, without breaking anything else. I tried once, and my installation broke -- don't know if it is related, but don't want to try again unless I do it right. Secondly, there is some commonality in the subscribe addresses, are there strings I can use to discard the subscribes so I never have to see them. Below are examples, there is a common word, or a common word, a period ., and another common word, then a plus sign + then a 4 5 or 6 character word, all alpha, and @gmail.com Here are examples: dragonommz+ jwmidnight+ nommz.naidoo+ If I could knock these out, it would be helpful. This has happened several times previously, but has always stopped after a few weeks. This time it has been a couple months. Finally, I know it is probably too late in the Mailman2 cycle to get a new feature, but in the web UI, it would be nice if you could delete all deferred subscriptions. You can do so with deferred messages, that are held, but not subscriptions. Thanks! Dave

8 18

"Freezing" mailing list
by Tatsuo Ishii 02 Jun '18

02 Jun '18

Hi, I would like to "freeze" an existing mailing list: I want to keep the mailing list but I want no one newly subscribe the list. Can you please anyone tell me how I can implement it? Best regards, -- Tatsuo Ishii SRA OSS, Inc. Japan English: http://www.sraoss.co.jp/index_en.php Japanese:http://www.sraoss.co.jp

4 7

Mailman3 domain aliases
by Andrew Hodgson 02 Jun '18

02 Jun '18

Hi, I want to create some lists in Mailman3 which can be accessed via web and email with 2 different domains. There will of course be a default domain which Mailman uses on outgoing emails etc, but I want users to be able to use either the old or new domain to access the website or sending email. Is this possible in Mailman3? it is essentially giving me the behaviour I have in Mailman2. I will be hosting other domains as separate virtual hosts in Mailman3 as well so any changes I have to make to get this to work need to not brake the new virtual host functionality. Thanks. Andrew.

2 1

Problems Erasing Subscribe Spam
by Rüdiger Wolf 01 Jun '18

01 Jun '18

We're currently dealing with some Subscribe Spam. Dealing with it, I encountered a problem I need help with: I used Mark's scrip list_pending (https://www.msapiro.net/scripts/list_pending) to find out how many Subscriptions we got and which adresses were used. I iterated over all lists I got from list_lists --bare and took just the ones with "type: S". Turns out we got 66608 subscriptions from 66560 different adresses. Luckily, they all match the regex \w*\+\w*(a)gmail\.com, so I tried to wipe the mess whith another script of Mark, erase (https://www.msapiro.net/scripts/erase). It works nicely for a bunch of lists, but I don't get why it doesn't work with all of them. Looking more closely I found in /var/lib/mailman/lists/<listname> the pending.pck file the script is operating on. Does someone have an idea why it might not work for all lists? Regards, Ruediger

2 2

How do I run 2.x mailman more securely?
by Parker, Michael D. 01 Jun '18

01 Jun '18

I've been assigned the task of attempting to secure our current implementation of GNU MailMan. Have any of you out there done this? What did you do? Some of the initial items that have been directed my way: 1. Can archiving be totally and permanently be eliminated? 2. How and where are the passwords stored? 3. Can user passwords be eliminated and have the list administrator make any user adjustments which should not be necessary? 4. Does the website have to run in http: since passwords are entered at points in the interactions? Thanks for your guidance and thoughts.

6 15

Server joining the CBL blacklist every day!
by Henrique Fagundes 01 Jun '18

01 Jun '18

Dear, Sorry if the text is difficult to understand. I am Brazilian and I do not have many English language skills. I'm just sending this email for information. There we have I was not able to send emails from my server to some domains [especially those linked to Microsoft (hotmail.como, msn.com, outlook.com, etc.)]. Then I realized that the IP of my server was listed in the CBL blacklist. I realized that one of the sites hosted on this server (which is also a Web server) was infected by malware that was connecting all the time to IP 192.42.116.41 (port 80 and 443). This infection comes from Wordpress. One of my hosting clients used an obsolete version of the Wordpress platform and was eventually hit. Details here: https://consultalinux.org/blog/ler_post.php?category=linux&id=129 Almost every source on his site had been encrypted. Fortunately, the server automatically backs up the database every day. Just delete the old WP, install the new upload dump of the DB. After I resolved the problem, the IP was no longer listed. Regards, Henrique Fagundes suporte(a)aprendendolinux.com Skype: magnata-br-rj Linux User: 475399 https://www.aprendendolinux.com https://www.facebook.com/AprendendoLinux https://youtube.com/AprendendoLinux https://twitter.com/AprendendoLinux https://telegram.me/AprendendoLinux ______________________________________________________________________ Participe do Grupo Aprendendo Linux https://listas.aprendendolinux.com/listinfo/aprendendolinux Ou envie um e-mail para: aprendendolinux-subscribe(a)listas.aprendendolinux.com

1 0

Mailman-Users June 2018