Mailman 3 August 2018 - Mailman-Users

send invitations programmatically
by David Palao 14 Aug '18

14 Aug '18

Hi, I'm administrating a mailman 2.1 list and I'd like to write a (python) program that sends an invitation to a given email address. Is there a way to do it? TIA

1 1

Link in list message footer?
by Glen Page 14 Aug '18

14 Aug '18

Is it possible to include an HTML link or links in the footer of list messages? We use mailman to send messages to parents of our students. We have our own mobile app and would love to be able to include a link to the app in both the Apple App store and the Google Play store if that is possible. Thanks in advance. Glen Page Director of Information Technology ThetNet - Thetford Academy 802.785.4805.x231 Never ask a man what computer he uses. If it's a Mac, he'll tell you. If it's not, why embarrass him? - Tom Clancy

2 1

Digest members of one domain marked bouncing
by Peter Shute 13 Aug '18

13 Aug '18

Recently we've had a lot of members from one particular domain ( bigpond.com/bigpond.com.au) marked bouncing, and it looks like it's only digest members who are affected. I haven't checked yet if all digest members from that domain are affected. We unticked their nomail box, but a few days later they're marked bouncing again. I'm guessing that for some reason, that mail server thinks our digest emails are spam. Any ideas what to do about this? Peter Shute

4 8

@signs in FORMs
by Bernie Cosell 09 Aug '18

09 Aug '18

I'm a bit confused [as always]. On the Member List page, all of the @signs that appear [e.g., in all the email addresses] are HTML encoded: The member "jojo(a)newhost.com" ends up in the FORM for the list as <INPUT name="jojo%40newhost.com_realname" type="TEXT" value="jojojo" size="22" > <INPUT name="user" type="HIDDEN" value="jojo%40newhost.com" > I see in web developer, that the fields are apparently submitted just that way: -----------------------------265001916915724 Content-Disposition: form-data; name="jojo%40newhost.com_realname" jojojo -----------------------------265001916915724 Content-Disposition: form-data; name="user" jojo%40newhost.com -----------------------------265001916915724 But I can't get my dumb program to update the member list [e.g., to turn on a 'mod' checkbox]. I'm busy debugging but I'm wondering: when my program submits the form fields, should it use the %40 form, or convert the fields back to @signs? [At the moment I can't get it to work either way but I'd like to know which is correct]. Thanks!! /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

2 1

trouble with q.com address
by Loren Engrav 08 Aug '18

08 Aug '18

Hi to finish this off case anyone else needs to know... I did as you said thank you and then received the message below <xxx(a)q.com>: host mx.centurylink.net[206.152.134.65] said: 550 SPF Hard Fail: Domain engrav.mobi does not designate 192.185.193.12 as permitted sender. (in reply to MAIL FROM command) Reporting-MTA: dns; gateway36.websitewelcome.com X-Postfix-Queue-ID: E9D1A400C8AB9 X-Postfix-Sender: rfc822; wg-bounces@xxx Arrival-Date: Thu, 2 Aug 2018 23:25:42 -0500 (CDT) Final-Recipient: rfc822; xxx(a)q.com Original-Recipient: rfc822;xxx(a)q.com Action: failed Status: 5.0.0 Remote-MTA: dns; mx.centurylink.net Diagnostic-Code: smtp; 550 SPF Hard Fail: Domain engrav.mobi does not designate 192.185.193.12 as permitted sender. now since I do not understand I “chatted” with Site5 (my host) who said quote 11:39:51 AM Ankitha Y I have reviewed your account and found the SPF record was not updated to the correct one. 11:40:04 AM Ankitha Y I have now updated to v=spf1 +a +mx +ip4:129.121.3.204 +include:websitewelcome.com ~all and that solved the problem; q.com and other centurylink.net mail passing thru Ok thanks

2 1

Undelivered Mail Returned to Sender
by Jon Clements 08 Aug '18

08 Aug '18

Sorry, but can anyone tell me how to stop this from happening? I receive one of these in Spam every minute. Mailman version 2.1.13 on Mac OSX. Thanks. Jon ***** This is the mail system at host virtualorchard.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <jmcextman(a)gmail.com>: host gmail-smtp-in.l.google.com[64.233.176.26] said: 550-5.7.1 This message does not have authentication information or fails to pass 550-5.7.1 authentication checks. To best protect our users from spam, the 550-5.7.1 message has been blocked. Please visit 550-5.7.1 https://support.google.com/mail/answer/81126#authentication for more 550 5.7.1 information. 62-v6si1797769ybw.621 - gsmtp (in reply to end of DATA command) ---------- Forwarded message ---------- From: "龚致" <1975834224(a)qq.com> To: <apple-crop-owner(a)virtualorchard.com> Cc: Bcc: Date: Sat, 04 Aug 2018 19:55:59 +0800 Subject: 11死鬼这么长时间不来找我加我企鹅1960009745 特送你188綵金地址336428 点COM 面试成功~要送你188綵金加我企鹅67277<（文件的）整理汇集>0016 领连接 336428C0M 支持文字與語音聊天模式，最高可獲588電子遊藝15重曲，巨劃算。公司入款無上限 -- Jon Clements aka 'Mr Honeycrisp' University of Massachusetts Amherst Extension UMass Cold Spring Orchard 393 Sabin St. Belchertown, MA 01007 413-478-7219 Verizon 413-378-3068 Project Fi umassfruit.com

5 4

How to force retry queue to try again?
by Richard Johnson 07 Aug '18

07 Aug '18

I'm trying to find some documentation on how to force my retry ("RetryRunner") queue to try delivery again. I'll keep searching but thought I'd toss a quick note here as well. Anyone? Thanks for any help you can provide! /raj

2 4

Submitting the members page
by Bernie Cosell 07 Aug '18

07 Aug '18

Just for reference: I just checked and when I make a change in just one list member, includes a bit of stuff: csrf_token and findmember and setmemberopts_btn and allmodbit_val For every member on the page: _realname, user, _language, Plus, every checkbox that is "on" is also sent. I know that manyof you think I'm nuts and all this hassle I'm going through to program-submit mailman's forms is silly. But: I manage 8 lists now [it'll soon be nine or ten] and it is really very nice that I can open a windows command prompt and just type mailman LIST1 -s jim jim(a)hisdomain.com and in one stroke "jim" is "subscribed" [-u unsubscribes, etc] [not to mention how much I've learned about the wonders of the web developer addin for Firefox...:o)] /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

2 1

scrub set to No but message says scrubbed
by Loren Engrav 07 Aug '18

07 Aug '18

Hi (newbie to this) Mailman 2.1.26 MacOS 10.13.6 I have scrub of regular delivery in non-digest set to No but when I peruse a message with attachments in Archives it says they were scrubbed and in the message the attachments appear, not a link what am I missing? thank you

2 1

Unexpected password reminder from this list
by Jayson Smith 07 Aug '18

07 Aug '18

Hi, Last night at 11:15 or so, I received a password reminder from Mailman-users, with my correct password. Only problem is, I never requested such a reminder. Did anyone else get one, was someone testing something with a random sample of subscribers, or was I targeted (not realizing that they'd have to hack my Email account to get the password)? Thanks, Jayson

5 8

Re: [Mailman-Users] Banned Addresses
by Mike Flannigan 06 Aug '18

06 Aug '18

It is Postorius. Thank you. I am in the process of subscribing. Mike On 8/6/2018 11:00 AM, mailman-users-request(a)python.org wrote: If this is Mailman 3/Postorius the appropriate list is mailman-users(a)mailman3.org <https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/>.

1 0

Banned Addresses
by Mike Flannigan 06 Aug '18

06 Aug '18

We have lists with a lot of banned addresses. Is it necessary to click on a white X in a red box for each address removed, or is there a trick with the reg expression box to remove banned addresses? In most cases we want to remove ALL of the banned addresses. Mike

3 2

Re: [Mailman-Users] POST problem fixed!
by Bernie Cosell 05 Aug '18

05 Aug '18

> I discovered, after much mucking around, that the problem > is that Mailman requires all of the form fields to be > submitted. Just a footnote to this: If you have a big list and you're trying to, say, change the 'nomail' setting via the membership page, you're going to have a *lot* of POST parameters! Every person subscribed to the list that's listed on that page will generate something like 10 form variables. That's going to be a *big* POST! Just to flip one bit..:o) /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

2 1

POST problem fixed!
by Bernie Cosell 05 Aug '18

05 Aug '18

I discovered, after much mucking around, that the problem is that Mailman requires all of the form fields to be submitted. So unsubscribing with just @fields = ( unsubscribees => "$email", setmemberopts_btn => "Submit Your Changes", ) ; Doesn't work. What does work is: @fields = ( send_unsub_ack_to_this_batch => 0, send_unsub_notifications_to_list_owner => 1 , unsubscribees => "$email", setmemberopts_btn => "Submit Your Changes", Content => { unsubscribers_upload => "" }, ) ; YAY! /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

2 1

Automatic web subscription format
by Jason Wandel 05 Aug '18

05 Aug '18

Hi all, I'm using mm 2.1.26 on a lamp install from a hosting company... But have downloaded the code to look through locally. I'm trying to automatically subscribe/unsubscribe members to an already restricted access list. This is because I have a separate webform that's used to select people already in our non-mm database. I've found some info including on the list history (one from back in 2001 though the link provided on that no longer exists). I think I'm most of the way there, I'm now getting a "bad/invalid email address" error from the following (obscured) url, reporting on the Firstname Lastname: http://domain/mailman/admin/list_domain/members/add?subscribe_or_invite=0&s… notification_to_list_owner=0&subscribees=Firstname%20Lastname%20<email@otherdomain>&adminpw=the password I've tried without quotes and with single or double quotes around the name and the name/address combo, all without success. It looks like I'm getting a failure due to email.Utils.parseaddr as called from admin.py (I think line 1465), which supposedly accepts double quotes around the name portion. Could I please ask for guidance on the format needed to make this work? TIA!

2 3

trouble with q.com address
by Loren Engrav 03 Aug '18

03 Aug '18

Hi Have list with ~50 members. One fails to receive messages with email ending in @q.com. And I see notice that Mailman is having trouble (bounces) from that address. Where do I start to sort this out? Thank you

2 1

Re: [Mailman-Users] Mod_Security
by tlhackque 02 Aug '18

02 Aug '18

On 08/01/2018 09:43 AM, Bernie Cosell wrote: > And I tried my program on the Bluehost version and I was greeted with > > Not Acceptable!</title></head><body><h1>Not > Acceptable!</h1><p>An appropriate representation of the requested > resource could not be found on this server. This error was generated by > Mod_Security.< mod_security is an Apache webserver module that has a complex ruleset used to examine every request and response. It attempts to detect and prevent malicious activity. Doc on https://www.modsecurity.org. It is not uncommon for form submissions to run afoul of mod_security rules. Typically, there are cases where data is encoded in ways that appear to be hiding something - e.g. %-encoding urls or POST data where it's not necessary, excessively long URLs or large POSTs - and so on. There's a pretty large list. Most are regex s applied at various stages of request processing; some are based on things like request size. Some are rules that assume a pretty dumb web service; where you know that Mailman can cope with constructs/sizes/encodings, you're expected to disable those rules on the URLs that it serves. There will be logs on the server that specify exactly what rule was tripped, it's id, and the suspect input. Then there are three courses of action possible: o The rule can be disabled by ID in the webserver config, for the specific mailman POST URL (or globally, but that's not smart). It's also possible to completely disable mod_security for a URL or vhost - but that's also not advisable. o Mailman can be changed to not require input that trips the rule. o Your client can be changed not to generate input that trips the rule. You will need help from someone with admin privs to at least share the logs, if not make adjustments to the mod_security configuration. Like any protective filter, it takes some thought and analysis to make the right changes. That is the change that allows what you want, but doesn't open an unintended attack surface. In my experience, these issues are never caused by just one rule - if an application trips one, waiving or fixing it will only get you to the next one. It can take a while to get to a workable ruleset. It is generally worth the trouble, as mod_security is effective at protecting against quite a few exploits. It does take a while to learn how it works and how to teach it how to stay out of your way. There are two things likely to be changed on the server end: The webserver config file that will include directives to disable specific rules on particular URLs. And possibly a set of customized rule overrides for Mailman. (These can go in separate files that are dropped in the rules directory.) Once that's done, sharing the result with the MM community would save others a lot of repeat effort. Good hunting.

1 0

Mod_Security
by Bernie Cosell 02 Aug '18

02 Aug '18

I'm still working on the auto-submission stuff. I set up another test mailing list, this one on Bluehost. First, I compared the HTML of the members/unsubscribe page and they are *identical* [except for having different URLs for the links to the various pages]. And I tried my program on the Bluehost version and I was greeted with Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.< OK, next step is to do a complete packet-capture of the transactions with Dreamhost and wireshark it to see what is strange versus what my program is doing... ....and mailman's forms seemed so simple...:o) /b\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

3 3

non-subscribers getting through--email address in "Real Name"
by Matt Morgan 01 Aug '18

01 Aug '18

On one of my lists I'm seeing some spam from non-subscribers getting through. It appears that the trick is to put a subscriber's address in the "real name" of the sender. E.g., this got through, without being held for moderation, on a list with generic_nonmember_action = discard (emails of the innocent obfuscated): *From:* "xxx(a)johnxxx.com <jgl(a)johngreenwaltlee.com>" <enrollment(a)ekonek.com> *Date:* July 18, 2018 at 5:27:24 PM CDT *To:* <listname(a)server.org <osg-l(a)cool.conservation-us.org>> *Subject:* *[OSG-l] No. PL-01-17923 AIC Objects Specialty Group Discussion* *Reply-To:* My List's Name <listname(a)server.org <osg-l(a)cool.conservation-us.org>> Account Summary: --------------------------- Invoice No: No. PL-01-17923 Billing Date: Jul 19, 2018 Due Date: Jul 22, 2018 Amount Due: 1,047.48 Download DOC: etc. (I'm avoiding sharing the links that follow). xxx(a)johnxxx.com IS a subscriber on the list. However enrollment(a)ekonek.com is not. Yet this message went straight through, as if it had been sent by a subscriber. I've looked at the archives of mailman-users and it looks like--from a very old discussion--that a) this cheap trick should not be sufficient to allow the message through b) the content of the message as delivered to the list may not reflect the exact contents/metadata of the message as it was sent. Still, I don't really know what else could be going on here, or how to investigate. Suggestions? Thanks! Matt

14 81

bounce notification to owner from non members?
by Adam Morris 01 Aug '18

01 Aug '18

Hi all, I receive about 8 bounce messages a day for one of my lists from people trying to post to it who aren't members. The list is set up as private so not sure how these spammers find it. I've been to the bounce page but can't work out how to stop these messages but allow bounce messages from members? TIA. -- Adam Morris Jaws certified 2016 Email, iMessage & FaceTime adam(a)damorris.com

4 3

What does mailman do with a POST?
by Bernie Cosell 01 Aug '18

01 Aug '18

I'm trying to submit a form or two from a program and I can't quite understand Mailman's form handling, this with Mailman 2.1.23. What I've done is a little program that does something simple: it first authenticates [and gets the appropriate cookies], then I GET the mass-removal page [to get its csrf_object. Then I do a simple POST with just three form fields: csrf_object=> <whatever it was in the GET of the page> unsubscribees => the email address, 'setmemberopts_btn => 'Submit Your Changes' The response I get back is the original page - no error and no success, just the mass-removal page again. It is what would happen if you clicked on the submit button without giving it anything to do I've also tried a similar POSTing with every field from the form included, and always the same: a 200 response and I get the mass-removal page back again. I'd look at the code, but I'm a perl guy -- never messed with python. What does Mailman do to when receiving a POST to decide if there's something to do or not? THANKS! /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

3 7