Mailman 3 August 2018 - Mailman-Users

Automatic web subscription format
by Jason Wandel 05 Aug '18

05 Aug '18

Hi all, I'm using mm 2.1.26 on a lamp install from a hosting company... But have downloaded the code to look through locally. I'm trying to automatically subscribe/unsubscribe members to an already restricted access list. This is because I have a separate webform that's used to select people already in our non-mm database. I've found some info including on the list history (one from back in 2001 though the link provided on that no longer exists). I think I'm most of the way there, I'm now getting a "bad/invalid email address" error from the following (obscured) url, reporting on the Firstname Lastname: http://domain/mailman/admin/list_domain/members/add?subscribe_or_invite=0&s… notification_to_list_owner=0&subscribees=Firstname%20Lastname%20<email@otherdomain>&adminpw=the password I've tried without quotes and with single or double quotes around the name and the name/address combo, all without success. It looks like I'm getting a failure due to email.Utils.parseaddr as called from admin.py (I think line 1465), which supposedly accepts double quotes around the name portion. Could I please ask for guidance on the format needed to make this work? TIA!

2 3

trouble with q.com address
by Loren Engrav 03 Aug '18

03 Aug '18

Hi Have list with ~50 members. One fails to receive messages with email ending in @q.com. And I see notice that Mailman is having trouble (bounces) from that address. Where do I start to sort this out? Thank you

2 1

Re: [Mailman-Users] Mod_Security
by tlhackque 02 Aug '18

02 Aug '18

On 08/01/2018 09:43 AM, Bernie Cosell wrote: > And I tried my program on the Bluehost version and I was greeted with > > Not Acceptable!</title></head><body><h1>Not > Acceptable!</h1><p>An appropriate representation of the requested > resource could not be found on this server. This error was generated by > Mod_Security.< mod_security is an Apache webserver module that has a complex ruleset used to examine every request and response. It attempts to detect and prevent malicious activity. Doc on https://www.modsecurity.org. It is not uncommon for form submissions to run afoul of mod_security rules. Typically, there are cases where data is encoded in ways that appear to be hiding something - e.g. %-encoding urls or POST data where it's not necessary, excessively long URLs or large POSTs - and so on. There's a pretty large list. Most are regex s applied at various stages of request processing; some are based on things like request size. Some are rules that assume a pretty dumb web service; where you know that Mailman can cope with constructs/sizes/encodings, you're expected to disable those rules on the URLs that it serves. There will be logs on the server that specify exactly what rule was tripped, it's id, and the suspect input. Then there are three courses of action possible: o The rule can be disabled by ID in the webserver config, for the specific mailman POST URL (or globally, but that's not smart). It's also possible to completely disable mod_security for a URL or vhost - but that's also not advisable. o Mailman can be changed to not require input that trips the rule. o Your client can be changed not to generate input that trips the rule. You will need help from someone with admin privs to at least share the logs, if not make adjustments to the mod_security configuration. Like any protective filter, it takes some thought and analysis to make the right changes. That is the change that allows what you want, but doesn't open an unintended attack surface. In my experience, these issues are never caused by just one rule - if an application trips one, waiving or fixing it will only get you to the next one. It can take a while to get to a workable ruleset. It is generally worth the trouble, as mod_security is effective at protecting against quite a few exploits. It does take a while to learn how it works and how to teach it how to stay out of your way. There are two things likely to be changed on the server end: The webserver config file that will include directives to disable specific rules on particular URLs. And possibly a set of customized rule overrides for Mailman. (These can go in separate files that are dropped in the rules directory.) Once that's done, sharing the result with the MM community would save others a lot of repeat effort. Good hunting.

1 0

Mod_Security
by Bernie Cosell 02 Aug '18

02 Aug '18

I'm still working on the auto-submission stuff. I set up another test mailing list, this one on Bluehost. First, I compared the HTML of the members/unsubscribe page and they are *identical* [except for having different URLs for the links to the various pages]. And I tried my program on the Bluehost version and I was greeted with Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.< OK, next step is to do a complete packet-capture of the transactions with Dreamhost and wireshark it to see what is strange versus what my program is doing... ....and mailman's forms seemed so simple...:o) /b\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

3 3

non-subscribers getting through--email address in "Real Name"
by Matt Morgan 01 Aug '18

01 Aug '18

On one of my lists I'm seeing some spam from non-subscribers getting through. It appears that the trick is to put a subscriber's address in the "real name" of the sender. E.g., this got through, without being held for moderation, on a list with generic_nonmember_action = discard (emails of the innocent obfuscated): *From:* "xxx(a)johnxxx.com <jgl(a)johngreenwaltlee.com>" <enrollment(a)ekonek.com> *Date:* July 18, 2018 at 5:27:24 PM CDT *To:* <listname(a)server.org <osg-l(a)cool.conservation-us.org>> *Subject:* *[OSG-l] No. PL-01-17923 AIC Objects Specialty Group Discussion* *Reply-To:* My List's Name <listname(a)server.org <osg-l(a)cool.conservation-us.org>> Account Summary: --------------------------- Invoice No: No. PL-01-17923 Billing Date: Jul 19, 2018 Due Date: Jul 22, 2018 Amount Due: 1,047.48 Download DOC: etc. (I'm avoiding sharing the links that follow). xxx(a)johnxxx.com IS a subscriber on the list. However enrollment(a)ekonek.com is not. Yet this message went straight through, as if it had been sent by a subscriber. I've looked at the archives of mailman-users and it looks like--from a very old discussion--that a) this cheap trick should not be sufficient to allow the message through b) the content of the message as delivered to the list may not reflect the exact contents/metadata of the message as it was sent. Still, I don't really know what else could be going on here, or how to investigate. Suggestions? Thanks! Matt

14 81

bounce notification to owner from non members?
by Adam Morris 01 Aug '18

01 Aug '18

Hi all, I receive about 8 bounce messages a day for one of my lists from people trying to post to it who aren't members. The list is set up as private so not sure how these spammers find it. I've been to the bounce page but can't work out how to stop these messages but allow bounce messages from members? TIA. -- Adam Morris Jaws certified 2016 Email, iMessage & FaceTime adam(a)damorris.com

4 3

What does mailman do with a POST?
by Bernie Cosell 01 Aug '18

01 Aug '18

I'm trying to submit a form or two from a program and I can't quite understand Mailman's form handling, this with Mailman 2.1.23. What I've done is a little program that does something simple: it first authenticates [and gets the appropriate cookies], then I GET the mass-removal page [to get its csrf_object. Then I do a simple POST with just three form fields: csrf_object=> <whatever it was in the GET of the page> unsubscribees => the email address, 'setmemberopts_btn => 'Submit Your Changes' The response I get back is the original page - no error and no success, just the mass-removal page again. It is what would happen if you clicked on the submit button without giving it anything to do I've also tried a similar POSTing with every field from the form included, and always the same: a 200 response and I get the mass-removal page back again. I'd look at the code, but I'm a perl guy -- never messed with python. What does Mailman do to when receiving a POST to decide if there's something to do or not? THANKS! /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

3 7