[Mailman-Developers] Hashing member passwords in config.pck

[Tobias Eigen]

Hi Barry,

While you're on this subject, I was intrigued by the password resetting  
script but was disappointed that there is no way to actually configure  
the password on the command-line. I was thinking this would enable  
integration of Mailman subscriptions into an existing user database  
(i.e. via a nightly cron). If you use a commonly used encryption, then  
doing this on the command line shouldn't pose any security issues. On  
Kabissa this would be a key aspect to making Mailman continue to work  
as our list manager of choice for e-mail newsletters and discussions in  
our CMS of choice, Mambo Open Source.

Then again, if you're thinking of rewriting how passwords are kept,  
perhaps it might be useful to think about using a different type of  
container anyway, one that works with other, more sophisticated user  
management systems like those that come with CMSs. I.e. LDAP or simply  
mysql.

And this, plus the CAN prefix to the patch name, reminds me: correct me  
if I'm wrong, but my understanding is that Mailman as it exists does  
not comply with the new (unfortunately named) CAN SPAM act. According  
to this act, a recipient of an email from a given site has to be able  
to opt out from receiving ANY MAIL from that site. Right now all  
mailman lists are treated completely separately, and nobody (not even  
the subscriber) can easily find out which lists subscribers are  
subscribed to. What I envision having in my Mailman/Mambo system is a  
single user database with one password per username for all services.  
Users can then go to a simple preferences page on Mambo and do basic  
things like change their email address or password, tick a box to opt  
in/out of various mailings, and in particular opt to receive no mail at  
all. Other Mambo components would handle reading forums and newsletters  
online and enable users to subscribe/unsubscribe to them.

If anybody's got any suggestions on how to achieve this or is  
interested in working with us to develop this functionality, let me  
know.

Cheers,

Tobias

On Feb 10, 2005, at 10:02 AM, Barry Warsaw wrote:

> I think CAN-2005-0202 gives us the opportunity to finally implement  
> what
> we have long considered an embarrassing exposure in Mailman's  
> config.pck
> databases.  Member passwords are kept in this database in the clear.
> The obvious fix is to hash member passwords and keep only the hash in
> the database.
>
> We haven't changed this before now for two reasons:
>
> 1. We would have to regenerate all member passwords, which is an
> administrative burden.  We might also need to implement checks to see  
> if
> the passwords were cleartext or hashed and do the password comparison
> accordingly.
>
> 2. This breaks all password reminders.
>
> To fully address CAN-2005-0202 we're recommending sites regenerate  
> their
> member passwords anyway, so this gives us an opening to fix this
> properly.  And we have a better internal password generator now too.
>
> As for #2, well, I think most people hate those password reminders
> anyway, and we've decided that they are going away for MM3.  I don't
> think many people would shed too many tears if we killed off monthly
> password reminders for 2.1.6.  Doing that would also eliminate the
> requirement for the site list, since its primary purpose is to function
> as the sender of the reminder messages.
>
> To do this for 2.1.6, we'd have to change the "Email My Password To Me"
> feature in the options page and in the member login page.  These would
> have to become a "create a new password for me" feature.  Also,
> crontab.in should not call mailpasswds anymore, or that script should
> turn into a simple "here's the lists you are on" reminder, without the
> password information in it.  This will require i18n updates too.
>
> The downside to doing this now is that it's more coding work for 2.1.6
> and I'd like to get the new version out asap.  Still, this seems like  
> an
> opportunity that we shouldn't lightly dismiss.
>
> What do you all think?  Is anybody willing to take a crack at a patch
> for this?
>
> -Barry
>
> _______________________________________________
> Mailman-Developers mailing list
> Mailman-Developers at python.org
> http://mail.python.org/mailman/listinfo/mailman-developers
> Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
> Searchable Archives:  
> http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe:  
> http://mail.python.org/mailman/options/mailman-developers/ 
> tobias%40kabissa.org
--
Tobias Eigen
Executive Director

Kabissa - Space for Change in Africa
http://www.kabissa.org

* Kabissa's vision is for a socially, economically, politically, and  
environmentally vibrant Africa, supported by a strong network of  
effective civil society organizations. *