[Mailman-Developers] Doubt about security

[Barry Warsaw]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jan 5, 2009, at 1:12 PM, skip at pobox.com wrote:

> I suspect the default should be to not expose those things.  I  
> wasn't even
> aware that list creation through the web was possible.  Based on the
> extremely novice questions I see posted to mailman-users on occasion I
> suspect many potential Mailman admins are unaware of this as well.   
> I fear
> those admins are also the ones most likely to not create strong  
> passwords.

Note that by default, it's not possible to create mailing lists  
through the web even though the link exists.  You have to create a  
site password or 'list creators' password to enable this feature.  A  
site admin should know enough to set these passwords to something  
strong and difficult to brute force.

Still, the suggestions for disabling this CGI is easy enough, and if  
you have shell access to create those passwords, you have shell access  
to disable the CGI.

- -Barry

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iEYEARECAAYFAkliWYwACgkQ2YZpQepbvXFM9wCaAifGNrsBzdL0Mf5RDmrf6jAj
BekAn0LvBA684d7AsE86eiEHjdyghLZX
=D1FM
-----END PGP SIGNATURE-----