[Mailman-Users] List marked private, still accessible from web?

[Michael Urashka]

About a year ago I set up 3 lists. I was fairly certain I set
up 2 of the lists as private and 1 as public. A couple weeks ago
we discovered that all three were set to public (looking in the web
admin interface). Now I'm not certain if somehow I didn't originally set
them private. We've upgraded Mailman at least once in this time, not
sure if that could possibly have affected the settings but I should think
it unlikely.

Anyway, we then toggled the 2 lists we wanted back to private, but
searching Google I am able to find a couple posts. Additionally, going
to the Mailman-run web site for one of the mailing lists (the page
people can subscribe from or view the archives, etc), when one clicks
one the Archives, one isn't prompted
for authentication and just gets the /mailman/private/list archive pages
(listed by month: thread/author/subject/date) and one is able to click
and read the archives.

I attempted to rebuild the archives with the arch command but that
appears to not have the desired affect.

Running check_perms showed that the /private archives had the +x for
'other' set so I toggled that to -x.

I can still go to the list archives page and view the private archives
though.

I was wondering what the best way to limit viewing of these pages from
the outside public but allow list members to still have access to the 
archives is.

Is there something obvious I am missing?