[Mailman-Users] Getting Spam from Banned Address

[Mark Sapiro]

On 5/2/11 9:45 AM, Henry Hartley wrote:
> On 5/2/2011 11:05 AM, Mark Sapiro wrote:
>> Henry Hartley wrote:
>>>
>>> possibly a setting that says "all From addresses must be on the list".
>>
>> Perhaps that would be useful, but it doesn't currently exist.
> 
> Or at the least something that says if a specifically banned address is
> in the From field, then don't allow it. That might be simpler to
> impliment, and is more likely to always be the right thing to do.


Actually, while standards allow multiple addresses in From:, I can see
that they would be rare to non-existent in legitimate list posts.
Possibly a hold along the lines of "Post contains multiple From:
addresses.", either unconditional or enabled by a list setting would be
a good thing.


>> If this is your Mailman installation, you could try putting
>>
>> SENDER_HEADERS = (None,)
>>
>> in mm_cfg.py. This would say that the post is considered to be from a
>> member only if the envelope sender is a member.
> 
> I've done this. Thanks for the suggestion. I'll report back if that
> doesn't solve the problem but it seems like it should. It occurs to me
> that this is site-wide, however. Is that right? I have a half dozen
> lists so now does this apply to all of them? They are all small and it's
> probably OK, but I should know.
> 


Yes, this is a global setting and affects all lists.

My impression is that this will be pretty safe in most environments,
i.e. most MUA's mail submission processes seem to set the envelope
sender to the same address as From:, but there may be cases where this
isn't true for legitimate list mail. I suspect if there are legitimate
posts From: a list member with a non-member envelope sender, that the
sender would be able to "fix" it.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    Better use your sense - B. Dylan