From Ralf.Hildebrandt at charite.de  Tue Sep  4 05:22:46 2018
From: Ralf.Hildebrandt at charite.de (Ralf Hildebrandt)
Date: Tue, 4 Sep 2018 11:22:46 +0200
Subject: [Mailman-Users] private archives,
 but not when accessing from intranet?
Message-ID: <20180904092246.GE11906@charite.de>

Is it possible to make a list archive private (thus requiring
Email&pass), but allowing access when accessing from special IPs (i.e.
intranet)?

I'm willing to perform ugly config hacks on the apache config...

-- 
Ralf Hildebrandt                   Charite Universit?tsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
https://www.charite.de             Hindenburgdamm 30, 12203 Berlin
Gesch?ftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155

From mark at msapiro.net  Tue Sep  4 21:10:24 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 4 Sep 2018 18:10:24 -0700
Subject: [Mailman-Users] private archives,
 but not when accessing from intranet?
In-Reply-To: <20180904092246.GE11906@charite.de>
References: <20180904092246.GE11906@charite.de>
Message-ID: <e53efa1c-a2f0-2a21-c8de-e6ca803f0386@msapiro.net>

On 09/04/2018 02:22 AM, Ralf Hildebrandt wrote:
> Is it possible to make a list archive private (thus requiring
> Email&pass), but allowing access when accessing from special IPs (i.e.
> intranet)?
> 
> I'm willing to perform ugly config hacks on the apache config...
> 


Assuming MM 2.1, just make an alias in Apache that requires the special
IPs and goes to archives/private/LISTNAME/

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From Ralf.Hildebrandt at charite.de  Wed Sep  5 02:27:18 2018
From: Ralf.Hildebrandt at charite.de (Ralf Hildebrandt)
Date: Wed, 5 Sep 2018 08:27:18 +0200
Subject: [Mailman-Users] [ext] Re:  private archives,
 but not when accessing from intranet?
In-Reply-To: <e53efa1c-a2f0-2a21-c8de-e6ca803f0386@msapiro.net>
References: <20180904092246.GE11906@charite.de>
 <e53efa1c-a2f0-2a21-c8de-e6ca803f0386@msapiro.net>
Message-ID: <20180905062717.GB8828@charite.de>

* Mark Sapiro <mark at msapiro.net>:
> On 09/04/2018 02:22 AM, Ralf Hildebrandt wrote:
> > Is it possible to make a list archive private (thus requiring
> > Email&pass), but allowing access when accessing from special IPs (i.e.
> > intranet)?
> > 
> > I'm willing to perform ugly config hacks on the apache config...
> > 
> 
> 
> Assuming MM 2.1, just make an alias in Apache that requires the special
> IPs and goes to archives/private/LISTNAME/

Forgot to mention that I'm stripping attachments and that's why the
users need to access the archives.... Meaning the mails contain links to
the attachments in the archive. External users will have to take the
normal route (email & pass) and interal users should be able to access
without that hurdle.

-- 
Ralf Hildebrandt                   Charite Universit?tsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
https://www.charite.de             Hindenburgdamm 30, 12203 Berlin
Gesch?ftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155

From mark at msapiro.net  Wed Sep  5 20:45:04 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Wed, 5 Sep 2018 17:45:04 -0700
Subject: [Mailman-Users] [ext] Re: private archives,
 but not when accessing from intranet?
In-Reply-To: <20180905062717.GB8828@charite.de>
References: <20180904092246.GE11906@charite.de>
 <e53efa1c-a2f0-2a21-c8de-e6ca803f0386@msapiro.net>
 <20180905062717.GB8828@charite.de>
Message-ID: <dcd9e084-bbc9-bbda-c4ec-bdbb2028c47a@msapiro.net>

On 09/04/2018 11:27 PM, Ralf Hildebrandt wrote:
> * Mark Sapiro <mark at msapiro.net>:
>>
>> Assuming MM 2.1, just make an alias in Apache that requires the special
>> IPs and goes to archives/private/LISTNAME/
> 
> Forgot to mention that I'm stripping attachments and that's why the
> users need to access the archives.... Meaning the mails contain links to
> the attachments in the archive. External users will have to take the
> normal route (email & pass) and interal users should be able to access
> without that hurdle.


That makes it trickier. Suppose you were to create an alias in Apache
with the IP restrictions such that for a URL like
http://example.com/mailman/private/list/..., one of the permitted IPs
could go instead to
http://example.com/the_alias/... and be sent to archives/private/list/...

Then people from the special IPs who found a link to say
http://example.com/mailman/private/list/attachments/20180901/xxxxxxxx/attachment.xxx
would need to go instead to
http://example.com/the_alias/attachments/20180901/xxxxxxxx/attachment.xxx
and it would be awkward for them to have to make that translation manually.

I suspect you could do this in Apache with RewriteCond (for the IPs) and
RewriteRule to map mailman/private/list to the_alias.

You might also consider modifying Mailman/Cgi/private.py to skip login
if the request is for 'list' and from one of the special IPs. This
approach would allow everyone to use the same private archive URLs and
require no Apache tweaks.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From steven.jones at vuw.ac.nz  Sun Sep  9 22:29:55 2018
From: steven.jones at vuw.ac.nz (Steven Jones)
Date: Mon, 10 Sep 2018 02:29:55 +0000
Subject: [Mailman-Users] restoring a list
Message-ID: <SYCPR01MB3310AA9E4F66A1F75ADE5F8AD4050@SYCPR01MB3310.ausprd01.prod.outlook.com>

<https://mail.python.org/pipermail/mailman-users/2009-November/067870.html>Hi,


I restored a list (after a deletion as per,


https://mail.python.org/pipermail/mailman-users/2009-November/067870.html


However the list owner says it isnt working, is there anything I am missing?


regards

Steven Jones

B.Eng (Hons)

Technical Specialist - Linux RHCE

Victoria University ITS,

Level 8 Rankin Brown Building,

Wellington, NZ

6012

0064 4 463 6272

From steven.jones at vuw.ac.nz  Mon Sep 10 03:04:45 2018
From: steven.jones at vuw.ac.nz (Steven Jones)
Date: Mon, 10 Sep 2018 07:04:45 +0000
Subject: [Mailman-Users] restoring a list
In-Reply-To: <SYCPR01MB3310AA9E4F66A1F75ADE5F8AD4050@SYCPR01MB3310.ausprd01.prod.outlook.com>
References: <SYCPR01MB3310AA9E4F66A1F75ADE5F8AD4050@SYCPR01MB3310.ausprd01.prod.outlook.com>
Message-ID: <SYCPR01MB3310F44326D51954CEBB30A4D4050@SYCPR01MB3310.ausprd01.prod.outlook.com>

Traced it to the aliases file for postfix, re-added the 8? "links" all works fine now


regards

Steven


________________________________
From: Mailman-Users <mailman-users-bounces+steven.jones=vuw.ac.nz at python.org> on behalf of Steven Jones <steven.jones at vuw.ac.nz>
Sent: Monday, 10 September 2018 2:29 PM
To: mailman-users at python.org
Subject: [Mailman-Users] restoring a list

<https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.python.org%2Fpipermail%2Fmailman-users%2F2009-November%2F067870.html&amp;data=02%7C01%7Csteven.jones%40vuw.ac.nz%7C25347c878fd747a61eaf08d616ca1bb6%7Ccfe63e236951427e8683bb84dcf1d20c%7C1%7C0%7C636721454697043783&amp;sdata=tTFXzxFfmN7Jgvtyv%2FnWfnqxHcY%2FKmNMUbzHzREJOsI%3D&amp;reserved=0>Hi,


I restored a list (after a deletion as per,


https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.python.org%2Fpipermail%2Fmailman-users%2F2009-November%2F067870.html&amp;data=02%7C01%7Csteven.jones%40vuw.ac.nz%7C25347c878fd747a61eaf08d616ca1bb6%7Ccfe63e236951427e8683bb84dcf1d20c%7C1%7C0%7C636721454697043783&amp;sdata=tTFXzxFfmN7Jgvtyv%2FnWfnqxHcY%2FKmNMUbzHzREJOsI%3D&amp;reserved=0


However the list owner says it isnt working, is there anything I am missing?


regards

Steven Jones

B.Eng (Hons)

Technical Specialist - Linux RHCE

Victoria University ITS,

Level 8 Rankin Brown Building,

Wellington, NZ

6012

0064 4 463 6272
------------------------------------------------------
Mailman-Users mailing list Mailman-Users at python.org
https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.python.org%2Fmailman%2Flistinfo%2Fmailman-users&amp;data=02%7C01%7Csteven.jones%40vuw.ac.nz%7C25347c878fd747a61eaf08d616ca1bb6%7Ccfe63e236951427e8683bb84dcf1d20c%7C1%7C0%7C636721454697200031&amp;sdata=U9e3Nje2wYQxnewUR0x%2BOFlA0SLDjH8AWOeQxY%2FZ1%2Fg%3D&amp;reserved=0
Mailman FAQ: https://apac01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.list.org%2Fx%2FAgA3&amp;data=02%7C01%7Csteven.jones%40vuw.ac.nz%7C25347c878fd747a61eaf08d616ca1bb6%7Ccfe63e236951427e8683bb84dcf1d20c%7C1%7C0%7C636721454697200031&amp;sdata=zm2QjObzQLmgsSB%2BWcKKNvlCDOByyFuOXafyfpb1ap8%3D&amp;reserved=0
Security Policy: https://apac01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.list.org%2Fx%2FQIA9&amp;data=02%7C01%7Csteven.jones%40vuw.ac.nz%7C25347c878fd747a61eaf08d616ca1bb6%7Ccfe63e236951427e8683bb84dcf1d20c%7C1%7C0%7C636721454697200031&amp;sdata=LnXXO6C1CrEbzLga4aal8pDUvNUZborx2Whj7aQA4xw%3D&amp;reserved=0
Searchable Archives: https://apac01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.mail-archive.com%2Fmailman-users%2540python.org%2F&amp;data=02%7C01%7Csteven.jones%40vuw.ac.nz%7C25347c878fd747a61eaf08d616ca1bb6%7Ccfe63e236951427e8683bb84dcf1d20c%7C1%7C0%7C636721454697200031&amp;sdata=Lm9pIO%2FQ0FxO6JwdOwQJs1hYy%2Bpbu59bP5503ymgjwc%3D&amp;reserved=0
Unsubscribe: https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.python.org%2Fmailman%2Foptions%2Fmailman-users%2Fsteven.jones%2540vuw.ac.nz&amp;data=02%7C01%7Csteven.jones%40vuw.ac.nz%7C25347c878fd747a61eaf08d616ca1bb6%7Ccfe63e236951427e8683bb84dcf1d20c%7C1%7C0%7C636721454697200031&amp;sdata=6ORBj%2BZWPFe7ZW%2Ft%2BzHjoomE15z3%2FXD8cEHqg580FWo%3D&amp;reserved=0

From linuxmailinglistsemail at gmail.com  Mon Sep 10 12:04:28 2018
From: linuxmailinglistsemail at gmail.com (Sean Son)
Date: Mon, 10 Sep 2018 12:04:28 -0400
Subject: [Mailman-Users] Setting up SSL Virtualhost for Mailman
Message-ID: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>

Hello all

I have to set up SSL for our mailman instance and I am stuck on how the SSL
Virtualhost for HTTPs should be set up. I know the FAQ on the list.org
website explains all of the steps for setting up HTTPS with mailman, but I
do not see anything that explains how to set up the actual virtual host and
which options and directives should be in the virtual host.. Any and ALL
help is greatly appreciated!!


Thanks

Sean

From mark at msapiro.net  Tue Sep 11 12:11:23 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 11 Sep 2018 09:11:23 -0700
Subject: [Mailman-Users] Setting up SSL Virtualhost for Mailman
In-Reply-To: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
Message-ID: <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>

On 09/10/2018 09:04 AM, Sean Son wrote:
> 
> I have to set up SSL for our mailman instance and I am stuck on how the SSL
> Virtualhost for HTTPs should be set up. I know the FAQ on the list.org
> website explains all of the steps for setting up HTTPS with mailman, but I
> do not see anything that explains how to set up the actual virtual host and
> which options and directives should be in the virtual host.. Any and ALL
> help is greatly appreciated!!


If I understand correctly, this is a web server question, not a Mailman
question.

Please elaborate. Are you asking how to set up your web server? if so,
what web server are you using (Apache, nginx, ??). Also, what are you
trying to do. I.e. do you want to require https for Mailman or only
allow it? Do you have an SSL certificate? If not, see
<https://letsencrypt.org/>.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From linuxmailinglistsemail at gmail.com  Tue Sep 11 14:47:39 2018
From: linuxmailinglistsemail at gmail.com (Sean Son)
Date: Tue, 11 Sep 2018 14:47:39 -0400
Subject: [Mailman-Users] Setting up SSL Virtualhost for Mailman
In-Reply-To: <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
Message-ID: <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>

On Tue, Sep 11, 2018 at 12:11 PM, Mark Sapiro <mark at msapiro.net> wrote:

> On 09/10/2018 09:04 AM, Sean Son wrote:
> >
> > I have to set up SSL for our mailman instance and I am stuck on how the
> SSL
> > Virtualhost for HTTPs should be set up. I know the FAQ on the list.org
> > website explains all of the steps for setting up HTTPS with mailman, but
> I
> > do not see anything that explains how to set up the actual virtual host
> and
> > which options and directives should be in the virtual host.. Any and ALL
> > help is greatly appreciated!!
>
>
> If I understand correctly, this is a web server question, not a Mailman
> question.
>
> Please elaborate. Are you asking how to set up your web server? if so,
> what web server are you using (Apache, nginx, ??). Also, what are you
> trying to do. I.e. do you want to require https for Mailman or only
> allow it? Do you have an SSL certificate? If not, see
> <https://letsencrypt.org/>.
>
> --
> Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
> San Francisco Bay Area, California    better use your sense - B. Dylan
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/
> mailman-users%40python.org/
> Unsubscribe: https://mail.python.org/mailman/options/mailman-users/
> linuxmailinglistsemail%40gmail.com
>

Hey Mark

Thanks for the reply man. I want to require HTTPS for Mailman and all of
its lists. I already have an SSL cert . I am running Apache as the
webserver on RHEL 7.  I took a look at the FAQs on the Mailman site,
regarding setting up SSL. It mentions that a virtual host can be set up for
HTTP to redirect to HTTPS, and a virtualhost can be set up for the HTTPS
and mailman configured to only work on HTTPs.  It is the latter part,
setting up the VirtualHost for HTTPS and configuring mailman to work only
with HTTPs, which I am lost on. I did research online and I found this
posting:

https://www.apachelounge.com/viewtopic.php?p=30938

But it does not seem that the OP ever got his issue resolved. He did not
post any updates.  So, to summarize, I need assistance on setting up the
VirtualHost for the HTTPS only access to Mailman


Thanks!

From mark at msapiro.net  Tue Sep 11 16:00:16 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 11 Sep 2018 13:00:16 -0700
Subject: [Mailman-Users] Setting up SSL Virtualhost for Mailman
In-Reply-To: <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
 <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
Message-ID: <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>

On 09/11/2018 11:47 AM, Sean Son wrote:
> 
> Thanks for the reply man. I want to require HTTPS for Mailman and all of
> its lists. I already have an SSL cert . I am running Apache as the
> webserver on RHEL 7.  I took a look at the FAQs on the Mailman site,
> regarding setting up SSL. It mentions that a virtual host can be set up for
> HTTP to redirect to HTTPS, and a virtualhost can be set up for the HTTPS
> and mailman configured to only work on HTTPs.  It is the latter part,
> setting up the VirtualHost for HTTPS and configuring mailman to work only
> with HTTPs, which I am lost on.

There are multiple ways to do this. It depends on whether you have other
virtual hosts and if so, if they should also be able to access mailman.

In the simplest case, just put the various things for the mailman config
such as

ScriptAlias /mailman/ /path/to/mailman/cgi-bin
Alias   /pipermail/  /path/to/mailman/archives/public/

<Directory "/path/to/mailman/cgi-bin/">
    Options ExecCGI
    Require all granted
</Directory>

<Directory "/path/to/mailman/archives/public">
    Options +FollowSymLinks
    Require all granted
</Directory>

directly in the mailman https virtual host.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From Michael.D.Parker at ga.com  Tue Sep 11 17:00:47 2018
From: Michael.D.Parker at ga.com (Parker, Michael D.)
Date: Tue, 11 Sep 2018 21:00:47 +0000
Subject: [Mailman-Users] -EXT-Re: Setting up SSL Virtualhost for Mailman
In-Reply-To: <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
 <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
 <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
Message-ID: <9e2d9094897f4b60a746300c246eb2d5@ASGEXCPWP05.ga.com>

Hmmm....I seem to remember that there are places in the configuration files where http:// that would need to be changed to https://.  
If I also recall, existing mail lists have the http:// reference in them which would have to be changed also.

***** ***** ***** ***** ***** *****
Email: michael.d.parker at ga.com      <<<<< NOTE:  Remember to include my middle initial >>>>>

Michael D. Parker, CISSP 
EMS Programs Cybersecurity, Architecture, Software & Controls Division
General Atomics
ElectroMagnetics Systems Group (GA-EMS)
+1-858-964-6675 work phone
+1-858-376-7474 mobile phone
16969 Mesamint Street
San Diego, CA      92127-2407

*****************************************************************************
CONFIDENTIALITY NOTICE: This communication is intended to be confidential to the person(s)
 to whom it is addressed. If you are not the intended recipient or the agent of the intended 
recipient or if you are unable to deliver this communication to the intended recipient, you 
must not read, use or disseminate this information. If you have received this communication 
in error, please advise the sender immediately by telephone and delete this message and any
 attachments without retaining a copy. 
*****************************************************************************


-----Original Message-----
From: Mailman-Users <mailman-users-bounces+michael.d.parker=ga.com at python.org> On Behalf Of Mark Sapiro
Sent: Tuesday, September 11, 2018 13:00
To: mailman-users at python.org
Subject: -EXT-Re: [Mailman-Users] Setting up SSL Virtualhost for Mailman

On 09/11/2018 11:47 AM, Sean Son wrote:
> 
> Thanks for the reply man. I want to require HTTPS for Mailman and all 
> of its lists. I already have an SSL cert . I am running Apache as the 
> webserver on RHEL 7.  I took a look at the FAQs on the Mailman site, 
> regarding setting up SSL. It mentions that a virtual host can be set 
> up for HTTP to redirect to HTTPS, and a virtualhost can be set up for 
> the HTTPS and mailman configured to only work on HTTPs.  It is the 
> latter part, setting up the VirtualHost for HTTPS and configuring 
> mailman to work only with HTTPs, which I am lost on.

There are multiple ways to do this. It depends on whether you have other virtual hosts and if so, if they should also be able to access mailman.

In the simplest case, just put the various things for the mailman config such as

ScriptAlias /mailman/ /path/to/mailman/cgi-bin
Alias   /pipermail/  /path/to/mailman/archives/public/

<Directory "/path/to/mailman/cgi-bin/">
    Options ExecCGI
    Require all granted
</Directory>

<Directory "/path/to/mailman/archives/public">
    Options +FollowSymLinks
    Require all granted
</Directory>

directly in the mailman https virtual host.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan
------------------------------------------------------
Mailman-Users mailing list Mailman-Users at python.org https://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: https://mail.python.org/mailman/options/mailman-users/michael.d.parker%40ga.com


From mark at msapiro.net  Tue Sep 11 18:29:11 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 11 Sep 2018 15:29:11 -0700
Subject: [Mailman-Users] -EXT-Re: Setting up SSL Virtualhost for Mailman
In-Reply-To: <9e2d9094897f4b60a746300c246eb2d5@ASGEXCPWP05.ga.com>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
 <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
 <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
 <9e2d9094897f4b60a746300c246eb2d5@ASGEXCPWP05.ga.com>
Message-ID: <88f1bd69-f453-228f-4dca-f611dfcde118@msapiro.net>

On 09/11/2018 02:00 PM, Parker, Michael D. wrote:
> Hmmm....I seem to remember that there are places in the configuration files where http:// that would need to be changed to https://.  
> If I also recall, existing mail lists have the http:// reference in them which would have to be changed also.


This is all covered in the FAQ at <https://wiki.list.org/x/17892007>
which the OP said he read.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From linuxmailinglistsemail at gmail.com  Tue Sep 11 18:42:09 2018
From: linuxmailinglistsemail at gmail.com (Sean Son)
Date: Tue, 11 Sep 2018 18:42:09 -0400
Subject: [Mailman-Users] -EXT-Re: Setting up SSL Virtualhost for Mailman
In-Reply-To: <88f1bd69-f453-228f-4dca-f611dfcde118@msapiro.net>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
 <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
 <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
 <9e2d9094897f4b60a746300c246eb2d5@ASGEXCPWP05.ga.com>
 <88f1bd69-f453-228f-4dca-f611dfcde118@msapiro.net>
Message-ID: <CAOKpjz8yKFQ4Uc1UfvUmouyyD+Yvf5H8YWaLsWfYWks0xPs5kQ@mail.gmail.com>

On Tue, Sep 11, 2018 at 6:29 PM, Mark Sapiro <mark at msapiro.net> wrote:

> On 09/11/2018 02:00 PM, Parker, Michael D. wrote:
> > Hmmm....I seem to remember that there are places in the configuration
> files where http:// that would need to be changed to https://.
> > If I also recall, existing mail lists have the http:// reference in
> them which would have to be changed also.
>
>
> This is all covered in the FAQ at <https://wiki.list.org/x/17892007>
> which the OP said he read.
>
> --
> Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
> San Francisco Bay Area, California    better use your sense - B. Dylan
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/
> mailman-users%40python.org/
> Unsubscribe: https://mail.python.org/mailman/options/mailman-users/
> linuxmailinglistsemail%40gmail.com
>

Thanks everyone for the suggestions. I will try them and see what happens

From linuxmailinglistsemail at gmail.com  Tue Sep 11 21:03:32 2018
From: linuxmailinglistsemail at gmail.com (Sean Son)
Date: Tue, 11 Sep 2018 21:03:32 -0400
Subject: [Mailman-Users] Setting up SSL Virtualhost for Mailman
In-Reply-To: <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
 <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
 <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
Message-ID: <CAOKpjz_=+GMbr5MPnnsdyRZnhVTfYnkXyEe7R_EatVSqm6f-Sw@mail.gmail.com>

On Tue, Sep 11, 2018 at 4:00 PM, Mark Sapiro <mark at msapiro.net> wrote:

> On 09/11/2018 11:47 AM, Sean Son wrote:
> >
> > Thanks for the reply man. I want to require HTTPS for Mailman and all of
> > its lists. I already have an SSL cert . I am running Apache as the
> > webserver on RHEL 7.  I took a look at the FAQs on the Mailman site,
> > regarding setting up SSL. It mentions that a virtual host can be set up
> for
> > HTTP to redirect to HTTPS, and a virtualhost can be set up for the HTTPS
> > and mailman configured to only work on HTTPs.  It is the latter part,
> > setting up the VirtualHost for HTTPS and configuring mailman to work only
> > with HTTPs, which I am lost on.
>
> There are multiple ways to do this. It depends on whether you have other
> virtual hosts and if so, if they should also be able to access mailman.
>
> In the simplest case, just put the various things for the mailman config
> such as
>
> ScriptAlias /mailman/ /path/to/mailman/cgi-bin
> Alias   /pipermail/  /path/to/mailman/archives/public/
>
> <Directory "/path/to/mailman/cgi-bin/">
>     Options ExecCGI
>     Require all granted
> </Directory>
>
> <Directory "/path/to/mailman/archives/public">
>     Options +FollowSymLinks
>     Require all granted
> </Directory>
>
> directly in the mailman https virtual host.
>
> --
> Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
> San Francisco Bay Area, California    better use your sense - B. Dylan
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/
> mailman-users%40python.org/
> Unsubscribe: https://mail.python.org/mailman/options/mailman-users/
> linuxmailinglistsemail%40gmail.com
>

So i got HTTPS to work on the main site, but now when I access the list
archives, i see that they are still being accessed through HTTP and not
HTTPS

So I then ran this command:

$prefix/bin/withlist -l -a -r fix_url

and each of the lists were listed but the word "locked" appeared by each
one of them.. After the command finished running and I restarted Mailman as
well as Apache, I still see that the list archives are being accessed
through HTTP and not HTTPS.  Any ideas on how I should resolve this? What
does "locked" mean that appeared by each list name:

/usr/lib/mailman/bin/withlist -l -a -r fix_url
Importing fix_url...
Running fix_url.fix_url()...
Loading list list0 (locked)
Saving list
Loading list list1 (locked)
Saving list
Loading list list2 (locked)
Saving list
.
.
Finalizing

From bernie at fantasyfarm.com  Tue Sep 11 10:04:58 2018
From: bernie at fantasyfarm.com (Bernie Cosell)
Date: Tue, 11 Sep 2018 10:04:58 -0400
Subject: [Mailman-Users] gmail
Message-ID: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>

I've gotten buried by 80 bounce messages, thanks to gmail's new policy [that was, 
apparently, put into effect yesterday].  The bounces say:

<.... at gmail.com>: host alt1.gmail-smtp-in.l.google.com[74.125.129.26] said:
    421-4.7.0 This message does not have authentication information or fails to
    pass 421-4.7.0 authentication checks. To best protect our users from spam,
    the 421-4.7.0 message has been blocked. Please visit 421-4.7.0
    https://support.google.com/mail/answer/81126#authentication for more
421- 4.7.0 information. 128-v6si11952705iti.109 - gsmtp (in reply to end of
DATA command)

I looked at their 'answer' and mostly found it to be unhelpful.  i certainly can't get 
any server anywhere to change their their system configuration, nor can I mess 
with mailman [all suggestions about python-esque tweaks to mailman presume 
that you have access to the server, which I don't].   Is there something I can do 
[just as a list owner] to deal with this mess?

  /Bernie\_


                 Bernie Cosell
         bernie at fantasyfarm.com
-- Too many people; too few sheep --


From mark at msapiro.net  Tue Sep 11 22:19:33 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 11 Sep 2018 19:19:33 -0700
Subject: [Mailman-Users] Setting up SSL Virtualhost for Mailman
In-Reply-To: <CAOKpjz_=+GMbr5MPnnsdyRZnhVTfYnkXyEe7R_EatVSqm6f-Sw@mail.gmail.com>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
 <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
 <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
 <CAOKpjz_=+GMbr5MPnnsdyRZnhVTfYnkXyEe7R_EatVSqm6f-Sw@mail.gmail.com>
Message-ID: <e60d6a80-977c-a889-3f25-a31b786c7f37@msapiro.net>

On 09/11/2018 06:03 PM, Sean Son wrote:
> 
> So i got HTTPS to work on the main site, but now when I access the list
> archives, i see that they are still being accessed through HTTP and not
> HTTPS
> 
> So I then ran this command:
> 
> $prefix/bin/withlist -l -a -r fix_url
> 
> and each of the lists were listed but the word "locked" appeared by each
> one of them.. After the command finished running and I restarted Mailman as
> well as Apache, I still see that the list archives are being accessed
> through HTTP and not HTTPS.  Any ideas on how I should resolve this? What
> does "locked" mean that appeared by each list name:


'locked' is because you specified -l to lock the lists when running fix_url.


> /usr/lib/mailman/bin/withlist -l -a -r fix_url
> Importing fix_url...
> Running fix_url.fix_url()...
> Loading list list0 (locked)
> Saving list


withlist is just telling you it locked the list when loading it. This is
expected.

Running fix_url will fix the web_page_url attribute for existing lists
to use https assuming you set DEFAULT_URL_PATTERN to use https.

To fix the public archive URLs to be https, do step 4 at
<https://wiki.list.org/x/17892007>.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From Richard at Damon-Family.org  Tue Sep 11 22:32:00 2018
From: Richard at Damon-Family.org (Richard Damon)
Date: Tue, 11 Sep 2018 22:32:00 -0400
Subject: [Mailman-Users] gmail
In-Reply-To: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
Message-ID: <b4e21bfc-d45f-c6bd-537e-6fad70edace4@Damon-Family.org>

On 9/11/18 10:04 AM, Bernie Cosell wrote:
> I've gotten buried by 80 bounce messages, thanks to gmail's new policy [that was, 
> apparently, put into effect yesterday].  The bounces say:
>
> <.... at gmail.com>: host alt1.gmail-smtp-in.l.google.com[74.125.129.26] said:
>     421-4.7.0 This message does not have authentication information or fails to
>     pass 421-4.7.0 authentication checks. To best protect our users from spam,
>     the 421-4.7.0 message has been blocked. Please visit 421-4.7.0
>     https://support.google.com/mail/answer/81126#authentication for more
> 421- 4.7.0 information. 128-v6si11952705iti.109 - gsmtp (in reply to end of
> DATA command)
>
> I looked at their 'answer' and mostly found it to be unhelpful.  i certainly can't get 
> any server anywhere to change their their system configuration, nor can I mess 
> with mailman [all suggestions about python-esque tweaks to mailman presume 
> that you have access to the server, which I don't].   Is there something I can do 
> [just as a list owner] to deal with this mess?
>
>   /Bernie\_
>
>
>                  Bernie Cosell
One option they list is to establish SPF for your domain (assuming that
the list comes from a domain that you control). I found that a couple of
years ago I need to add SPF for my list to avoid getting lots of these
from GMail.

The one big downside of adding SPF, is that this cause problems if
anyone sets up a forward for list messages to another domain, as these
now will get rejected by any domain that checks SPF.

-- 
Richard Damon


From mark at msapiro.net  Tue Sep 11 22:46:53 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 11 Sep 2018 19:46:53 -0700
Subject: [Mailman-Users] gmail
In-Reply-To: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
Message-ID: <7f71e3aa-e9c0-fe5c-8556-55e3d4cf8ccc@msapiro.net>

On 09/11/2018 07:04 AM, Bernie Cosell wrote:
> I've gotten buried by 80 bounce messages, thanks to gmail's new policy [that was, 
> apparently, put into effect yesterday].  The bounces say:
> 
> <.... at gmail.com>: host alt1.gmail-smtp-in.l.google.com[74.125.129.26] said:
>     421-4.7.0 This message does not have authentication information or fails to
>     pass 421-4.7.0 authentication checks. To best protect our users from spam,
>     the 421-4.7.0 message has been blocked. Please visit 421-4.7.0
>     https://support.google.com/mail/answer/81126#authentication for more
> 421- 4.7.0 information. 128-v6si11952705iti.109 - gsmtp (in reply to end of
> DATA command)
> 
> I looked at their 'answer' and mostly found it to be unhelpful.  i certainly can't get 
> any server anywhere to change their their system configuration, nor can I mess 
> with mailman [all suggestions about python-esque tweaks to mailman presume 
> that you have access to the server, which I don't].   Is there something I can do 
> [just as a list owner] to deal with this mess?


No.

You need to convince your hosting service to publish SPF records for
your domain indicating that the outgoing server is permitted and to DKIM
sign outgoing messages from your domain.

In todays environment these are normal requirements for sending mail and
the Mailman host should do them.

However, if your list domain is fantasyfarm.com, it appears that
dreamhost does publish an appropriate SPF and at least DKIM signed the
post to which I'm replying.

Also, FWIW, I'm not seeing an abnormal number of gmail users bouncing on
my lists or on python.org lists.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From mark at msapiro.net  Tue Sep 11 23:06:27 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 11 Sep 2018 20:06:27 -0700
Subject: [Mailman-Users] gmail
In-Reply-To: <b4e21bfc-d45f-c6bd-537e-6fad70edace4@Damon-Family.org>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
 <b4e21bfc-d45f-c6bd-537e-6fad70edace4@Damon-Family.org>
Message-ID: <96d883ef-28f3-597c-7f79-7fd57ef1fa35@msapiro.net>

On 09/11/2018 07:32 PM, Richard Damon wrote:
> 
> The one big downside of adding SPF, is that this cause problems if
> anyone sets up a forward for list messages to another domain, as these
> now will get rejected by any domain that checks SPF.


This can be at least partially mitigated by appending ~all (SOFTFAIL) or
even ?all (NEUTRAL) to your SPF record.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From heller at deepsoft.com  Wed Sep 12 10:18:39 2018
From: heller at deepsoft.com (Robert Heller)
Date: Wed, 12 Sep 2018 10:18:39 -0400 (EDT)
Subject: [Mailman-Users] gmail
In-Reply-To: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
Message-ID: <20180912141839.1E84226C273F@sharky3.deepsoft.com>

At Tue, 11 Sep 2018 10:04:58 -0400 "Bernie Cosell" <bernie at fantasyfarm.com> wrote:

> 
> I've gotten buried by 80 bounce messages, thanks to gmail's new policy [that was, 
> apparently, put into effect yesterday].  The bounces say:
> 
> <.... at gmail.com>: host alt1.gmail-smtp-in.l.google.com[74.125.129.26] said:
>     421-4.7.0 This message does not have authentication information or fails to
>     pass 421-4.7.0 authentication checks. To best protect our users from spam,
>     the 421-4.7.0 message has been blocked. Please visit 421-4.7.0
>     https://support.google.com/mail/answer/81126#authentication for more
> 421- 4.7.0 information. 128-v6si11952705iti.109 - gsmtp (in reply to end of
> DATA command)
> 
> I looked at their 'answer' and mostly found it to be unhelpful.  i certainly can't get 
> any server anywhere to change their their system configuration, nor can I mess 
> with mailman [all suggestions about python-esque tweaks to mailman presume 
> that you have access to the server, which I don't].   Is there something I can do 
> [just as a list owner] to deal with this mess?

There is nothing you can do as a "list owner".  You will have to talk to your 
server's admin.  "He/She/They" *have* to implement *at least* SPF and DKIM.  
ALL legit outbound mail servers *have* to implement *at least* SPF and DKIM.

If your server's admin can't / won't do this, your only other option is to 
move your list to a different server.

> 
>   /Bernie\_
> 
> 
>                  Bernie Cosell
>          bernie at fantasyfarm.com
> -- Too many people; too few sheep --
> 
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe: https://mail.python.org/mailman/options/mailman-users/heller%40deepsoft.com
> 
>                 

-- 
Robert Heller             -- 978-544-6933
Deepwoods Software        -- Custom Software Services
http://www.deepsoft.com/  -- Linux Administration Services
heller at deepsoft.com       -- Webhosting Services
                                                                     

From brennan at columbia.edu  Wed Sep 12 10:27:02 2018
From: brennan at columbia.edu (Joseph Brennan)
Date: Wed, 12 Sep 2018 10:27:02 -0400
Subject: [Mailman-Users] gmail
In-Reply-To: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
Message-ID: <CAMSGcLDwrVzF3o2fQR8qPPhDZV+ohMmH7S0+hY00YzrxaX6JSw@mail.gmail.com>

I don't have a Mailman recommendation, but the situation is worth some
comment:

Notice Gmail "blocks" with a 4xx temp fail, for a message they will never
accept. That's a protocol violation. It's abusive.

I've been seeing the same temp fail abuse for some messages received from
Mailchimp and forwarded by our users to external addresses, and also a
message from princeton.edu forwarded through us to gmail. The fake temp
fails clutter up the mail queue and slow down queue runs. To cope, I've
started a separate queue runner to bounce on a short timeout for recipients
@gmail.

The 800 pound gorilla makes up its own rules.




On Tue, Sep 11, 2018 at 10:10 PM Bernie Cosell <bernie at fantasyfarm.com>
wrote:

> I've gotten buried by 80 bounce messages, thanks to gmail's new policy
> [that was,
> apparently, put into effect yesterday].  The bounces say:
>
> <.... at gmail.com>: host alt1.gmail-smtp-in.l.google.com[74.125.129.26]
> said:
>     421-4.7.0 This message does not have authentication information or
> fails to
>     pass 421-4.7.0 authentication checks. To best protect our users from
> spam,
>     the 421-4.7.0 message has been blocked. Please visit 421-4.7.0
>     https://support.google.com/mail/answer/81126#authentication for more
> 421- 4.7.0 information. 128-v6si11952705iti.109 - gsmtp (in reply to end of
> DATA command)
>
> I looked at their 'answer' and mostly found it to be unhelpful.  i
> certainly can't get
> any server anywhere to change their their system configuration, nor can I
> mess
> with mailman [all suggestions about python-esque tweaks to mailman presume
> that you have access to the server, which I don't].   Is there something I
> can do
> [just as a list owner] to deal with this mess?
>
>   /Bernie\_
>
>
>                  Bernie Cosell
>          bernie at fantasyfarm.com
> -- Too many people; too few sheep --
>
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives:
> http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe:
> https://mail.python.org/mailman/options/mailman-users/brennan%40columbia.edu
>


-- 
Joseph Brennan
Lead, Email and Systems Applications

From turnbull.stephen.fw at u.tsukuba.ac.jp  Wed Sep 12 21:35:05 2018
From: turnbull.stephen.fw at u.tsukuba.ac.jp (Stephen J. Turnbull)
Date: Thu, 13 Sep 2018 10:35:05 +0900
Subject: [Mailman-Users] gmail
In-Reply-To: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
Message-ID: <23449.48841.216797.453749@turnbull.sk.tsukuba.ac.jp>

Bernie Cosell writes:

 > I've gotten buried by 80 bounce messages, thanks to gmail's new
 > policy [that was, apparently, put into effect yesterday].  The
 > bounces say:

Can you provide more information about this, or are you deducing a new
policy from the sudden spate of bounces?  I ask because

 >     Please visit 421-4.7.0
 >     https://support.google.com/mail/answer/81126#authentication for more
 >     421- 4.7.0 information.
 > 
 > I looked at their 'answer' and mostly found it to be unhelpful.

That's at least partly because it's bog-standard best-practice advice,
and I see no evidence that anything in that document has changed
recently.

While it certainly could be a Google policy issue, this kind of thing
is known to be caused sometimes by several other factors (eliminate
any that just don't apply to you, of course):

1.  One (usually more for Google) of your list posts actually was spam
    or otherwise abusive.

2.  A group of your subscribers at Gmail took serious offense to
    something posted and reported to Gmail simultaneously.

3.  One or more users on another list served by your host did
    something remarkably abusive and the whole domain was marked as a
    bad/incompetent actor.

4.  A DNS-related snafu made it look like your whole IP block was
    transferred to a group full of abusers, even though nothing bad
    has happened in your own IP.

5.  4chan mischief.

6.  Having mentioned 4chan, let's go right off the deep and mention
    "Cozy Bear" and the ilk.  (That's a joke unless you're #natsec
    relevant, 4chan, unfortunately, while *very* unlikely is a
    possibility.)

1, 2, and 3 you can sometimes do something about, including getting in
touch with Google, reporting that "this happened", and explaining why
"it won't happen again" (in case 3, "not my list's fault").  Google is
awfully big and may not care about you, but miracles do happen and 10
minutes writing an email to them might work one.  YMMV, of course.

 > I certainly can't get any server anywhere to change their their
 > system configuration,

Of course you can, for values of "you" == "all you users of the
system."  Remember, if you are having a problem due to a change in
Google policy, most likely many others are as well.  If you are a
first reporter and do so in a measured tone, your credibility gets a
boost.  I don't deny that there are BOFHs and incompetent services out
there, and all I can advise about them is "move" (which may not be a
reasonable choice, YMMV).

Obviously this route is unlikely to get fast action; I'm recommending
it as an investment in the future.  As usual, YMMV.

Steve


From bernie at fantasyfarm.com  Wed Sep 12 22:15:51 2018
From: bernie at fantasyfarm.com (Bernie Cosell)
Date: Wed, 12 Sep 2018 22:15:51 -0400
Subject: [Mailman-Users] gmail
In-Reply-To: <23449.48841.216797.453749@turnbull.sk.tsukuba.ac.jp>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>,
 <23449.48841.216797.453749@turnbull.sk.tsukuba.ac.jp>
Message-ID: <5B99C857.19328.61F1D54B@bernie.fantasyfarm.com>

On 13 Sep 2018 at 10:35, Stephen J. Turnbull wrote:

> Bernie Cosell writes:
> 
>  > I've gotten buried by 80 bounce messages, thanks to gmail's new
>  > policy [that was, apparently, put into effect yesterday].  The
>  > bounces say:
> 
> Can you provide more information about this, or are you deducing a new
> policy from the sudden spate of bounces?  I ask because
> 
>  >     Please visit 421-4.7.0
>  >     https://support.google.com/mail/answer/81126#authentication for
> more
>  >     421- 4.7.0 information.
>  > 
>  > I looked at their 'answer' and mostly found it to be unhelpful.
> 
> That's at least partly because it's bog-standard best-practice advice,
> and I see no evidence that anything in that document has changed
> recently.

Well, something changed between Thursday and Friday, because posts to the list 
were fine and this one generated a bounce for every gmail member.

> 1.  One (usually more for Google) of your list posts actually was spam
>     or otherwise abusive.

I don't think that would get me an "authentication" complaint, would it?    But 
that hypothesis would make sense if through some oddity of google spam 
detection they decided a perfectly legitimate list message was spam and so 
bounced it.   It certainly wasn't abusive [although it was a [civil] complaint].
Also, I realized after Joseph enlightened me/us why it took until Monday for the 
Friday-post to bounce: google, in their wisdom, has issued a "temporary try 
again" error instead of a fatal [500] one.   My service provider kept trying for 
three days and I got the bounces when their queue runner timed out the message.

I understood that the error message was mostly normal SPF/DKIM bafflegab, 
but it appeared that none of the things it complained about were things under 
my control and I face the question: did google change their policy on all 
incoming email [easy for them to do!] or did my service provider break the DNS 
stuff for just our domain [out of the thousands of domains they host].  I asked 
here because i guessed the former was more likely [but I also submitted a trouble 
ticket to my service provider..:o)]

> 2.  A group of your subscribers at Gmail took serious offense to
>     something posted and reported to Gmail simultaneously.

Unlikely...   I'm the "postmaster" for the list and they'd have complained to me [as 
they have in the past].

> 3.  One or more users on another list served by your host did
>     something remarkably abusive and the whole domain was marked as a
>     bad/incompetent actor.

That is a possibility!!  I left my last service provide [just a month ago!] when it 
had managed to get banned by aol, comcast, oneand1, mindspring.com, 
netscape.net, optonline.net, roadrunner.com,  verizon.net and a  bunch of others.  
I would *hate* to have to be the tech at one of these mega-domain-service-hosts.  
They may have thousands of domains and who knows how many people passing 
mail through them, and all it takes is a few bad actors to get their IP block 
banned, and I know [having had to do this job at an ISP I worked at] it is 
annoying and often difficult to get it fixed.  [a credit where it is due: some of the 
RBL/blocking places allow you just to say "I'm the sysop at <IP> and I've fixed 
the problem, please let me go" and they do.  Others make it feel like they're doing 
you a huge favor to not blacklist you.

> 4.  A DNS-related snafu made it look like your whole IP block was
>     transferred to a group full of abusers, even though nothing bad
>     has happened in your own IP.

That's a possiblity -- I've contacted the ISP {as i mentioned} and although I've 
heard nothing, the problem *seems* to have been a one-shot [subsequent posts to 
the mialing list have not [yet] bounced from gmail] -- I'll know for sure in another 
two days...:o)]. 

> 1, 2, and 3 you can sometimes do something about, including getting in
> touch with Google, reporting that "this happened", and explaining why
> "it won't happen again" (in case 3, "not my list's fault").  Google is
> awfully big and may not care about you, but miracles do happen and 10
> minutes writing an email to them might work one.  YMMV, of course.

Is there any way to do this?  I have absolutely nothing to do with google [no 
accounts, no mailbox there, no google-apps, no hangouts, etc] but even from the 
google fanboys I correspond with I'm told that tech support is essentially 
nonexistent.   When I had a problem once, years ago, it took finding a friend of a 
friend who worked at google to email my question to..:o)

But enough on this, since it isn't a mailman problem [the only thing I kinda 
wondered is if there were some setting, akin to the DMARC settings, that might 
ameliorate this].   Thanks for all the info and with luck my service host has fixed 
up our DNS

 /Bernie\
            Bernie Cosell
       bernie at fantasyfarm.com
-- Too many people; too few sheep --
   




From johnl at taugh.com  Thu Sep 13 00:33:48 2018
From: johnl at taugh.com (John Levine)
Date: 13 Sep 2018 00:33:48 -0400
Subject: [Mailman-Users] gmail
In-Reply-To: <5B99C857.19328.61F1D54B@bernie.fantasyfarm.com>
Message-ID: <20180913043349.98689200448515@ary.qy>

In article <5B99C857.19328.61F1D54B at bernie.fantasyfarm.com> you write:
>Well, something changed between Thursday and Friday, because posts to the list 
>were fine and this one generated a bounce for every gmail member.

Any chance that the message in question had a From: address in a
domain that publishes a restrictive DMARC policy?  That can cause
bounces all over the place.

The usual suspects here are aol.com and yahoo.com, but a lot of
companies that believe (usually wrongly) that they have a problem
that DMARC can solve set DMARC policies, too.

R's,
John

From mark at msapiro.net  Thu Sep 13 01:21:44 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Wed, 12 Sep 2018 22:21:44 -0700
Subject: [Mailman-Users] gmail
In-Reply-To: <20180913043349.98689200448515@ary.qy>
References: <20180913043349.98689200448515@ary.qy>
Message-ID: <f38545d1-8a8e-43d1-493f-8beefb96ae27@msapiro.net>

On 09/12/2018 09:33 PM, John Levine wrote:
> In article <5B99C857.19328.61F1D54B at bernie.fantasyfarm.com> you write:
>> Well, something changed between Thursday and Friday, because posts to the list 
>> were fine and this one generated a bounce for every gmail member.


Has Gmail been bouncing all list posts or just this one.


> Any chance that the message in question had a From: address in a
> domain that publishes a restrictive DMARC policy?  That can cause
> bounces all over the place.


If just this one post, it could be a DMARC issue, although I think Gmail
gives a different reason for DMARC failures. Does your list apply any
DMARC mitigations? I.e. Privacy options... -> Sender filters ->
dmarc_moderation_action other than Accept.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From clarer1 at yahoo.co.uk  Thu Sep 13 05:45:51 2018
From: clarer1 at yahoo.co.uk (clarer1 at yahoo.co.uk)
Date: Thu, 13 Sep 2018 10:45:51 +0100
Subject: [Mailman-Users] Spoofed spam problem
Message-ID: <080101d44b46$8f5d5740$ae1805c0$@yahoo.co.uk>

Hello.

 

I have a discussion group so all members can post to the group. Most spam is
filtered out by Mailman. But I've just had a couple of spam messages get
through using, I assume spoofing, a member's address.

 

Spam spoofing a member's address is sometimes sent to the list but in years
of running this list, I've had very few that get through instead of being
held for moderation.

 

For the time being I've set this address to be moderated. I'm not always
able to deal with moderation queue promptly so is there something I can do
to catch these messages before they get through?

 

I'm not sure if I asked when a couple of spoofed messages made it through a
year ago and can't find anything in the archive. If I did ask before I'm
sorry for asking again.

 

Thanks for your help.

Clare


From raj at mischievous.us  Fri Sep 14 12:43:38 2018
From: raj at mischievous.us (Richard Johnson)
Date: Fri, 14 Sep 2018 09:43:38 -0700
Subject: [Mailman-Users] Question re. moving a mailing list
Message-ID: <6D6CF351-BE36-439E-A71D-934EA0D61ED8@mischievous.us>

I have my original test mailing list "testlist at mischievous.us".  I copied it to be "testlist at peacock.place" and then aliased "testlist" on mischievous.us to go to "testlist at peacock.place".  This works fine.  My "General Options" has "Munge From", so the From address always says "testlist at peacock.place", when peacock.place is sending out the messages.  This works fine.

My issue is that the mail sent out says:

From: testlist at peacock.place
To: testlist at mischievous.us
Cc: <original sender email>

such that when I do a Reply-all, I get a message addressed as:

To: testlist at peacock.place
Cc: testlist at mischievous.us

I notice that I don't seem to receive any duplicate messages.  Perhaps Mailman is taking care of that for me, which is great!  I had expected that my configuration in /usr/local/mailman/Mailman/mm_cfg.py of:

MTA = 'Postfix'
OWNERS_CAN_ENABLE_PERSONALIZATION = Yes
RCPT_BASE64_HEADER_NAME = 'X-My-Recip'
DEFAULT_EMAIL_HOST = 'peacock.place'
DEFAULT_URL_HOST = 'peacock.place'
add_virtualhost('mischievous.us', 'peacock.place')
add_virtualhost('peacock.place', 'peacock.place')
add_virtualhost('www.peacock.place', 'peacock.place')

would have maybe told it that "mischievous.us" is another way of sending to this same mailing list and thus it wouldn't include the CC, but maybe I'm missing something?

/raj


From linuxmailinglistsemail at gmail.com  Fri Sep 14 13:10:07 2018
From: linuxmailinglistsemail at gmail.com (Sean Son)
Date: Fri, 14 Sep 2018 13:10:07 -0400
Subject: [Mailman-Users] Setting up SSL Virtualhost for Mailman
In-Reply-To: <01cb01d44ab3$0001daf0$000590d0$@jimplumb.com>
References: <CAOKpjz-6T7f8CVW0=okbjN--763iOFBBS_eKZT+YHs1CSBvKFQ@mail.gmail.com>
 <a5c4f8f6-2806-19e2-219e-96d6a6ca3602@msapiro.net>
 <CAOKpjz_HQ1Hz_Ks83mQOkVTgJUSDMcUkwB2zNTW2UXKwrLrmGA@mail.gmail.com>
 <94a198af-78a8-8b08-6622-46aeb51fe61b@msapiro.net>
 <CAOKpjz_=+GMbr5MPnnsdyRZnhVTfYnkXyEe7R_EatVSqm6f-Sw@mail.gmail.com>
 <01cb01d44ab3$0001daf0$000590d0$@jimplumb.com>
Message-ID: <CAOKpjz9_cnzvuevmM451HdcKi_gntVk4X=hkGbo=AAtxn5sPdA@mail.gmail.com>

On Wed, Sep 12, 2018 at 12:09 PM, Jim Plumb <jim at jimplumb.com> wrote:

>
>
> -----Original Message-----
> From: Mailman-Users
> [mailto:mailman-users-bounces+jim=jimplumb.com at python.org] On Behalf Of
> Sean
> Son
> Sent: Tuesday, September 11, 2018 9:04 PM
> To: Mark Sapiro
> Cc: mailman-users at python.org
> Subject: Re: [Mailman-Users] Setting up SSL Virtualhost for Mailman
>
> On Tue, Sep 11, 2018 at 4:00 PM, Mark Sapiro <mark at msapiro.net> wrote:
>
> > On 09/11/2018 11:47 AM, Sean Son wrote:
> > >
> > > Thanks for the reply man. I want to require HTTPS for Mailman and all
> of
> > > its lists. I already have an SSL cert . I am running Apache as the
> > > webserver on RHEL 7.  I took a look at the FAQs on the Mailman site,
> > > regarding setting up SSL. It mentions that a virtual host can be set up
> > for
> > > HTTP to redirect to HTTPS, and a virtualhost can be set up for the
> HTTPS
> > > and mailman configured to only work on HTTPs.  It is the latter part,
> > > setting up the VirtualHost for HTTPS and configuring mailman to work
> only
> > > with HTTPs, which I am lost on.
> >
> > There are multiple ways to do this. It depends on whether you have other
> > virtual hosts and if so, if they should also be able to access mailman.
> >
> > In the simplest case, just put the various things for the mailman config
> > such as
> >
> > ScriptAlias /mailman/ /path/to/mailman/cgi-bin
> > Alias   /pipermail/  /path/to/mailman/archives/public/
> >
> > <Directory "/path/to/mailman/cgi-bin/">
> >     Options ExecCGI
> >     Require all granted
> > </Directory>
> >
> > <Directory "/path/to/mailman/archives/public">
> >     Options +FollowSymLinks
> >     Require all granted
> > </Directory>
> >
> > directly in the mailman https virtual host.
> >
> > --
> > Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
> > San Francisco Bay Area, California    better use your sense - B. Dylan
> > ------------------------------------------------------
> > Mailman-Users mailing list Mailman-Users at python.org
> > https://mail.python.org/mailman/listinfo/mailman-users
> > Mailman FAQ: http://wiki.list.org/x/AgA3
> > Security Policy: http://wiki.list.org/x/QIA9
> > Searchable Archives: http://www.mail-archive.com/
> > mailman-users%40python.org/
> > Unsubscribe: https://mail.python.org/mailman/options/mailman-users/
> > linuxmailinglistsemail%40gmail.com
> >
>
> So i got HTTPS to work on the main site, but now when I access the list
> archives, i see that they are still being accessed through HTTP and not
> HTTPS
>
> So I then ran this command:
>
> $prefix/bin/withlist -l -a -r fix_url
>
> and each of the lists were listed but the word "locked" appeared by each
> one of them.. After the command finished running and I restarted Mailman as
> well as Apache, I still see that the list archives are being accessed
> through HTTP and not HTTPS.  Any ideas on how I should resolve this? What
> does "locked" mean that appeared by each list name:
>
> /usr/lib/mailman/bin/withlist -l -a -r fix_url
> Importing fix_url...
> Running fix_url.fix_url()...
> Loading list list0 (locked)
> Saving list
> Loading list list1 (locked)
> Saving list
> Loading list list2 (locked)
> Saving list
> .
> .
> Finalizing
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/
> mailman-users%40python.org/
> Unsubscribe:
> https://mail.python.org/mailman/options/mailman-users/jim%40jimplumb.com
>
> From my experience in recently setting up Mailman with HTTPS you cannot use
> fix_url but instead add this setting to mm_cfg.py:
>
> DEFAULT_URL_PATTERN = 'https://%s/mailman/'
>
>
>
>

Thanks everyone! It worked!!

From mark at msapiro.net  Fri Sep 14 13:19:00 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Fri, 14 Sep 2018 10:19:00 -0700
Subject: [Mailman-Users] Question re. moving a mailing list
In-Reply-To: <6D6CF351-BE36-439E-A71D-934EA0D61ED8@mischievous.us>
References: <6D6CF351-BE36-439E-A71D-934EA0D61ED8@mischievous.us>
Message-ID: <e5609095-2b1a-cbc1-9126-cf106516305d@msapiro.net>

On 09/14/2018 09:43 AM, Richard Johnson wrote:
> 
> My issue is that the mail sent out says:
> 
> From: testlist at peacock.place
> To: testlist at mischievous.us
> Cc: <original sender email>
> 
> such that when I do a Reply-all, I get a message addressed as:
> 
> To: testlist at peacock.place
> Cc: testlist at mischievous.us


Right. Your original message was To: testlist at mischievous.us so when you
reply-all, your MUA includes that address in the recipients of the reply.


> I notice that I don't seem to receive any duplicate messages.  Perhaps Mailman is taking care of that for me, which is great!


Mailman is not doing that. Possibly something is dropping one of the
messages because of the duplicate Message-ID


> I had expected that my configuration in /usr/local/mailman/Mailman/mm_cfg.py of:
> 
> MTA = 'Postfix'
> OWNERS_CAN_ENABLE_PERSONALIZATION = Yes
> RCPT_BASE64_HEADER_NAME = 'X-My-Recip'
> DEFAULT_EMAIL_HOST = 'peacock.place'
> DEFAULT_URL_HOST = 'peacock.place'
> add_virtualhost('mischievous.us', 'peacock.place')
> add_virtualhost('peacock.place', 'peacock.place')
> add_virtualhost('www.peacock.place', 'peacock.place')
> 
> would have maybe told it that "mischievous.us" is another way of sending to this same mailing list and thus it wouldn't include the CC, but maybe I'm missing something?


What tells Mailman that "mischievous.us" is another way of sending to
this same mailing list is putting testlist at mischievous.us in Privacy
options... -> Recipient filters -> acceptable_aliases of the
testlist at peacock.place list.

Your add_virtualhost('mischievous.us', 'peacock.place') and
add_virtualhost('www.peacock.place', 'peacock.place') have nothing to do
with this.

However, as far as I can see, it is not Mailman putting
testlist at mischievous.us in the Cc: of your reply-all. It is your MUA.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From raj at mischievous.us  Fri Sep 14 14:00:47 2018
From: raj at mischievous.us (Richard Johnson)
Date: Fri, 14 Sep 2018 11:00:47 -0700
Subject: [Mailman-Users] Question re. moving a mailing list
In-Reply-To: <e5609095-2b1a-cbc1-9126-cf106516305d@msapiro.net>
References: <6D6CF351-BE36-439E-A71D-934EA0D61ED8@mischievous.us>
 <e5609095-2b1a-cbc1-9126-cf106516305d@msapiro.net>
Message-ID: <DA1812A3-5C23-4AD8-ACAE-A350B348F6FD@mischievous.us>

Ok, it looks as if specifying my "General Options" -> "Host name this list prefers for email" as "mischievous.us" will force the From address on all outgoing messages to say "testlist at mischievous.us".  Since that matches with the original To address, then a Reply-all will not produce two addresses.

I think this will work for me and then when I'm ready to really move totally over, I'll just change it.

Thanks for the help!

/raj


> On Sep 14, 2018, at 10:19 AM, Mark Sapiro <mark at msapiro.net> wrote:
> 
> On 09/14/2018 09:43 AM, Richard Johnson wrote:
>> 
>> My issue is that the mail sent out says:
>> 
>> From: testlist at peacock.place
>> To: testlist at mischievous.us
>> Cc: <original sender email>
>> 
>> such that when I do a Reply-all, I get a message addressed as:
>> 
>> To: testlist at peacock.place
>> Cc: testlist at mischievous.us
> 
> 
> Right. Your original message was To: testlist at mischievous.us so when you
> reply-all, your MUA includes that address in the recipients of the reply.
> 
> 
>> I notice that I don't seem to receive any duplicate messages.  Perhaps Mailman is taking care of that for me, which is great!
> 
> 
> Mailman is not doing that. Possibly something is dropping one of the
> messages because of the duplicate Message-ID
> 
> 
>> I had expected that my configuration in /usr/local/mailman/Mailman/mm_cfg.py of:
>> 
>> MTA = 'Postfix'
>> OWNERS_CAN_ENABLE_PERSONALIZATION = Yes
>> RCPT_BASE64_HEADER_NAME = 'X-My-Recip'
>> DEFAULT_EMAIL_HOST = 'peacock.place'
>> DEFAULT_URL_HOST = 'peacock.place'
>> add_virtualhost('mischievous.us', 'peacock.place')
>> add_virtualhost('peacock.place', 'peacock.place')
>> add_virtualhost('www.peacock.place', 'peacock.place')
>> 
>> would have maybe told it that "mischievous.us" is another way of sending to this same mailing list and thus it wouldn't include the CC, but maybe I'm missing something?
> 
> 
> What tells Mailman that "mischievous.us" is another way of sending to
> this same mailing list is putting testlist at mischievous.us in Privacy
> options... -> Recipient filters -> acceptable_aliases of the
> testlist at peacock.place list.
> 
> Your add_virtualhost('mischievous.us', 'peacock.place') and
> add_virtualhost('www.peacock.place', 'peacock.place') have nothing to do
> with this.
> 
> However, as far as I can see, it is not Mailman putting
> testlist at mischievous.us in the Cc: of your reply-all. It is your MUA.
> 
> -- 
> Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
> San Francisco Bay Area, California    better use your sense - B. Dylan
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe: https://mail.python.org/mailman/options/mailman-users/raj%40mischievous.us


From mark at msapiro.net  Fri Sep 14 16:40:16 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Fri, 14 Sep 2018 13:40:16 -0700
Subject: [Mailman-Users] Spoofed spam problem
In-Reply-To: <080101d44b46$8f5d5740$ae1805c0$@yahoo.co.uk>
References: <080101d44b46$8f5d5740$ae1805c0$@yahoo.co.uk>
Message-ID: <4950af5e-daa8-16bc-5864-ced8499db5c4@msapiro.net>

On 09/13/2018 02:45 AM, Clare via Mailman-Users wrote:
> 
> For the time being I've set this address to be moderated. I'm not always
> able to deal with moderation queue promptly so is there something I can do
> to catch these messages before they get through?


If I understand correctly, There is a single spammer posting to the list
by spoofing a member address and there are also legitimate posts from
the member.

If you can identify some constant information in the headers of the spam
posts that isn't in the member's posts, perhaps a domain in a Received:
header, you could make a Privacy options... -> Spam filters ->
header_filter_rules rule to match that and discard the spam.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From mailman at 16bits.net  Sat Sep 15 16:00:13 2018
From: mailman at 16bits.net (=?ISO-8859-1?Q?=C1ngel?=)
Date: Sat, 15 Sep 2018 22:00:13 +0200
Subject: [Mailman-Users] Spoofed spam problem
In-Reply-To: <080101d44b46$8f5d5740$ae1805c0$@yahoo.co.uk>
References: <080101d44b46$8f5d5740$ae1805c0$@yahoo.co.uk>
Message-ID: <1537041613.2121.9.camel@16bits.net>

On 2018-09-13 at 10:45 +0100, Clare via Mailman-Users wrote:
> For the time being I've set this address to be moderated. I'm not always
> able to deal with moderation queue promptly so is there something I can do
> to catch these messages before they get through?

Are you checking SPF?


Ideally,

a) the domain of your member publishes a SPF policy.
b) this policy is a FAIL one (ie. -all)
c) your members don't send emails violating their SPF policy (eg.
because it is malformed)
d) your mail server is checking SPF and rejecting spoofed emails


Then spoofed emails would be rejected before being delivered to mailman.

You may find that (b) is missing, that the domain is using a weaker SPF
policy, like SOFTFAIL, and at the same time you may not want to reject
anything with "just" a softfail. In this case, depending on how it is
logged (eg. authentication-results header), you can probably set a
mailman rule to filter the softfails for that domain at this mailman
list.

OTOH if they fail points (a) or (c) I feel it's ok to held their
messages for moderation until they (their provider) provides a proper
SPF policy allowing to tell legit and spoofed messages apart.

Best regards




From turnbull.stephen.fw at u.tsukuba.ac.jp  Sun Sep 16 04:36:15 2018
From: turnbull.stephen.fw at u.tsukuba.ac.jp (Stephen J. Turnbull)
Date: Sun, 16 Sep 2018 17:36:15 +0900
Subject: [Mailman-Users] gmail
In-Reply-To: <CAMSGcLDwrVzF3o2fQR8qPPhDZV+ohMmH7S0+hY00YzrxaX6JSw@mail.gmail.com>
References: <5B97CB8A.8731.5A2E53D3@bernie.fantasyfarm.com>
 <CAMSGcLDwrVzF3o2fQR8qPPhDZV+ohMmH7S0+hY00YzrxaX6JSw@mail.gmail.com>
Message-ID: <23454.5631.346230.941223@turnbull.sk.tsukuba.ac.jp>

Joseph Brennan writes:
 > I don't have a Mailman recommendation, but the situation is worth some
 > comment:
 > 
 > Notice Gmail "blocks" with a 4xx temp fail, for a message they will never
 > accept. That's a protocol violation. It's abusive.

This is unclear, and I lean to saying Google's interpretation is not a
protocol violation.  RFC 5321 gives a specific rule of thumb for this:

      It is difficult to assign a meaning to "transient" when two
      different sites (receiver- and sender-SMTP agents) must agree on
      the interpretation.  Each reply in this category might have a
      different time value, but the SMTP client SHOULD try again.  A
      rule of thumb to determine whether a reply fits into the 4yz or
      the 5yz category (see below) is that replies are 4yz if they can
      be successful if repeated without any change in command form or
      in properties of the sender or receiver (that is, the command is
      repeated identically and the receiver does not put up a new
      implementation).

I interpret that to mean that if fixing a broken sender-side DNS (an
SPF or DKIM record) would allow the message to pass a 4yz code is
justified.

I can't speak to other 4xx fails without knowing what they are.

It might be more useful to block with 5xx, but I don't think Google is
technically wrong on this, and they may have experience that says that
this is better.

Steve


From pshute at nuw.org.au  Sun Sep 16 10:44:40 2018
From: pshute at nuw.org.au (Peter Shute)
Date: Mon, 17 Sep 2018 00:44:40 +1000
Subject: [Mailman-Users] Unexpected unsubscription confirmation emails
Message-ID: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>

At least one member of our list has received an unexpected email from the list server requesting confirmation of unsubscription. It looks to me like someone has filled in this member's address on the unsubscription form on their behalf in an attempt to remove them from the list.

Is there any way for us to monitor these attempts?

Peter Shute

Sent from my iPad

From dmaziuk at bmrb.wisc.edu  Sun Sep 16 12:31:39 2018
From: dmaziuk at bmrb.wisc.edu (Dmitri Maziuk)
Date: Sun, 16 Sep 2018 11:31:39 -0500
Subject: [Mailman-Users] Unexpected unsubscription confirmation emails
In-Reply-To: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
References: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
Message-ID: <20180916113139.9cee2eae860e0d88c3c42a7a@bmrb.wisc.edu>

On Mon, 17 Sep 2018 00:44:40 +1000
Peter Shute <pshute at nuw.org.au> wrote:

> At least one member of our list has received an unexpected email from the list server requesting confirmation of unsubscription. It looks to me like someone has filled in this member's address on the unsubscription form on their behalf in an attempt to remove them from the list.
> 
> Is there any way for us to monitor these attempts?

Short answer is it should be in your webserver log if it came via the web interface.

-- 
Dmitri Maziuk <dmaziuk at bmrb.wisc.edu>

From pshute at nuw.org.au  Sun Sep 16 18:18:31 2018
From: pshute at nuw.org.au (Peter Shute)
Date: Mon, 17 Sep 2018 08:18:31 +1000
Subject: [Mailman-Users] Unexpected unsubscription confirmation emails
In-Reply-To: <20180916113139.9cee2eae860e0d88c3c42a7a@bmrb.wisc.edu>
References: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
 <20180916113139.9cee2eae860e0d88c3c42a7a@bmrb.wisc.edu>
Message-ID: <CAF-n9CPic8P_KytGP3XjSCPLpwaNzEx-gTF-wJ1PbqCjMUhMnw@mail.gmail.com>

Thanks. We'll have to ask the admin for those. We're on cpanel, and I
don't think we've got access ourselves.

On 17 September 2018 at 02:31, Dmitri Maziuk via Mailman-Users
<mailman-users at python.org> wrote:
> On Mon, 17 Sep 2018 00:44:40 +1000
> Peter Shute <pshute at nuw.org.au> wrote:
>
>> At least one member of our list has received an unexpected email from the list server requesting confirmation of unsubscription. It looks to me like someone has filled in this member's address on the unsubscription form on their behalf in an attempt to remove them from the list.
>>
>> Is there any way for us to monitor these attempts?
>
> Short answer is it should be in your webserver log if it came via the web interface.
>
> --
> Dmitri Maziuk <dmaziuk at bmrb.wisc.edu>
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe: https://mail.python.org/mailman/options/mailman-users/pshute%40nuw.org.au

From mark at msapiro.net  Sun Sep 16 18:48:08 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Sun, 16 Sep 2018 15:48:08 -0700
Subject: [Mailman-Users] Unexpected unsubscription confirmation emails
In-Reply-To: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
References: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
Message-ID: <f1d16ff6-22db-3986-b0cb-6ebc9dd2dce7@msapiro.net>

On 09/16/2018 07:44 AM, Peter Shute wrote:
> At least one member of our list has received an unexpected email from the list server requesting confirmation of unsubscription. It looks to me like someone has filled in this member's address on the unsubscription form on their behalf in an attempt to remove them from the list.


Or, if you have a personalized unsubscribe link in a list footer like
this list does, the list member replied to or forwarded a list post
without removing the quoted footer and a recipient clicked it
maliciously, inadvertently or thinking she was unsubscribing herself.


> Is there any way for us to monitor these attempts?


You could analyze your web server logs looking for POSTs to the list's
options page, however that won't show you the POST data so won't be too
useful.

Alternatively, you could modify the ConfirmUnsubscription method in
Mailman/MailList.py to log the event in addition to sending the
confirmation email, or perhaps more simply, change the lines

        msg = Message.UserNotification(
            addr, self.GetRequestEmail(cookie),
            text=text, lang=lang)

in that method to

        msg = Message.UserNotification(
            [addr, 'other at example.com'], self.GetRequestEmail(cookie),
            text=text, lang=lang)

to effectively Bcc: all such notices to other at example.com.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From turnbull.stephen.fw at u.tsukuba.ac.jp  Mon Sep 17 05:03:03 2018
From: turnbull.stephen.fw at u.tsukuba.ac.jp (Stephen J. Turnbull)
Date: Mon, 17 Sep 2018 18:03:03 +0900
Subject: [Mailman-Users] Unexpected unsubscription confirmation emails
In-Reply-To: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
References: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
Message-ID: <23455.28103.345193.227370@turnbull.sk.tsukuba.ac.jp>

Peter Shute writes:

 > At least one member of our list has received an unexpected email
 > from the list server requesting confirmation of unsubscription. It
 > looks to me like someone has filled in this member's address on the
 > unsubscription form on their behalf in an attempt to remove them
 > from the list.

If it was the web form, there will be traces in the webserver log.  As
Mark points out, the POST data won't be there, but you may be able to
correlate the webserver log with the origination time on the message
received by the user.

There are other possibilities.  The stock RFC 2369 headers provide a
mailto link, for one.  Somebody would have to use that deliberately,
though.  It's also possible personalize the list with an unsubscribe
link, as this one does.  Like this:

    https://mail.python.org/mailman/options/mailman-users/pobox%40example.com

A similar link is usually to be found in the List-Unsubscribe header
in received posts.  The common parts of the two would make a good grep
target in the webserver's log.  (Often the footer link is customized
to include the subscribed mailbox, while the List-Unsubscribe link
goes to the listinfo page, or vice versa.)

If so, it is a common occurance that people either forward the mail or
reply to it without trimming.  In many MUAs the link will be quoted,
but live, and people either accidentally click the link or
intentionally click the link expecting to unsubscribe themselves.

Either way, if this is an isolated incident, I wouldn't worry about
it, since it does occur reasonably frequently by accident.

Steve

From mdraft1 at gmail.com  Tue Sep 18 08:47:06 2018
From: mdraft1 at gmail.com (Matthew Draft)
Date: Tue, 18 Sep 2018 08:47:06 -0400
Subject: [Mailman-Users] help setting up mailman
Message-ID: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com>

Hi,
I'm new to mailman and could use some advise as far as setting up a new
listserv.  Do I need to rent server space to hold the list data?

Matt

From weif at weif.net  Wed Sep 19 11:36:13 2018
From: weif at weif.net (Keith Seyffarth)
Date: Wed, 19 Sep 2018 09:36:13 -0600
Subject: [Mailman-Users] help setting up mailman
In-Reply-To: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com> (message
 from Matthew Draft on Tue, 18 Sep 2018 08:47:06 -0400)
Message-ID: <841s9pqz2q.fsf@maxwell.cjones.org>

Matthew Draft <mdraft1 at gmail.com> writes:

> Hi,
> I'm new to mailman and could use some advise as far as setting up a new
> listserv.  Do I need to rent server space to hold the list data?

Probably. You will need some form of hosting or you will need a
dedicated IP and your own server that you can manage and keep up all the
time. Getting set up with hosting is probably easier. Many web hosting
providers include Mailman as a part of their package, which may make
this even easier.

Do you currently have a web site and a domain that this mailing list
would be relevant to?

Keith

-- 
----
from my mac to yours...

Keith Seyffarth
mailto:weif at weif.net
http://www.weif.net/ - Home of the First Tank Guide!
http://www.rpgcalendar.net/ - the Montana Role-Playing Calendar
----
http://www.miscon.org/ - Montana's Longest Running Science Fiction Convention

From cpz at tuunq.com  Wed Sep 19 11:35:55 2018
From: cpz at tuunq.com (Carl Zwanzig)
Date: Wed, 19 Sep 2018 08:35:55 -0700
Subject: [Mailman-Users] help setting up mailman
In-Reply-To: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com>
References: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com>
Message-ID: <a4247e7a-a68c-b52e-05fb-2abde5bd807a@tuunq.com>

Hello,

On 9/18/2018 5:47 AM, Matthew Draft wrote:
> I'm new to mailman and could use some advise as far as setting up a new
> listserv.  Do I need to rent server space to hold the list data?

It depends.... You can hire a setup from some ISPs which are ready to go, 
otherwise, you need a system to run mailman; that could be a VM, 
amazon-hosted instance, or a standalone machine. Have you looked at the 
mailman FAQ? (link in the message footer)

Also, 'listserv' is a name/trademark for a different mailing list manager (MLM).

Later,

z!

From jimpop at domainmail.org  Wed Sep 19 11:41:17 2018
From: jimpop at domainmail.org (Jim Popovitch)
Date: Wed, 19 Sep 2018 11:41:17 -0400
Subject: [Mailman-Users] help setting up mailman
In-Reply-To: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com>
References: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com>
Message-ID: <1537371677.2031.1.camel@domainmail.org>

On Tue, 2018-09-18 at 08:47 -0400, Matthew Draft wrote:
> Hi,
> I'm new to mailman and could use some advise as far as setting up a
> new listserv.??Do I need to rent server space to hold the list data?

Hi,

If you don't want to rent a server and install and maintain mailman, you
can find a list of Mailman hosting services here:

https://wiki.list.org/COM/Mailman%20hosting%20services


-Jim P.

From rmcclung at afilias.info  Wed Sep 19 11:36:03 2018
From: rmcclung at afilias.info (Ryan McClung)
Date: Wed, 19 Sep 2018 11:36:03 -0400
Subject: [Mailman-Users] help setting up mailman
In-Reply-To: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com>
References: <CA+c_VcY8qgcoq3-qouLbr7NM-MkonUqbzCVG2G0VKPiNKLqVSw@mail.gmail.com>
Message-ID: <CAH=cwAMVn0TQYN7dmNJ5f=LExLEFFAz7s3w8ofHX1mFVR8+QnQ@mail.gmail.com>

Hi Matthew,

I would strongly suggest having your own local storage space for this.
However, I would recommend reading the documentation pertaining to system
requirements before proceeding.

On Wed, Sep 19, 2018 at 11:26 AM Matthew Draft <mdraft1 at gmail.com> wrote:

> Hi,
> I'm new to mailman and could use some advise as far as setting up a new
> listserv.  Do I need to rent server space to hold the list data?
>
> Matt
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives:
> http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe:
> https://mail.python.org/mailman/options/mailman-users/rmcclung%40afilias.info
>


-- 

Ryan McClung
Systems Administrator @ Afilias Canada
A.  204-4141 Yonge Street, Toronto, ON, Canada, M2P 2A8
<https://maps.google.com/?q=4141+Yonge+Street,+Toronto,+ON,+Canada,+M2P+2A8&entry=gmail&source=g>
W. www.afilias.info
T.  +1.416.646.3304 x4186

From pshute at nuw.org.au  Wed Sep 19 22:54:39 2018
From: pshute at nuw.org.au (Peter Shute)
Date: Thu, 20 Sep 2018 12:54:39 +1000
Subject: [Mailman-Users] Unexpected unsubscription confirmation emails
In-Reply-To: <f1d16ff6-22db-3986-b0cb-6ebc9dd2dce7@msapiro.net>
References: <828EA23C-FB13-481A-B490-A6C1124EDD3C@nuw.org.au>
 <f1d16ff6-22db-3986-b0cb-6ebc9dd2dce7@msapiro.net>
Message-ID: <CAF-n9COv_oJW0abpWnGJt7r6jbKh7w_O3_tbs=mRYwhnM1vb4w@mail.gmail.com>

On 17 September 2018 at 08:48, Mark Sapiro <mark at msapiro.net> wrote:

> Or, if you have a personalized unsubscribe link in a list footer like
> this list does, the list member replied to or forwarded a list post
> without removing the quoted footer and a recipient clicked it
> maliciously, inadvertently or thinking she was unsubscribing herself.

No, it's not customised. I feel they must have followed the generic
link and entered someone else's address. It might have been some kind
of accident, but it coincides with a period where one member might
well have wanted this particular address off the list. Only one
unsubscription attempt was reported by members, but I'd like to check
if there were more that were ignored.

> You could analyze your web server logs looking for POSTs to the list's
> options page, however that won't show you the POST data so won't be too
> useful.

So that would let us see which ip address submitted the form, but not
what was on the form? As you can see, I still haven't got around to
finding out how to access the logs, and probably won't!

> Alternatively, you could modify the ConfirmUnsubscription method in
> Mailman/MailList.py to log the event in addition to sending the
> confirmation email, or perhaps more simply, change the lines

We don't have that kind of access.

From pascal.christen at hostpoint.ch  Thu Sep 20 04:54:33 2018
From: pascal.christen at hostpoint.ch (Pascal Christen)
Date: Thu, 20 Sep 2018 10:54:33 +0200
Subject: [Mailman-Users] User doesn't get added to mailinglist
Message-ID: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>

Hi

We have a problem since we updated from Mailman 2.1.27 -> 2.1.29
(FreeBSD). If we try to add an User on the Webgui "members/add" the Gui
says successfully added and in the logs we see this:

> logs/subscribe:Sep 20 10:04:59 2018 (20772) ugh_panteghini.ch: new
> shouldfail at pascalchristen.ch, admin mass sub

The user even get his confirmation mail with the password and link to
his account. But if he tries to log in it says he's not authorized:

> logs/mischief:Sep 20 10:09:48 2018 (33059) Login failure with private
> rosters: shouldfail at pascalchristen.ch from X.X.X.X

> logs/security:Sep 20 10:09:48 2018 (33059) Authorization failed
> (private): user=shouldfail at pascalchristen.ch: list=ugh_panteghini.ch:
> remote=X.X.X.X


And if I check it with the command line tool the user isn't added:

> ./list_members ugh_panteghini.ch
> ...
> shouldbeok at pascalchristen.ch
Sometimes we're able to add an user when we set the "Send notifications
about new registrations to the list owner?" to No. But it's like 50/50
if it works then or not.


Do you guys have any idea whats wrong?


Greetings Pascal


From mark at msapiro.net  Thu Sep 20 12:14:40 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Thu, 20 Sep 2018 09:14:40 -0700
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
Message-ID: <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>

On 09/20/2018 01:54 AM, Pascal Christen wrote:
> 
> We have a problem since we updated from Mailman 2.1.27 -> 2.1.29
> (FreeBSD). If we try to add an User on the Webgui "members/add" the Gui
> says successfully added and in the logs we see this:
...
> And if I check it with the command line tool the user isn't added:
...
> Sometimes we're able to add an user when we set the "Send notifications
> about new registrations to the list owner?" to No. But it's like 50/50
> if it works then or not.


Does the list owner get a notification if "Send notifications about new
registrations to the list owner?" is Yes?

Are users able to subscribe by other methods, e.g, from the listinfo
page or by email?

What's in Mailman's 'error' log?

Have you tried running Mailman's bin/check_perms?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From weif at weif.net  Thu Sep 20 16:28:08 2018
From: weif at weif.net (Keith Seyffarth)
Date: Thu, 20 Sep 2018 14:28:08 -0600
Subject: [Mailman-Users] changing domains on Mailman implementation
In-Reply-To: <5632510B.6090404@msapiro.net> (message from Mark Sapiro on Thu,
 29 Oct 2015 10:02:03 -0700)
Message-ID: <847ejfoqw7.fsf@maxwell.cjones.org>


Okay, so it took me long enough to get back to this (like, a month shy
of three years...). I am sure this will be of use to someone, maybe even
me in the future, so I wanted to make sure it was publicly documented
somewhere.

Anyway, to change the domain of a mailing list, when both domains are
hosted on the same server and the server is running PLESK Onyx:

1) In the PLESK admin, make sure that mailing lists are enabled for the
domain you are moving the mailing list to. This will add the
add_virtualhost line for the new domain to the mm_cfg.py file.

2) Go into the PSA database and update the MailLists table to change the
dom_id for the mailing list you are moving to the id of the new
subscription. This will take some looking around, or you can temporarily
create a dummy mailing list on the new domain so you can see what its
dom_id is.

3) run
/usr/lib/mailman/bin/withlist  -l -r fix_url listname --urlhost=the.new.web.domain

4) run
/usr/lib/mailman/bin/genaliases

5) In the PLESK admin, find the subscription you moved the mailing list
to, and go to Mail -> Mailing Lists
5)a) Click the name of the mailing list you just moved, uncheck the
"Switched On" checkbox, and click "OK."
5)b) Click on the name of the mailing list you just moved again, check
the "Switched On" checkbox, and click "OK."
This appears to reset the aliases and email addresses in the mail
configuration.

6) Restart your mail server (i.e. Postfix). This can either be done from
the PLESK services management window or from the command line.

7) Restart mailman from the command line with:
systemctl restart mailman

8) If you created a temporary mailing list before step 2, you can delete
that temporary mailing list now.



The mailing list should now be running on the new domain, and receiving
and relaying emails correctly.

Keith



-- 
----
from my mac to yours...

Keith Seyffarth
mailto:weif at weif.net
http://www.weif.net/ - Home of the First Tank Guide!
http://www.rpgcalendar.net/ - the Montana Role-Playing Calendar
----
http://www.miscon.org/ - Montana's Longest Running Science Fiction Convention

From pascal.christen at hostpoint.ch  Fri Sep 21 07:25:47 2018
From: pascal.christen at hostpoint.ch (Pascal Christen)
Date: Fri, 21 Sep 2018 13:25:47 +0200
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
Message-ID: <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>

Hi

> Does the list owner get a notification if "Send notifications about new
> registrations to the list owner?" is Yes?

No, just the new added user get an email with the subject: /"Welcome to
the "blabla" mailing list"./
Just if I set it to "No" the owner gets the mail with:
"blabla at pascalchristen.ch has been successfully subscribed to blabla.
(admin mass sub)"
//

> Are users able to subscribe by other methods, e.g, from the listinfo
> page or by email?
Yes no problem when subscribing from the listinfo.
> What's in Mailman's 'error' log?
Nothing...


> Have you tried running Mailman's bin/check_perms?
Yes without problems...


> Had some similar Problem where an sync_members Script was running as a crown job ... eliminating all new members every Minute ... 
Hmm nothing special there...and no special qrunner:

/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=ArchRunner:0:1 -s
/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=BounceRunner:0:1 -s
/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=CommandRunner:0:1 -s
/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=IncomingRunner:0:1 -s
/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=NewsRunner:0:1 -s
/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=OutgoingRunner:0:1 -s
/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=VirginRunner:0:1 -s
/usr/local/bin/python2.7 /usr/local/mailman/bin/qrunner --runner=RetryRunner:0:1 -s

Greetings Pascal



From martin at bittop.de  Thu Sep 20 13:59:49 2018
From: martin at bittop.de (=?utf-8?Q?Martin_N=C3=BCnning?=)
Date: Thu, 20 Sep 2018 19:59:49 +0200
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
Message-ID: <AEF66900-A2F9-4B35-91D9-7446840F1F1F@bittop.de>

HI Pascal,

Had some similar Problem where an sync_members Script was running as a crown job ... eliminating all new members every Minute ... 

Regards


> Am 20.09.2018 um 10:54 schrieb Pascal Christen <pascal.christen at hostpoint.ch>:
> 
> Hi
> 
> We have a problem since we updated from Mailman 2.1.27 -> 2.1.29
> (FreeBSD). If we try to add an User on the Webgui "members/add" the Gui
> says successfully added and in the logs we see this:
> 
>> logs/subscribe:Sep 20 10:04:59 2018 (20772) ugh_panteghini.ch: new
>> shouldfail at pascalchristen.ch, admin mass sub
> 
> The user even get his confirmation mail with the password and link to
> his account. But if he tries to log in it says he's not authorized:
> 
>> logs/mischief:Sep 20 10:09:48 2018 (33059) Login failure with private
>> rosters: shouldfail at pascalchristen.ch from X.X.X.X
> 
>> logs/security:Sep 20 10:09:48 2018 (33059) Authorization failed
>> (private): user=shouldfail at pascalchristen.ch: list=ugh_panteghini.ch:
>> remote=X.X.X.X
> 
> 
> And if I check it with the command line tool the user isn't added:
> 
>> ./list_members ugh_panteghini.ch
>> ...
>> shouldbeok at pascalchristen.ch
> Sometimes we're able to add an user when we set the "Send notifications
> about new registrations to the list owner?" to No. But it's like 50/50
> if it works then or not.
> 
> 
> Do you guys have any idea whats wrong?
> 
> 
> Greetings Pascal
> 
> ------------------------------------------------------
> Mailman-Users mailing list Mailman-Users at python.org
> https://mail.python.org/mailman/listinfo/mailman-users
> Mailman FAQ: http://wiki.list.org/x/AgA3
> Security Policy: http://wiki.list.org/x/QIA9
> Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
> Unsubscribe: https://mail.python.org/mailman/options/mailman-users/martin%40bittop.de


From mark at msapiro.net  Fri Sep 21 10:48:03 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Fri, 21 Sep 2018 07:48:03 -0700
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
 <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
Message-ID: <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>

On 9/21/18 4:25 AM, Pascal Christen wrote:
> 
>> Are users able to subscribe by other methods, e.g, from the listinfo
>> page or by email?
> Yes no problem when subscribing from the listinfo.
>> What's in Mailman's 'error' log?
> Nothing...


What's in Mailman's subscribe log? Is there an unsubscription?

What's in Mailman's bounce log? This should not happen, but possibly the
notice to the owner is bouncing and this is causing the unsubscription?

The only other thing I can think of is some exception is thrown causing
the updated list to not be saved, but that should be logged in the error
log.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From ted at frohling.org  Fri Sep 21 14:27:27 2018
From: ted at frohling.org (Ted Frohling)
Date: Fri, 21 Sep 2018 11:27:27 -0700
Subject: [Mailman-Users] can't approve/reject any messages
Message-ID: <20f59aaf-c5b1-4985-8488-d799cc2c89b4@frohling.org>

I have a couple of lists using mailman 2.1.20.  I recently updated the
web server software (apache 2) to redirect everything to HTTPS.  I did
something to break the approval process of messages, but can't find out
where I've made the mistake.  I've read, I think, all the available
documentation for using HTTPS with mailman.  I've looked at all the log
files for both apache and mailman, error, accesses, smtp, etc and can't
find any hint about what I've done wrong as nothing is showing up in
any of the logfiles.  When I use the admindb page for a list and click
on the accept radio and then click on the Submit All Data button, nothing
happens.

I've run check_perms as root and supplied the -f to fix any issues to no
effect.

If I view the page source all the form actions include https://...

So long story short, how can I find where the error is that is causing the
messages to continue to be unapproved and languish as held messages?

Thanks,

ted

-- 
   Ted Frohling (TF30-ARIN)                                520.499.1919
   www.frohling.org                             ted-at-frohling-dot-org
   Change the world one loan at a time - visit Kiva.org to find out how

From pascal.christen at hostpoint.ch  Sat Sep 22 10:41:33 2018
From: pascal.christen at hostpoint.ch (Pascal Christen)
Date: Sat, 22 Sep 2018 16:41:33 +0200
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
 <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
 <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>
Message-ID: <d2bd2a65-dbed-71be-ebdf-c4c44a065037@hostpoint.ch>

Hi

> What's in Mailman's subscribe log? Is there an unsubscription?
Nothing special. It just contains that the user got added my mass sub, nothing more. See my first mail on that topic where I pasted some log details

> The only other thing I can think of is some exception is thrown causing
> the updated list to not be saved, but that should be logged in the error
> log.
> What's in Mailman's bounce log? This should not happen, but possibly the
> notice to the owner is bouncing and this is causing the unsubscription?

Sadly there's nothing in these logs which match that time I subscribed the user. Will post all the logs I get when adding on Monday

Greeting Pascal




From mark at msapiro.net  Sat Sep 22 10:46:49 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Sat, 22 Sep 2018 07:46:49 -0700
Subject: [Mailman-Users] can't approve/reject any messages
In-Reply-To: <20f59aaf-c5b1-4985-8488-d799cc2c89b4@frohling.org>
References: <20f59aaf-c5b1-4985-8488-d799cc2c89b4@frohling.org>
Message-ID: <9d825a0d-f0d0-ff43-6ca1-43ef06ed29fe@msapiro.net>

On 9/21/18 11:27 AM, Ted Frohling wrote:
> 
> If I view the page source all the form actions include https://...


Normally, this issue is because the form actions are still http:// and
this is fixed by steps 2 and 3 at <https://wiki.list.org/x/17892007>,
but that doesn't seem to be the issue here.

There are some other things mentioned/linked at
<https://wiki.list.org/x/4030602>.

You have to look at your web server. Something is causing the POST data
from the form to be lost. Try enabling 'debugging' in your browser to
see the full interaction.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From mark at msapiro.net  Sat Sep 22 11:20:48 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Sat, 22 Sep 2018 08:20:48 -0700
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <d2bd2a65-dbed-71be-ebdf-c4c44a065037@hostpoint.ch>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
 <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
 <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>
 <d2bd2a65-dbed-71be-ebdf-c4c44a065037@hostpoint.ch>
Message-ID: <52b0abcd-f82e-24d2-c9f8-011f6fb2487c@msapiro.net>

On 9/22/18 7:41 AM, Pascal Christen wrote:
> 
>> The only other thing I can think of is some exception is thrown causing
>> the updated list to not be saved, but that should be logged in the error
>> log.
>> What's in Mailman's bounce log? This should not happen, but possibly the
>> notice to the owner is bouncing and this is causing the unsubscription?
> 
> Sadly there's nothing in these logs which match that time I subscribed the user. Will post all the logs I get when adding on Monday


When you submit the mass subscribe do you get a response that says
'successfully subscribed'?


-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From pascal.christen at hostpoint.ch  Sat Sep 22 11:27:55 2018
From: pascal.christen at hostpoint.ch (Pascal Christen)
Date: Sat, 22 Sep 2018 17:27:55 +0200
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <52b0abcd-f82e-24d2-c9f8-011f6fb2487c@msapiro.net>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
 <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
 <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>
 <d2bd2a65-dbed-71be-ebdf-c4c44a065037@hostpoint.ch>
 <52b0abcd-f82e-24d2-c9f8-011f6fb2487c@msapiro.net>
Message-ID: <b46ddff3-c4d6-e38f-5eca-f34fba76cace@hostpoint.ch>

Yes, on the GUI it got added successfully and even in the log it appears:

>/logs/subscribe:Sep 20 10:04:59 2018 (20772) ugh_panteghini.ch: new />/shouldfail at pascalchristen.ch
<https://mail.python.org/mailman/listinfo/mailman-users>, admin mass sub/


From mark at msapiro.net  Sun Sep 23 09:33:40 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Sun, 23 Sep 2018 06:33:40 -0700
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <b46ddff3-c4d6-e38f-5eca-f34fba76cace@hostpoint.ch>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
 <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
 <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>
 <d2bd2a65-dbed-71be-ebdf-c4c44a065037@hostpoint.ch>
 <52b0abcd-f82e-24d2-c9f8-011f6fb2487c@msapiro.net>
 <b46ddff3-c4d6-e38f-5eca-f34fba76cace@hostpoint.ch>
Message-ID: <6f7a9332-b22b-f0e1-c3a7-d78df88035a5@msapiro.net>

On 9/22/18 8:27 AM, Pascal Christen wrote:
> Yes, on the GUI it got added successfully and even in the log it appears:


I have one more idea.

When you upgraded, is it possible the older instance is still at least
partially there in a different path.

I.e., you actually have the list in two instances and mass subscribe
adds it to the one you aren't otherwise looking at?

What happens if you go to the web admin UI, mass subscribe the user and
then go to the Membership List? is the user there? I.e., is the web
admin UI you go to looking at a different instance of the list than the
other things are.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From pascal.christen at hostpoint.ch  Tue Sep 25 03:55:01 2018
From: pascal.christen at hostpoint.ch (Pascal Christen)
Date: Tue, 25 Sep 2018 09:55:01 +0200
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <6f7a9332-b22b-f0e1-c3a7-d78df88035a5@msapiro.net>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
 <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
 <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>
 <d2bd2a65-dbed-71be-ebdf-c4c44a065037@hostpoint.ch>
 <52b0abcd-f82e-24d2-c9f8-011f6fb2487c@msapiro.net>
 <b46ddff3-c4d6-e38f-5eca-f34fba76cace@hostpoint.ch>
 <6f7a9332-b22b-f0e1-c3a7-d78df88035a5@msapiro.net>
Message-ID: <a3feac0d-a7ec-ada5-1c0a-998efe8a851a@hostpoint.ch>

Hi

> When you upgraded, is it possible the older instance is still at least
> partially there in a different path.
You could be right. I got a bit deeper into this problem and I
discovered something: When I add an user with the mass subscription in
the GUI I see that the "testtest_pesc.xyz/config.pck" gets written with
the new user but half a second later it gets overwritten with the old
one. But at the moment I don't know why.

Our setup: 1 Mailman backend-Server (with all the qrunners - NFS mount
of /usr/local/mailman), 2 Webservers (NFS mount of /usr/local/mailman).
So all the systems are mounting the same Mailman data.

Do you have any ideas why this happens?

Greetings Pascal

From mark at msapiro.net  Tue Sep 25 10:44:20 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 25 Sep 2018 07:44:20 -0700
Subject: [Mailman-Users] User doesn't get added to mailinglist
In-Reply-To: <a3feac0d-a7ec-ada5-1c0a-998efe8a851a@hostpoint.ch>
References: <85025549-1251-40c7-4e6c-826f4d26fa2b@hostpoint.ch>
 <3f721b0a-c539-a19e-c5c8-f0743b9cf32c@msapiro.net>
 <45768f2d-96bd-ad1c-81d3-2f359ca5feeb@hostpoint.ch>
 <79d73ad9-1a00-86be-2250-9be06381f195@msapiro.net>
 <d2bd2a65-dbed-71be-ebdf-c4c44a065037@hostpoint.ch>
 <52b0abcd-f82e-24d2-c9f8-011f6fb2487c@msapiro.net>
 <b46ddff3-c4d6-e38f-5eca-f34fba76cace@hostpoint.ch>
 <6f7a9332-b22b-f0e1-c3a7-d78df88035a5@msapiro.net>
 <a3feac0d-a7ec-ada5-1c0a-998efe8a851a@hostpoint.ch>
Message-ID: <faa32cbb-8026-8227-9ec3-77a06e5771a4@msapiro.net>

On 9/25/18 12:55 AM, Pascal Christen wrote:
> 
> I got a bit deeper into this problem and I
> discovered something: When I add an user with the mass subscription in
> the GUI I see that the "testtest_pesc.xyz/config.pck" gets written with
> the new user but half a second later it gets overwritten with the old
> one. But at the moment I don't know why.
> 
> Our setup: 1 Mailman backend-Server (with all the qrunners - NFS mount
> of /usr/local/mailman), 2 Webservers (NFS mount of /usr/local/mailman).
> So all the systems are mounting the same Mailman data.


I think the scenario maybe something like this:

You submit the mass subscribe. This is forwarded to one of the web
servers which locks the list and and does the subscribe, updating the
config.pck. Meanwhile, something gets forwarded to another web server
which somehow manages to lock the list before it's updated and then save
the 'old' config.pck.

Locking is supposed to prevent this and is supposed to be NFS safe, but
possibly there is an issue here. See Mailman/LockFile.py.

I suggest careful examination of the web server logs and configs and
maybe also MTA logs and configs to see more about what's going on and in
what order things are happening.

I'm not familiar with NFS and what it logs, but it's logging may also be
useful if detailed enough.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

From dap1 at bellsouth.net  Wed Sep 26 09:33:27 2018
From: dap1 at bellsouth.net (Dennis Putnam)
Date: Wed, 26 Sep 2018 09:33:27 -0400
Subject: [Mailman-Users] Using REST API
Message-ID: <3e48e349-0094-2d15-ab24-831b7eac2f2e@bellsouth.net>

I am reading through the REST API documentation and cannot find a way to
obtain a list of all the email addresses to a specific list. Can someone
point me to the proper page? TIA.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: OpenPGP digital signature
URL: <http://mail.python.org/pipermail/mailman-users/attachments/20180926/7e317e56/attachment.sig>

From mark at msapiro.net  Wed Sep 26 10:25:31 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Wed, 26 Sep 2018 07:25:31 -0700
Subject: [Mailman-Users] Using REST API
In-Reply-To: <3e48e349-0094-2d15-ab24-831b7eac2f2e@bellsouth.net>
References: <3e48e349-0094-2d15-ab24-831b7eac2f2e@bellsouth.net>
Message-ID: <aec9d89b-f50f-7b77-c095-760d8025190f@msapiro.net>

On 9/26/18 6:33 AM, Dennis Putnam wrote:
> I am reading through the REST API documentation and cannot find a way to
> obtain a list of all the email addresses to a specific list. Can someone
> point me to the proper page? TIA.


<https://mailman.readthedocs.io/en/latest/src/mailman/rest/docs/membership.html#subscribers>

Also note that the focus of this list is Mailman 2.1. The corresponding
list for Mailman 3 is mailman-users at mailman3.org
<https://lists.mailman3.org/mailman3/lists/mailman-users at mailman3.org/>.


-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: OpenPGP digital signature
URL: <http://mail.python.org/pipermail/mailman-users/attachments/20180926/7b613b87/attachment.sig>

From dap1 at bellsouth.net  Wed Sep 26 11:14:06 2018
From: dap1 at bellsouth.net (Dennis Putnam)
Date: Wed, 26 Sep 2018 11:14:06 -0400
Subject: [Mailman-Users] Using REST API
In-Reply-To: <aec9d89b-f50f-7b77-c095-760d8025190f@msapiro.net>
References: <3e48e349-0094-2d15-ab24-831b7eac2f2e@bellsouth.net>
 <aec9d89b-f50f-7b77-c095-760d8025190f@msapiro.net>
Message-ID: <438c392f-e8bc-8c0e-47c9-44f2768db26b@bellsouth.net>

On 9/26/2018 10:25 AM, Mark Sapiro wrote:
> On 9/26/18 6:33 AM, Dennis Putnam wrote:
>> I am reading through the REST API documentation and cannot find a way to
>> obtain a list of all the email addresses to a specific list. Can someone
>> point me to the proper page? TIA.
>
> <https://mailman.readthedocs.io/en/latest/src/mailman/rest/docs/membership.html#subscribers>
>
> Also note that the focus of this list is Mailman 2.1. The corresponding
> list for Mailman 3 is mailman-users at mailman3.org
> <https://lists.mailman3.org/mailman3/lists/mailman-users at mailman3.org/>.
>

Hi Mark,

Thanks for the reply. I saw that page but it didn't seem to answer what
I was looking for so I thought I needed to look elsewhere. I guess I am
missing something basic. I don't see where I specify from which list I
want to retrieve members?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: OpenPGP digital signature
URL: <http://mail.python.org/pipermail/mailman-users/attachments/20180926/36cf8334/attachment.sig>

From mark at msapiro.net  Wed Sep 26 12:23:22 2018
From: mark at msapiro.net (Mark Sapiro)
Date: Wed, 26 Sep 2018 11:23:22 -0500
Subject: [Mailman-Users] Using REST API
In-Reply-To: <438c392f-e8bc-8c0e-47c9-44f2768db26b@bellsouth.net>
References: <3e48e349-0094-2d15-ab24-831b7eac2f2e@bellsouth.net>
 <aec9d89b-f50f-7b77-c095-760d8025190f@msapiro.net>
 <438c392f-e8bc-8c0e-47c9-44f2768db26b@bellsouth.net>
Message-ID: <4A9998F4-6884-4C86-9B63-F8684ECD290D@msapiro.net>

On September 26, 2018 10:14:06 AM CDT, Dennis Putnam <dap1 at bellsouth.net> wrote:
>
>Thanks for the reply. I saw that page but it didn't seem to answer what
>I was looking for so I thought I needed to look elsewhere. I guess I am
>missing something basic. I don't see where I specify from which list I
>want to retrieve members?


Scroll down to "We can also get just the members of a single mailing list."


-- 
Mark Sapiro <mark at msapiro.net>
Sent from my Not_an_iThing with standards compliant, open source software.

From dap1 at bellsouth.net  Wed Sep 26 13:08:15 2018
From: dap1 at bellsouth.net (Dennis Putnam)
Date: Wed, 26 Sep 2018 13:08:15 -0400
Subject: [Mailman-Users] Using REST API
In-Reply-To: <4A9998F4-6884-4C86-9B63-F8684ECD290D@msapiro.net>
References: <3e48e349-0094-2d15-ab24-831b7eac2f2e@bellsouth.net>
 <aec9d89b-f50f-7b77-c095-760d8025190f@msapiro.net>
 <438c392f-e8bc-8c0e-47c9-44f2768db26b@bellsouth.net>
 <4A9998F4-6884-4C86-9B63-F8684ECD290D@msapiro.net>
Message-ID: <3150f4bc-e7b1-1def-bfe6-253c4ab5a72d@bellsouth.net>

On 9/26/2018 12:23 PM, Mark Sapiro wrote:
> On September 26, 2018 10:14:06 AM CDT, Dennis Putnam <dap1 at bellsouth.net> wrote:
>> Thanks for the reply. I saw that page but it didn't seem to answer what
>> I was looking for so I thought I needed to look elsewhere. I guess I am
>> missing something basic. I don't see where I specify from which list I
>> want to retrieve members?
>
> Scroll down to "We can also get just the members of a single mailing list."
>
>
Hi Mark,

Sheesh! How did I miss that? Sorry.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: OpenPGP digital signature
URL: <http://mail.python.org/pipermail/mailman-users/attachments/20180926/5d65e48e/attachment.sig>