Steve Lindemann wrote: > Dragon wrote: >> Steve Lindemann sent the message below at 14:43 4/3/2008: >>> Dragon wrote: >>>> Steve Lindemann sent the message below at 12:18 4/3/2008: >>>>> The problem - when the list email address is (spoofed) in the From: line >>>>> (as well as being on the To: line) the message posts to the list. The >>>>> ability to post to the list is supposed to be restricted to only list >>>>> members. The list address is not in the list of list members. >>>>> >>>>> Is this normal? I checked the config and there did see anything to >>>>> allow this behavior there. Is the list email address automatically >>>>> considered to be a member of the list? I can always block it in >>>>> "privacy options->sender filters", but should that even be necessary? >>>>> Help! >>>> ---------------- End original message. --------------------- >>>> This seemed rather strange to me too so I decided to test it on my >>>> server. I have 2.1.10b3 installed from source on a Redhat machine. >>>> My list is configured for posts from non-members to be discarded. >>>> I sent a message to one of my lists using the list address in the >>>> From: header. The message was discarded as I expected it would be >>>> and I confirmed this by an entry in the vette log. >>>> So it works on my installation as I expect it would. The question >>>> now is, what is the difference between my source install and your >>>> installation. Are you using a cPanel or Plesk version, or a version >>>> installed from somebody else's package maybe through yum or something >>>> similar? >>>> Are you certain that the message was distributed via the list? >>>> Is it in the list archive? >>>> Can you match the message ID to one in the post log? >>>> If you can see it in the archive and post log then it did get >>>> processed through mailman. If not, perhaps it was BCC'ed to your >>>> address or there is something else going on with your MTA. >>>> Dragon >>> I'm running version 2.1.9, installed from a tarball on a Dell server >>> running CentOS 5. I administer from the command line and thru the >>> web interface. It's a pretty basic install. >> Now when you say it's from a tarball, is it a binary install or did >> you compile it (configure, make, make install, etc.)? >> >> Where did you obtain this version? >> >> If it isn't from one of the links on the page linked below, it may >> have been altered in some way by somebody else to conform to some >> distribution specific criteria. >> >> http://www.gnu.org/software/mailman/mailman.html >> >> >>> I went thru the logs and saw the message hit our email server >>> (originally from 5850-260-1-62.dialup.samtel.ru), it gets passed to >>> mailman and I see the post entry showing it's arrival into mailman >>> then then smtp entry showing it's delivery back to the email >>> server. I confirmed the delivery to the 144 recipients (fortunately >>> this is a small list) in the mail log. I am one of the recipients >>> on this list, but in my case spamassassin flagged the message and it >>> gets filtered away. >>> >>> I just widened my search thru the mailman logs and noticed some >>> other lists (in the vette log) holding messages for moderation with >>> the list email in the From: line. So it does appear to be something >>> in this specific list that's misconfigured. I'm off to poke around >>> the config again but I'd be very interested in any suggestions about >>> what I might be looking for!? My first pass thru the config I was >>> looking for something that would allow this to happen and didn't see it. >> If this is a stock install from the mailman source, I've pretty much >> exhausted my ideas. The only settings I know that should affect the >> ability to deliver an e-mail are: >> >> accept_these_nonmembers >> generic_nonmember_action >> header_filter_rules >> >> I've looked through all the other options and don't see anything >> there that would possibly allow something through. The only other >> thing I can think of is that this mail might have been held and >> accidentally accepted or it might have been sent with an Approved: >> header with the list or site password. >> >> Dragon > > acquired the software with: > wget > http://openwebmail.org/openwebmail/download/release/openwebmail-2.52.tar.gz > > followed by many wget's of required perl modules and such > and installed the lot. I recall rounds of configure,make,make test,make > install for the perl modules. I don't recall doing that for the > openwebmail, I do remember "./openwebmail-tool.pl --init" after some > config file changes.
OOPS... never mind that. My notes only say I went to the mailman website and downloaded mailman-2.1.9.tgz... from there the notes get more involved but it boils down to: unpacked it, went thru the make/make install routine, ended up with a working copy. I really need to pay attention to which question I working on... I was also dealing with an openwebmail issue at the same time (not much of an excuse but it's all I have 8^) ...sorry for the confusion!! > I'll check those specific settings. > > If the message had been held I should have seen an entry for it in the > vette log and there wasn't one. I checked the message header for an > Approved line and (fortunately) didn't find it. I'd be very > "disappointed" to find that password in a message header. > > I'll keep poking at this end. I'd love to hear any other ideas... > -- > Steve ------------------------------------------------------ Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org Security Policy: http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq01.027.htp
