- Mailman-users - lists.mailman3.org

Hosting
by mail＠peterowens.com.au Sept. 5, 2021

Sept. 5, 2021

Hi Does anyone know of a server provider offering Mailman3 hosting in Australia? Or a reliable provider OS thanks Peter

2 2

New vulnerability in Hyperkitty master branch
by Abhilash Raj Sept. 5, 2021

Sept. 5, 2021

Hey Everyone, A new vulnerability was reported against Hyperkitty’s git master branch branch which can expose the archives of a private Mailing List through the new Feeds API that was added to Hyperkitty recently to someone who isn't a member or logged-in. Thanks to Ngo Wei Lin for reporting this vulnerability. This bug does not affect any stable released version of Hyperkitty and only affects installations from source (1.3.5b1 version). To differentiate from the vulnerable version, I have bumped the version in master branch to 1.3.5b2, so if you have 1.3.5b1 installed, you should upgrade! The fix for this bug has been committed to master branch[1][2] less than an hour ago as of this writing. If you are using git branches to install Hyperkitty, you can upgrade using the following command: $ pip install --upgrade git+https://gitlab.com/mailman/hyperkitty@master I have also triggered a build for Mailman container images[3] with this changes, so if you are using the rolling container images (which are the only affected ones), then you should upgrade to the latest one when the build[1] finishes (approximately in next 30mins). Do note that this version of rolling release of mailman-web image also includes the fix for the vulnerability announced against Postoruis earlier today. You can verify that you have the fixed version of Hyperkitty in the image by running: $ docker run -it --entrypoint bash maxking/mailman-web:rolling bash-5.0# pip list | grep HyperKitty HyperKitty 1.3.5b2 Ensure that you get 1.3.5b2 version. [1]: https://gitlab.com/mailman/hyperkitty/-/merge_requests/362 [2]: https://gitlab.com/mailman/hyperkitty/-/commit/ed086015acbf66ba377e2af7f6e7… [3]: https://github.com/maxking/docker-mailman/runs/3519658592 -- thanks, Abhilash Raj (maxking)

1 0

CVE-2021-40347: New security release for Postorius
by Abhilash Raj Sept. 5, 2021

Sept. 5, 2021

Everyone, A security vulnerability was reported against Postorius recently which allows any logged-in user to unsubscribe any other member on any other list on same Mailman installation using a specially crafted POST request due to a missing ownership check. This has been assigned CVE-2021-40347. This affects all past versions of Postorius including 1.0.0. Thanks to Kunal Mehta for the security report and a quick patch to fix the vulnerability. I am also attaching a minimal patch that fixes it along with this email, without tests and NEWS so that it applies to older versions of Postorius easily (I have tested the included patch with 1.3.3, 1.3.2 git tags). Upgrading to 1.3.5 release is highly recommended and it mostly includes the fix for this vulnerability (and a small compatibility fix for django-mailman3 1.3.6) so it shouldn’t introduce any other bugs. You can upgrade to this release by running: $ pip install postorius==1.3.5 A full change log is available here[1] as usual and can be downloaded from PyPI[2]. [1]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-5 [2]: https://pypi.org/project/postorius/1.3.5/ Since there aren't many changes, this release requires 3.5+ like 1.3.4. Although, note that the next release will drop support for 3.5 and will support 3.6 only. For those of you who use container images, I am working on 0.3.12 of container images right now, so look out for that announcement. For those of you using the rolling releases, you can already upgrade to the latest version of the rolling release as it has the fix. -- thanks, Abhilash Raj (maxking)

1 0

domain owner role
by Rainer Herbst Sept. 1, 2021

Sept. 1, 2021

Dear all, recently, I have added one account to a domain as domain owner. I did expect the new owner to see all lists in that domain in Postorius, but he sees no list at all. Is this the way it should be? How can I add administrators able to perform administrative tasks on all lists in Postorius? Viele Grüße, Rainer Herbst Leiter IT-Service Phone: +49 331 7499-257 e-mail: rainer.herbst(a)aip.de https://www.aip.de ----------------------------------------------------------------------------------------------- Leibniz-Institut für Astrophysik Potsdam (AIP) An der Sternwarte 16, 14482 Potsdam Vorstand: Prof. Dr. Matthias Steinmetz, Wolfram Rosenbach Stiftung bürgerlichen Rechts Stiftungsverzeichnis Brandenburg: 26 742-00/7026 -----------------------------------------------------------------------------------------------

2 1

How to increase maximum size of the message in mailman
by Shashikanth Komandoor Aug. 31, 2021

Aug. 31, 2021

Hi Team, I am currently running Mailman 3 with version 3.3.1 and in-built postfix version 2.10.1-6 on RHEL 7.5 with PostgreSQL 11.7 version with default values. I am almost running 2200 lists with 128 GB RAM and 24 Cores on a single VM and on which all the mailman 3 components are running. I have been running this setup in production for the past 2 years and 6 months. I have recently encountered a scenario where a user sent mail with a PPT attachment to one of the lists on the said mailman server. The mail is received by postfix on the mailman server and is handed over to mailman at *0.0.0.0:8024 <http://0.0.0.0:8024>.* But the /var/log/maillog says the below error during the above hand shake. *status=bounced (host 0.0.0.0[0.0.0.0] said: 552 Error: Too much mail data* I have browsed google for understanding and fixing the issue. During which I encountered the information given by Mr. Mark Sapio at https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/…. But I could not fix the issue as it is mentioned the default size limit is 33554432. I request someone to suggest where I can customize the value 33554432 and put a higher value or can be configured without any limit. I have configured message_size_limit as 100MB at postfix level. I would like to configure, in fact, the same at mailman level too. But I don't understand where to edit. I tried editing the variable DATA_SIZE_DEFAULT value in /var/lib/mailman/mailman/.tox/py36-nocov/lib/python3.6/site-packages/aiosmtpd/smtp.py file but unfortunately no luck. So, could someone please help us in this regard ? Also, please also let me know if there is any limitation specific for the attachments so that I can customize that too respectively. -- Thanks & Regards, Shashi Kanth.K 9052671936

3 2

how to become member of mailman-users list
by Shashikanth Komandoor Aug. 31, 2021

Aug. 31, 2021

Hi Team, One of my colleagues is trying to become a member of the mailman-users list but she is not able to become so even after sending multiple emails to the list. Could someone suggest this ? -- Thanks & Regards, Shashi Kanth.K 9052671936

2 2

Question about message bounce stats
by Ruth Ivimey-Cook Aug. 30, 2021

Aug. 30, 2021

When I used Mailgun some time back, it had a feature of, for any specific outgoing mailing, being able to show you stats and other details of which mails were received ok, which bounced, and which were undeliverable, which I found helpful to check every so often. Their system also kept track of long-term trends, eg for addresses that frequently failed. Does Mailman3 keep such stats, and if so is there any way to get access to them, even if only API? I would think it useful to do so (and yes, for individual outgoing messages at least for a period). Regards, Ruth -- Tel: 01223 414180 Blog: http://www.ivimey.org/blog LinkedIn: http://uk.linkedin.com/in/ruthivimeycook/

5 9

auto-away notices as bounces
by Andreas Barth Aug. 30, 2021

Aug. 30, 2021

Hi, I had a user complaint that his subscription was disabled. Looking into details, his mail provider sent out lots of auto aways notices marked with Auto-Submitted: auto-replied (vacation) Should we not exclude these as being counted as bounce? (List settings are "Individual" for "Personalize" and yes for both "Include RFC2369 headers" and "Include the list post header". Regards, Andi

3 6

(nagios-)Monitoring for mailman3?
by Andreas Barth Aug. 29, 2021

Aug. 29, 2021

Hi together, does anyone have a sensible nagios monitoring for mailman3? (I had the issue that after a data base restart mailman3 was somehow disturbed but the basic web interface was still available, just the detailed pages like .../lists/$listid/ showed the error) Andi

2 1

Logging subscriptions and unsubscriptions
by Christian Schoepplein Aug. 28, 2021

Aug. 28, 2021

Hi, I am in the process to migrate from mailman 2 to mailman 3 and currently I am setting up the new environment and do some tests and play around with the new system. I'd like to have a seperate log for list subscriptions and unsubscriptions. For that reason I added the following section to the mailman-extra.cfg file: [logging.subscribe] path: subscribe.log That created a file called subscribe.log but not everything regarding subscription / unsubscriptions is added to the file. When subscribing and unsubscribing a user via mail only the following line is shown: Aug 27 10:58:31 2021 (28) tmod(a)mm3.example.com: held subscription request from chris(a)example.com Nothing regarding the finished subscription and absolutely nothing regarding the unsubscription performed later. Also in mailman.log I can find the following lines: Aug 27 10:58:05 2021 (28) deque: do_confirm_verify Traceback (most recent call last): File "/usr/lib/python3.8/site-packages/mailman/app/workflow.py", line 69, in __next__ return step() File "/usr/lib/python3.8/site-packages/mailman/app/subscriptions.py", line 356, in _step_send_confirmation raise StopIteration StopIteration Aug 27 10:58:31 2021 (28) deque: subscribe_from_restored Traceback (most recent call last): File "/usr/lib/python3.8/site-packages/mailman/app/workflow.py", line 69, in __next__ return step() File "/usr/lib/python3.8/site-packages/mailman/app/subscriptions.py", line 326, in _step_get_moderator_approval raise StopIteration StopIteration Aug 27 10:58:33 2021 (29) OWNER: <163005471133.28.13827351997075408419@mailman-core> Is this because a higher logging level or is this an error? I can find nothing really helpfull regarding subscriptions and unsubscriptions in any logfile. Is this wanted or can this changed by any configuration setting or are this information stored in the database? Cheers, Schoepp

2 1