On 1/3/25 5:44 PM, Mark Sapiro wrote:
Greetings. On a system running Mailman 3.3.9 and Postfix, I'm seeing about 20-30 entries per day in the Postfix queue where it appears a Gmail user signs up for a mailing list that requires confirmation, and Gmail responds that the user is too busy to handle requests.
There are no publicly advertised email lists on this server, and I don't ever see anything in the Mailman logs indicating the user ever tried signing up.
This is an attack mail bombing the user. The requests that result in the can come via web or email. Mailman's logging of subscribes has been missing most events through Mailman 3.3.10. See https://gitlab.com/ mailman/mailman/-/issues/1143 which will be fixed in 3.3.11, but subscribes waiting user confirmation still won't be logged.
However, the message with subject "Please Confirm Your Email Address" comes from Django allauth so it isn't actually Mailman sending it but rather Django allauth as a result of a request to sign up for a Django account at https://mail.example3.com/accounts/signup/. You can probably find that request in your web server logs, and you may find the user and/or email in the Django admin UI.
Thanks VERY much for this.
No such users in the Django UI, but the web server logs have 252 attempts from 132 unique IPv4 addresses registered to different ISPs throughout Europe.
So, even though Mailman support for more detailed logging of sub and unsub requests would be useful, it likely would not have helped with attacks from many source IP addresses.
Since django-mailman3 1.3.6, you can disable these signups by putting
ACCOUNT_ADAPTER = 'django_mailman3.views.user_adapter.DisableSignupAdapter'
in your Django settings, but then your users won't be able to sign up for web accounts.
I have made this change. As for not having web accounts, this just means new users cannot sign up to manage their Mailman settings, correct? I presume existing web accounts will continue to work.
Thanks again!
dn