Search results for "Postorius" - Mailman-users

Re: One-click unsubscribe?

by Stephen J. Turnbull

Jered Floyd writes: > > As I discovered (to my chagrin) Mailman's current simple RFC > > 2369 List-Unsubscribe field doesn't, even for personalized lists where > > there might be a personalized link in the footer. > > My understanding from up-thread is that the RFC 2369 headers are > added pre-personalization. They are. It would also be trivial to personalize them; they just aren't. > If we add a timestamp to the encrypted token I suggest there should > be a pretty broad window allowed (i.e. several months). I guess it would be a matter of keeping 2 tokens in the database. > > Safety would suggest adding a random nonce and that would need to > > be saved in the database.) > > Do you just mean a salt? Or are you suggesting adding a > per-subscription nonce stored in the DB? (In which case, that could > simply be the URI token...) Per-subscription and it would be the URI token. > I agree with your analysis, but this would be a very specialized > attack, especially if we don't provide direct feedback on if the > request was successful (which we are not required to do). I think we do need to provide feedback, at least when the request fails due to an expired token. > I have trouble constructing a practical threat here I don't know if there's a practical threat. I don't think the known plaintext attack on the key is practical if we use a key dedicated to this purpose. You'd need at least a large university's collection of tokens, and what could you do with it that would be worth the effort? The DOS attack is practical if encryption is expensive enough. But storing the token would make that a single database lookup. > and I think the encrypted tuple, or a plaintext tuple and truncated > HMAC (like how SRS works) would be sufficient. Checking the encrypted tuple is cheaper and simpler. > The real risk without a per-subscription random unique identifier > would be a replay attack -- the user is unsubscribed multiple > times? That feels outside of the threat model. The identifier has to be unique to the subscription. If there are multiple valid unsubscriptions, the later ones won't have an existing subscription to unsubscribe. That does argue for the nonce -- that would stop the attack in the case where the user resubscribes. > > And you could combine the two strategies which would allow sites that > > don't use Postorius to configure the reverse proxy, while sites that > > do would get it for "free" since we'd configure Postorius to do it. > > I hadn't considered this -- I definitely like this approach because it > means the same function need not be implemented twice, differently. OK, that's part of the design we'll start with. > guess the big question is now just what the simplest content of the URI > should be. I think there should be just an opaque token plus an optional expiration date for sites paranoid enough to have a rotation policy for the keys. We need to do some thinking about how to implement "several months validity" in case of a sudden key change. The expiration date is irrelevant to the implementation of 8058, it's just for the benefit of the user (and data collection for how old the token is, I guess). This is shaping up pretty well, I think. > The Internet is an increasingly hostile place. True enough. > Regardless, not something we can do much about. There's hope. When Yahoo! and AOL broke the Internet in 2014 by setting p=reject DMARC policies, the Ministry of Education issued "administrative guidance" that *yahoo.* addresses should not be used for school business, and my university sent them all to spam. ;-) Including yahoo.jp which did not have a p=reject policy. -- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan

10 months

Re: Disable archives per list

by Bernd Wurst

Hello. Thank you for your answers. Am 25.02.21 um 22:01 schrieb Mark Sapiro: > Normally a list admin can select which of the enabled archivers is > active for that list via Postorius. To prevent this, you would have to > modify Postorius. It would be easy enough to just remove settings from > the relevant templates. This will take effect for all lists at once, I suppose. :( > I'm not sure what you mean by "custom archiver settings", but other than > enable/disable and public/private, probably not. Hyperkitty has a rather cool frontend but stores all messages from all lists together in one database table. Additionally, neither Mailman nor Hyperkitty seems to know or tell anything about archive sizes of a list. This is horribly for accounting. So I thought if I can have a separate hyperkitty installation per user without having to duplicate the whole mailman. Alternatively, I'd like to enable archiving only for some customers that buy a suitable plan. I did not really get into mailman plugins. Is is possible for plugins to hook into such settings? I could not really find examples for plugins. regards, Bernd

5 years, 7 months

Re: Question about lists and domains on Mailman 3

by Philip Colmer

On Wed, 29 Dec 2021 at 11:48, Jeff <mm3(a)steele.com> wrote: > I believe that you need to add "FILTER_VHOST = True” to your “settings.py" > Brilliant! Thank you, Jeff. > > > On Dec 29, 2021, at 5:11 AM, Philip Colmer <philip.colmer(a)linaro.org> > wrote: > > > > I've got a single server hosting multiple domains. I've got Apache > working > > as the proxy in front of MM3. > > > > Regardless of whether I go to https://lists.domainA.org/mailman3/lists/ > or > > https://lists.domainB.org/mailman3/lists/, Postorius lists ALL of the > lists > > across both domains. > > > > Is there a way of configuring the system so that, if a user goes to > "domain > > A", only the lists for that domain are listed? > > > > Thanks. > > > > Philip > > _______________________________________________ > > Mailman-users mailing list -- mailman-users(a)mailman3.org > > To unsubscribe send an email to mailman-users-leave(a)mailman3.org > > https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ > >

4 years, 9 months

Re: List Migration from MM2.1 -> MM3

by Odhiambo Washington

On Mon, Aug 15, 2022 at 7:57 PM Mark Sapiro <mark(a)msapiro.net> wrote: > On 8/15/22 7:28 AM, Odhiambo Washington wrote: > > On Mon, Aug 15, 2022 at 4:59 PM Mark Sapiro <mark(a)msapiro.net> wrote: > >> > >> Your /opt/mailman/mm/venv/bin/mailman is talking to a different Mailman > >> core than the one reading that mailman.cfg and the one Postorius is > >> talking to. > >> > > > > How can I track the one it's talking to? > > > Try `/opt/mailman/mm/venv/bin/mailman info` > So this command's output pointed to /opt/mailman/var/etc/mailman.cfg instead of my file that is in /opt/mailman/mm/mailman.cfg According to the HOWTO <https://wiki.list.org/DOC/Howto_Install_Mailman3_On_Debian10> I am following, mailman.cfg should be in /opt/mailman/mm/. Now I am wondering what I am missing again. Did something change? Should I place all my config files in /opt/mailman/var/etc/ instead of /opt/mailman/mm/ ? -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)

4 years, 1 month

Re: MIMEDefang to fix footers

by Mark Sapiro

On 11/13/20 9:51 AM, Ryan Morash wrote: > Does anyone know how to use MIMEDefang to fix the footer as attachment issue when using Mailman3? I've seen several guides/scripts referring to its use with Mailman2, but I'm unsure of how they would match with Mailman 3. I don't use MIMEDefang and don't specifically recommend it, but I have looked at <https://stuff.mit.edu/~jik/software/mailman_mimedefang/>, and it seems that the only Mailman specific things involved in the installation and configuration of this script are the addition of the "MAILMAN_MIMEDEFANG" lines as the first and last lines of the footer template. The only thing Mailman 3 specific in that is how to edit the footer template. This can be done on a per-list basis via Postorius since 1.2.0 or more directly in Mailman core by setting URIs, see <https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/rest/docs/…> or by creating templates in Mailman's var/templates directory, see <https://gitlab.com/mailman/mailman/-/blob/master/src/mailman/utilities/i18n…>. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

5 years, 10 months

Re: Mailman 3 installation documentation

by Terri Oda

Hurrah! I'm very excited about these updates. :) On October 6, 2019 8:17:15 p.m. PDT, Abhilash Raj <maxking(a)asynchronous.in> wrote: >Hi All, > >I have been trying to work on revamping the documentation site we have >at https://docs.mailman3.org. It is on https:// but I am not sure why >the http->https redirect doesn't work in Readthedocs. I have set it to >"serve always from https". > >Anyway, it might not look too different right now, but there are some >small re-organizations. I have been learning some new ReST and Sphinx >tricks and been trying to cross-reference and link various sections and >settings. The docs site shows up Mailman's logo now (I didn't even know >we could do that ;-). > >There is a place[1] for all supported Django settings that Postorius >and Hyperkitty have. I am also planning to add some common Django >settings that often people have to lookup and is not fun for people >from non-python backgrounds. Hopefully, it will make lives easier for >administrators. > >I have reverted my own stupid decision to use "sudo pip3 install" in >the docs to instead use virtualenv. The installation docs are going to >grow to be more comprehensive. > >I am also working on mailman-web project[3], which should simply >installation process for all the web components using a single project >and provide better guidance on Django's settings file management and >howto run manage.py commands. > >I have added a `mailman-web` command, which, for those of you familiar >with internal details of Django, is going to be our custom manage.py >script. It sets up settings correctly and would hopefully reduce the >pain of using `django-admin` and/or finding out the right path for >`manage.py` script. It is still not ready for prime time, but it is >usable. Early adopters can play with it if they like! > > >I would really appreciate if people who have tried to manually install >Mailman 3 in the past would share their experiences about what they >think could be documented better. You can reply here or open an >issue[2]. > >The user documentation are going to follow, hopefully soon :) > > >[1]: >https://docs.mailman3.org/en/latest/config-web.html#configure-postorius-hyp… >[2]: https://gitlab.com/mailman/mailman-suite-doc/issues >[3]: https://gitlab.com/mailman/mailman-web > >-- > thanks, > Abhilash Raj (maxking) >_______________________________________________ >Mailman-users mailing list -- mailman-users(a)mailman3.org >To unsubscribe send an email to mailman-users-leave(a)mailman3.org >https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/

7 years

Re: very few moderation capabilities for moderators

by Guillermo Hernandez (Oldno7)

On 16/9/21 16:40, Mark Sapiro wrote: > On 9/16/21 2:39 AM, Guillermo Hernandez (Oldno7) via Mailman-users wrote: >> Hi all: >> >> I need to provide the list moderators a way to change the moderation >> flag for users from whichever it is (normally "list default >> processing") to "hold for moderation" and viceversa (to "list >> default" or to "accept") >> >> I understand that it could be done via console script (That's the way >> I did on mailman2: I made two commands using "withlist", one to hold, >> moderar.py, and other one to accept, desmoderar.py. I show you below) > > > Are you asking what the equivalent MM 3 scripts would be? > More or less: I'm asking for a general direction here. I think I cannot use tthe "withlist" method as before, inside a python script, and I'm not sure how to do it. I've been reviewing all the command docs that I've found, but I have no clear way. I need a shell or a python script that I can pass the list and the mail address to put on hold/hold (that way the moderators can log in a special account thhat asks for the address to hold/unhold). I did it in mailman2 whith the bin/withlist command, but now whithlist seems to be an alias for shell and is interactive.Thats not my goal) > >> But I think I'm not the only one that could use as an improvement a >> way to do this on postorius/web. > > > Postorius allows a list owner or site admin to set Moderation for list > members and non members at e.g. > https://www.example.com/mailman3/lists/list.example.com/members/(non)member/. Yes, I know that. But the owner cannot be 24/7 attending the lists (as we all know), and could need a help hand from moderators. Not just from accepting mails on hold, but to put on hold a member (and be capable of reversing it) when the netiquete dissapears completely and some thread becomes a flame and all goes south. I'ts the admin capability I miss the most for moderators in mailman. > Currently, a list moderator who is not an owner cannot do this, but a > moderator can set Moderation for the sender of a held post when > handling the post. But I'm talking about a moderator can put a member mails in hold when it is marked to accept. To prevent putting more gas in the fire. > >

5 years

Re: mailman admin (django) interface does not work anymore after deleting website example.com

by Torge Riedel

Am 10.03.19 um 16:44 schrieb Mark Sapiro: > On 3/10/19 8:18 AM, Torge Riedel wrote: >> I deleted the existing "example.com" and added a new one >> "lists.mydomain.de". >> >> Now the admin (django) interface always gives "An error occurred while >> processing your request". After one of the first navigation clicks I saw >> a message that "site with id 1 is missing". > > In your Django settings your have > > SITE_ID = 1 > > which pointed to the example.com domain you deleted. > > You need to override this in settings_local.py. Probably > > SITE_ID = 2 > > but if that doesn't work, try '0' > Ah, thank you Mark. That makes a kind of sense. I changed the database directly to fix it. And renamed example.com to lists.mydomain.de. Now the error is gone. I'm wondering why the initial database set up of postorius (?) adds "example.com". Is there a way to directly add my domain instead? Somewhere in settings_local.py?

7 years, 6 months

New messages not being archived

by Sarah H

I have 2 active lists that are properly mailing out and working, plus an admin testing list that is as well. The list info pane correctly shows the mail volume and the imported archives from the previous 2.1 installation are present for both active lists. None of the 3 lists are generating new entries in the archive, all 3 are set up with default settings except 1 active and admin are set to private. I know that hyperkitty is showing some new content as admin was created in postorius and the list is present in hyperkitty and working in mailman. None of the logs show anything of note, mailmanweb.log has no new entries since it caused a serious issue when I changed the domain, uwsgi-error is the same and uwsgi.log has proper access logs. When trying to add a new thread via the hyperkitty interface I can see the email go through the maillog, I get the email with the entered content and everything else works, it just doesn't add a new thread to the archive. The installation is set up with the default settings from the virtualenv installation guide. Any assistance would be appreciated.

5 years, 3 months

Re: duplicate SITE_IDs and broken /postorius/lists/ display; Mailman Client

by Stanisław Findeisen

On Thu, Mar 24, 2022 at 09:27:06PM -0700, Mark Sapiro wrote: > The issue is client.create_domain doesn't support setting a Web Host. Web Hosts are the sites in the django_site table and SITE_ID is the id of > the table entry. See `sites` in the Django admin UI. > > So when you create a domain with client.create_domain it gets arbitrarily assigned to a `site` Ok thanks, this is good to know. How about mailing list creation using Mailman Client, like this? domains = client.domains domains = list(filter(lambda x: (domain_name == x.mail_host), domains)) # .. check if domains is a singleton list .. domain1 = domains[0] domain1.create_list(list_name, style_name=style_name) Do you know of any quirks/deficiencies related to this kind of code? This code is taken from mailman3-utils: https://github.com/sfindeisen/mailman3-utils , a set of scripts I stitched together to facilitate common Mailman3 operations on the command-line. Most importantly this can apply the (currently hardcoded) set of list settings uniformly across the different lists (and different domains). (I realize part of this overlaps with the mailman command, especially in the local setting.) Thanks Stanisław

4 years, 6 months

Mailman-users search results for query "Postorius"