Search results for "Postorius" - Mailman-users

Can creating too many Django accounts crash Mailman3 server?

by Mohsen Masoudfar

Hi, It seems anybody can go to the site: https://LISTSERVNAME/mailman3/postorius/lists/ and click on the [Sign up] on the top-right corner and create an account. This can easily be automated, even though the next step, confirming the email address, being ignored. I believe it can be used as a target for a DOS attack by creating so many accounts, that eventually causes an 'out of space' error. Is this a justified concern? Is there a way to manage this feature in a secure way? Best regards Mohsen Masoudfar Lead System Analyst, IT Operation American Association for the Advancement of Science 1200 New York Ave, NW, Washington, DC 20005 202-326-7087

5 years, 10 months

Permissions issue after upgrade of virtualenv

by Odhiambo Washington

Ola, So I installed a new virtualenv using Python3.11, kept all settings intact, copied /opt/mailman/mmvar from the old virtualenv to the new one. Trying to access Postorius, I am greeted with this error: Thu Mar 09 22:17:59.313459 2023] [core:error] [pid 15655] (13)Permission denied: [client 197.232.xx.xx:26574] AH00035: access to / denied (filesystem path '/opt/mailman/mm') because search permissions are missing on a component of the path, referer: https://mm3-lists.kictanet.or.ke/ I did not change Apache config and I made sure that /opt/mailman is all owned by mailman:mailman. What am I missing? -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)

3 years, 5 months

Re: Mailman3 without Hyperkitty in docker

by Abhilash Raj

Test email to check something, please ignore. Abhilash On Fri, Mar 1, 2019, at 5:19 PM, Abhilash Raj wrote: > > > On Thu, Feb 28, 2019, at 10:18 PM, Danil Smirnov wrote: >> Hi Abhilash, >> >> Thank you very much - the previous error is fixed now. >> >> But I have another one now, which causes the same 500 Server Error: >> >> bash-4.3# cat /opt/mailman-web-data/logs/uwsgi-error.log >> *** Starting uWSGI 2.0.18 (64bit) on [Fri Mar 1 05:42:09 2019] *** >> compiled with version: 6.3.0 on 01 March 2019 01:52:42 >> os: Linux-3.10.0-693.11.1.el7.x86_64 #1 SMP Mon Dec 4 23:52:40 UTC 2017 >> nodename: mailman-web >> machine: x86_64 >> clock source: unix >> detected number of CPU cores: 2 >> current working directory: /opt/mailman-web >> detected binary path: /usr/local/bin/uwsgi >> !!! no internal routing support, rebuild with pcre support !!! >> setgid() to 101 >> setuid() to 100 >> chdir() to /opt/mailman-web >> your memory page size is 4096 bytes >> detected max file descriptor number: 1048576 >> building mime-types dictionary from file /etc/mime.types...1168 entry found >> lock engine: pthread robust mutexes >> thunder lock: disabled (you can enable it with --thunder-lock) >> uwsgi socket 0 bound to TCP address 0.0.0.0:8080 fd 8 >> uwsgi socket 1 bound to TCP address 0.0.0.0:8000 fd 9 >> Python version: 3.6.8 (default, Jan 30 2019, 23:58:16) [GCC 6.3.0] >> Python main interpreter initialized at 0x55a2df7f57e0 >> python threads support enabled >> your server socket listen backlog is limited to 100 connections >> your mercy for graceful operations on workers is 60 seconds >> mapped 166752 bytes (162 KB) for 2 cores >> *** Operational MODE: threaded *** >> Traceback (most recent call last): >> File "/usr/local/lib/python3.6/site-packages/django/utils/module_loading.py", line 20, in import_string >> return getattr(module, class_name) >> AttributeError: module 'django.contrib.auth.middleware' has no attribute 'SessionAuthenticationMiddleware' >> >> The above exception was the direct cause of the following exception: >> >> Traceback (most recent call last): >> File "wsgi.py", line 38, in <module> >> application = get_wsgi_application() >> File "/usr/local/lib/python3.6/site-packages/django/core/wsgi.py", line 13, in get_wsgi_application >> return WSGIHandler() >> File "/usr/local/lib/python3.6/site-packages/django/core/handlers/wsgi.py", line 136, in __init__ >> self.load_middleware() >> File "/usr/local/lib/python3.6/site-packages/django/core/handlers/base.py", line 34, in load_middleware >> middleware = import_string(middleware_path) >> File "/usr/local/lib/python3.6/site-packages/django/utils/module_loading.py", line 24, in import_string >> ) from err >> ImportError: Module "django.contrib.auth.middleware" does not define a "SessionAuthenticationMiddleware" attribute/class >> unable to load app 0 (mountpoint='') (callable not found or import error) >> *** no app loaded. going in full dynamic mode *** >> *** uWSGI is running in multiple interpreter mode *** >> spawned uWSGI master process (pid: 1) >> spawned uWSGI worker 1 (pid: 37, cores: 2) >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> --- no python application found, check your startup logs for errors --- >> >> As per my investigation, this error possibly caused by Django upgrade: >> >> *The SessionAuthenticationMiddleware class is removed. It provided no functionality since session authentication is unconditionally enabled in Django 1.10.* >> >> See https://docs.djangoproject.com/en/2.0/releases/2.0/ >> >> After I've removed the line >> https://github.com/maxking/docker-mailman/blob/master/postorius/mailman-web… >> from settings.py, the container is finally working. >> >> I've placed PR in github: >> https://github.com/maxking/docker-mailman/pull/314 > > Thank you for your contributions! > > I have merged your pull request and it should now be out (hopefully!). > >> >> Thank you for your help. >> >> Danil >> >> >> пт, 1 мар. 2019 г. в 04:33, Abhilash Raj <maxking(a)asynchronous.in>: >>> >>> >>> On Thu, Feb 28, 2019, at 5:19 PM, Abhilash Raj wrote: >>> > On February 27, 2019 11:53:34 PM PST, Danil Smirnov <danil(a)smirnov.la> wrote: >>> > >Hi Mark, >>> > > >>> > >Actually all this stuff happens inside the container after it's started >>> > >and >>> > >initialized without errors. I didn't amend the image anyhow. >>> > > >>> > >Also I have the configuration based on docker-compose.yaml provided in >>> > >the >>> > >repository which works just fine for mailman-web image. >>> > > >>> > >The very same config with postorius image (+ UWSGI_STATIC_MAP param) >>> > >fails >>> > >with 500 error... >>> > > >>> > >Now answering your questions: >>> > > >>> > >ср, 27 февр. 2019 г., 22:56 Mark Sapiro <mark(a)msapiro.net>: >>> > > >>> > >> do you have django-q in INSTALLED_APPS in your Django settings and >>> > >what >>> > >> is set for Q_CLUSTER? >>> > >> >>> > > >>> > >I've checked settings.py inside the container and I haven't found any >>> > >of >>> > >the mentioned configurations there. >>> > > >>> > >Does the manage.py that's being run here point to the right >>> > >settings.py? >>> > >> >>> > > >>> > >No clue. >>> > > >>> > >Also I wonder why we have some Hyperkitty-related cronjobs in non-HK >>> > >configured image? >>> > > >>> > >https://github.com/maxking/docker-mailman/blob/master/postorius/mailman-web… >>> > >>> > Because I am a dum dum ;-) >>> > >>> > Will work on removing those crons and stuff. Would be nice if you >>> > opened an issue on Github so that I don't forget. >>> >>> Should now be fixed in the latest image. >>> >>> > >>> > >Danil >>> > > >>> > > >>> > > >>> > >> -- >>> > >> Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, >>> > >> San Francisco Bay Area, California better use your sense - B. >>> > >Dylan >>> > >> _______________________________________________ >>> > >> Mailman-users mailing list -- mailman-users(a)mailman3.org >>> > >> To unsubscribe send an email to mailman-users-leave(a)mailman3.org >>> > >> https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ >>> > >> >>> > >_______________________________________________ >>> > >Mailman-users mailing list -- mailman-users(a)mailman3.org >>> > >To unsubscribe send an email to mailman-users-leave(a)mailman3.org >>> > >https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ >>> > >>> > >>> > -- >>> > Sent from my Android device with K-9 Mail. Please excuse my brevity. >>> >>> -- >>> thanks, >>> Abhilash Raj (maxking) > > -- > thanks, > Abhilash Raj (maxking) > > -- thanks, Abhilash Raj (maxking)

7 years, 5 months

Re: Converting discussion list to read-only list (settings)

by Mark Sapiro

On 10/12/19 8:55 PM, Paul Arenson wrote: > I have found that my users in the discussion list are creating their own topics rather than using the existing ones, so decided to make it a read-only list and use WordPress moderated comments. Since I do not have the original settings for READ ONLY (this is a hosted version), I want to make sure that these are correct. Can someone comment. I'm guessing what you want and what you are saying First, I think you are saying your issue is that your users are using HyperKitty as a web forum and when replying to a message in an existing thread instead of using the 'reply' action on that message, they use the Start a new thread button. Is that really what you are saying? > MOST IMPORTANT—> What setting makes it a discussion list as opposed to read only? If by "read only" you mean the "Announce only mailing list style" as opposed to the "Ordinary discussion mailing list style" the only difference is that for the Announce only style the list attribute allow_list_posts is False and for the Discussion style, it's True. This is the setting in Postorius -> Settings -> Alter Messages -> Include the list post header an all it does is include or not include the List-Post: header in mail from the list. > ALTER MESSAGES > ----------------------- > Filter content Now YES > > Collapse Alternatives Now yes > > Convert html to plain text Now NO Above are not relevant. > Anonymous NOW YES Are you sure you want this. What it does is replace the From: address with the list posting address and removes all other headers that could aid in identifying the poster. It is intended for lists discussing things such as domestic abuse where people may want to be able to post anonymously. > Include RFC2369 headers Now Yes OK, but not relevant > Include the list post header Now Yes This is what the announce style will set to No. > Reply Goes to List Now No munging > > Pipeline Default > > > > DMARC MITIFGATIONS > ----------------------- > > Replace From with list address > > DMARC mitigate unconditionally Now NO > > > MESSAGE ACCEPTANCE > ----------------------- > > Require Explicit Destination Yes > > Administrivia YES The above are OK, but again not relevan to what I think you're asking. > > Default action to take when a member posts to the list Hold for moderation > > > Default action to take when a member posts to the list Hold for moderation Basically these two settings will hold all posts for moderator action, however if the user has a moderation setting other thgan list default, they won't apply. > OTHER? See the FAQ at <https://wiki.list.org/x/4030685>. This is written for Mailman 2.1 and older and some of the settings aren't relevant or exactly the same in Mailman 3, but it may help. On the other hand, if I'm not understanding what you want, please clarify. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

6 years, 9 months

Re: Using REST with CLI using curl .... help needed

by kontakt＠michaelbakonyi.de

Hey everyone, I have the same usecase as Krešimir and tried the example of Mark. So in mailman.cfg I set hostname to "https://lists.mydomain.org" and then fire this command curl -urestadmin:mypw --referer https://lists.mydomain.org --request POST -H 'Content-Type: application/json' --data-binary '{"list_id": "thelist.lists.mydomain.org", "subscriber": "user(a)example.net", "display_name": "Joe User", "pre_verified": true, "pre_confirmed": true, "pre_approved": true}' https://lists.mydomain.org/mailman3/postorius/lists/thelist.lists.mydomain.… But then I get a CSRF-warning. Do I now have to get the token and put it in my POST or is there an easier way to do this? cheers, Michael

3 years, 11 months

Re: Moderator e-mails only going out once a day

by Mark Sapiro

On 3/26/25 12:52 AM, jkoral(a)luc.edu wrote: > Mark, thank you for your reply. I did not mention it, but that is already set and we are still having an issue. Is there anything in the setting I can check? Also, I changed the name of the e-mail in the settings and restarted the mailman3 service. Does anything else need to be restarted? Assuming admin_immed_notify is True (Postorius Admin immed notify is Yes), the notice should be sent. Check Mailman's mailman.log and your MTA logs for clues. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 year, 4 months

Re: Mailman 3 Status Update Please?

by Abhilash Raj

Hi David, On Thu, Jul 20, 2017, at 12:47 PM, ddw David Wilson wrote: > Mailman 3 Status Update Please > > I have been following the progress and difficulties with great interest > as many struggle to implement the new version of the great Mailman 3 > list-server software. Last year about this time I posed some questions > regarding the current development status and recognize that many > additional problems seem to get in the way of actually working on long > term big picture issues. > > From my perspective of being an senior (ie overaged) person desirous of > implementing fully-featured, capable, scalable, reliable, secure > applications such as Mailman, I am convinced that I am thoroughly over > my head. > > From my limited perspective, it would seem to me that a 'nice to have' > system would incorporate the following. > > 1. An open container standard configurable system install, compatible > with different web & mail servers, DB utilities, etc; This already exists as of today, there are some open bugs and issues but nothing that would prevent you from using it right now. You can follow the documentation for the container images here[1] and look at the issues on the corresponding Github project. It should be compatible with major web & mail server and databases. [1]: https://asynchronous.in/docker-mailman/ > 2. Python 3 version Django utilities for archiving and mail list name > management; This is in the Roadmap and on high priority now that we have Mailman 3.1 out. > 3. A design/plan from an inside expert perspective stating costs, time > and resources to implement the plan, incorporating crowdfunding to > pay for project. > 4. As a backup incentive to the crowdfunding plan might be the offer of > an expert to set up a system for each significant amount donated, > say US$1,000, such as might be accomplished by an SSL session on the > target computer/server after the user has specified all necessary > detail as required in a template. AFAIK the Core developers aren't providing any services for Mailman 3 as of now. > > I am sure that the program author and other major contributors could > greatly enhance this list. > > In summary, I guess what I am requesting is an overview forecast by half > year period and out for the next two years? > > Please share the big picture? There are some TODO items that we have talked about but they aren't set as hard goals with deadlines. Most important of it is adding more features to Postorius (the Web Frontend) so as to accomplish everything one would want to interact with Mailman Core. One missing feature of the top of my head is the customizing the template. Fixing the upgrade path from Mailman 2 is another important issue. Other changes have more to do with the quality of code and probably more robust testing of the different components. Another important thing would be to have more user documentation for different management related tasks, like a List Administrator Manual. Apart from this, I can't think anything more as of now. Others might step in if they feel there is something missing in the list. -- thanks, Abhilash Raj

9 years

Re: Verification links to localhost

by Odhiambo Washington

On Sun, Feb 5, 2023 at 2:16 PM Lars Bjørndal <lars(a)lamasti.net> wrote: > Hi! > > You wrote: > > > On Sun, Feb 5, 2023 at 10:23 AM Lars Bjørndal <[1]lars(a)lamasti.net> > wrote: > > > > Hi, and than you for your quick reply! > > > > You wrote: > > > > > On Sun, Feb 5, 2023 at 9:51 AM Lars Bjørndal <[1][2] > lars(a)lamasti.net> > > wrote: > > > > > > The verification link I get back when trying to add an account, > > referes > > > to localhost, e.g. > > > > > > To confirm this is correct, go to [2][3] > https://localhost:8000/ > > accounts/ > > > confirm-email/Mw:1... > > > > > > Where do I change that? > > > > > > > > > What do you have as POSTORIUS_TEMPLATE_BASE_URL value in settings? > > > > I don't have this variable anywhere in /etc/mailman3. However, I > found it > > here: > > > > ./venv/lib/python3.10/site-packages/mailman_web/settings/ > > mailman.py:POSTORIUS_TEMPLATE_BASE_URL = '[4]http://localhost:8000' > > > > In which config file should that variable be set, and how do I set > it so > > that mailman can works for multiple domains? > > > > > > Because it is still too early in your quest to get to run Mailman3, I'd > advise > > that you take your time to follow this guide: > > [5]https://docs.mailman3.org/en/latest/install/virtualenv.html# > > > It is the official installation guide. > > Yes, I've followed it, maybe with some errors. > > > There is a step where it tells you to create a file named settings.py, > in a > > particular path. You really need that step. > > Yes, I have the file /etc/mailman3/settings.py, but in that file, I didn't > have the variable in question. > Oh, in that case, it does not appear in settings.py. I have followed that guide, but I always login to the /admin UI to create a site (and a mail domain tied to a site) before I create my lists. Perhaps that's why I haven't encountered the problem you are seeing. > > > Regarding your question about multiple domains, that is already well > taken care > > of when you create a list either via Postorius or the cli: > > (venv) [mailman@gw /opt/mailman]$mailman create [6]list1(a)domain1.name > > (venv) [mailman@gw /opt/mailman]$mailman create [7] > another-lis(a)domain2.name > > > > Mailman will know how to handle this in conjunction with your MTA. > > That's right. But, still, when I set the SITE_ID = 0, I get an server > error when trying to connect. I also get mail from Django that states the > error. I'm not sure how to fix it. > How many sites did you create already? IIRC, this SITE_ID = 0 should be accompanied with FILTER_VHOST = True -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)

3 years, 6 months

Re: Can't remove footer(s)

by Henrik Rasmussen

Mark Sapiro wrote: > The templates named list_member_digest_footer.txt and > list_member_regular_footer.txt (with underscores) were created by > import21 and set as the URIs for those templates. Had you just copied > /dev/null (or otherwise made empty) those files and done nothing else, > that would have done what you wanted, but since you deleted the template > URIs for the list, the template names are now the default How do I make these not default? > list:member:digest:footer.txt and list:member:regular:footer.txt names > (with colons) and those are the empty files you need to create. Or when I upgrade to V3.2.2 will I be able to just empty the templates in /postorius/lists/LISTNAME/templates? Henrik

7 years, 9 months

Re: Held messages showing a reason not in English on the Postorious

by Alan So

Yes, it is a screenshot of held message view in Postorius. Right. It's basically due to some customization in old days. In the mailman 2 days, we customized somethings that related to wordings or else and made it as English (UK) and used the code uk. When these lists were imported to mailman 3, the preferred language changed to the original meaning of the code uk (Ukrainian) and we did not aware. I could not repeat the issue of held message view when I only changed the language of the list. However, I can repeat the issue when the sender's preferred language is set to Ukrainian.

2 years, 1 month

Mailman-users search results for query "Postorius"