Search results for "Postorius" - Mailman-users

Re: mailman3 on new Debian 12 installation, got ssl apache working on all URLs except /mailman3

by Philip Bondi

Thank you, Mark, and the whole community for your help, so far. Gosh, it feels so close. It works from browser on Debian virtual machine: But still fails through Apache: root@shackleton12:~# *cat /etc/mailman3/urls.py* # **************************************************************************** # # $Id: urls.py 165750 2025-03-31 18:19:32Z svn_beechwood $ # $URL: https://systemdatabase.com/svn/svn-sdi/sdi-sysadmin/trunk/SHACKLETON12-root… $ # $Date: 2025-03-31 14:19:32 -0400 (Mon, 31 Mar 2025) $ # # Description: https://gitlab.com/mailman/mailman-web/-/blob/master/mailman_web/urls.py # # **************************************************************************** # -*- coding: utf-8 -*- # Copyright (C) 2023 by the Free Software Foundation, Inc. # # This file is part of mailman-web. # # Postorius is free software: you can redistribute it and/or modify it under # the terms of the GNU General Public License as published by the Free # Software Foundation, either version 3 of the License, or (at your option) # any later version. # # Postorius is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for # more details. # # You should have received a copy of the GNU General Public License along with # Postorius. If not, see <http://www.gnu.org/licenses/>. from django.conf.urls import include from django.contrib import admin from django.urls import path, reverse_lazy from django.views.generic import RedirectView urlpatterns = [ path( '', RedirectView.as_view(url=reverse_lazy('list_index'), permanent=True), ), # Include alternate Postorius and HyperKitty URLs. path('postorius/', include('postorius.urls')), path('hyperkitty/', include('hyperkitty.urls')), # Order counts for various links. Put the above first and the following # after so the suggested Apache config still works. *path('mailman3/', include('postorius.urls')),* path('archives/', include('hyperkitty.urls')), path('', include('django_mailman3.urls')), path('accounts/', include('allauth.urls')), path('admin/', admin.site.urls), ] When I hit https://systemdatabase.ca/mailman3, I see the following in /var/log/apache2/systemdatabase.ca_error.log [Mon Mar 31 13:48:21.074890 2025] [proxy:error] [pid 3075263:tid 3075272] (2)No such file or directory: AH02454: uwsgi: attempt to connect to Unix domain socket */run/mailman3-web/uwsgi.sock* (localhost:0) failed [Mon Mar 31 13:48:21.075258 2025] [:error] [pid 3075263:tid 3075272] [client 192.168.1.1:48063] AH10101: failed to make connection to backend: localhost:0 This is my /etc/apache2/sites-available/systemdatabase.ca-le-ssl.conf # **************************************************************************** # # $Id: systemdatabase.ca-le-ssl.conf 165634 2025-03-27 20:07:40Z svn_beechwood $ # $URL: https://systemdatabase.com/svn/svn-sdi/sdi-sysadmin/trunk/SHACKLETON12-root… $ # $Date: 2025-03-27 16:07:40 -0400 (Thu, 27 Mar 2025) $ # # Description: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/… # # **************************************************************************** <IfModule mod_ssl.c> <VirtualHost *:80> ServerName systemdatabase.ca Redirect permanent / https://systemdatabase.ca/ DocumentRoot /var/www/html/systemdatabase.ca/ </VirtualHost> <VirtualHost *:443> SSLEngine on ServerAdmin pjbondi(a)systemdatabase.com ServerName systemdatabase.ca ServerAlias www.systemdatabase.ca DocumentRoot /var/www/html/systemdatabase.ca/ ErrorLog ${APACHE_LOG_DIR}/systemdatabase.ca_error.log CustomLog ${APACHE_LOG_DIR}/systemdatabase.ca_access.log combined Include /etc/letsencrypt/options-ssl-apache.conf SSLCertificateFile /etc/letsencrypt/live/systemdatabase.ca-0001/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/systemdatabase.ca-0001/privkey.pem Alias /static/ /opt/mailman/web/static/ <Directory "/opt/mailman/web/static/"> Require all granted </Directory> <IfModule mod_headers.c> RequestHeader unset X-Forwarded-Proto <If "%{HTTPS} =~ /on/"> RequestHeader set X-Forwarded-Proto "https" </If> </IfModule> <IfModule mod_proxy.c> ProxyPreserveHost On ProxyPass "/postorius" "http://127.0.0.1:8000/postorius" ProxyPass "/hyperkitty" "http://127.0.0.1:8000/hyperkitty" ProxyPass "/accounts" "http://127.0.0.1:8000/accounts" ProxyPass "/admin" "http://127.0.0.1:8000/admin" ProxyPass "/user-profile" "http://127.0.0.1:8000/user-profile" ProxyPass "/mailman3" "http://127.0.0.1:8000/mailman3" ProxyPass "/archives" "http://127.0.0.1:8000/archives" # https://github.com/maxking/docker-mailman/issues/525 #ProxyPass / unix:/run/mailman3-web/uwsgi.sock|uwsgi://localhost/ #ProxyPassReverse / unix:/run/mailman3-web/uwsgi.sock|uwsgi://localhost/ ProxyPassMatch "^/$" "http://127.0.0.1:8000/mailman3" </IfModule> </VirtualHost> </IfModule> -- Philip Bondi,pjbondi(a)SystemDatabase.com cell: +1 -416 540-2869 ___________________________________________ Mailman's content filtering has removed the following MIME parts from this message. Content-Type: image/png Name: 07YHHkaJc8flnc8d.png Content-Type: image/png Name: tBLp6tc9U7kLbxko.png Replaced multipart/alternative part with first alternative.

9 months, 1 week

Re: One-click unsubscribe?

by Stephen J. Turnbull

Jered Floyd writes: > Ugh, I had not considered that RFC 8058 breaks the separation of > concerns here. Not your job, but it is ours. :-) > we can at least make this work for Postorius users. Definitely, that's a reasonable first step. We just need to make sure to do that while allowing others to opt out until they've implemented it themselves. I think I have a suggestion how it could just work for everybody, though. > Are there many who use just Mailman-Core and not the full suite? I don't know about absolute numbers, but yeah, it's a FAQ. There's the EMWD Affinity application which replaces Postorius for many of the sites they host, and enterprises often ask how to use bespoke scripts to control lists (although they may be using Postorius as well). > The URI path/query is defined as opaque. It probably should be > something like list-name/subscribed-address plus a signed hash to > avoid unsub-attacks. That means this likely will be a new web > application endpoint (although it may be possible to overload the > existing "unsubscribe" endpoint -- I haven't looked at the code > yet). RFC 8058 says The URI SHOULD include an opaque identifier or another hard-to-forge component in addition to, or instead of, the plaintext names of the list and the subscriber. The server handling the unsubscription SHOULD verify that the opaque or hard-to-forge component is valid. We don't need to have an explicit reference to the subscription in the URI. As I discovered (to my chagrin) Mailman's current simple RFC 2369 List-Unsubscribe field doesn't, even for personalized lists where there might be a personalized link in the footer. So I think we should go with "instead of". Maybe while experimenting it would be useful to have the plain text subscription information in the URI, though. So ... the existing REST endpoint in core won't change, because the whole REST API assumes that it's talking to the superuser. The "obvious" way to do this is through Postorius, which provides a proxy object backed by a map in Mailman core from tokens in the URL to subscriptions, and use the existing REST endpoint. This is "obvious" because Django already provides an authorization framework for subscription management -- we wouldn't be exposing anything else protected by that framework to mischief. The token would be the encrypted (list, address) pair, possibly dated in clear (to allow expiration of tokens and rotation of encryption keys). Unfortunately RFC 8058 doesn't discuss that, I guess John assumed that people would usually be unsubscribing from the most recent post. On the assumption that unsubscribes would be "rare", you wouldn't have to store the token in the database. (Have to think about that, you might be able to DOS attack by sending lots of fake unsubscribes and attack the encryption with known plaintext attacks. Safety would suggest adding a random nonce and that would need to be saved in the database.) Alternatively, you could reverse proxy this directly through the front-end webserver to Mailman core with a new REST endpoint. That gives me bad vibes because I can just see naive admins messing up the configuration of the single endpoint, and "fixing" the problem by reverse proxying port 8001 to the Internet. We'd have to be careful that the urlconf not slop over to anything else, maybe something like "listen" on the Internet at (nginx notation): location /mailman3/rfc8058/ { proxy_pass http://localhost:8001/3.2/PROXIED/rfc8058; } The "PROXIED" part is just to provide a REST namespace that is obviously separate from the domains, addresses, users, lists, etc. Maybe "SELF_AUTHORIZING" would be more accurate. I think that reverse proxy sepcification would be safe enough. And you could combine the two strategies which would allow sites that don't use Postorius to configure the reverse proxy, while sites that do would get it for "free" since we'd configure Postorius to do it. Aside: RFC 8058 says But anti-spam software often fetches all resources in mail header fields automatically, without any action by the user, and there is no mechanical way for a sender to tell whether a request was made automatically by anti-spam software or manually requested by a user. Weirdly, the RFC doesn't address this problem at all. :-( -- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan

1 month, 1 week

Re: Postorius permissions granularity

by Stephen J. Turnbull

Liam Reilly writes: > It looks like we're going to take the simple route of the helpdesk > using existing screen sharing tools to assist list owners, rather > than providing elevated access in Postorius. Many of our list > owners are not technical and so the transition from Mailman 2 to 3 > has been challenging for some. Understood. Some of the design of Mailman 2 had become unsupportable over the years, and there were some features we needed to add. But accomodating those also causes discontinuities for many users. I may have a customer for a change related to your request for "view-only" superusers . If it's possible to implement in such a way as to support your requirement as well, I'll let you know. Even if you find that the screen-sharing approach makes it unnecessary for you, having multiple possible use cases makes integrating the feature much more attractive for us. Steve -- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan

3 weeks, 5 days

Re: "Unsubscribe all" failed with large lists

by Abhilash Raj

thanks, Abhilash Raj On Wed, Jan 20, 2021 at 10:34, Alan So <ktso(a)cuhk.edu.hk> wrote: > We are currently testing latest mailman suite (w/Postorius 1.3.3) and > notice that that the the API call > /3.1/lists/listname.domain/roster/member failed when using > "Unsubscribe all" on Postorius for a large list (~15000 members). > Not sure whether the issue has been already reported or not. It has been reported before for sure, but I couldn't find an issue tracking it in Postorius' tracker so I created one[1]. The Core and Mailmanclient already have a mass-unsubscribe API that doesn't require looping over all address and unsubscribing them one by one, it just needs to be plumbed through in P, in case someone wants to take a stab at it. [1]:https://gitlab.com/mailman/postorius/-/issues/464 > _______________________________________________ > Mailman-users mailing list -- mailman-users(a)mailman3.org > <mailto:mailman-users@mailman3.org> > To unsubscribe send an email to mailman-users-leave(a)mailman3.org > <mailto:mailman-users-leave@mailman3.org> > <https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/>

4 years, 11 months

Re: postorius configuration of the from-part

by Wolfgang Bock

Hello, thanks for your information. After creating the dmarc-entries in the DNS-databases everthing works as wanted! Regards Wolfgang Am 13.11.2019 um 06:02 schrieb Mark Sapiro: > On 11/12/19 2:27 PM, Wolfgang Bock via Mailman-users wrote: >> Hello, >> >> can someone give me an advice how I can configure in the >> postorius-menues the view of the from-part of my list-member like in >> this mailinglist: >> >> Wolfgang Bock_via Mailman-users_ <mailman-users(a)mailman3.org> > > The above is the result of Settings -> DMARC Mitigatations -> DMARC > mitigation action = "Replace From: with list address" > > You can apply that to only messages From: a domain the publishes a DMARC > policy of reject or quarantine or to all messages depending on DMARC > Mitigate unconditionally. > > >> case 1 reply goes to the list or to the member >> case 2 reply goes only to the list > > The DMARC Mitigatations settings are independent of the various reply > settings on the Alter Messages tab. >

6 years, 1 month

Re: [EXT] - moving lists to another server

by Stephen J. Turnbull

Bryan Kartzman writes: > Wow, thanks for the very thorough response, Steve. > > I should have started by saying that when we built the current > production server, we cloned it off the test server and we were > thinking now to move the data onto another clone of the old test > server. So, yes we would have to apply all the changes we made > since we cloned the current production server, but everything else > as far as the OS is concerned should be comparable (webserver, MTA, > Mailman core, Django, Hyperkitty, Postorius). That's why I was just > asking about the "data" aspects of > mailman/hyperkitty/postorius. What would I have to move to > replicate all the lists on the current production server to a new > clone of the original test server once we've applied any changes we > made to production server since the clone. If you're using the same instance of the database, and the transient queues are clean, then once you've applied those changes you just point Mailman core, HyperKitty, and Postorius at the database. If you need to copy the database into a different instance that's already running, *pro-ba-bly* you can just dump the 'mailman' database (and if you have a separate 'mailmanweb' database for Postorius and HyperKitty, that one too) as SQL code. Then load them into that database (make sure there's nothing in the SQL that messes with any existing databases in the RDBMS). If you have a fresh new instance of the database it's the same but no worries. Steve

2 years, 2 months

Re: Mailman, etc. upgrade woes and persistent bugs

by Brian Carpenter

On 2/13/21 10:53 AM, Jim Popovitch via Mailman-users wrote: > But how do you display a "Membership List page" for admins in MM3 > (choice of wording is specific to other emails you've posted today) > without third-party application(s), and isn't that too a shortcoming in > MM3 due to that functionality being present in MM2? Look, without a > doubt the REST API of MM3 Core is cool, but let's be honest, all the 3rd > party wrapping and baggage is, well, not so cool. But, again being > honest, you can't have a MM3 system without all of those things. With > MM2 we have all those things, and we are happy with them.:) Affinity is just a UI that sits on top of Mailman 3 core. Most of its functions and displays come from Mailman 3 core. Everything I mentioned about how Affinity displays List Member Management to List Owners uses MM3's REST api to do so. In my opinion, Postorius is nowhere near in taking advantage of all that Mailman 3 core offers along with free tools such as Bootstrap 4. The only thing that is holding Postorius back is time to improve it and that is not the fault of MM3 or the developers. The thing to take away from this however is Postorius still has the potential (because the foundation is there) to be a great modern UI for Mailman 3 core. MM2 does not have that potential and never will. Sure it works until it doesn't. I am pretty sure Pipermail is a wrapper and not an inherit part of MM2. -- Brian Carpenter Harmonylists.com Emwd.com

4 years, 10 months

Moderation action "None" is misleading

by Stephen J. Turnbull

Markus Grandpré writes: > I find the use of the term 'None' (or 'Kein' in the German > translation; see attachments) This list does not allow attachments. Please be more explicit in your explanations (see comments below), or (preferred, because it's unlikely that action will take place soon, and mailing list conversations are forgotten in a few weeks at most) create an issue (probably at https://gitlab.com/mailman/postorius/-/issues/) and attach the files there. > in the 'Moderation action' column of the member list misleading, as > the term suggests that no moderation action is applied to the > respective member. > > However, this is not necessarily the case. If you check a member’s > "Administration options / Moderation" setting, a moderation action, > such as "Moderation" or "List default", may be in effect. I don't understand. My users are pretty innocuous so "List default" and "Default processing" are in fact what is displayed in my installation (Mailman 3.3.10 and Postorius 1.3.13). If I change one subscriber to "Hold", that is what is displayed after refreshing the user list screen. What versions of Mailman and Postorius are you using? If you are using current Mailman, perhap the German translation is inaccurate. > I suggest that the 'Moderation action' column should display the > currently set value of the 'Administration options / Moderation' > setting for each member. See also https://gitlab.com/mailman/postorius/-/issues/188 for a related issue in a different context (the user's preferences page). The issue there is wanting the effective setting in cases where a list or user setting is in effect but the user's list of subscriptions shows "----".

11 months, 1 week

Re: Moderated unsub requests are not provided by mailman3 service

by Mark Sapiro

On 11/29/24 4:47 PM, Joachim Schrod wrote: > > The unsubscriptions requests are not shown in the web interface. I > suppose they should appear in the UI section "Subscription requests", > either as "Pending Approval" or "Pending Confirmation". (Frankly, I > don't understand the difference between these two options at all.) Subscriptions pending confirmation are those waiting for the user to confirm. Those pending approval are waiting for moderator approval. Unsubscription requests not being shown is https://gitlab.com/mailman/postorius/-/issues/332 which was fixed in Postorius 1,3.6 released over 3 years ago. Current release is 1.3.13. > System information: mailman3 3.3.3; Postorius (mailman3-web) 1.3.4; > both on Debian 11 (bullseye). > > I know that this is out of date; thus a definitive info "this is fixed > by now" is quite OK for me. (Debian upgrade is planned as the next > action after getting Mailman3 to work for that use case.) Yes, this is fixed. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 year, 1 month

Re: MM3 on debian - redirect problem

by Mark Sapiro

On 4/27/20 8:17 AM, Gelpi Andrea wrote: > Hi, > on a debian10 I have mm3 installed via apt-get > > apt-get install mailman3-full > dpkg-reconfigure mailman3 > dpkg-reconfigure mailman3-web > > I have this minor issue > > https://webserver/mailman3 redirects to > http://webserver/mailman/postorius/lists/ > > that doesn't exist. > > The same problem form django admin page to return to lists > > https://website/mailman3/admin/sites/site > > In the upper right corner I have a link to https://webserver/mailman3 > that redirects to https://mailman/postorius/lists/ > > I searched for a redirect but without success. The redirection must be a web server issue. There is a urls.py file probably in the same directory as your django settings - probably /usr/share/mailman3-web/urls.py in your case. You can make a URL like http://webserver/mailman/postorius/lists/ work by adding url(r'^mailman/postorius/', include('postorius.urls')), to the urlpatterns list in the urls.py file. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

5 years, 8 months

Mailman-users search results for query "Postorius"