[Mailman-Users] List security: approved line got mailed out to list users

2007-01-26 Thread Jacob Sam-La Rose
Hi.

I've got my list configured as an announcement-only list, and the  
first few mailings I've sent have gone through exactly as planned.  I  
use Approved: password as the first line to approve mailings.  I  
inadvertently sent email to the list from one of my other email  
addresses, and when the message went out, the Approved: line was  
there, intact.  There was a space above it, if that means anything  
(the sent email doesn't have that space...)

I changed the password - easily done, no security problems there.   
But I'd still like to know what could have allowed this to happen.   
Since then, I've set up a test list and tried to replicate the  
behaviour - thus far no success.  Anyone have any suggestions as to  
what might have happened?

Thanks,

Jacob Sam-La Rose
Executive Editor
FYI / Metaroar.com




--
Mailman-Users mailing list
Mailman-Users@python.org
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
http://mail.python.org/mailman/options/mailman-users/archive%40jab.org

Security Policy: 
http://www.python.org/cgi-bin/faqw-mm.py?req=showamp;file=faq01.027.htp


Re: [Mailman-Users] List security: approved line got mailed out to listusers

2007-01-26 Thread Mark Sapiro
Jacob Sam-La Rose wrote:

I've got my list configured as an announcement-only list, and the  
first few mailings I've sent have gone through exactly as planned.  I  
use Approved: password as the first line to approve mailings.  I  
inadvertently sent email to the list from one of my other email  
addresses, and when the message went out, the Approved: line was  
there, intact.  There was a space above it, if that means anything  
(the sent email doesn't have that space...)


What Mailman version is this?

Do you have a copy of the message from the list - complete with all
headers? If nothing else, if the list is archived, this copy will be
in archives/private/listname.mbox/listname.mbox.

How did the message get sent to the list? Was it held and manually
approved (a clue that something was wrong with Approved:).

Was the Approved: line that went to the list in the first text/plain
part of the message or was it in a subsequent part, e.g. an HTML
alternative part.

Approved: body lines must be the first non-blank line in the first
text/plain part of the message. If found there, they will be removed.
Beginning in Mailman 2.1.7, an attempt is made to remove the approved
line from other parts of the message, but it must first be found in
the first text/plain part, and this removal from other parts isn't
perfect.

So, based on what little I have to go on so far, I will guess that the
message you sent to the list was multipart/alternative with text/plain
and text/html alternative parts and the Approved: line was found in
and removed from the text/plain part and the message was accepted, but
either because this is Mailman prior to 2.1.7 or because of something
unusual about the way the Approved: line appeared in the html part, it
wasn't removed from that part and that's where people saw it.

-- 
Mark Sapiro [EMAIL PROTECTED]   The highway is for gamblers,
San Francisco Bay Area, Californiabetter use your sense - B. Dylan

--
Mailman-Users mailing list
Mailman-Users@python.org
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
http://mail.python.org/mailman/options/mailman-users/archive%40jab.org

Security Policy: 
http://www.python.org/cgi-bin/faqw-mm.py?req=showamp;file=faq01.027.htp


Re: [Mailman-Users] List security: approved line got mailed out to listusers

2007-01-26 Thread Jacob Sam-La Rose
Thanks for the response, Mark. I'm only just getting used to the  
concept of community via mailing list (I'm more used to user forums...!)

On 26 Jan 2007, at 19:00, Mark Sapiro wrote:

 Jacob Sam-La Rose wrote:

 I've got my list configured as an announcement-only list, and the
 first few mailings I've sent have gone through exactly as planned.  I
 use Approved: password as the first line to approve mailings.  I
 inadvertently sent email to the list from one of my other email
 addresses, and when the message went out, the Approved: line was
 there, intact.  There was a space above it, if that means anything
 (the sent email doesn't have that space...)


 What Mailman version is this?


2.1.9.cp2

 Do you have a copy of the message from the list - complete with all
 headers? If nothing else, if the list is archived, this copy will be
 in archives/private/listname.mbox/listname.mbox.

Headers:

Subject:FYI (important): any email to  / Jacob this morning...
Date:   26 January 2007 11:00:05 GMT
To:   [EMAIL PROTECTED]
Return-Path:[EMAIL PROTECTED]
Envelope-To:[EMAIL PROTECTED]
Delivery-Date:  Fri, 26 Jan 2007 06:03:20 -0500
Received:   from yosafa by mrfriendly.asmallorange.com with local- 
bsmtp (Exim 4.63) (envelope-from  
[EMAIL PROTECTED]) id 1HAOrV-z6-3K for  
[EMAIL PROTECTED]; Fri, 26 Jan 2007 06:03:20 -0500
Received:   from hypnotoad.liquidweb.com ([72.52.133.24]:50358) by  
mrfriendly.asmallorange.com with esmtps (TLSv1:AES256-SHA:256) (Exim  
4.63) (envelope-from [EMAIL PROTECTED]) id 1HAOrU-xz-PZ  
for [EMAIL PROTECTED]; Fri, 26 Jan 2007 06:03:16 -0500
Received:   from localhost ([127.0.0.1]:50149  
helo=hypnotoad.liquidweb.com) by hypnotoad.liquidweb.com with esmtp  
(Exim 4.63) (envelope-from [EMAIL PROTECTED]) id  
1HAOoT-00032t-0j; Fri, 26 Jan 2007 06:00:09 -0500
Received:   from [81.103.209.178] (port=56306) by  
hypnotoad.liquidweb.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim  
4.63) (envelope-from [EMAIL PROTECTED]) id 1HAOoR-00032U-85 for  
[EMAIL PROTECTED]; Fri, 26 Jan 2007 06:00:07 -0500
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on   
mrfriendly.asmallorange.com
X-Spam-Level:   
X-Spam-Status:  No, score=0.0 required=7.0 tests=AWL,HTML_MESSAGE   
autolearn=ham version=3.1.7
Mime-Version:   1.0 (Apple Message framework v752.2)
Message-Id: [EMAIL PROTECTED]
X-Mailer:   Apple Mail (2.752.2)
X-Clamantivirus-Scanner:This mail is clean
X-Clamantivirus-Scanner:This mail is clean
X-Beenthere:[EMAIL PROTECTED]
X-Mailman-Version:  2.1.9.cp2
Precedence: list
List-Id:Everything you wanted to know about poetry, but didn't 
 
know who to ask... fyi_metaroar.com.metaroar.com
List-Unsubscribe:   http://metaroar.com/mailman/listinfo/ 
fyi_metaroar.com, mailto:[EMAIL PROTECTED]
List-Archive:   http://metaroar.com/pipermail/fyi_metaroar.com
List-Post:  mailto:[EMAIL PROTECTED]
List-Help:  mailto:[EMAIL PROTECTED]
List-Subscribe: http://metaroar.com/mailman/listinfo/ 
fyi_metaroar.com, mailto:[EMAIL PROTECTED]
Content-Type:   multipart/mixed;  
boundary2746362320716674074==
Errors-To:  [EMAIL PROTECTED]
X-Antiabuse:This header was added to track abuse, please include  
it with any abuse report
X-Antiabuse:Primary Hostname - hypnotoad.liquidweb.com
X-Antiabuse:Original Domain - jsamlarose.com
X-Antiabuse:Originator/Caller UID/GID - [0 0] / [47 12]
X-Antiabuse:Sender Address Domain - metaroar.com
X-Source:   
X-Source-Args:  
X-Source-Dir:   
X-Antivirus-Scanner:Clean mail though you should still use an  
Antivirus

Do you need to see the body of the email?


 How did the message get sent to the list? Was it held and manually
 approved (a clue that something was wrong with Approved:).

Sent as email straight to the list - didn't have to be manually  
approved - it went straight through.


 Was the Approved: line that went to the list in the first text/plain
 part of the message or was it in a subsequent part, e.g. an HTML
 alternative part.

It was in the first text/plain part - though in the sent version I've  
got of the mail, the Approved: line is the very first line.  Once it  
went through the list, there was a line space at the top of the  
email, before the Approved: line...


 Approved: body lines must be the first non-blank line in the first
 text/plain part of the message. If found there, they will be removed.
 Beginning in Mailman 2.1.7, an attempt is made to remove the approved
 line from other parts of the message, but it must first be found in
 the first text/plain part, and this removal from other parts isn't
 perfect.

 So, 

Re: [Mailman-Users] List security: approved line got mailed out to listusers

2007-01-26 Thread Brad Knowles
At 10:59 PM + 1/26/07, Jacob Sam-La Rose wrote:

  What Mailman version is this?

2.1.9.cp2

That's a cPanel version number.  Please see FAQ 6.11.

  Do you have a copy of the message from the list - complete with all
  headers? If nothing else, if the list is archived, this copy will be
  in archives/private/listname.mbox/listname.mbox.

  Headers:

  Subject: FYI (important): any email to  / Jacob this morning...
   Date:   26 January 2007 11:00:05 GMT
   To:   [EMAIL PROTECTED]
   Return-Path:[EMAIL PROTECTED]
   Envelope-To:[EMAIL PROTECTED]
   Delivery-Date:  Fri, 26 Jan 2007 06:03:20 -0500
   Received:   from yosafa by mrfriendly.asmallorange.com with

Something has munged the heck out of these headers.  In the raw mbox 
file, there are no preceding space characters before any of them.  We 
want to see what is in the raw mbox file, not anything else.

-- 
Brad Knowles [EMAIL PROTECTED], Consultant  Author
Co-author of SAGE Booklet #15 Internet Postmaster: Duties and 
Responsibilities
Founding Member and Platinum Individual Sponsor of LOPSA: 
http://www.lopsa.org
Papers: http://tinyurl.com/tj6q4 LinkedIn Profile: 
http://tinyurl.com/y8kpxu
--
Mailman-Users mailing list
Mailman-Users@python.org
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: 
http://mail.python.org/mailman/options/mailman-users/archive%40jab.org

Security Policy: 
http://www.python.org/cgi-bin/faqw-mm.py?req=showamp;file=faq01.027.htp


Re: [Mailman-Users] List security: approved line got mailed out to listusers

2007-01-26 Thread Mark Sapiro
Jacob Sam-La Rose wrote:

Headers:

Subject:   FYI (important): any email to  / Jacob this morning...
   Date:   26 January 2007 11:00:05 GMT
   To:   [EMAIL PROTECTED]


As Brad points out in another reply, these don't look like raw message
headers for a few reasons, not the least of which being Subject:,
Date: and To: preceeding the headers immediately below.


   Return-Path:[EMAIL PROTECTED]
   Envelope-To:[EMAIL PROTECTED]
   Delivery-Date:  Fri, 26 Jan 2007 06:03:20 -0500
   Received:   from yosafa by mrfriendly.asmallorange.com with local- 
bsmtp (Exim 4.63) (envelope-from  
[EMAIL PROTECTED]) id 1HAOrV-z6-3K for  
[EMAIL PROTECTED]; Fri, 26 Jan 2007 06:03:20 -0500
   Received:   from hypnotoad.liquidweb.com ([72.52.133.24]:50358) by  
mrfriendly.asmallorange.com with esmtps (TLSv1:AES256-SHA:256) (Exim  
4.63) (envelope-from [EMAIL PROTECTED]) id 1HAOrU-xz-PZ  
for [EMAIL PROTECTED]; Fri, 26 Jan 2007 06:03:16 -0500
   Received:   from localhost ([127.0.0.1]:50149  
helo=hypnotoad.liquidweb.com) by hypnotoad.liquidweb.com with esmtp  
(Exim 4.63) (envelope-from [EMAIL PROTECTED]) id  
1HAOoT-00032t-0j; Fri, 26 Jan 2007 06:00:09 -0500
   Received:   from [81.103.209.178] (port=56306) by  
hypnotoad.liquidweb.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim  
4.63) (envelope-from [EMAIL PROTECTED]) id 1HAOoR-00032U-85 for  
[EMAIL PROTECTED]; Fri, 26 Jan 2007 06:00:07 -0500
   X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on   
mrfriendly.asmallorange.com
   X-Spam-Level:   
   X-Spam-Status:  No, score=0.0 required=7.0 tests=AWL,HTML_MESSAGE   
autolearn=ham version=3.1.7
   Mime-Version:   1.0 (Apple Message framework v752.2)
   Message-Id: [EMAIL PROTECTED]
   X-Mailer:   Apple Mail (2.752.2)
   X-Clamantivirus-Scanner:This mail is clean
   X-Clamantivirus-Scanner:This mail is clean
   X-Beenthere:[EMAIL PROTECTED]
   X-Mailman-Version:  2.1.9.cp2
   Precedence: list
   List-Id:Everything you wanted to know about poetry, but didn't 
  
know who to ask... fyi_metaroar.com.metaroar.com
   List-Unsubscribe:   http://metaroar.com/mailman/listinfo/ 
fyi_metaroar.com, mailto:[EMAIL PROTECTED]
   List-Archive:   http://metaroar.com/pipermail/fyi_metaroar.com
   List-Post:  mailto:[EMAIL PROTECTED]
   List-Help:  mailto:[EMAIL PROTECTED]
   List-Subscribe: http://metaroar.com/mailman/listinfo/ 
fyi_metaroar.com, mailto:[EMAIL PROTECTED]
   Content-Type:   multipart/mixed;  
boundary2746362320716674074==


The multipart/mixed structure is probably due to Mailman's adding
either msg_header or msg_footer or both as separate MIME parts, thus,
by itself this doesn't tell me much about the original message.


   Errors-To:  [EMAIL PROTECTED]
   X-Antiabuse:This header was added to track abuse, please include  
it with any abuse report
   X-Antiabuse:Primary Hostname - hypnotoad.liquidweb.com
   X-Antiabuse:Original Domain - jsamlarose.com
   X-Antiabuse:Originator/Caller UID/GID - [0 0] / [47 12]
   X-Antiabuse:Sender Address Domain - metaroar.com
   X-Source:   
   X-Source-Args:  
   X-Source-Dir:   
   X-Antivirus-Scanner:Clean mail though you should still use an  
Antivirus

Do you need to see the body of the email?


I need to see the mime structure of the message including the part
headers and at least the initial lines of the part that still has the
Approved: line in it, and I need to see this as a raw message, not
interpreted by some MUA.


 How did the message get sent to the list? Was it held and manually
 approved (a clue that something was wrong with Approved:).

Sent as email straight to the list - didn't have to be manually  
approved - it went straight through.


 Was the Approved: line that went to the list in the first text/plain
 part of the message or was it in a subsequent part, e.g. an HTML
 alternative part.

It was in the first text/plain part - though in the sent version I've  
got of the mail, the Approved: line is the very first line.  Once it  
went through the list, there was a line space at the top of the  
email, before the Approved: line...


Assuming that the message actually needed to be approved, the line
would have been removed at least from the first text/plain part.

If you are able to get that 'sent version' in its raw form, that would
be most useful.

You appear to be using Apple mail. You can view raw source via
View-Message-Raw source (option-command-U).

-- 
Mark Sapiro [EMAIL PROTECTED]   The highway is for gamblers,
San Francisco Bay Area, Californiabetter use your sense - B. Dylan

--
Mailman-Users mailing list
Mailman-Users@python.org
http://mail.python.org/mailman/listinfo/mailman-users
Mailman 

Re: [Mailman-Users] List security

2004-05-07 Thread Stephen J. Turnbull
 Kai == Kai Schaetzl [EMAIL PROTECTED] writes:

Kai So, put Approved: password in the first line or as a
Kai header. Note, this will be parsed away and NOT distributed to
Kai the list, don't worry!

Well, worry a little.  It's cleartext, so unless you're using a VPN/
encrypted channels/intranet-only you have to be aware that it can be
sniffed off the 'net.  Also, if you bypass the list for some
recipients (eg, a wide reply), they'll get it.  And of course
passwords are relatively weak security if they're mnemonic.

If security means against spam/viruses, likely you don't need to be
so paranoid.

-- 
Institute of Policy and Planning Sciences http://turnbull.sk.tsukuba.ac.jp
University of TsukubaTennodai 1-1-1 Tsukuba 305-8573 JAPAN
   Ask not how you can do free software business;
  ask what your business can do for free software.

--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/


[Mailman-Users] List security

2004-05-06 Thread Sean

Hi,

I'm running a list on Mailman 2.1.3 and I am looking to secure my list as
much as possible.  I saw this in FAQ 3.11
(http://www.python.org/cgi-bin/faqw-mm.py?req=showfile=faq03.011.htp):

  A more secure alternative is for your approved posters to add an
  Approved header to their postings as a header, or as the first line of
  the post).

I'd like to implement this but I'm uncertain to go about it.  I'm pretty
certain the content filtering options are where the test for the Approved
header should go.  My question is how can the header be added to the
posting?  Any insight or tips as to how this can be accomplished will be
appreciated.

Thanks,
Sean

--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/


Re: [Mailman-Users] List security

2004-05-06 Thread Kai Schaetzl
Sean wrote on Thu, 6 May 2004 12:12:18 -0400 (EDT):

 A more secure alternative is for your approved posters to add an
   Approved header to their postings as a header, or as the first line of
   the post).
 
 I'd like to implement this but I'm uncertain to go about it.  I'm pretty
 certain the content filtering options are where the test for the Approved
 header should go.

No, you got that wrong. Usually, you have to approve an email via web 
interface. If it contains the Approved header and password then it gets 
handled in the same way as if you had approved it via web, just that this 
works automatically. There's no test to put anywhere. Actually, it's an 
old mailing list method which was invented earlier than web interfaces.

My question is how can the header be added to the
 posting?  Any insight or tips as to how this can be accomplished will be
 appreciated.


It's exactly as it says:

  add an
Approved header to their postings as a header


and if the program isn't able to do this:

 as the first line of
the post).


So, put Approved: password in the first line or as a header. Note, this 
will be parsed away and NOT distributed to the list, don't worry!


Kai

-- 

Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de  http://msie.winware.org




--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/


Re: [Mailman-Users] List Security

2002-10-23 Thread Jon Parise
On Wed, Oct 23, 2002 at 08:45:46AM +0200, Dan Richter wrote:

 I was using Majordomo, but I got scared off when I realized that anyone 
 could bypass the list posting restrictions by posting to the correct alias. 
 (The normal list alias processes, then redirects to a second alias which 
 blindly transmits.) The blind forward alias shows up in the headers, so I 
 can't even hide it from people. Please reassure me that Mailman does not 
 have this vulnerability!
 
It's quite easy to block inbound mail to majordomo's list exploder
address.  If you're using Postfix, just add something like the
following to a recipient access map:

/^(.*)-outgoing@(.*)$/!/^owner-.*/  550 Use recipient address ${1}@${2} instead.

I don't believe Mailman suffers from the same kind insecurity, though.

-- 
Jon Parise ([EMAIL PROTECTED])  ::  http://www.csh.rit.edu/~jon/

--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/



Re: [Mailman-Users] List Security

2002-10-23 Thread J C Lawrence
On Wed, 23 Oct 2002 08:45:46 +0200 
Dan Richter [EMAIL PROTECTED] wrote:

 I was using Majordomo, but I got scared off when I realized that
 anyone could bypass the list posting restrictions by posting to the
 correct alias. (The normal list alias processes, then redirects to a
 second alias which blindly transmits.) The blind forward alias shows
 up in the headers, so I can't even hide it from people. Please
 reassure me that Mailman does not have this vulnerability!

Mailman doesn't use secret aliased.

Mailman v2.0 authenticates on From: or envelope (you pick).

Mailman v2.1 authenticates on From: and envelope.

-- 
J C Lawrence
-(*)Satan, oscillate my metallic sonatas. 
[EMAIL PROTECTED]   He lived as a devil, eh?  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.


--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/



Re: [Mailman-Users] List Security

2002-10-23 Thread Dan Richter


Mailman doesn't use secret aliased.


That's good.


Mailman v2.0 authenticates on From: or envelope (you pick).

Mailman v2.1 authenticates on From: and envelope.


Pardon me for being a pain here, but isn't it ridiculously easy to forge a 
From:, and also rather easy to forge an envelope?

Now I'll be humble and admit that I don't even know what an envelope is. So 
my question about the envelope really boils down to: if I have root access 
on a machine other than the one Mailman is running on, can I fool Mailman's 
envelope recognition?

== Dan Richter == mailto:Dan;wimba.com ===
   He [Bob Dole] fought in Italy, where he suffered
   a serious head injury. Then he went into politics.
   - a poorly worded radio announcement in 1961


--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/


Re: [Mailman-Users] List Security

2002-10-23 Thread admin
 Mailman v2.1 authenticates on From: and envelope.
What is used?

 Pardon me for being a pain here, but isn't it ridiculously easy to forge a
 From:, and also rather easy to forge an envelope?

 Now I'll be humble and admit that I don't even know what an envelope is.
So
 my question about the envelope really boils down to: if I have root access
 on a machine other than the one Mailman is running on, can I fool
Mailman's
 envelope recognition?
no seen protection no - write although with any machines, but faked field
From: and access open - I checked from miscellaneous hosts and domains


--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/



Re: [Mailman-Users] List Security

2002-10-23 Thread J C Lawrence
On Wed, 23 Oct 2002 19:00:06 +0200 
Dan Richter [EMAIL PROTECTED] wrote:

 Pardon me for being a pain here, but isn't it ridiculously easy to
 forge a From:, and also rather easy to forge an envelope?

From: is trivial under many MTAs.  Envelope requires understanding SMTP
and driving that manually.  However, this is largely moot: if you need
strong(er) authentication in email systems, period, and this is not just
limited to Mailman, you're basically into the realms of PKI.

  Exception: (I do this in a couple case) I require mail arriving with
  specific From: and Envelopes to also list specific addresses in the
  Received: headers.  This is not strong, it is equally trivially forged
  as the envelope, but it is (currently) a sufficient barrier to entry
  to cut even the few who do forge envelopes that I've found.

 Now I'll be humble and admit that I don't even know what an envelope
 is. 

Crudely, its the From  header (note the space).  More usefully the
envelope contains the return-path, the address to which a bounce should
be sent back to if this message bounces.

 So my question about the envelope really boils down to: if I have root
 access on a machine other than the one Mailman is running on, can I
 fool Mailman's envelope recognition?

Absolutely.

You don't need root access on any system to forge email.

-- 
J C Lawrence
-(*)Satan, oscillate my metallic sonatas. 
[EMAIL PROTECTED]   He lived as a devil, eh?  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.


--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/



[Mailman-Users] List Security

2002-10-23 Thread Dan Richter
I was using Majordomo, but I got scared off when I realized that anyone 
could bypass the list posting restrictions by posting to the correct alias. 
(The normal list alias processes, then redirects to a second alias which 
blindly transmits.) The blind forward alias shows up in the headers, so I 
can't even hide it from people. Please reassure me that Mailman does not 
have this vulnerability!

== Dan Richter == mailto:Dan;wimba.com ===
Customers who consider our waitresses uncivil
ought to see the manager.
   - Sign in a restaurant in New York


--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/


Re: [Mailman-Users] List Security

2002-10-23 Thread admin
I had that- question
and in current of the week tried to get here answer, but alas, nobody not
was able on this answer, come to go to majordomo

 I was using Majordomo, but I got scared off when I realized that anyone
 could bypass the list posting restrictions by posting to the correct
alias.
 (The normal list alias processes, then redirects to a second alias which
 blindly transmits.) The blind forward alias shows up in the headers, so
I
 can't even hide it from people. Please reassure me that Mailman does not
 have this vulnerability!

 == Dan Richter == mailto:Dan;wimba.com ===
  Customers who consider our waitresses uncivil
  ought to see the manager.
 - Sign in a restaurant in New York


 --
 Mailman-Users mailing list
 [EMAIL PROTECTED]
 http://mail.python.org/mailman/listinfo/mailman-users
 Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
 Searchable Archives:
http://www.mail-archive.com/mailman-users%40python.org/



--
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/