Subject: mailman and spam

From: "Dan Wing" <[email-masked]>
Date: Sun, 10 Aug 2003 22:01:31 -0700

Please forward the message below to the moderators of your ietf.org-hosted
mailing lists.

-d

-----

At <http://www.waider.ie/hacks/workshop/perl> I found a nice Perl script
which automates deleting spam that is waiting for Mailman administrator
approve/deny/reject.

To use it, both Perl and SpamAssassin need to be installed on your Unix box.
To run it with ietf.org-hosted mailing lists, use the following syntax:

  perl
despam.pl --url=https://www1.ietf.org/mailman/admindb/MAILINGLIST --password
=XYZZY

The Perl script will obtain a SpamAssassin score for each queued message.
If the score is above your SpamAssassin-configured threshold (default=5),
the message is Denied.  If the score is below your threshold, the message is
left for you to manually Approve/Deny.  The value of "required_hits" in
~/.spamassassin/user_prefs controls the threshold value.

The script is available from
<http://www.waider.ie/hacks/workshop/perl/mailman.pl> and is also attached
(my only change was to include the source URL in the mailman.pl file
itself).

-Dan Wing

---

From: Spencer Dawkins <[email-masked]>
Date: Mon, 11 Aug 2003 07:23:03 -0700 (PDT)

Dear Dan,

Very nice - has anyone noticed how to auto-discard MIME-encoded
e-mail using mailman? I don't think I've seen a single posting
on TRIGTRAN that this wouldn't have handled...

Spencer

--- Dan Wing <[email-masked]> wrote:
> despam.pl
> --url=https://www1.ietf.org/mailman/admindb/MAILINGLIST
> --password
> =XYZZY
> 

> ATTACHMENT part 2 application/octet-stream name=mailman.pl

---

From: "Dean Willis" <[email-masked]>
Date: Mon, 11 Aug 2003 20:24:52 -0500

> At <http://www.waider.ie/hacks/workshop/perl> I found a nice 
> Perl script which automates deleting spam that is waiting for 
> Mailman administrator approve/deny/reject.

Oh yeah. Haven't tried it yet, but I'm excited. I've been manually deleting
about 160 spams at a time from SIP and SIPPING. That's tedious and painful,
especially on my PDA over a GSM link at a couple of dollars a minute. Just
deleting the messages promoting genital enlargement and money-laundering for
rich political refugees woule be most helpful.

On a related note, why can't the sysamdins just tie Spam Assassin into the
mailmain delivery process? I thought they were working on that last year . .
. I haven't tried it myself, but it seems like one could just tweak the
aliases file to redirect through a procmail invocation of spam-assassin
using a +addressing hack. Anybody know of a more efficient way?

I also heard of a nifty server-side hack that rejects initial incoming
requests with a Retry-After, databases the request, then lets the retry
through if it matches a database entry. This seems to take out most spam
originating from bulk-mailers that aren't really SMTP compatible.

Or we could just use S/MIME to sign all mails to IETF lists and have mailman
reject the unsigned stuff (ouch! Stop pelting me with rotten fruit!) . . .

--
Dean

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 22 Aug 2003 08:40:54 -0700

In case anyone is using mailman 2.1, I've got a version that works with 
mailman 2.1 at http://www.alvestrand.no/software/mailman.pl (and have sent 
the patch back to the author).

You have to give it "--mailman=2.1" as a parameter; the URLs you have to 
use to get the right data are different.

Happy spam-discarding!

                       Harald

--On 10. august 2003 22:01 -0700 Dan Wing <[email-masked]> wrote:

> http://www.waider.ie/hacks/workshop/perl

---

From: Aaron Falk <[email-masked]>
Date: Fri, 22 Aug 2003 09:48:17 -0700

Harald-

Since many of the lists are run by the secretariat, can you tell us a)
whether this script will be available for lists hosted at ietf.org and
b) how we might be able to run it without shell access?

--aaron (who's looking at 51 pending spam discards^H^H^H^H^H
	"administrative requests" for the pilc list since Wed.)

---

From: "Randy Presuhn" <[email-masked]>
Date: Fri, 22 Aug 2003 09:54:38 -0700

Hi -

Any ideas how this one got through?
http://www1.ietf.org/mail-archive/working-groups/disman/current/msg00114.html

As far as I can tell, it's not from a subscriber, and there were a couple of
"triggers" in the headers that should have caused it to be held for
administrator approval.

Randy

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 22 Aug 2003 10:05:10 -0700

> 	"administrative requests" for the pilc list since Wed.)

there's a note in the script that says the author would like to have it run 
as a CGI, presenting an admin page with the default action tweaked rather 
than doing the action - that could be hosted at the secretariat, if someone 
coded that. Without that, it needs shell access, which the secretariat has 
traditionally been very reluctant to hand out.

If you have an Unix box with spamassassin installed, you don't need any 
special privilleges to run it against IETF lists - just set the URL and 
password as parameters, and you're golden.
(Anyone want to host that as a service?)

It depends on a running spamassassin installation, though.

                         Harald

---

From: Matthew J Zekauskas <[email-masked]>
Date: Fri, 22 Aug 2003 14:00:50 -0400

did it actually go out the mailing list?  (I'm on DISMAN,
and I don't think I saw it... but on the other hand, my
local spamassassin installation may have classified it for me
and I may have just tossed without noticing it was from the
list.)

Some of the archive addresses (e.g. disman-web-archive or
disman-archive) are also on these lists, so it's possible
that the mail goes into the archive without ever getting
on the list.  (It's definitely happened for ippm.)

--Matt

---

From: "Randy Presuhn" <[email-masked]>
Date: Fri, 22 Aug 2003 19:53:13 -0700

Hi -

> From: "Matthew J Zekauskas" <[email-masked]>
> To: <[email-masked]>
> Cc: "Randy Presuhn" <[email-masked]>
> Sent: Friday, August 22, 2003 11:00 AM
> Subject: Re: mailman and spam
>

> and I may have just tossed without noticing it was from the

As far as I can tell, it did.  I received a copy in my own mailbox
with all the usual disman list headers, but *without* the "[Disman]"
that would normally appear in the subject line.

> on the list.  (It's definitely happened for ippm.)

Majordomo ("out-of-box") had this vulnerability.  We were able
to avoid the problem by having the majordomo scripts invoke
sendmail using a private sendmail.cf and aliases so that someone
sending directly to [email-masked] would simply
bounce.  We further limited things by putting the archives on a
firewall-protected host so that SMTP traffic could get there only
from the list host.  I don't know enough about mailman to know
whether similar vulnerabilities and work-arounds apply.

Randy

---

From: Bill Fenner <[email-masked]>
Date: Sun, 24 Aug 2003 14:29:20 -0700

>coded that.

I wrote most of this but didn't finish the CGI part before
I left for vacation.  See http://rtg.ietf.org/~fenner/foo2.html
for sample output.

  Bill