Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Mark Sapiro
Steve Lindemann wrote: Had something strange occur early Saturday morning. A non-subscriber managed to successfully post to two member only lists (and, of course, it was spam). The bogus sender (thelevisstoreonl...@levis.rsys1.com) is not a member of these member only lists and is not in the

Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Lindsay Haisley
On Mon, 2009-01-26 at 13:26 -0800, Mark Sapiro wrote: If that isn't the answer, then it is possible that, as Lindsay suggests, the post contained an Approved: header with the list admin or moderator password. Mark's answer is probably more likely than mine. I was in the process of reading

Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Grant Taylor
On 01/26/09 15:26, Mark Sapiro wrote: All the headers of the spam post. In a default installation, if any of From:, Reply-To: or Sender: headers or the envelope sender as reflected in the Unix From or Return-Path: header contains a member address, the post will be deemed from that member.

Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Lindsay Haisley
On Mon, 2009-01-26 at 15:44 -0600, Grant Taylor wrote: On 01/26/09 15:26, Mark Sapiro wrote: All the headers of the spam post. In a default installation, if any of From:, Reply-To: or Sender: headers or the envelope sender as reflected in the Unix From or Return-Path: header contains a

Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Lindsay Haisley
On Mon, 2009-01-26 at 16:03 -0600, Barry Finkel wrote: We had a case last week when someone sent mail with a spoofed From: line that contained the e-mail address of the list owner. Unless the list owner is also a subscriber with his/her mod flag turned off, the fact that

Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Grant Taylor
On 01/26/09 15:55, Lindsay Haisley wrote: This kind of defeats the purpose, by definition, of a non-moderated, subscribers-only list. This would be the equivalent of setting everyone's mod flag on, at which point it becomes a moderated list. Either you allow subscribers to post, or you

Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Barry Finkel
Steve Lindemann wrote: Had something strange occur early Saturday morning. A non-subscriber managed to successfully post to two member only lists (and, of course, it was spam). The bogus sender (thelevisstoreonl...@levis.rsys1.com) is not a member of these member only lists and is not in the

Re: [Mailman-Users] non-subscriber managed to post to a subscriber onlylist

2009-01-26 Thread Brad Knowles
on 1/26/09 4:03 PM, Barry Finkel said: We had a case last week when someone sent mail with a spoofed From: line that contained the e-mail address of the list owner. The mail was delivered to us via a SMTP mailer of an ISP, and we have in the mail headers the IP address of the