BALUG-Admin

balug-admin@lists.balug.org

1 participants
536 discussions

Update on the 23 balug-announce subscribers
by Rick Moen 29 Aug '22

29 Aug '22

DSNs arrived overnight on some of my test messages from rick(a)linuxmafia.com to the 24 balug-announce subscribers for whom delivery recently got disabled (over high bounce scores). vdow(a)unex.berkeley.edu: Delivery attempts will continue star(a)starshine.org: Delivery attempts will continue luvisi(a)andru.sonoma.edu: Delivery attempts will continue jtbolton(a)digizen.net: Delivery attempts will continue cmsclaud(a)arches.uga.edu: Delivery attempts will continue amcgee(a)virtualidentity.org: Delivery attempts will continue harpo(a)thebackrow.net: Delivery attempts will continue danlyke(a)chattanooga.net: Delivery attempts will continue jason(a)jcorcoran.net: Delivery attempts will continue kevinchi(a)tp.silkera.net: Delivery attempts will continue sugo(a)pescaralug.org: Delivery attempts will continue theeba(a)cultureisaweapon.org: 454 4.7.1 Relay access denied mhigashi(a)hooked.net: Delivery attempts will continue mark(a)gidgetkitchen.org: Delivery attempts will continue travis+ml-balug-talk(a)subspacefield.org: Delivery attempts will continue ngunther(a)ricochet.net: Delivery attempts will continue mditter(a)student.santarosa.edu: Delivery attempts will continue dlym(a)pop.vox.secureserver.net (generated from dlym(a)mail.sfpcug.org): Delivery attempts will continue That's 18 of them. I'll wait to hear about the other six. (Of course, those six may have been SMTP 250-delivered immediately, yesterday. I've not checked my outbound logs, to see.) Those 18 all seem highly likely to be genuinely undeliverable subscription addresses, but I'll wait for the test attempt to time out. Except, of those 18, "theeba(a)cultureisaweapon.org" is definitely undeliverable, so I just now removed it from the roster (to clean things up just that little bit more).

1 2

27 balug-announce subscribers newly in "B" status
by Rick Moen 24 Aug '22

24 Aug '22

Here we have listed 27 subscribed addresses on balug-announce that on Sunday got delivery disabled, all at once, on account of too high a bounce score. Of those, three were special cases, resolved as follows: 1. glub-balug-talk(a)gmane.org (service moved to m.gmane-mx.org; see https://lars.ingebrigtsen.no/2020/01/15/news-gmane-org-is-now-news-gmane-io/): removed old subscription, sent invite to glub-balug-talk(a)m.gmane-mx.org 2. grep(a)oriole.sbay.org (gone; DNS doesn't resolve any more): removed 3. lobal(a)cds1.net: non-delivery notice says: "550 sorry, no mailbox here by that name": removed 4. Doug Lym <dlym(a)pop.vox.secureserver.net> a longtime friend of mine, is subscribed as "dlym(a)mail.sfpcug.org", which FQDN is a CNAME resolving to pop.vox.secureserver.net . I sent from rick(a)linuxmafia.com to his mail.sfpcug.org the following form message, which appears to have SMTP 250 delivered (in any event, did not generate DSN): From: Rick Moen <rick(a)linuxmafia.com> To: [recipient] Subject: Checking your BALUG subscription address's deliverability Greetings. Your address is subscribed to announcements mailing list balug-announce(a)lists.balug.org, but lately has been undeliverable, so this is a test message to verify you're still reachable. Apologies for any intrusion. This is the best way I could think of to check. -- Rick Moen Bay Area Linux User Group listadmin 5 through 27: Likewise, I sent the same form mail to the remaining 23 subscribers, listed below with fullnames where known: Art McGee <amcgee(a)virtualidentity.org> btimberl(a)student.santarosa.edu cmsclaud(a)arches.uga.edu Dan Lyke <danlyke(a)chattanooga.net> Will Lowe <harpo(a)thebackrow.net> Jason Corcoran <jason(a)jcorcoran.net> jsmith4(a)student.santarosa.edu jtbolton(a)digizen.net kevinchi(a)tp.silkera.net Laurie Pennisi <lpennisi(a)student.santarosa.edu> Andru Luvisi <luvisi(a)andru.sonoma.edu> Mark Terranova <mark(a)gidgetkitchen.org> mditter(a)student.santarosa.edu Mike Higashi <mhigashi(a)hooked.net> Neil J. Gunther <ngunther(a)ricochet.net> rhernand(a)student.santarosa.edu shart(a)blacklight.net Heather Stern <star(a)starshine.org> sugo(a)pescaralug.org theeba(a)cultureisaweapon.org Travis Hassloch <travis+ml-balug-announce(a)subspacefield.org> Travis Hassloch <travis+ml-balug-talk(a)subspacefield.org> vdow(a)unex.berkeley.edu As with my mail to Doug Lym, all of my test mails to those appear to have gone through. Michael P., AFAIK, only you have the MTA/MLM log file access on the BALUG host necessary to determine why these subscribers' mail is generating bounce scores. Therefore, I am ending my investigation with the problem left open, unless someone can think of another route forward. That leaves subscribers 4-27 (above) in "B" status, delivery disabled owing to high bounce scores, and likely eventually to get unsubscribed. ----- Forwarded message from mailman(a)lists.balug.org ----- Date: Sun, 21 Aug 2022 00:38:48 +0000 From: mailman(a)lists.balug.org To: balug-announce-owner(a)lists.balug.org Subject: Bounce action notification X-Spam-Status: No, score=-2.6 required=4.0 tests=BAYES_00,MAILING_LIST_MULTI, NO_REAL_NAME,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham version=3.3.1 This is a Mailman mailing list bounce action notice: List: BALUG-Announce Member: sugo(a)pescaralug.org Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.balug.org. Received: from Debian-exim by balug-sf-lug-v2.balug.org with local (Exim 4.92) id 1oPYuV-0007SV-Hf for balug-announce-bounces(a)lists.balug.org; Sun, 21 Aug 2022 00:33:51 +0000 X-Failed-Recipients: amcgee(a)virtualidentity.org, ngunther(a)ricochet.net, mark(a)gidgetkitchen.org, grep(a)oriole.sbay.org, star(a)starshine.org, kevinchi(a)tp.silkera.net, jtbolton(a)digizen.net, travis+ml-balug-announce(a)subspacefield.org, travis+ml-balug-talk(a)subspacefield.org, glub-balug-talk(a)gmane.org, jason(a)jcorcoran.net, shart(a)blacklight.net, sugo(a)pescaralug.org, lobal(a)cds1.net, dlym(a)pop.vox.secureserver.net, danlyke(a)chattanooga.net, theeba(a)cultureisaweapon.org, harpo(a)thebackrow.net, mhigashi(a)hooked.net Auto-Submitted: auto-replied From: Mail Delivery System <Mailer-Daemon(a)balug.org> To: balug-announce-bounces(a)lists.balug.org Content-Type: multipart/report; report-type=delivery-status; boundary=1661042031-eximdsn-619765593 MIME-Version: 1.0 Subject: Mail delivery failed: returning message to sender Message-Id: <E1oPYuV-0007SV-Hf(a)balug-sf-lug-v2.balug.org> Date: Sun, 21 Aug 2022 00:33:51 +0000 This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: amcgee(a)virtualidentity.org retry timeout exceeded ngunther(a)ricochet.net retry timeout exceeded mark(a)gidgetkitchen.org retry timeout exceeded grep(a)oriole.sbay.org retry timeout exceeded star(a)starshine.org retry timeout exceeded kevinchi(a)tp.silkera.net retry timeout exceeded jtbolton(a)digizen.net retry timeout exceeded travis+ml-balug-announce(a)subspacefield.org host c.mx.subspacefield.org [64.156.192.217] retry timeout exceeded travis+ml-balug-talk(a)subspacefield.org host c.mx.subspacefield.org [64.156.192.217] retry timeout exceeded glub-balug-talk(a)gmane.org retry timeout exceeded jason(a)jcorcoran.net host jcorcoran.net [34.102.136.180] retry timeout exceeded shart(a)blacklight.net host mail.blacklight.net [35.163.141.36] SMTP error from remote mail server after initial connection: 451 http://www.barracudanetworks.com/reputation/?pr=1&ip=96.86.170.229: retry timeout exceeded sugo(a)pescaralug.org retry timeout exceeded lobal(a)cds1.net host mail.cds1.net [74.208.12.112] retry timeout exceeded dlym(a)pop.vox.secureserver.net (generated from dlym(a)mail.sfpcug.org) retry timeout exceeded danlyke(a)chattanooga.net retry timeout exceeded theeba(a)cultureisaweapon.org host cultureisaweapon.org [183.181.85.9] SMTP error from remote mail server after RCPT TO:<theeba(a)cultureisaweapon.org>: 454 4.7.1 <theeba(a)cultureisaweapon.org>: Relay access denied: retry timeout exceeded harpo(a)thebackrow.net retry timeout exceeded mhigashi(a)hooked.net retry timeout exceeded Reporting-MTA: dns; balug-sf-lug-v2.balug.org Action: failed Final-Recipient: rfc822;mhigashi(a)hooked.net Status: 5.0.0 Action: failed Final-Recipient: rfc822;harpo(a)thebackrow.net Status: 5.0.0 Action: failed Final-Recipient: rfc822;theeba(a)cultureisaweapon.org Status: 5.0.0 Remote-MTA: dns; cultureisaweapon.org Diagnostic-Code: smtp; 454 4.7.1 <theeba(a)cultureisaweapon.org>: Relay access denied: retry timeout exceeded Action: failed Final-Recipient: rfc822;danlyke(a)chattanooga.net Status: 5.0.0 Action: failed Final-Recipient: rfc822;dlym(a)pop.vox.secureserver.net Status: 5.0.0 Action: failed Final-Recipient: rfc822;lobal(a)cds1.net Status: 5.0.0 Remote-MTA: dns; mail.cds1.net Action: failed Final-Recipient: rfc822;sugo(a)pescaralug.org Status: 5.0.0 Action: failed Final-Recipient: rfc822;shart(a)blacklight.net Status: 5.0.0 Remote-MTA: dns; mail.blacklight.net Diagnostic-Code: smtp; 451 http://www.barracudanetworks.com/reputation/?pr=1&ip=96.86.170.229: retry timeout exceeded Action: failed Final-Recipient: rfc822;jason(a)jcorcoran.net Status: 5.0.0 Remote-MTA: dns; jcorcoran.net Action: failed Final-Recipient: rfc822;glub-balug-talk(a)gmane.org Status: 5.0.0 Action: failed Final-Recipient: rfc822;travis+ml-balug-talk(a)subspacefield.org Status: 5.0.0 Remote-MTA: dns; c.mx.subspacefield.org Action: failed Final-Recipient: rfc822;travis+ml-balug-announce(a)subspacefield.org Status: 5.0.0 Remote-MTA: dns; c.mx.subspacefield.org Action: failed Final-Recipient: rfc822;jtbolton(a)digizen.net Status: 5.0.0 Action: failed Final-Recipient: rfc822;kevinchi(a)tp.silkera.net Status: 5.0.0 Action: failed Final-Recipient: rfc822;star(a)starshine.org Status: 5.0.0 Action: failed Final-Recipient: rfc822;grep(a)oriole.sbay.org Status: 5.0.0 Action: failed Final-Recipient: rfc822;mark(a)gidgetkitchen.org Status: 5.0.0 Action: failed Final-Recipient: rfc822;ngunther(a)ricochet.net Status: 5.0.0 Action: failed Final-Recipient: rfc822;amcgee(a)virtualidentity.org Status: 5.0.0 Return-path: <balug-announce-bounces(a)lists.balug.org> Received: from localhost ([127.0.0.1] helo=balug.org) by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92) (envelope-from <balug-announce-bounces(a)lists.balug.org>) id 1oO5xs-00055p-Aa; Tue, 16 Aug 2022 23:27:16 +0000 Received: from shell1.rawbw.com ([198.144.192.42]) by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92) (envelope-from <Michael.Paoli(a)cal.berkeley.edu>) id 1oO5xq-00055f-DK for balug-announce(a)lists.balug.org; Tue, 16 Aug 2022 23:27:14 +0000 Received: from mail1.rawbw.com (mail1.rawbw.com [198.144.192.43]) by shell1.rawbw.com (8.15.1/8.15.1) with ESMTP id 27GNRBvD052143; Tue, 16 Aug 2022 16:27:11 -0700 (PDT) (envelope-from Michael.Paoli(a)cal.berkeley.edu) Received: from h199-255-45-4.hgst.com (h199-255-45-4.hgst.com [199.255.45.4]) by webmail.rawbw.com (Horde Framework) with HTTP; Tue, 16 Aug 2022 16:27:11 -0700 Message-ID: <20220816162711.87896zn2932vipcs(a)webmail.rawbw.com> Date: Tue, 16 Aug 2022 16:27:11 -0700 From: "Michael Paoli" <Michael.Paoli(a)cal.berkeley.edu> To: BALUG-Announce <balug-announce(a)lists.balug.org> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.2.1-RC1) Received-SPF: none client-ip=198.144.192.42; envelope-from=Michael.Paoli(a)cal.berkeley.edu; helo=shell1.rawbw.com Subject: [BALUG-Announce] BALUG - no meeting today! X-BeenThere: balug-announce(a)lists.balug.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Announcements for and by BALUG <balug-announce.lists.balug.org> List-Unsubscribe: <https://lists.balug.org/cgi-bin/mailman/options/balug-announce>, <mailto:balug-announce-request@lists.balug.org?subject=unsubscribe> List-Archive: <https://lists.balug.org/pipermail/balug-announce/> List-Post: <mailto:balug-announce@lists.balug.org> List-Help: <mailto:balug-announce-request@lists.balug.org?subject=help> List-Subscribe: <https://lists.balug.org/cgi-bin/mailman/listinfo/balug-announce>, <mailto:balug-announce-request@lists.balug.org?subject=subscribe> Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="Yes" Errors-To: balug-announce-bounces(a)lists.balug.org Sender: "BALUG-Announce" <balug-announce-bounces(a)lists.balug.org> BALUG - no meeting today! Sorry, no meeting today. Watch this list and/or check the web site for updates. https://www.balug.org/#Meetings-upcoming _______________________________________________ BALUG-Announce mailing list BALUG-Announce(a)lists.balug.org https://lists.balug.org/cgi-bin/mailman/listinfo/balug-announce ----- End forwarded message ----- ----- Forwarded message from mailman(a)lists.balug.org ----- Date: Sat, 20 Aug 2022 23:53:47 +0000 From: mailman(a)lists.balug.org To: balug-announce-owner(a)lists.balug.org Subject: Bounce action notification X-Spam-Status: No, score=-2.6 required=4.0 tests=BAYES_00,MAILING_LIST_MULTI, NO_REAL_NAME,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham version=3.3.1 This is a Mailman mailing list bounce action notice: List: BALUG-Announce Member: vdow(a)unex.berkeley.edu Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.balug.org. Received: from Debian-exim by balug-sf-lug-v2.balug.org with local (Exim 4.92) id 1oPYHj-00075j-6Q for balug-announce-bounces(a)lists.balug.org; Sat, 20 Aug 2022 23:53:47 +0000 X-Failed-Recipients: cmsclaud(a)arches.uga.edu, vdow(a)unex.berkeley.edu, btimberl(a)student.santarosa.edu, lpennisi(a)student.santarosa.edu, rhernand(a)student.santarosa.edu, jsmith4(a)student.santarosa.edu, mditter(a)student.santarosa.edu, luvisi(a)andru.sonoma.edu Auto-Submitted: auto-replied From: Mail Delivery System <Mailer-Daemon(a)balug.org> To: balug-announce-bounces(a)lists.balug.org Content-Type: multipart/report; report-type=delivery-status; boundary=1661039627-eximdsn-1811577007 MIME-Version: 1.0 Subject: Mail delivery failed: returning message to sender Message-Id: <E1oPYHj-00075j-6Q(a)balug-sf-lug-v2.balug.org> Date: Sat, 20 Aug 2022 23:53:47 +0000 This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: cmsclaud(a)arches.uga.edu retry timeout exceeded vdow(a)unex.berkeley.edu retry timeout exceeded btimberl(a)student.santarosa.edu retry timeout exceeded lpennisi(a)student.santarosa.edu retry timeout exceeded rhernand(a)student.santarosa.edu retry timeout exceeded jsmith4(a)student.santarosa.edu retry timeout exceeded mditter(a)student.santarosa.edu retry timeout exceeded luvisi(a)andru.sonoma.edu retry timeout exceeded Reporting-MTA: dns; balug-sf-lug-v2.balug.org Action: failed Final-Recipient: rfc822;luvisi(a)andru.sonoma.edu Status: 5.0.0 Action: failed Final-Recipient: rfc822;mditter(a)student.santarosa.edu Status: 5.0.0 Action: failed Final-Recipient: rfc822;jsmith4(a)student.santarosa.edu Status: 5.0.0 Action: failed Final-Recipient: rfc822;rhernand(a)student.santarosa.edu Status: 5.0.0 Action: failed Final-Recipient: rfc822;lpennisi(a)student.santarosa.edu Status: 5.0.0 Action: failed Final-Recipient: rfc822;btimberl(a)student.santarosa.edu Status: 5.0.0 Action: failed Final-Recipient: rfc822;vdow(a)unex.berkeley.edu Status: 5.0.0 Action: failed Final-Recipient: rfc822;cmsclaud(a)arches.uga.edu Status: 5.0.0 Return-path: <balug-announce-bounces(a)lists.balug.org> Received: from localhost ([127.0.0.1] helo=balug.org) by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92) (envelope-from <balug-announce-bounces(a)lists.balug.org>) id 1oO5xs-00055p-5m; Tue, 16 Aug 2022 23:27:16 +0000 Received: from shell1.rawbw.com ([198.144.192.42]) by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92) (envelope-from <Michael.Paoli(a)cal.berkeley.edu>) id 1oO5xq-00055f-DK for balug-announce(a)lists.balug.org; Tue, 16 Aug 2022 23:27:14 +0000 Received: from mail1.rawbw.com (mail1.rawbw.com [198.144.192.43]) by shell1.rawbw.com (8.15.1/8.15.1) with ESMTP id 27GNRBvD052143; Tue, 16 Aug 2022 16:27:11 -0700 (PDT) (envelope-from Michael.Paoli(a)cal.berkeley.edu) Received: from h199-255-45-4.hgst.com (h199-255-45-4.hgst.com [199.255.45.4]) by webmail.rawbw.com (Horde Framework) with HTTP; Tue, 16 Aug 2022 16:27:11 -0700 Message-ID: <20220816162711.87896zn2932vipcs(a)webmail.rawbw.com> Date: Tue, 16 Aug 2022 16:27:11 -0700 From: "Michael Paoli" <Michael.Paoli(a)cal.berkeley.edu> To: BALUG-Announce <balug-announce(a)lists.balug.org> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.2.1-RC1) Received-SPF: none client-ip=198.144.192.42; envelope-from=Michael.Paoli(a)cal.berkeley.edu; helo=shell1.rawbw.com Subject: [BALUG-Announce] BALUG - no meeting today! X-BeenThere: balug-announce(a)lists.balug.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Announcements for and by BALUG <balug-announce.lists.balug.org> List-Unsubscribe: <https://lists.balug.org/cgi-bin/mailman/options/balug-announce>, <mailto:balug-announce-request@lists.balug.org?subject=unsubscribe> List-Archive: <https://lists.balug.org/pipermail/balug-announce/> List-Post: <mailto:balug-announce@lists.balug.org> List-Help: <mailto:balug-announce-request@lists.balug.org?subject=help> List-Subscribe: <https://lists.balug.org/cgi-bin/mailman/listinfo/balug-announce>, <mailto:balug-announce-request@lists.balug.org?subject=subscribe> Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="Yes" Errors-To: balug-announce-bounces(a)lists.balug.org Sender: "BALUG-Announce" <balug-announce-bounces(a)lists.balug.org> BALUG - no meeting today! Sorry, no meeting today. Watch this list and/or check the web site for updates. https://www.balug.org/#Meetings-upcoming _______________________________________________ BALUG-Announce mailing list BALUG-Announce(a)lists.balug.org https://lists.balug.org/cgi-bin/mailman/listinfo/balug-announce ----- End forwarded message -----

1 0

kwz@eecs.berkeley.edu -> zimmkw@gmail.com aliasing won't work
by Rick Moen 18 Aug '22

18 Aug '22

Hi, Kevin. You've apparently for some time had kwz(a)eecs.berkeley.edu subscribed to the balug-announce(a)lists.balug.org mailing list, and at some point caused the berkeley.edu address to redirect, as some sort of SMTP alias, to your GMail account. Please be advised that, in 2022, that will not work, and will cause mass-rejection of mail, because it will trigger antiforgery defences. If I were you, I would change _all_ such subscriptions you may have, to eliminate the redirection mechanism. Accordingly, I am removing your kwz(a)eecs.berkeley.edu subscription from balug-announce, and having GNU Mailman at lists.balug.org send an "invitation" easy-subscribe offer to Kevin Zimmerman <zimmkw(a)gmail.com>, in case you still wish to be on balug-announce from _that_ address. -- Rick Moen for the BALUG listadmin team ----- Forwarded message from mailman(a)lists.balug.org ----- Date: Tue, 16 Aug 2022 23:27:37 +0000 From: mailman(a)lists.balug.org To: balug-announce-owner(a)lists.balug.org Subject: Bounce action notification X-Spam-Status: No, score=-0.8 required=4.0 tests=BAYES_00,J_CHICKENPOX_24, J_CHICKENPOX_34,J_CHICKENPOX_54,MAILING_LIST_MULTI,NO_REAL_NAME,SPF_PASS, T_SCC_BODY_TEXT_LINE,T_TVD_MIME_NO_HEADERS autolearn=no version=3.3.1 This is a Mailman mailing list bounce action notice: List: BALUG-Announce Member: kwz(a)eecs.berkeley.edu Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.balug.org. Received: from alias1.eecs.berkeley.edu ([169.229.60.89]) by balug-sf-lug-v2.balug.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) id 1oO5yC-00056R-Up for balug-announce-bounces(a)lists.balug.org; Tue, 16 Aug 2022 23:27:37 +0000 Received: from localhost (localhost) by alias1.EECS.Berkeley.EDU (8.14.7/8.14.7) id 27GNRa4t017612; Tue, 16 Aug 2022 16:27:36 -0700 Date: Tue, 16 Aug 2022 16:27:36 -0700 From: Mail Delivery Subsystem <MAILER-DAEMON(a)alias1.EECS.Berkeley.EDU> Message-Id: <202208162327.27GNRa4t017612(a)alias1.EECS.Berkeley.EDU> To: <balug-announce-bounces(a)lists.balug.org> MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="27GNRa4t017612.1660692456/alias1.EECS.Berkeley.EDU" Subject: Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) Received-SPF: none client-ip=169.229.60.89; helo=alias1.EECS.Berkeley.EDU The original message was received at Tue, 16 Aug 2022 16:27:35 -0700 from mail-pj1-f71.google.com [209.85.216.71] ----- The following addresses had permanent fatal errors ----- zimmkw(a)gmail.com (reason: 550-5.7.26 The MAIL FROM domain [lists.balug.org] has an SPF record with a hard) (expanded from: <kwz(a)eecs.berkeley.edu>) ----- Transcript of session follows ----- ... while talking to gmail-smtp-in.l.google.com.: >>> DATA <<< 550-5.7.26 The MAIL FROM domain [lists.balug.org] has an SPF record with a hard <<< 550-5.7.26 fail policy (-all) but it fails to pass SPF checks with the ip: <<< 550-5.7.26 [169.229.60.89]. To best protect our users from spam and phishing, <<< 550-5.7.26 the message has been blocked. Please visit <<< 550-5.7.26 https://support.google.com/mail/answer/81126#authentication for more <<< 550 5.7.26 information. m6-20020a654c86000000b0041a680d2831si3917481pgt.488 - gsmtp 554 5.0.0 Service unavailable Reporting-MTA: dns; alias1.EECS.Berkeley.EDU Received-From-MTA: DNS; mail-pj1-f71.google.com Arrival-Date: Tue, 16 Aug 2022 16:27:35 -0700 Final-Recipient: RFC822; kwz(a)eecs.berkeley.edu X-Actual-Recipient: RFC822; zimmkw(a)gmail.com Action: failed Status: 5.7.26 Remote-MTA: DNS; gmail-smtp-in.l.google.com Diagnostic-Code: SMTP; 550-5.7.26 The MAIL FROM domain [lists.balug.org] has an SPF record with a hard Last-Attempt-Date: Tue, 16 Aug 2022 16:27:36 -0700 Return-Path: <balug-announce-bounces(a)lists.balug.org> Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) by alias1.EECS.Berkeley.EDU (8.14.7/8.14.7) with ESMTP id 27GNRY4u017610 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=FAIL) for <kwz(a)eecs.berkeley.edu>; Tue, 16 Aug 2022 16:27:35 -0700 Received: by mail-pj1-f71.google.com with SMTP id pb16-20020a17090b3c1000b001faa88acd6bso762655pjb.8 for <kwz(a)eecs.berkeley.edu>; Tue, 16 Aug 2022 16:27:34 -0700 (PDT) X-Gm-Message-State: ACgBeo1pYXrp4zDShDe7BOUfQ7xPK1xN4mqfDU7F60HDPb/034+m0ZaH DMP3CSVFBFeR4QB8hVsBo8XduOpsqNXB6PMdwEMfhsld5iBCH6InMAXPR3VbdJnuMIwu6hIFOHT 4OiZwzWE3 X-Received: by 2002:a05:6a00:9a7:b0:52d:bbf9:c3d5 with SMTP id u39-20020a056a0009a700b0052dbbf9c3d5mr23072011pfg.9.1660692454372; Tue, 16 Aug 2022 16:27:34 -0700 (PDT) X-Google-Smtp-Source: AA6agR7Uc1aDs94xTJhJD/CI2lVEUqKhV/KS58cwnlyBuvu8NG4CRmm1SLwcJjd+a201ltDfwPTW X-Received: by 2002:a05:6a00:9a7:b0:52d:bbf9:c3d5 with SMTP id u39-20020a056a0009a700b0052dbbf9c3d5mr23071966pfg.9.1660692453481; Tue, 16 Aug 2022 16:27:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1660692453; cv=none; d=google.com; s=arc-20160816; b=rcR+hB4jypN6W54cBOMM+t+usBqa4dUaY68sIxzN4iPY+vHlf33tAKnfpiXWGrrt1q rqIJY91P6MzHz6eZYYh31kdRbP/tuHD/5JX7EVbytsjgtDD7it/feVYTv+5XWkPqzj0R nfaq6A6yBubS9lfH+KRrYOcJ/63LA/nkZHGhIgrP3lKKddN9bsQJA5noEMW8dwgWK9ZZ r0oIlsgpzK2sPo39Ta8zL1FgaFjhiCEsDyLLyLIkx7/nzAeW3n7YSe8jsZJlhvrVgd6r HyuEkwgtw6CwP0wflii1S+u0D6IJFB4M6VgsFndsVXNgfdOFq3LBOK5xaINv4LFDgSv6 jdnA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :user-agent:content-disposition:mime-version:to:from:date:message-id; bh=kTlwa6ozGJEOTtMziUyaBp+BMfQOf5OA8o2Js/bHR4M=; b=mAHUu+fYVQ49eRbzajXUz+HUjU8TRTOUwentN+cG6l7FgMzm8ymZ640GkzNVJXIfHX 32IrGD1XGLRvib11JXsq2rvS+AdYjgbB6w6GHDfcsOBRu8ubaTFEVAzPKvQrTytG6Vil hJH2R50dPw2tEt5koVaXb3F6Px/R7Gm/kJHIZlbqGYiActZR3GXAs4/8zs+X6Uv/ZsVu lJcHDCqiJ0k2bQ5WLpc3CQgK+YvK/wlHBGR0rSKHLBNnx5gSfIXUNuGir+plVf2+69Am 1VG0x0v4iMzdb7meg0lmxYujt/kux0mHAYw/ZQTyZ0201NIblT5k+Gn0J1Ljm5FA1Lom d8rQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of balug-announce-bounces(a)lists.balug.org designates 96.86.170.229 as permitted sender) smtp.mailfrom=balug-announce-bounces(a)lists.balug.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=berkeley.edu Received: from balug-sf-lug-v2.balug.org (balug.org. [96.86.170.229]) by mx.google.com with ESMTPS id v35-20020a631523000000b0041bf61feb91si15079031pgl.875.2022.08.16.16.27.33 for <kwz(a)eecs.berkeley.edu> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Aug 2022 16:27:33 -0700 (PDT) Received-SPF: pass (google.com: domain of balug-announce-bounces(a)lists.balug.org designates 96.86.170.229 as permitted sender) client-ip=96.86.170.229; Authentication-Results: mx.google.com; spf=pass (google.com: domain of balug-announce-bounces(a)lists.balug.org designates 96.86.170.229 as permitted sender) smtp.mailfrom=balug-announce-bounces(a)lists.balug.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=berkeley.edu Received: from localhost ([127.0.0.1] helo=balug.org) by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92) (envelope-from <balug-announce-bounces(a)lists.balug.org>) id 1oO5xs-00055p-5m; Tue, 16 Aug 2022 23:27:16 +0000 Received: from shell1.rawbw.com ([198.144.192.42]) by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92) (envelope-from <Michael.Paoli(a)cal.berkeley.edu>) id 1oO5xq-00055f-DK for balug-announce(a)lists.balug.org; Tue, 16 Aug 2022 23:27:14 +0000 Received: from mail1.rawbw.com (mail1.rawbw.com [198.144.192.43]) by shell1.rawbw.com (8.15.1/8.15.1) with ESMTP id 27GNRBvD052143; Tue, 16 Aug 2022 16:27:11 -0700 (PDT) (envelope-from Michael.Paoli(a)cal.berkeley.edu) Received: from h199-255-45-4.hgst.com (h199-255-45-4.hgst.com [199.255.45.4]) by webmail.rawbw.com (Horde Framework) with HTTP; Tue, 16 Aug 2022 16:27:11 -0700 Message-ID: <20220816162711.87896zn2932vipcs(a)webmail.rawbw.com> Date: Tue, 16 Aug 2022 16:27:11 -0700 From: "Michael Paoli" <Michael.Paoli(a)cal.berkeley.edu> To: BALUG-Announce <balug-announce(a)lists.balug.org> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Internet Messaging Program (IMP) H3 (4.2.1-RC1) Received-SPF: none client-ip=198.144.192.42; envelope-from=Michael.Paoli(a)cal.berkeley.edu; helo=shell1.rawbw.com Subject: [BALUG-Announce] BALUG - no meeting today! X-BeenThere: balug-announce(a)lists.balug.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Announcements for and by BALUG <balug-announce.lists.balug.org> List-Unsubscribe: <https://lists.balug.org/cgi-bin/mailman/options/balug-announce>, <mailto:balug-announce-request@lists.balug.org?subject=unsubscribe> List-Archive: <https://lists.balug.org/pipermail/balug-announce/> List-Post: <mailto:balug-announce@lists.balug.org> List-Help: <mailto:balug-announce-request@lists.balug.org?subject=help> List-Subscribe: <https://lists.balug.org/cgi-bin/mailman/listinfo/balug-announce>, <mailto:balug-announce-request@lists.balug.org?subject=subscribe> Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="Yes" Errors-To: balug-announce-bounces(a)lists.balug.org Sender: "BALUG-Announce" <balug-announce-bounces(a)lists.balug.org> X-Scanned-By: MIMEDefang 2.86 on 169.229.60.89 ----- End forwarded message -----

1 0

BALUG: Lists, stats, etc.
by Michael Paoli 03 Aug '22

03 Aug '22

dates, lists, number of members: YYYY-MM-DD announce talk admin 2022-08-01 616 249 33 2022-07-01 834 260 35 2022-06-01 832 259 35 2022-05-01 832 259 35 2022-04-01 832 259 35 2022-03-01 833 259 35 2022-02-01 833 259 35 2022-01-01 833 258 35 2021-12-01 832 257 35 2021-11-01 831 257 35 2021-10-01 832 257 35 2021-09-01 832 257 35 2021-08-01 832 257 35 2021-07-01 832 257 35 2021-06-01 832 256 35 2021-05-01 833 257 35 2021-04-01 832 259 35 2021-03-01 833 259 35 2021-02-01 833 259 35 2021-01-01 833 259 35 2020-12-01 832 259 35 2020-11-01 833 260 35 2020-10-01 834 260 35 2020-09-01 835 260 35 2020-08-01 834 259 34 2020-07-01 834 266 34 2020-06-01 838 266 34 2020-05-01 839 267 34 2020-04-01 840 270 34 2020-03-01 840 271 34 2020-02-01 841 271 34 2020-01-01 841 271 34 2019-12-01 841 271 34 2019-11-01 840 271 34 2019-10-01 842 271 34 2019-09-01 844 272 34 2019-08-01 847 272 34 2019-07-01 852 272 36 2019-06-01 854 273 37 2019-05-01 856 272 38 2019-04-01 853 273 38 2019-03-01 851 273 38 2019-02-01 853 273 38 2019-01-01 856 274 38 2018-12-01 858 274 38 2018-11-01 861 274 39 2018-10-02 862 274 39 2018-09-01 864 274 38 2018-07-28 866 278 38 2018-06-08 870 282 38 2018-04-28 875 282 38 2018-02-17 880 283 36 2017-11-04 883 284 36 2017-08-19 897 293 37 2017-07-01 897 297 38 2017-05-27 897 297 38 2017-05-16 897 296 38 2017-04-01 896 297 38 2017-03-30 885 297 38 2016-05-03 886 291 39 2016-04-03 887 290 39 2016-03-05 888 291 45 2016-01-05 887 295 45 2015-12-05 887 296 45 2015-11-07 887 301 45 2015-10-06 888 301 45 2015-09-05 887 301 45 2015-08-04 888 301 45 2015-07-03 888 300 45 2015-06-05 888 301 46 2015-05-02 885 298 45 2015-04-04 884 297 44 2015-03-07 886 298 44 2015-02-06 885 303 44 2015-01-07 885 304 45 2014-12-06 886 304 45 2014-11-01 884 302 45 2014-10-04 881 303 46 2014-09-06 878 309 44 2014-06-13 875 307 44 2014-05-02 874 306 44 2014-04-04 876 306 44 2014-03-01 876 306 43 2014-01-11 872 305 42 2013-10-05 854 293 40 2013-08-31 855 295 41 2013-07-20 852 297 40 2013-04-10 838 286 41 2013-03-03 841 289 41 2013-02-02 843 291 41 2012-12-15 845 310 41 2012-03-23 818 310 39 2012-02-01 813 307 40 2011-04-28 768 291 37 2011-02-27 762 288 36 2010-05-02 730 289 34 2010-04-01 727 291 33 2010-03-16 727 293 33 2009-12-16 716 290 33 2009-09-09 700 288 32 2009-03-27 677 287 29 2009-01-10 662 290 30 2008-08-17 635 290 29 2008-03-03 571 247 28 2008-01-02 337 260 28 2007-12-28 336 261 28 2007-09-03 264 258 27 2007-07-24 287 256 27 2007-06-17 280 249 27 references: http://www.balug.org/#Lists

2 3

(forw) Bounce action notification
by Rick Moen 31 Jul '22

31 Jul '22

It took me a moment to figure this out, because I was in a security talk at SCaLE 19x and was distracted. Hoover Chan did something that many people think is a good idea, but is not: Hoover subscribed "hchan(a)mail.ewind.com" but set that mailbox to forward to his GMail mailbox, hoover.chan(a)gmail.com . Hoover, sorry, in 2022 you can no longer do mail forwarding with wild abandon, because of increasing deployment of anti-forgery blocking technologies (SPF and DMARC). In this case, my posting to balug-admin was processed by list.balug.org and re-mailed to all subscribers including your hchan(a)mail.ewind.com . Host nephoscale.ewind.com (IP 198.89.112.140) tried re-lobbing your subscriber copy to GMail, which rejected it because IP 198.89.112.140 is not a permitted originator for mail from domain balug.org, i.e., that IP as an SMTP source violates balug.org's SPF and DMARC declarations. I am deleting your subscriptions of hchan(a)mail.ewind.com from balug-admin and from any other BALUG mailing list it might be on. (I haven't yet checked the other three.) I will also have Mailman send an "invitation" to quick-subscribe Hoover Chan <hoover.chan(a)gmail.com> , if you so wish. Please review your subscriptions to any _other_ mailing lists, and stop relying on hchan(a)mail.ewind.com -> hoover.chan(a)gmail.com forwarding. You really cannot rely on that, any more. TY. -- Rick Moen for the BALUG sysadmin team ----- Forwarded message from mailman(a)lists.balug.org ----- Date: Sat, 30 Jul 2022 20:35:00 +0000 From: mailman(a)lists.balug.org To: balug-admin-owner(a)lists.balug.org Subject: Bounce action notification X-Spam-Status: No, score=-2.6 required=4.0 tests=BAYES_00,MAILING_LIST_MULTI, NO_REAL_NAME,SPF_PASS,T_TVD_MIME_NO_HEADERS autolearn=ham version=3.3.1 This is a Mailman mailing list bounce action notice: List: BALUG-Admin Member: hchan(a)mail.ewind.com Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.balug.org. Received: from static-198.89.112.140.nephohosting.com ([198.89.112.140] helo=nephoscale.ewind.com) by balug-sf-lug-v2.balug.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) id 1oHtAp-00053A-No for balug-admin-bounces(a)lists.balug.org; Sat, 30 Jul 2022 20:34:59 +0000 Received: from localhost (localhost) by nephoscale.ewind.com (8.14.4/8.14.4) id 26UKUlVD005544; Sat, 30 Jul 2022 13:30:47 -0700 Date: Sat, 30 Jul 2022 13:30:47 -0700 From: Mail Delivery Subsystem <MAILER-DAEMON(a)nephoscale.ewind.com> Message-Id: <202207302030.26UKUlVD005544(a)nephoscale.ewind.com> To: <balug-admin-bounces(a)lists.balug.org> MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="26UKUlVD005544.1659213047/nephoscale.ewind.com" Subject: Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) Received-SPF: none client-ip=198.89.112.140; helo=nephoscale.ewind.com The original message was received at Sat, 30 Jul 2022 13:30:41 -0700 from balug.org [96.86.170.229] ----- The following addresses had permanent fatal errors ----- hoover.chan(a)gmail.com (reason: 550-5.7.26 This message does not pass authentication checks (SPF and DKIM both) (expanded from: <hchan(a)mail.ewind.com>) ----- Transcript of session follows ----- ... while talking to gmail-smtp-in.l.google.com.: >>> DATA <<< 550-5.7.26 This message does not pass authentication checks (SPF and DKIM both <<< 550-5.7.26 do not pass). SPF check for [lists.balug.org] does not pass with ip: <<< 550-5.7.26 [198.89.112.140].To best protect our users from spam, the message <<< 550-5.7.26 has been blocked. Please visit <<< 550-5.7.26 https://support.google.com/mail/answer/81126#authentication for more <<< 550 5.7.26 information. f5-20020a62db05000000b0052c708707dbsi7062217pfg.121 - gsmtp 554 5.0.0 Service unavailable Reporting-MTA: dns; nephoscale.ewind.com Received-From-MTA: DNS; balug.org Arrival-Date: Sat, 30 Jul 2022 13:30:41 -0700 Final-Recipient: RFC822; hchan(a)mail.ewind.com X-Actual-Recipient: RFC822; hoover.chan(a)gmail.com Action: failed Status: 5.7.26 Remote-MTA: DNS; gmail-smtp-in.l.google.com Diagnostic-Code: SMTP; 550-5.7.26 This message does not pass authentication checks (SPF and DKIM both Last-Attempt-Date: Sat, 30 Jul 2022 13:30:42 -0700 Return-Path: <balug-admin-bounces(a)lists.balug.org> Received: from balug-sf-lug-v2.balug.org (balug.org [96.86.170.229]) by nephoscale.ewind.com (8.14.4/8.14.4) with ESMTP id 26UKUfVD005543 for <hchan(a)mail.ewind.com>; Sat, 30 Jul 2022 13:30:41 -0700 Received: from localhost ([127.0.0.1] helo=balug.org) by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92) (envelope-from <balug-admin-bounces(a)lists.balug.org>) id 1oHtAc-00052G-8o; Sat, 30 Jul 2022 20:34:46 +0000 Received: from linuxmafia.com ([96.95.217.99]) by balug-sf-lug-v2.balug.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from <rick(a)linuxmafia.com>) id 1oHtAZ-000526-W5 for balug-admin(a)lists.balug.org; Sat, 30 Jul 2022 20:34:44 +0000 Received: from rick by linuxmafia.com with local (Exim 4.72) (envelope-from <rick(a)linuxmafia.com>) id 1oHtAX-0001P2-QB for balug-admin(a)lists.balug.org; Sat, 30 Jul 2022 13:34:41 -0700 Date: Sat, 30 Jul 2022 13:34:41 -0700 From: Rick Moen <rick(a)linuxmafia.com> To: balug-admin(a)lists.balug.org Message-ID: <20220730203441.GI13985(a)linuxmafia.com> References: <20220726022507.GV13985(a)linuxmafia.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20220726022507.GV13985(a)linuxmafia.com> Organization: If you lived here, you'd be $HOME already. X-Mas: Bah humbug. X-Clacks-Overhead: GNU Terry Pratchett User-Agent: Mutt/1.5.20 (2009-06-14) X-SA-Exim-Connect-IP: <locally generated> X-SA-Exim-Mail-From: rick(a)linuxmafia.com X-SA-Exim-Scanned: No (on linuxmafia.com); SAEximRunCond expanded to false Received-SPF: pass client-ip=96.95.217.99; envelope-from=rick(a)linuxmafia.com; helo=linuxmafia.com Subject: Re: [BALUG-Admin] Spamtraps and http://www.uceprotect.net/en/rblcheck.php?ipr=96.86.170.229 X-BeenThere: balug-admin(a)lists.balug.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion among those who make BALUG work <balug-admin.lists.balug.org> List-Unsubscribe: <https://lists.balug.org/cgi-bin/mailman/options/balug-admin>, <mailto:balug-admin-request@lists.balug.org?subject=unsubscribe> List-Archive: <https://lists.balug.org/pipermail/balug-admin/> List-Post: <mailto:balug-admin@lists.balug.org> List-Help: <mailto:balug-admin-request@lists.balug.org?subject=help> List-Subscribe: <https://lists.balug.org/cgi-bin/mailman/listinfo/balug-admin>, <mailto:balug-admin-request@lists.balug.org?subject=subscribe> Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: balug-admin-bounces(a)lists.balug.org Sender: "BALUG-Admin" <balug-admin-bounces(a)lists.balug.org> ----- End forwarded message -----

2 2

Spamtraps and http://www.uceprotect.net/en/rblcheck.php?ipr=96.86.170.229
by Rick Moen 30 Jul '22

30 Jul '22

Michael, here's the thing that worries me, and the reason I concentrated on getting as much junk as possible out of the subscriber rosters. In a word, spamtraps. Spamtraps already subscribed, and still subscribed. http://www.uceprotect.net/en/rblcheck.php?ipr=96.86.170.229 , as an example of the (several) remaining DNSBL entries, says: What does it mean to be listed at the UCEPROTECT-Level 1? It means abusive activity was seen from IP 96.86.170.229 directly within the last 7 days. Concrete allegation: IP 96.86.170.229 tried to deliver mail to spamtraps. _If_ bogus subscriptions have been allowed in the past, then one or more of the subscriptions, to one or more of the four BALUG mailing lists, almost certainly are still spamtraps -- unless I lucked out and pruned them in my recent work. SO: The above-cited URL permits "express delisting" from the cited DNSBL -- with the caveat that if we haven't fixed the underlying problem, we'll soon get relisted. I would invite you to look over the situation, then tell me your thoughts about how/whether we can tell that we aren't going to get bogus subscriptions (without 3-way handshake) going forward, and that we don't have any spamtrap addresses remaining in the rosters. Worst case, if we're pretty sure that bogus subscriptions _have_ been possible, but we've scotched that, e.g., with the mm_cfg.py secret key for subscription forms, then we might have to bite the bullet and require all existing subscribers to re-confirm their desire to be present.

1 2

DNSBL listings for IP 96.86.170.229, recapped
by Rick Moen 26 Jul '22

26 Jul '22

Important: Create and use a login/password to more effectively use SORBS and get more-detailed info. SORBS dings the IP for spam and for spamvertising of URLs. The entries for spamvertising are shown as "Historic (Inactive)". Spam entries (4). The four entries were received on these date: 04:30:02 24 Apr 2021 GMT-04 04:30:01 24 Apr 2021 GMT-04 04:49:44 16 Apr 2021 GMT-04 17:07:50 12 Apr 2021 GMT-04 Claimed spam #2 was asserted to have spamvertised URL "j.mp". (Which doesn't matter, as that's inactive.) Apparently, delisting in this case will require opening a support ticket. Michael, you care to? Likewise, Barracuda Central does, in their case by filling out a Web form. https://www.barracudacentral.org/rbl/removal-request For DNSBL bl-h1.rbl.polspam.pl , I have no idea if there is a delisting method. For Barracuda Central, man, are they ever broken. https://www.barracudacentral.org/reputation?pr=1&ip=96.86.170.229 shows a blank page. The page for the all.s5h.net DNSRBL redirects to http://www.usenix.org.uk/content/rbl.html for removal information. Says you must visit http://www.usenix.org.uk/content/rblremove from the IP of the listed host -- e.g., by doing curl -4 http://www.usenix.org.uk/content/rblremove from the console. There is also a manual removal process, alternatively. dnsbl-1.uceprotect.net , we've already talked about, there being an express removal Web CGI, but with the warning that they consider us to have been guilty within the last 7 days of sending spam to a spamtrap. (We could wait a week, and see if my mass-removal happened to fix that.) black.dnsbl.brukalai.lt apparently uses the UCEPROTECT-Level 1 list, covered above.

1 0

RFC Ignorant DNSBL: removal requested from "postmaster" DNSBL
by Rick Moen 26 Jul '22

26 Jul '22

I used http://rfc-clueless.org/request/removal to request removal of the "postmaster" listing for FQDN balug.org, which indirectly caused the listing of lists.balug.org. The database entry shown at http://rfc-clueless.org/lookup/balug.org says that this was an entry on 2012-09-27 17:27:28, and was imported from Derek Balling's original postmaster.rfc-ignorant.org DNSBL, for which rfc-clueless.org is a replacement created when Balling's DNSBL went away. http://rfc-clueless.org/pages/removal_process says "You may only request removal from a given list once within a seven-day period".

1 0

Unauthenticated subscriptions to Mailman prior to v. 2.1.16
by Rick Moen 26 Jul '22

26 Jul '22

Here is what I was thinking of, a security weakness in Mailman's WebUI for subscribing, that permitted spammers to sneak arbitrary addresses onto a Mailman list's roster by generating forged POST datastreams from offsite. Description of the bugfix, which was merged starting 2.1.16rc1: There is a new mm_cfg.py setting SUBSCRIBE_FORM_SECRET which will put a dynamically generated, hidden hash in the listinfo subscribe form and check it upon submission. Setting this will prevent automated processes (bots) from successfully POSTing web subscribes without first retrieving and parsing the form from the listinfo page. The form must also be submitted no later than FORM_LIFETIME nor no earlier than SUBSCRIBE_FORM_MIN_TIME after retrieval. Note that enabling this will break any static subscribe forms on your site. See the description in Defaults.py for more info https://bugs.launchpad.net/mailman/+bug/1082746 https://mail.python.org/pipermail/mailman-users/2014-June/077202.html https://launchpad.net/mailman/+milestone/2.1.16rc1 SUBSCRIBE_FORM_SECRET must be set to "write your own string here" in mm_cfg.py (a site-specific hash written by the site admin. Mailman then embeds a CSRF (cross-site request forgery) token into its subscription form. Mailman will also enforce that the form be submitted at least five seconds after it was generated. Michael, please confirm that is set.

1 0

DMARC mitigation: already enabled (good!)
by Rick Moen 25 Jul '22

25 Jul '22

Upthread, I urged upgrading GNU Mailman so we got the ability to do a tailored DMARC mitigation aimed at just the asshat sending domains with p=reject or p=quarantine "strong" DMARC policies. It was late, I was tired, and I just assumed our version of Mailman (2.1.29) is too old for that feature, because there have a number of 2.1.x bugfix versions since then. Well... https://lists.balug.org/cgi-bin/mailman/admin/balug-announce/privacy/sender includes the desired Action to take when anyone posts to the list from a domain with a DMARC Reject/Quarantine Policy. ...setting, and the desired option "Munge From" is already selected. Accompanying item Shall the above dmarc_moderation_action apply to messages From: domains with DMARC p=quarantine as well as p=reject ...is likewise present and set to "yes" as desired. I have verified this is true of the other three balug-* lists, too. So, DMARC damage _is_ being handled as well as MLM software can. It still might be a good idea to look into what later packaged 2.1.x are available and feasible for this Debian release. I haven't checked the changelog, but worry that we're missing security bugfixes.

1 0

← Newer
1
...
4
5
6
7
8
9
10
...
54
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

BALUG-Admin