Issue #5649: Two new spam e-mails - fedora-infrastructure

kevin commented 7 years ago

Both deleted, but would be good to figure out how they were posting.

I don't see that user subscribed.

Can you attach the headers you saw from one of those emails?

:mag_right:

bowlofeggs commented 7 years ago

Hey @kevin!

Another one got through:

https://lists.fedoraproject.org/archives/list/erlang@lists.fedoraproject.org/message/IPX6F4IUXNUBMWUVZPYBNYRK3BMSL42T/

Here are the headers for the new one:

Return-Path: <erlang-bounces@lists.fedoraproject.org>
X-Original-To: randy@electronsweatshop.com
Delivered-To: randy@electronsweatshop.com
Received: from bastion.fedoraproject.org (bastion01.fedoraproject.org
 [209.132.181.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256
 bits)) (No client certificate requested) by hatch.electronsweatshop.com
 (Postfix) with ESMTPS id BB27120CE18D for <randy@electronsweatshop.com>;
 Sat, 24 Dec 2016 13:15:41 -0500 (EST)
Received: from mailman01.phx2.fedoraproject.org
 (mailman01.phx2.fedoraproject.org [10.5.126.36]) by
 bastion01.phx2.fedoraproject.org (Postfix) with ESMTP id 59EDA6070D3B; Sat,
 24 Dec 2016 18:15:40 +0000 (UTC)
Received: from mailman01.phx2.fedoraproject.org (localhost [IPv6:::1])
        by mailman01.phx2.fedoraproject.org (Postfix) with ESMTP id 556B8387ACF68;
        Sat, 24 Dec 2016 18:15:40 +0000 (UTC)
Received: by mailman01.phx2.fedoraproject.org (Postfix, from userid 991)
        id 479D7387ACF6C; Sat, 24 Dec 2016 18:15:37 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
        hatch.electronsweatshop.com
X-Spam-Level: **
X-Spam-Status: No, score=2.3 required=5.0 tests=BAYES_00,DEAR_FRIEND,
 HEADER_FROM_DIFFERENT_DOMAINS,HK_NAME_DR,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,
 RDNS_NONE,SPF_HELO_PASS,UNPARSEABLE_RELAY,URIBL_BLOCKED autolearn=no
 autolearn_force=no version=3.4.0
Received: from smtp-mm-tummy01.fedoraproject.org
 (smtp-mm-tummy01.vpn.fedoraproject.org [192.168.1.82]) by
 mailman01.phx2.fedoraproject.org (Postfix) with ESMTP id 32115387ACF68 for
 <erlang@lists.fedoraproject.org>; Sat, 24 Dec 2016 18:15:36 +0000 (UTC)
Received: from pleasure.heomath.top (unknown [82.145.55.55])
        by smtp-mm-tummy01.fedoraproject.org (Postfix) with ESMTP id D6FF46087DF1
        for <erlang@lists.fedoraproject.org>; Sat, 24 Dec 2016 18:15:35 +0000 (UTC)
Date: Sat, 24 Dec 2016 11:15:34 -0700
Subject: Journals of Gerontology Study Finds Super Healthy Centenarians.
 What's Their Secret? 
From: Dr.Al@fedoraproject.org, Sears@fedoraproject.org,
        MD <DrAlSears-MD@pleasure.heomath.top>
To: <erlang@lists.fedoraproject.org>
Mime-Version: 1.0
Message-ID: <ff4b3f1de117f11d7dc5128843e01d6c.18259148.13428988erlang@lists.fedoraproject.org>
Message-ID-Hash: IPX6F4IUXNUBMWUVZPYBNYRK3BMSL42T
X-Message-ID-Hash: IPX6F4IUXNUBMWUVZPYBNYRK3BMSL42T
X-MailFrom: DrAlSears-MD@pleasure.heomath.top
X-Mailman-Rule-Hits: nonmember-moderation
X-Mailman-Rule-Misses: approved; emergency; loop; member-moderation;
 header-match-config-1; header-match-config-2; header-match-config-3;
 header-match-erlang.lists.fedoraproject.org-0
X-Mailman-Version: 3.1.0
Precedence: list
Reply-To: erlang@lists.fedoraproject.org
List-Id: <erlang.lists.fedoraproject.org>
Archived-At:
 <https://lists.fedoraproject.org/archives/list/erlang@lists.fedoraproject.org/message/IPX6F4IUXNUBMWUVZPYBNYRK3BMSL42T/>
List-Archive:
 <https://lists.fedoraproject.org/archives/list/erlang@lists.fedoraproject.org/>
List-Help: <mailto:erlang-request@lists.fedoraproject.org?subject=help>
List-Post: <mailto:erlang@lists.fedoraproject.org>
List-Subscribe: <mailto:erlang-join@lists.fedoraproject.org>
List-Unsubscribe: <mailto:erlang-leave@lists.fedoraproject.org>
Content-Type: multipart/mixed; boundary="===============3013249826168899182=="
X-Evolution-Source: 1465313777.24679.2@ohm.usersys.redhat.com

bowlofeggs commented 7 years ago

Odd that the From header has multiple addresses in it.

kevin commented 7 years ago

For some reason I cannot determine, mailman3 is accepting these emails when it shouldn't.

We are going to need to get @abompard to look further.

:christmas_tree:

abompard commented 7 years ago

In the list configuration, there's a setting called accept_these_nonmembers that is not accessible through the web UI, but was populated from the Mailman 2 configuration migration. This settings is regexps that included every @fedoraproject.org and @redhat.com. I've purged it, only members should be allowed to post to the list now.

abompard commented 7 years ago

In the list configuration, there's a setting called accept_these_nonmembers that is not accessible through the web UI, but was populated from the Mailman 2 configuration migration. This settings is regexps that included every @fedoraproject.org and @redhat.com. I've purged it, only members should be allowed to post to the list now.

bowlofeggs commented 7 years ago

Thanks @abompard!

fedora-infrastructure

#5649 Two new spam e-mails

Closed: Fixed 7 years ago Opened 7 years ago by bowlofeggs.

Metadata

fedora-infrastructure

Source Code

#5649 Two new spam e-mails Closed: Fixed 7 years ago Opened 7 years ago by bowlofeggs.

Metadata

lists

#5649 Two new spam e-mails

Closed: Fixed 7 years ago Opened 7 years ago by bowlofeggs.