Re: Mailman's Approval Duties Denied Me.

[Bob Proulx]

Hello Ralph,

Ralph Corderoy wrote:
> Bob Proulx wrote:
> > I'll add those lists to the hands-off list and then no one will be
> > helping with those lists again.
>
> I got an email from Mailman today stating there was a reply to an
> announcement awaiting moderation.  It later appeared on announcement
> mailing list.
> http://lists.nongnu.org/archive/html/nmh-announce/2018-02/msg00001.html
> I didn't approve it so someone else still is, and wrongly since it
> shouldn't have made it through.

Not that I can tell.  I look at the mailing list configuration for
nmh-announce and I see immediate large problems.

The first is that most of the subscribers are not moderated.  Look at
the membership list pages and see that the "mod" bit is not set for
them.  I suggest triggering the "Set everyone's moderation bit,
including those members not currently visible" action be taken to set
the mod bit on for everyone.

The problem you saw today is that the sender of that message is in the
accept_these_nonmembers list.  Therefore mail for that address will be
shipped right through without delay.  I suggest clearing that list.
However that is the only address there.  That does suggest that
someone only recently (such as today maybe) approved that message from
the summary page and added that sender to the accept list.  Looks
suspicious.  Don't know more at the moment.

Another problem is that under the Privacy options, Sender filters page
it shows that new members will not be moderated by default.  This
means that any new subscriber to the list is allowed to immediately
post to the list and it will not be moderated.  I suggest turning that
setting on for all lists.  (Spammers often subscribe and then post
spam.  Therefore it should be on for all lists and not just
announcement lists.)  [Do this step first then the mod all from the
membership page second to order things such that no one could
subscribe in between those actions.]

Third if you suspect that someone else also has the password to the
mailing list admin interface then I suggest changing that password.
That will prevent anyone else other than you from being able to access
the web admin pages.  This won't affect the site Mailman admins (me or
the other admins) because we use the site password so feel free to
change the list specific password as you wish.

> I've turned on emergency list moderation in the hope that will flag up

Good.  That is always appropriate when there are such issues.

> to those helpers not to do anything.  Can you have a look and confirm it
> was one of their actions and not some other fault?

I have to run out the door right now but when I return in a couple of
hours I will scan through the site logs and see if I can find the log
concerning that particular message.  It is recent enough that it
should be there and it should point fingers somewhere.

Bob