SLUUG Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
copy UID and shadow passwords from Amber

Let's Encrypt
Webalyzer
fail2ban


>Summary: Archived mail being read by bots, which is not wanted.
>
>In investigating the recent e-mail security breach, I noticed the
>entire discuss list archive being read by bots, probably including
>e-mail address harvesting for spammer use.  This in spite of us
>thinking this had been blocked by password authentication to
>prevent this.  Apparently they found a back door that we missed.

Summary:  One back door path into archives blocked, the other pending.

Longer summary:  Apache configuration for www.stlwebdev.org is changed
to prevent that domain being used to access all mailing lists on
www.sluug.org without any password protection.  Remaining is to change
www.sluug.org to prevent it being used as a back door into www.stlwebdev.org
and also block the "htdig" path to bypass security.  The change is to
block all access by default, on both paths, then allow appropriate
access to specific lists.  See code below.

The change was to use <LocationMatch> to block all access or require
password.  This was specific to the Malman "htdig" tool.  I don't think
there are others, but if any of these are suspect, please investigate.
  admin    confirm  edithtml  listinfo  options  rmlist  subscribe
  admindb  create   htdig     mmsearch  private  roster

Feel free to test access to the webdev mailing lists works and that access
to the SLUUG lists are now blocked when using "stlwebdev.org".  If you
can find any other access holes that need to be plugged, speak up.
Attempting access to unauthorized lists results in a 403 error, which
isn't very friendly, but normal users shouldn't find these URLs to
receive the error anyway.  More friendly would be to redirect to an
error page with descriptive text.

Note that the configuration for "sluug.org" hasn't been changed yet,
so there are still access holes through that domain.

Original "htdig" problem:  Part of the problem with this security, at
least for some humans, seems to be that every archived list posting has
two URLs, one for pipermail/mailman and the other for mailman/htdig.
I don't think we had that with Majordomo/MHonArc.  It appears mailman
does mail distribution, pipermail WAS the default archiver provided
with mailman, and htdig is independent.  According to Wikipedia, the
mail archiver for mailman has changed from pipermail to hyperkitty.
    https://en.wikipedia.org/wiki/GNU_Mailman

Newly discovered problem:  Oops, not two URLs, but four (not counting
https, which doesn't matter for this).  That is why I was able to access
"stlwebdev" list postings via "sluug.org" domain.  They are protected via
"stlwebdev.org", but not "sluug.org".  And the reverse, SLUUG lists are
protected via "sluug.org", but not via "stlwebdev.org".

Originally no authentication needed, now denied completely:
    http://www.stlwebdev.org/pipermail/sysadmin/2018-May/008960.html
    http://www.stlwebdev.org/mailman/htdig/sysadmin/2018-May/008960.html
    http://www.stlwebdev.org/pipermail/sysadmin/2018-May/
    http://www.stlwebdev.org/mailman/htdig/sysadmin/2018-May/
    http://www.stlwebdev.org/pipermail/sysadmin/
    http://www.stlwebdev.org/mailman/htdig/sysadmin/

Password authentication needed before and still needed:
    http://www.stlwebdev.org/pipermail/stlwebdev/
    http://www.stlwebdev.org/pipermail/stlwebdev-announce/
    http://www.stlwebdev.org/pipermail/stlwebdev-announce/2009/date.html
    http://www.stlwebdev.org/pipermail/stlwebdev-announce/2009/000002.html

Fails when using https, because https not configured:
    https://www.stlwebdev.org/pipermail/stlwebdev/
        Fails with: Site does not exist on this server!!!
    https://www.stlwebdev.org/
        Fails with: You don't have permission to access / on this server
    https://webdev.sluug.org/
        Fails with: You don't have permission to access / on this server

Since all domains and aliases end up in a single log file, in is
nearly impossible to tell which domain is used to retrieve many
URLs (files), such as "/", that are common to more than one domain.
SLUUG Wiki

User Tools

Site Tools

Page Tools
