Paul Russell wrote:
> On 2/19/2008 11:52 AM, Steve Howie wrote:
>> Hi
>>
>> One of our list owners reported a spam message managed to get posted
>> to one of his lists, where the sender is not a member of the list.
>>
>> The posting (obviously forged) came from listname@listserv-hostname
>> in other words, the posting address for the list.
>>
>> This "username" is not a subscriber to the list. Is it possible for
>> such a posting to bypass the Send= settings for the list? It's
>> currently set to Subscription= By_Owner and Send= Service, where
>> Service= our-local-email-domain
>>
>
> To the best of my knowledge, LISTSERV should not accept a posting where the
> sender address is the list address, but there is insufficient
> information to
> do anything more than speculate. It would be helpful to see the list
> configuration and the full headers from the message in question.
>
Hi Paul (and Gregory),
Greg: Yes, the logs showed that the list did accept the posting from the
poster with the same email address as the posting address for the list.
(XXXXXX is the name of the list)
---------------------------------------------------
17 Feb 2008 05:52:51 Processing file 22639715 from [log in to unmask]
17 Feb 2008 05:52:51 Processing mail from [log in to unmask] for XXXXXX
17 Feb 2008 05:52:51 Distributing mail ("XXXXXX") from
owner-XXXXXX@LISTSERV.UOGUELPH.CA...
17 Feb 2008 05:52:51 Mail posted via SMTP to [log in to unmask]
[.... Rest of subscribers follow ....]
---------------------------------------------------
here is the list config:
XXXX
Review= Private Subscription= By_Owner
Send= Service
Service=*.uoguelph.ca, uoguelph.ca
Default-Options= Repro,Noack
Confidential= Yes
Notify= Yes Reply-to= sender,Respect Files= No
Stats= Normal,Private Validate= No
Owner= [log in to unmask] (XXXXXX XXXX)
Quiet:
[log in to unmask] (YYY YYYYYYY)
---------------------------------------------------
Headers: (This is a sensitive list, so I'm going to replace the listname
with the string ZZZZZZZ)
Return-Path: <[log in to unmask]>
Received: from moe.cs.uoguelph.ca (moe.cs.uoguelph.ca [131.104.94.198]) by
purolator.cs.uoguelph.ca (8.13.1/8.13.1) with ESMTP id m1HAr2a2020827; Sun,
17 Feb 2008 05:53:02 -0500
Received: from listserv.uoguelph.ca (glasgow.cs.uoguelph.ca
[131.104.94.203]) by moe.cs.uoguelph.ca (8.13.1/8.13.1) with ESMTP id
m1HAqqQC008516; Sun, 17 Feb 2008 05:52:52 -0500
Received: from glasgow (listserv.uoguelph.ca [131.104.94.203]) by
listserv.uoguelph.ca (8.12.10+Sun/8.12.10) with ESMTP id m1H9DRuN004156;
Sun, 17 Feb 2008 05:52:51 -0500 (EST)
Received: from LISTSERV.UOGUELPH.CA by LISTSERV.UOGUELPH.CA (LISTSERV-TCP/IP
release 1.8e) with spool id 22639715 for [log in to unmask]; Sun,
17 Feb 2008 05:52:51 -0500
Received: from cm20070311 ([117.24.162.243]) by listserv.uoguelph.ca
(8.12.10+Sun/8.12.10) with SMTP id m1HAqmox015213 for
<[log in to unmask]>; Sun, 17 Feb 2008 05:52:49 -0500 (EST)
X-Mailer: CME-V6.5.4.3;
MSN Received: (qmail 14288 by uid 228); Sat, 17 Feb 2007 06:52:57 +0800
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Message-ID: <20070217145257.14290.qmail@cm20070311>
Date: Sun, 17 Feb 2008 05:52:48 -0500
Reply-To: [log in to unmask]
Sender: List Full name <[log in to unmask]>
From: [log in to unmask]
Subject: February 77% OFF
To: [log in to unmask]
Precedence: list
X-Scanned-By: MIMEDefang 2.63 on 131.104.94.198
[ Message follows ... ]
|
