We recently experienced a LISTSERV service outage as a result of a
list configuration error by a list owner. The list owner changed the
list configuration to specify the list address as the primary editor.
This was a moderated list and she was attempting to reconfigure the
list to allow subscribers to post without approval, however, she
apparently misunderstood the instructions she was given by one of
our staff.

When the next message was posted to the list, LISTSERV sent an
approval request to the primary editor - the list address. When
that message was delivered, LISTSERV sent another approval request,
and another, and another, each larger than the last. LISTSERV keeps
a copy of each pending request in its file system, and it took about
an hour to fill the file system to capacity with over 500 MB of
self-referential approval requests. At that point, this loop was
broken, however, with its file system at 100% of capacity, LISTSERV
was unable to accept any other incoming messages, all of which were
bounced to the LISTSERV postmaster mailbox. The incident occurred
at approximately 7:00 p.m. By the time I discovered the problem the
next morning, over 1000 messages had been bounced to the LISTSERV
postmaster mailbox. These included routine daily update jobs for
several hundred local lists, jobs from other LISTSERV servers, and
messages to other lists hosted on our server.

This is, first and foremost, a list owner education issue, but I
have asked L-Soft to consider adding logic to the validity checking
that is done during PUT processing, to reject a PUT in which the
address of a local list is specified as an owner, editor, or
moderator. The PUT processing logic verifies the existence of lists
specified on the "sub-list=" statement. It seems to me that similar
logic could be used to trap local list addresses on owner, editor
and moderator statements.

--
Paul Russell
Senior Systems Administrator
University of Notre Dame
http://www.nd.edu/~prussell