Subject: Re: Mailman password reminder emails

From: Art N <[email-masked]>
Date: Wed, 1 Aug 2018 16:44:13 +0000

So I suppose a password change would be prudent?

Regards, Art Nitsche

________________________________
From: IETF-Announce <[email-masked]> on behalf of Glen <[email-masked]>
Sent: Wednesday, August 1, 2018 9:08 AM
To: [email-masked]
Subject: Mailman password reminder emails

Greetings -

A number of you - myself included - will have received the dreaded
Mailman password reminder email this morning.   This is obviously a
bad thing: the script, part of the Mailman distribution, sends Mailman
passwords out to users in regular clear email.  Worse, its operation
cannot be disabled via configuration option, it can only be disabled
by patching the Mailman source files:  commenting out the relevant
cron entry, and removing the script.

AMS regularly applies OS-provided software updates and security
patches to the IETF servers as a part of our ongoing maintenance
duties.  We've seen Mailman updates before install without issue;
however, the most recent update silently re-enabled the cron entry and
restored the script... and we did not catch it.  So, last night, the
flood began.

Since we all love technical details, some of you might ask, "How could
a security patch re-enable a cron entry?"  Mailman has its own crontab
file, a copy of which is kept in its operating directory.  The Mailman
start script re-copies this file into /etc/cron.d whenever Mailman
starts.  So, the patch updated the crontab copy, containing the
offending (or offensive) line, and the file overwrites the live copy
on the next server startup.  What fun!

Our engineers have already disabled and removed the script again, and
I've asked them to add a specific monitoring rule to our monitoring
systems that will continuously check for the presence of this script
and alert our team immediately if it is ever restored again by a
future update.

I apologize for the disturbance and the noise.

Glen
--
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: Benjamin Damm <[email-masked]>
Date: Wed, 1 Aug 2018 09:50:47 -0700

I'm not sure changing the password helps, since it was basically public
to start out with, and hasn't been more exposed than it was before.

Just know that the IETF's mailing lists are all security-broken, and act
accordingly.

-Ben

--

---

From: Paul Wouters <[email-masked]>
Date: Wed, 1 Aug 2018 10:47:45 -0700

> On Aug 1, 2018, at 09:44, Art N <[email-masked]> wrote:
> 

Your password is not “ietf”? 😜

> Worse, its operation

This is not true. An option to disable this has been present in mailman for a decade or more.

Paul

---

From: Pedro Martinez-Julia <[email-masked]>
Date: Thu, 2 Aug 2018 08:03:30 +0900

Dear Glen,

There still is the issue that such system is storing the passwords in
clear text. It is really bad and must be fixed ASAP. I have little
knowledge of mailman but, if not supported by default, I think that it
can be easy to link it with some module to interact with PAM to support
cyphered passwords. Please consider it. Thank you.

Regards,
Pedro

-- 
Pedro Martinez-Julia
Network Science and Convergence Device Technology Laboratory
Network System Research Institute
National Institute of Information and Communications Technology (NICT)
4-2-1, Nukui-Kitamachi, Koganei, Tokyo 184-8795, Japan
Email: [email-masked]
---------------------------------------------------------
*** Entia non sunt multiplicanda praeter necessitatem ***