5efc72a33e
We have shifted over to using ansible for managing the listservs. This also updates our service docs to point at the corret ansible and not puppet. Change-Id: I76f01ff1479c5af0a502a060aac2baa1ab622b21
102 lines
2.9 KiB
ReStructuredText
102 lines
2.9 KiB
ReStructuredText
:title: Mailing Lists
|
|
|
|
.. _lists:
|
|
|
|
Mailing Lists
|
|
#############
|
|
|
|
`Mailman <http://www.gnu.org/software/mailman/>`_ is installed on
|
|
lists.openstack.org to run OpenStack related mailing lists, as well as
|
|
host list archives.
|
|
|
|
At a Glance
|
|
===========
|
|
|
|
:Hosts:
|
|
* http://lists.openstack.org
|
|
:Ansible:
|
|
* :git_file:`playbooks/service-lists.yaml`
|
|
* :git_file:`playbooks/roles/mailman`
|
|
* :git_file:`playbooks/roles/mailman-site`
|
|
* :git_file:`playbooks/roles/mailman-list`
|
|
:Projects:
|
|
* http://www.gnu.org/software/mailman/
|
|
:Bugs:
|
|
* https://storyboard.openstack.org/#!/project/748
|
|
* https://bugs.launchpad.net/mailman
|
|
:Resources:
|
|
* `Mailman Documentation <http://www.gnu.org/software/mailman/docs.html>`_
|
|
|
|
Adding a List
|
|
=============
|
|
|
|
A list may be added by adding it to the ``openstack-infra/system-config``
|
|
repository in :git_file:`inventory/service/host_vars/lists.openstack.org.yaml`.
|
|
For example:
|
|
|
|
.. code-block:: yaml
|
|
|
|
- name: Example list
|
|
description: 'This is an example'
|
|
admin: 'admin@example.com'
|
|
password: "{{ mailman_list_password }}"
|
|
|
|
Scripted Changes to Lists
|
|
=========================
|
|
|
|
This may only be performed with root access to the list server.
|
|
|
|
Mailman supports running a python code snippet in the context of
|
|
individual lists or every list on the system. The following example
|
|
adds an address to the list of banned addresses for every list. This
|
|
has proved useful in the case of attackers abusing the HTTP
|
|
subscription interface to subscribe a target's address to multiple
|
|
mailing lists.
|
|
|
|
Banning an Address from All Lists
|
|
---------------------------------
|
|
|
|
Create the file `/usr/lib/mailman/bin/ban.py` with the following
|
|
content:
|
|
|
|
.. code-block:: python
|
|
|
|
def ban(m, address):
|
|
try:
|
|
m.Lock()
|
|
if address not in m.ban_list:
|
|
m.ban_list.append(address)
|
|
m.Save()
|
|
finally:
|
|
m.Unlock()
|
|
|
|
And then run the withlist script as:
|
|
|
|
.. code-block:: bash
|
|
|
|
sudo -u list /usr/lib/mailman/bin/withlist -a -r ban "<address to ban>"
|
|
|
|
Because the script itself handles locking, do not use the `-l`
|
|
argument to withlist. To run the same script on a single list, use:
|
|
|
|
.. code-block:: bash
|
|
|
|
sudo -u list /usr/lib/mailman/bin/withlist -r ban listname "<address to ban>"
|
|
|
|
Note that the ban list accepts regular expressions, so to ban an
|
|
address and all suffixes, use '^address.*@example.com' as the "address
|
|
to ban".
|
|
|
|
Lock Files
|
|
----------
|
|
|
|
If a list stops handling traffic for some time, it may be due to a
|
|
stale lock file. Mailman locks are in /srv/mailman/openstack/locks.
|
|
If a lock is held for a list, then ``listname.lock`` will exist. The
|
|
contents of the file will be the name of the lock sequence file which
|
|
was used to obtain the lock. That file is in the form
|
|
``listname.lock.hostname.pid.sequence``. If the process id in that
|
|
string no longer exists, it's safe to assume the process died without
|
|
cleaning up the lock. It should generally be safe to remove the
|
|
lockfile in that case.
|