The GNOME and many other infrastructures have been recently attacked by an huge amount of subscription-based spam against their Mailman istances. What the attackers were doing was simply launching a GET call against a specific REST API URL passing all the parameters it needed for a subscription request (and confirmation) to be sent out. Understanding it becomes very easy when you look at the following example taken from our apache.log:
May 3 04:14:38 restaurant apache: 81.17.17.90, 127.0.0.1 - - [03/May/2014:04:14:38 +0000] "GET /mailman/subscribe/banshee-list?email=example@me.com&fullname=&pw=123456789&pw-conf=123456789&language=en&digest=0&email-button=Subscribe HTTP/1.1" 403 313 "http://spam/index2.html" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36"
As you can the see attackers were sending all the relevant details needed for the subscription to go forward (and specifically the full name, the email, the digest option and the password for the target list). At first we tried to either stop the spam by banning the subnets where the requests were coming from, then when it was obvious that more subnets were being used and manual intervention was needed we tried banning their User-Agents. Again no luck, the spammers were smart enough to change it every now and then making it to match an existing browser User-Agent. (with a good percentage to have a lot of false-positives)
Now you might be wondering why such an attack caused a lot of issues and pain, well, the attackers made use of addresses found around the web for their malicius subscription requests. That means we received a lot of emails from people that have never heard about the GNOME mailing lists but received around 10k subscription requests that were seemingly being sent by themselves.
It was obvious we needed to look at a backup solution and luckily someone on our support channel suggested the freedesktop.org sysadmins recently added CAPTCHAs support to Mailman. I m now sharing the patch and providing a few more details on how to properly set it up on either DEB or RPM based distributions. Credits for the patch should be given to Debian Developer
Tollef Fog Heen, who has been so kind to share it with us.
Before patching your installation make sure to install the python-recaptcha package (tested on Debian with Mailman 2.1.15) on DEB based distributions and python-recaptcha-client on RPM based distributions. (I personally tested it against Mailman release 2.1.15, RHEL 6)
The Patch
diff --git a/Mailman/Cgi/listinfo.py b/Mailman/Cgi/listinfo.py
index 4a54517..d6417ca 100644
--- a/Mailman/Cgi/listinfo.py
+++ b/Mailman/Cgi/listinfo.py
@@ -22,6 +22,7 @@
import os
import cgi
+import sys
from Mailman import mm_cfg
from Mailman import Utils
@@ -30,6 +31,8 @@ from Mailman import Errors
from Mailman import i18n
from Mailman.htmlformat import *
from Mailman.Logging.Syslog import syslog
+sys.path.append("/usr/share/pyshared")
+from recaptcha.client import captcha
# Set up i18n
_ = i18n._
@@ -200,6 +203,9 @@ def list_listinfo(mlist, lang):
replacements[''] = mlist.FormatFormStart('listinfo')
replacements[''] = mlist.FormatBox('fullname', size=30)
+ # Captcha
+ replacements[''] = captcha.displayhtml(mm_cfg.RECAPTCHA_PUBLIC_KEY, use_ssl=False)
+
# Do the expansion.
doc.AddItem(mlist.ParseTags('listinfo.html', replacements, lang))
print doc.Format()
diff --git a/Mailman/Cgi/subscribe.py b/Mailman/Cgi/subscribe.py
index 7b0b0e4..c1c7b8c 100644
--- a/Mailman/Cgi/subscribe.py
+++ b/Mailman/Cgi/subscribe.py
@@ -21,6 +21,8 @@ import sys
import os
import cgi
import signal
+sys.path.append("/usr/share/pyshared")
+from recaptcha.client import captcha
from Mailman import mm_cfg
from Mailman import Utils
@@ -132,6 +130,17 @@ def process_form(mlist, doc, cgidata, lang):
remote = os.environ.get('REMOTE_HOST',
os.environ.get('REMOTE_ADDR',
'unidentified origin'))
+
+ # recaptcha
+ captcha_response = captcha.submit(
+ cgidata.getvalue('recaptcha_challenge_field', ""),
+ cgidata.getvalue('recaptcha_response_field', ""),
+ mm_cfg.RECPTCHA_PRIVATE_KEY,
+ remote,
+ )
+ if not captcha_response.is_valid:
+ results.append(_('Invalid captcha'))
+
# Was an attempt made to subscribe the list to itself?
if email == mlist.GetListEmail():
syslog('mischief', 'Attempt to self subscribe %s: %s', email, remote)
Additional setup
Then on the
/var/lib/mailman/templates/en/listinfo.html template (right below
<mm-digest-question-end>) add:
<tr>
<td>Please fill out the following captcha</td>
<td><mm-recaptcha-javascript></TD>
</tr>
Make also sure to generate a public and private key at
https://www.google.com/recaptcha and add the following paramaters on your
mm_cfg.py file:
- RECAPTCHA_PRIVATE_KEY
- RECAPTCHA_PUBLIC_KEY
Loading reCAPTCHAs images from a trusted HTTPS source can be done by changing the following line:
replacements[''] = captcha.displayhtml(mm_cfg.RECAPTCHA_PUBLIC_KEY, use_ssl=False)
to
replacements[''] = captcha.displayhtml(mm_cfg.RECAPTCHA_PUBLIC_KEY, use_ssl=True)
EPEL 6 related details
A few additional details should be provided in case you are setting this up against a RHEL 6 host: (or any other machine using the EPEL 6 package
python-recaptcha-client-1.0.5-3.1.el6)
Importing the recaptcha.client module will fail for some strange reason, importing it correctly can be done this way:
ln -s /usr/lib/python2.6/site-packages/recaptcha/client /usr/lib/mailman/pythonlib/recaptcha
and then fix the imports also making sure
sys.path.append( /usr/share/pyshared ) is not there:
from recaptcha import captcha
That s not all, the package still won t work as expected given the API_SSL_SERVER, API_SERVER and VERIFY_SERVER variables on captcha.py are outdated (filed as
bug #1093855), substitute them with the following ones:
API_SSL_SERVER="https://www.google.com/recaptcha/api"
API_SERVER="http://www.google.com/recaptcha/api"
VERIFY_SERVER="www.google.com"
And then on line 76:
url = "https://%s/recaptcha/api/verify" % VERIFY_SERVER,
That should be all! Enjoy!
Thanks to the work of the Alioth admins and the DSA team, single sign-on
services are back online. Everyone will again be able to register for
DebConf14 according to the steps described on
If you're looking to get started at packaging free software for
While taking the tram to our favourite Croatian restaurant,
I spotted something dedicated to Ada. We ll never know which
one the language, the famous programmer, or someone else. 
). You can find the full specification (upstream and distro data) 
Thanks to all people who helped with making this happen, and especially Burkhard L ck and Albert Astals Cid for their patch-review and help with integrating the necessary changes into the KDE l10n-script.
The very useful 
This is the entireity of a (purportedly) HTML page I just got:
I have been testing 
okay. New hypervisor hardware. Switching from xen to KVM. I took a snapshot of the xen partitions and moved them to a holding location during migration.
I am now imaging these partitions to the LVM block devices:
url_for is normally used to avoid hard coding of URL in Flask based
webapps. I've been using it in SILPA 
Brainfuck.
I've been playing with brainfuck for my holiday project. It seems like an easy enough language to write an interpreter and compiler.
So far I've implemented several C++ interpreters and x86_64 assembly, refreshing to read x86_64 ABI documentation to see that it's not quite the same as x86. I thought rax was going to be used as first parameter, but rdi is used instead, hmmm why did I think so.
Since my last update I got the repo setup and started working on the specifications. I have been emailing with my mentors to work out the specs.
You can