On Thu, 21 Apr 2016 07:06:09 -0700 "danarauz(a)gmail.com" <danarauz(a)gmail.com> wrote: I had hoped so, but still no luck :( rcsheets@sudoroom:~$ sudo -l [sudo] password for rcsheets: Sorry, user rcsheets may not run sudo on sudoroom. I had hoped to work on whatever is causing us to be a source of spam. Can't really proceed without more access, though. Anyone willing/able to elevate my privileges? :) Thanks! -- Charley Sheets

On Mon, 25 Apr 2016 10:58:54 -0700 yar <yardenack(a)gmail.com> wrote: Thanks! I find it suspicious that we have list members with what appear to be nonsense extensions to their gmail addresses, that are subscribed to multiple lists. I suppose it's possible these are legitimate extensions, but to me this seems like a sign that we haven't sufficiently confirmed these addresses, and that we're thereby participating in a mail bomb. For example, there are 72 variations of ubercoffeetime+foo(a)gmail.com (with different values of foo) all in the outbound queue right now. I'd like to investigate how these addresses got added to the lists they're on. I don't have much mailman experience, but I'm totally willing to learn in order to figure this out. For now I'm going to put all mail on hold that's currently destined for these suspicious-looking addresses. -- Charley Sheets

On Mon, 25 Apr 2016 17:10:57 -0700 yar <yardenack(a)gmail.com> wrote: Yeah, I can confirm that now. Lots of confirmation attempts. I'm removing them as I find them, at this point just because there seems to be no reason to keep them around. Another thing we could do, but I'm not sure it's worth the effort, is to normalize username+tag(a)gmail.com to username(a)gmail.com in order to avoid sending duplicate confirmation emails to what's *actually* the same address. There are more normalizations that could be done to reduce noise, such as removing dots from gmail usernames (username(a)gmail.com is equivalent to u.ser.name(a)gmail.com, etc.) It's something I've thought about before, but never solved. Maybe someone else has solved it. Anyway, I guess we're not a source of spam... just unwanted subscription confirmations. -- Charley Sheets

On Mon, 25 Apr 2016 18:37:39 -0700 yar <yardenack(a)gmail.com> wrote: I should have been more clear. I don't mean normalize as in convert foo+bar(a)gmail.com to foo(a)gmail.com, but rather when making a decision such as "is this address already subscribed to this list?" or "is there already a pending confirmation for this user on this list?" to treat foo+bar(a)gmail.com as equivalent to foo+baz(a)gmail.com and f.o.o(a)gmail.com, so that we don't end up sending 80 confirmation messages to one user just because someone made up 80 +tags to create the appearance of 80 different email addresses and 80 separate subscription requests. My command line was pretty ugly, but it basically worked. Something like this, repeated for multiple addresses: rcsheets@sudoroom:/var/spool/postfix$ /usr/sbin/postqueue -p | grep -B2 newdramaalert | grep -E -A1 '^--$' | grep -vE '^--' | cut -d'!' -f1 | xargs -n1 sudo /usr/sbin/postsuper -d -- Charley Sheets