3 Dec
2023
3 Dec
'23
3:49 p.m.
we're still getting
"[sudo-info] Delayed Mail (still being retried)"
emails every day...are we retrying to the messages still?
Is there a good way to remove those? I can do it if you give me a hint where
to look, or what tools to use to dig into this.
thank you for your help
-jake
On Sat, 2 Dec 2023, Jake Watters via sudo-discuss wrote:
Yes please block Tor for now, until we have a better
solution
-jake
On Sat, Dec 2, 2023, 15:10 Sean Greenslade via sudo-discuss <
sudo-discuss(a)sudoroom.org> wrote:
On Fri, Dec 01, 2023 at 09:19:53PM -0800, Jake
via sudo-discuss wrote:
our mailing list system (postorius) is having
problems... we're not sure
what
it is but it looks like some spammer is entering
random addresses into
the
"join this mailing list" field and then
our system is trying to email a
confirmation to those addresses.
Anyone want to log in and take a look at it, try to figure out what's
going
on, and figure out a way to fix it? We might
need to add a CAPTCHA or at
least a checkbox or some sort of puzzle so that people can't just
automatically enter email addresses in and have us email them.
I've been doing a bit of investigation on this. It appears that the
spammer is using Tor to make the subscription requests. I see 68
hits to the web interface subscription endpoint within the past day, and
reverse lookups reveal:
sortie-tor.a-n-o-n-y-m-e.net.
LuxembourgTorNew4.Quetzalcoatl-relays.org.
exit-node1.tor-for-privacy.com.
tor-exit-anonymizer.appliedprivacy.net.
tor-exit-anonymizer.appliedprivacy.net.
tor-exit-anonymizer.appliedprivacy.net.
tor-exit-anonymizer.appliedprivacy.net.
vps-b79172cc.vps.ovh.net.
tor-exit-router-xp67.quido.org.
fixecalendar.net.
tor.d-ku.de.
tor-exit.mci.august.is.
tor.node15.shadowbrokers.eu.
tor-exit-14.zbau.f3netze.de.
tor-exit-16.zbau.f3netze.de.
tor-exit-5.zbau.f3netze.de.
tor-exit-6.zbau.f3netze.de.
tor-exit-11.zbau.f3netze.de.
tor-exit-12.zbau.f3netze.de.
berlin01.tor-exit.artikel10.org.
berlin01.tor-exit.artikel10.org.
tor-exit-134.relayon.org.
tor-exit-136.relayon.org.
berlin01.tor-exit.artikel10.org.
berlin01.tor-exit.artikel10.org.
tor-exit-72.cccs.de.
tor-exit-80.cccs.de.
tor-exit-81.cccs.de.
tor-exit-82.cccs.de.
185-220-102-242.torservers.net.
tor-exit-relay-2.anonymizing-proxy.digitalcourage.de.
tor-exit-relay-8.anonymizing-proxy.digitalcourage.de.
185-220-102-8.torservers.net.
vmi1262847.contaboserver.net.
sortie-tor.a-n-o-n-y-m-e.net.
tor-exit1-terrahost08.tuxli.org.
tor-exit-info.middelstaedt.com.
dedicated.sollutium.com.
onion.xor.sc.
22.tor-exit.nothingtohide.nl.
26.tor-exit.nothingtohide.nl.
30.tor-exit.nothingtohide.nl.
33.tor-exit.nothingtohide.nl.
34.tor-exit.nothingtohide.nl.
7.tor-exit.nothingtohide.nl.
12.tor-exit.nothingtohide.nl.
15.tor-exit.nothingtohide.nl.
07.rkv.exit.tor.loki.tel.
tor.exit.1.newyork.shimadate.com.
tor33.quintex.com.
tor59.quintex.com.
tor76.quintex.com.
mail.waytoslowmanagement.de.
tor-exit-router.quido.org.
exitor.zof.sh.
nosoignons.cust.milkywan.net.
this-is-a-tor-node---9.artikel5ev.de.
tor.node14.shadowbrokers.eu.
My knee-jerk reaction would be to block Tor from our mailing list web
interface, but I'd want to put that suggestion to the community first.
Note that users are able to subscribe to mailing lists by direct email
without using the web interface, so if users wish to maintain anonymity,
they still have a path.
--Sean
_______________________________________________
sudo-discuss mailing list -- sudo-discuss(a)sudoroom.org
To unsubscribe send an email to sudo-discuss-leave(a)sudoroom.org
More options at
https://sudoroom.org/lists/postorius/lists/sudo-discuss.sudoroom.org/
3 Dec
3 Dec
8:10 p.m.
New subject: [sudo-discuss] Re: our mailing list system needs help
On Sun, Dec 03, 2023 at 03:49:04PM -0800, Jake via sudo-sys wrote:
we're still getting "[sudo-info] Delayed Mail
(still being retried)"
emails every day...are we retrying to the messages still?
Is there a good way to remove those? I can do it if you give me a hint where
to look, or what tools to use to dig into this.
thank you for your help
Yeah, there's a pretty easy way to see the current "stuck mail" queue:
$ sudo postqueue -p
Each message has a queue ID at the start of it, something like
"9018BC07D1". To delete a given queue ID, use this command:
$ sudo postsuper -d <QUEUEID>
Be careful with this.
I'm currently looking into ways of blocking Tor. Apache doesn't seem to
have an easy blocklist-by-ip feature, and I'd rather not make it a hard
drop at the firewall level to at least give some notice as to why things
are blocked to the wayward innocent Tor user.
--Sean
8:54 p.m.
New subject: [sudo-discuss] Re: our mailing list system needs help
On Sun, Dec 03, 2023 at 08:10:21PM -0800, Sean Greenslade via sudo-sys wrote:
On Sun, Dec 03, 2023 at 03:49:04PM -0800, Jake via
sudo-sys wrote:
OK, I think I've gotten a working Tor block. There is a daily cron job
that downloads the Tor exit node list and formats it into an apache
block list:
/etc/cron.daily/tor-blocklist-update
/etc/apache2/tor_exit_nodes.conf
The main apache2 config has had a section added to consult this block
list and return a customized 403 message if it's triggered.
/etc/apache2/sites-enabled/sudoroom.org.conf
Definitely not perfect, but it did block the mailing list subscription
page for me when I tried accessing it through Tor.
Please let me know if anyone notices anything broken.
--Sean
we're still getting "[sudo-info] Delayed
Mail (still being retried)"
emails every day...are we retrying to the messages still?
Is there a good way to remove those? I can do it if you give me a hint where
to look, or what tools to use to dig into this.
thank you for your help
Yeah, there's a pretty easy way to see the current "stuck mail" queue:
$ sudo postqueue -p
Each message has a queue ID at the start of it, something like
"9018BC07D1". To delete a given queue ID, use this command:
$ sudo postsuper -d <QUEUEID>
Be careful with this.
I'm currently looking into ways of blocking Tor. Apache doesn't seem to
have an easy blocklist-by-ip feature, and I'd rather not make it a hard
drop at the firewall level to at least give some notice as to why things
are blocked to the wayward innocent Tor user.
10:13 p.m.
New subject: [sudo-discuss] Re: our mailing list system needs help
awesome Sean thank you so much!!!!! Our email systems are our main way of
keeping community connected and it's a miracle that they're working as well as
they do considering the attention they get. There are always people trying to
take advantage of email-based systems like it's their job (which i guess it
is)
-jake
On Sun, 3 Dec 2023, Sean Greenslade via sudo-sys wrote:
On Sun, Dec 03, 2023 at 08:10:21PM -0800, Sean
Greenslade via sudo-sys wrote:
On Sun, Dec 03, 2023 at 03:49:04PM -0800, Jake
via sudo-sys wrote:
OK, I think I've gotten a working Tor block. There is a daily cron job
that downloads the Tor exit node list and formats it into an apache
block list:
/etc/cron.daily/tor-blocklist-update
/etc/apache2/tor_exit_nodes.conf
The main apache2 config has had a section added to consult this block
list and return a customized 403 message if it's triggered.
/etc/apache2/sites-enabled/sudoroom.org.conf
Definitely not perfect, but it did block the mailing list subscription
page for me when I tried accessing it through Tor.
Please let me know if anyone notices anything broken.
--Sean
_______________________________________________
sudo-sys mailing list -- sudo-sys(a)sudoroom.org
To unsubscribe send an email to sudo-sys-leave(a)sudoroom.org
More options at https://sudoroom.org/lists/postorius/lists/sudo-sys.sudoroom.org/
we're still getting "[sudo-info] Delayed
Mail (still being retried)"
emails every day...are we retrying to the messages still?
Is there a good way to remove those? I can do it if you give me a hint where
to look, or what tools to use to dig into this.
thank you for your help
Yeah, there's a pretty easy way to see the current "stuck mail" queue:
$ sudo postqueue -p
Each message has a queue ID at the start of it, something like
"9018BC07D1". To delete a given queue ID, use this command:
$ sudo postsuper -d <QUEUEID>
Be careful with this.
I'm currently looking into ways of blocking Tor. Apache doesn't seem to
have an easy blocklist-by-ip feature, and I'd rather not make it a hard
drop at the firewall level to at least give some notice as to why things
are blocked to the wayward innocent Tor user.
157
days inactive
158
days old
3 comments
2 participants
participants (2)
-
Jake -
Sean Greenslade