Your new mailing list: mailman

[zerokarma]

I received a notification email from my server "Your new mailing list: mailman".

I did not create this and not sure how it would have been done and what I should do about it. I don't want someone spamming with it somehow.

Contents of the email show they are using the hostname?

----------------------

Your mailing list password is:

xxxxxxxxxxxxxxxxxx

You need this password to configure your mailing list. You also need
it to handle administrative requests, such as approving mail if you
choose to run a moderated list.

You can configure your mailing list at the following web page:

http://xxxxxxxxxxxxxx.theplanet.host.../admin/mailman

The web page for users of your mailing list is:

http://xxxxxxxxxxxxxx.theplanet.host...stinfo/mailman

----------------------

How do I delete this list?

[shimmy]

I received this same email on a couple of my servers. Plus I have mailman turned off. What's going on here?

[SageBrian]

I have mailman turned off also, but I got this message too.

[GaryT]

I also got this - But this was straight after I updated cpanel - I instantly generated a new one.

[Infopro]

Strange that 4 in a row have seen this. If it was one, maybe the account had been gotten into by someone. But 4? One or more of you should put in a ticket to cPanel to investigate a bit more, IMHO.

[yayyo]

+1

I have been trying unsuccessfully on and off for a long time to totally disable / remove mailman. It keeps coming back! This latest event is unexpected and unwelcome.

cPanel Ticket # 676105

cPanel 11.25.0-R46156 - WHM 11.25.0 - X 3.9
CENTOS 5.5 i686 standard

[yayyo]

I also got this - But this was straight after I updated cpanel - I instantly generated a new one.

Hi Gary,

What did you instantly generate a new one of?

[alexio]

I also received an email, subject "Your new mailing list: mailman" today.:

This is on a brand new (2 week old) server, and oddly, though the email came in today (June 3), the email appears to have been generated on May 14th, which I believe is the day it went online.

Here it is in raw form:
_______________________________________
Return-path: <mailman-bounces@server.xxxxx.com>
Envelope-to: root@xxxxxxxx.theplanet.host
Delivery-date: Thu, 03 Jun 2010 04:58:35 -0500
Received: from xxxxxxx ([127.0.0.1] helo=server.xxxxxxxx.com)
by server. xxxxxxxx.com with esmtp (Exim 4.69)
(envelope-from <mailman-bounces@server. xxxxxxxx.com>)
id 1OK7C6-0008Bc-Rw
for root@ xxxxxxxx.theplanet.host; Thu, 03 Jun 2010 04:58:34 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Subject: Your new mailing list: mailman
From: mailman-owner@ xxxxxxxx.theplanet.host
To: root@ xxxxxxxx.theplanet.host
Message-ID: <mailman.0.1273887484.27342.mailman@ xxxxxxxx.theplanet.host>
Date: Fri, 14 May 2010 20:38:04 -0500
Precedence: bulk
X-BeenThere: mailman@server. xxxxxxxx.com
X-Mailman-Version: 2.1.13
List-Id: Mailman site list <mailman.server. xxxxxxxx.com>
X-List-Administrivia: yes
Sender: mailman-bounces@server. xxxxxxxx.com
Errors-To: mailman-bounces@server. xxxxxxxx.com

The mailing list `mailman' has just been created for you. The
following is some basic information about your mailing list.

Your mailing list password is:

_xxxxxx

You need this password to configure your mailing list. You also need
it to handle administrative requests, such as approving mail if you
choose to run a moderated list.

You can configure your mailing list at the following web page:

http://xxxxxxxxx.theplanet.host/mailman/admin/mailman

The web page for users of your mailing list is:

http://xxxxxxxxx.theplanet.host/mail...stinfo/mailman

You can even customize these web pages from the list configuration
page. However, you do need to know HTML to be able to do this.

There is also an email-based interface for users (not administrators)
of your list; you can get info about using it by sending a message
with just the word `help' as subject or in the body, to:

mailman-request@xxxxxxxxx.theplanet.host

To unsubscribe a user: from the mailing list 'listinfo' web page,
click on or enter the user's email address as if you were that user.
Where that user would put in their password to unsubscribe, put in
your admin password. You can also use your password to change
member's options, including digestification, delivery disabling, etc.

Please address all questions to
mailman-owner@ xxxxxxxxx.theplanet.host.
_______________________________________

[yayyo]

My conclusion is that unless you actually *want* to use mailman, then the issue being discussed here is simply another symptom of the (very) long term issue discussed in the Disabling Mailman - What does "mailman" check in Tweak Settings really do? topic.

If so, please indicate your desire for a fix in that topic, thanks.

That topic also contains some workarounds that may help, though some of those get overwritten by updates.

HTH,
Marty

[alexio]

Thanks Marty...
So, can us quasi-newbies then assume that it's not a security issue, but rather a mere annoyance and forget about it?

[Infopro]

I notice in two different posts the same sort of address ending with:

theplanet.host/mailman/listinfo/mailman

Is this the case for the rest of you?

[SageBrian]

I'm putting in a ticket today so they can check it out.

I'm wondering if it's a Planet thing. (yes, I'm also with the Planet)

I got this immediately after updating.

ticket cPanel ID# 677081

[shimmy]

I'm not with The Planet, I got this on LiquidWeb Servers

[yayyo]

Thanks Marty...
So, can us quasi-newbies then assume that it's not a security issue, but rather a mere annoyance and forget about it?

YW Alexio,

I Am Not A Security Expert. I know of no "holes" in Mailman. But... It is a basic tenet of server (and any computer) security that "If you don't need it, don't install it". Also, I understand that some cPanel users are having problems achieving Payment Card Industry Data Security Standards (PCI-DSS) compliance, because of Mailman. This could prevent them from enabling website payments e.g. Credit Cards.

With the above (and your own) research in mind, you have to decide whether in your environment it's an annoyance or an issue.

Sorry, that's the best I can offer.

If you check the other thread I mentioned above, there are some "work-arounds" listed but they appear to be only temporary and could be disabled by future cPanel updates (thus re-enabling Mailman).

I see that cPanel Jared has replied to the initial subject of that topic, i.e. "what does the mailman option in tweak settings actually do".

What we need now is the "when" so that we can plan our future direction.

Please read, and if you agree, sign, the petition at http://forums.cpanel.net/f145/petiti...en-158029.html

Cheers!
Marty

(this post comes with no warranty of any kind, except that if you break your server... you get to keep the pieces )