--- /dev/null
+---
+title: "Fighting Mailman Subscription Spam: Leveling Up"
+categories: sysadmin
+---
+
+Last week, I blogged about [my efforts to fight mailman subscription spam]({{
+site.baseurl }}{% post_url 2018-06-02-mailman-subscription-spam %}). Enabling
+`SUBSCRIBE_FORM_SECRET` as described there indeed helped to drastically reduce
+the amount of subscription spam from more than 1000 to less than 10 mails sent
+per day, but some attackers still got through. My guess is that those machines
+were just so slow that they managed to wait the required five seconds before
+submitting the form.
+
+So, clearly I had to level up my game. I decided to pull through on my plan to
+write a simple CAPTCHA for mailman (that doesn't expose your users to Google).
+This post describes how to configure and install that CAPTCHA.
+
+<!-- MORE -->
+
+### CAPTCHA configuration
+
+This simple CAPTCHA is based on a list of questions and matching answers that
+you, the site admin, define. The idea is to use questions that anyone who is
+interested in your site can easily answer. Since most sites are small enough
+that they are not to be targeted specifically, the bots (hopefully) will not be
+able to answer these questions. At least for my sites, that has worked so far
+(I am running with this patch for a week now).
+
+The CAPTCHA requires `SUBSCRIBE_FORM_SECRET` to be enabled. Configuration can
+look something like this:
+```
+SUBSCRIBE_FORM_SECRET = "<some random string, generated e.g. by [openssl rand -base64 18]>"
+CAPTCHAS = [
+ # This is a list of questions, each paired with a list of answers.
+ ('What is two times six?', ['12', 'twelve']),
+ ('What is the name of this site's blog', ['Ralf's Ramblings']),
+]
+```
+
+### CAPTCHA patch
+
+Right now, the `CAPTCHAS` part of the configuration will not yet do anything
+because you still have to install my patch. The patch is losely based on
+[this blog post](https://warmcat.com/2017/08/12/mailman-captcha.html) and was
+written against Mailman 2.1.23 on Debian 9 "Stretch". If you are using a
+different version you may have to adapt it accordingly.
+
+First of all, create a new file `/usr/lib/mailman/Mailman/Captcha.py` with the
+following content:
+```
+import random
+from Mailman import Utils
+
+def display(mlist, captchas):
+ """Returns a CAPTCHA question, the HTML for the answer box, and
+ the data to be put into the CSRF token"""
+ idx = random.randrange(len(captchas))
+ question = captchas[idx][0]
+ box_html = mlist.FormatBox('captcha_answer', size=30)
+ return (Utils.websafe(question), box_html, str(idx))
+
+def verify(idx, given_answer, captchas):
+ try:
+ idx = int(idx)
+ except ValueError:
+ return False
+ if not idx in range(len(captchas)):
+ return False
+ # Chec the given answer
+ correct_answers = captchas[idx][1]
+ given_answer = given_answer.strip().lower()
+ return given_answer in map(lambda x: x.strip().lower(), correct_answers)
+```
+This contains the actual CAPTCHA logic. Now it needs to be wired up with the
+listinfo page (where the subscription form is shown to the user) and the
+subscription page (where the subscription form is submitted to).
+
+Here is the patch for `/usr/lib/mailman/Mailman/Cgi/listinfo.py`:
+```
+--- listinfo.py.orig 2018-06-03 19:18:30.089902948 +0200
++++ listinfo.py 2018-06-10 19:12:59.381910750 +0200
+@@ -26,6 +26,7 @@
+
+ from Mailman import mm_cfg
+ from Mailman import Utils
++from Mailman import Captcha
+ from Mailman import MailList
+ from Mailman import Errors
+ from Mailman import i18n
+@@ -216,10 +220,16 @@
+ # drop one : resulting in an invalid format, but it's only
+ # for our hash so it doesn't matter.
+ remote = remote.rsplit(':', 1)[0]
++ # get CAPTCHA data
++ (captcha_question, captcha_box, captcha_idx) = Captcha.display(mlist, mm_cfg.CAPTCHAS)
++ replacements['<mm-captcha-question>'] = captcha_question
++ replacements['<mm-captcha-box>'] = captcha_box
++ # fill form
+ replacements['<mm-subscribe-form-start>'] += (
+- '<input type="hidden" name="sub_form_token" value="%s:%s">\n'
+- % (now, Utils.sha_new(mm_cfg.SUBSCRIBE_FORM_SECRET +
++ '<input type="hidden" name="sub_form_token" value="%s:%s:%s">\n'
++ % (now, captcha_idx, Utils.sha_new(mm_cfg.SUBSCRIBE_FORM_SECRET +
+ now +
++ captcha_idx +
+ mlist.internal_name() +
+ remote
+ ).hexdigest()
+```
+And here the patch for `/usr/lib/mailman/Mailman/Cgi/subscribe.py`:
+```
+--- subscribe.py.orig 2018-06-03 19:18:35.761813517 +0200
++++ subscribe.py 2018-06-03 20:35:00.056454989 +0200
+@@ -25,6 +25,7 @@
+
+ from Mailman import mm_cfg
+ from Mailman import Utils
++from Mailman import Captcha
+ from Mailman import MailList
+ from Mailman import Errors
+ from Mailman import i18n
+@@ -144,13 +147,14 @@
+ # for our hash so it doesn't matter.
+ remote1 = remote.rsplit(':', 1)[0]
+ try:
+- ftime, fhash = cgidata.getvalue('sub_form_token', '').split(':')
++ ftime, fcaptcha_idx, fhash = cgidata.getvalue('sub_form_token', '').split(':')
+ then = int(ftime)
+ except ValueError:
+- ftime = fhash = ''
++ ftime = fcaptcha_idx = fhash = ''
+ then = 0
+ token = Utils.sha_new(mm_cfg.SUBSCRIBE_FORM_SECRET +
+ ftime +
++ fcaptcha_idx +
+ mlist.internal_name() +
+ remote1).hexdigest()
+ if ftime and now - then > mm_cfg.FORM_LIFETIME:
+@@ -165,6 +169,10 @@
+ results.append(
+ _('There was no hidden token in your submission or it was corrupted.'))
+ results.append(_('You must GET the form before submitting it.'))
++ # Check captcha
++ captcha_answer = cgidata.getvalue('captcha_answer', '')
++ if not Captcha.verify(fcaptcha_idx, captcha_answer, mm_cfg.CAPTCHAS):
++ results.append(_('This was not the right answer to the CAPTCHA question.'))
+ # Was an attempt made to subscribe the list to itself?
+ if email == mlist.GetListEmail():
+ syslog('mischief', 'Attempt to self subscribe %s: %s', email, remote)
+```
+
+Finally, the HTML template for the listinfo page needs to be updated to show the CAPTCHA question and answer box.
+On Debian, the templates for enabled languages are located in `/etc/mailman/<lang>`.
+The patch for the English template looks as follows:
+```
+--- /usr/share/mailman/en/listinfo.html 2018-02-08 07:54:28.000000000 +0100
++++ listinfo.html 2018-06-03 20:35:10.680275026 +0200
+@@ -116,6 +116,12 @@
+ </tr>
+ <mm-digest-question-end>
+ <tr>
++ <TD BGCOLOR="#dddddd">Please answer the following question to prove that you are not a bot:
++ <mm-captcha-question>
++ </TD>
++ <TD><mm-captcha-box></TD>
++ </tr>
++ <tr>
+ <td colspan="3">
+ <center><MM-Subscribe-Button></center>
+ </td>
+```
+
+If you have other languages enabled, you have to translate this patch
+accordingly.
+
+That's it! Now bots have to be adapted to your specific questions to be able to
+successfully subscribe someone. It is still a good idea to monitor the logs
+(`/var/log/mailman/subscribe` on Debian) to see if any illegitimate requests
+still make it through, but unless you site is really big I'd be rather surprised
+to see bots being able to answer site-specific questions.
projects / web.git / commitdiff