Bug 11765 - Possible list bombing running via mail01.ipfire.org
Summary: Possible list bombing running via mail01.ipfire.org
Status: CLOSED FIXED
Alias: None
Product: Infrastructure
Classification: Unclassified
Component: Mail & Mailing Lists (show other bugs)
Version: unspecified
Hardware: unspecified Unspecified
: - Unknown - Security
Assignee: Michael Tremer
QA Contact: Peter Müller
URL:
Keywords: Security
Depends on:
Blocks:
 
Reported: 2018-06-11 18:24 UTC by Peter Müller
Modified: 2019-09-11 15:50 UTC (History)
2 users (show)

See Also:


Attachments
Mail queue growth (28.39 KB, image/png)
2018-06-11 19:29 UTC, Michael Tremer
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Müller 2018-06-11 18:24:47 UTC
During a software update on mail01.ipfire.org, I discovered several mails coming from <XYZ-bounces@lists.ipfire.org> in the mail queue. Michael argued this might be caused by a bot subscribing people to our mailing list in order to generate spam or DoS.

We need to do something against this since it will have impact on our mail servers reputation (currently, we are running in some rate limits for some GMail addresses). Maybe add a captcha before the initial subscription invite is processed by Mailman?
Comment 1 Michael Tremer 2018-06-11 19:29:40 UTC
Created attachment 589 [details]
Mail queue growth
Comment 2 Peter Müller 2018-06-12 06:18:46 UTC
(In reply to Michael Tremer from comment #1)
> Created attachment 589 [details]
> Mail queue growth
This looks very bad indeed. Any ideas what to do about it?
Comment 3 Michael Tremer 2018-06-12 18:11:56 UTC
No, this is a botnet. IPs from all over the place. Every IP address has only
sent one single request to subscribe. So we cannot rate-limit anything.

I am out of ideas.
Comment 4 Peter Müller 2018-06-12 18:54:32 UTC
Well, we currently have 2054 mails in the queue... :-(

I will have a look at the IP addresses subscribing, but at the moment there are no ideas here either. However, we definitely need to do something against it.
Comment 5 Peter Müller 2018-06-12 19:21:32 UTC
Unfortunately I cannot see the original IP addresses since they are NATted. However, this looks like a DoS against some 50 destination mail addresses which seem to be involved with some cryptocurrency things. Since we are slowly running out of resources it might also be a slow Dos against our system.

Some of them have received > 500 subscriptions during the last two days (the whole thing started at June 10 13:35:23 UTC and continues since that time).

At the moment, I see the following options:
- Ban the subscribed mail addresses in Mailman
- Ban the IPs (if we are able to recognize them, for example via being listed in a RBL) at the webserver - I prefer this idea in general, too
- Both

Either way, I suggest shutting down mail subscriptions via Mailman temporarly until we ease the situation.
Comment 6 Peter Müller 2018-06-12 22:13:01 UTC
Blocking destination mails turns out to be difficult since f*cking Mailman does not read ban_list correctly. Documentation isn't helping. Great.

@Michael, *: Any idea how to do this?

I manually deleted all the clutter in the queue, but "attacks" still continue and we are about 200 mails now.
Comment 7 Peter Müller 2018-06-12 22:32:53 UTC
Temporarily banned all 50 mail addresses occuring so far by doing:

/usr/lib/mailman/bin/config_list -i /tmp/bad_dst_mails.mailman [list name]

Not a permanent solution (Captcha?!?), and there still seem to be some destination adresses upcoming. Giving up for today.
Comment 8 Peter Müller 2018-06-13 06:34:35 UTC
See also: https://www.m3aawg.org/rel-WebFormHeader

Mailman 2 neither supports Captcha nor Rate Limit. Mailman 3 does.
Comment 9 Michael Tremer 2018-06-13 15:30:52 UTC
I just applied this change to our installation which will stop the
subscriptions:

http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1371
Comment 10 Peter Müller 2018-06-18 18:38:53 UTC
This did not seem to help. We finally got rid of this by blacklisting any client listed in Spamhaus XBL (a possible fix for wiki/forum account creations?). However, there are some minor issues left - such as viewing the mailing list archive should be possible anyway, but this issue is closed.
Comment 11 Michael Tremer 2018-07-03 11:15:51 UTC
It's back...
Comment 12 Peter Müller 2018-08-06 22:42:11 UTC
Mailman 2.1.27 and higher have some patches built-in for preventing clients listed in Spamhaus SBL/XBL and/or mail addresses listed in Spamhaus DBL from triggering subscriptions: https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS

This would solve the problem here very elegant and might also fix #11635.

However, CentOS still ships an older version. I will have a look about how to upgade this on RHEL systems.
Comment 13 Michael Tremer 2018-08-07 14:10:03 UTC
Usually RH backports certain things. But I guess since this release is
already so outdated, nobody of their customer seems to be running it in
production and therefore nobody is pressing them to fix certain issues.

So we can either wait, or install mailman from scratch, but that would
create new problems since they have patches mailman quite a lot.
Comment 14 Peter Müller 2018-08-16 16:45:22 UTC
(In reply to Michael Tremer from comment #13)
> Usually RH backports certain things. But I guess since this release is
> already so outdated, nobody of their customer seems to be running it in
> production and therefore nobody is pressing them to fix certain issues.
I agree but it seems weird to me since Mailman is used quite often. But we all know e-mail died about 20 years ago... :-)
> 
> So we can either wait, or install mailman from scratch, but that would
> create new problems since they have patches mailman quite a lot.
I did not get the problem. Do we rely on any of RHELs patches?

My idea was to use the vanilla version of Mailman, and compile and install it on mail01.ipfire.org . Not very elegant, though, since it is a productive system, but the current situation blocks some things and it does not seem to get better.
Comment 15 Michael Tremer 2018-08-16 19:29:36 UTC
As I said last time, did you have a look at all the patches that are already
included in the CentOS version?

I am quite confident that the vanilla version will break it.
Comment 16 Peter Müller 2019-05-11 09:39:48 UTC
Personally, I'd like to postpone this for a while.

We dealt with dead mail accounts by tweaking Mailmans bounce processing (and Postfix handling of them), and subscriptions have been mitigated by RBL lookups.

Let's hope the new CentOS version will bring us a more recent Mailman version.

Until we have (tested) it, I suggest to close this as DEFERRED.
Comment 17 Michael Tremer 2019-05-11 10:39:42 UTC
Looks like we are going to get 2.1.29. That is the current upstream version:

https://git.centos.org/rpms/mailman/blob/c8-stream-2.1/f/SPECS/mailman.spec
Comment 18 Erik Kapfer 2019-05-12 05:12:08 UTC
Hi all,
am currently not really in this topic nor in the Mailman internas but might it be an idea to use maybe only temporarily IPSet for this so those attempts can be stopped on a FW level ?
I use the Firehol lists --> https://github.com/firehol/blocklist-ipsets/blob/f02b6547722ce72aa1027881e29648cbffbab0eb/README.md which are very extensive but good sorted (incl. beneath Spamhouse a lot more) and also very up-to-date since a couple of years now, we have had also some conversations with the Firehol developer in the forum --> https://forum.ipfire.org/viewtopic.php?f=50&t=15124&start=15#p91774 where a script has been made for cyclic updates in combination with 'update-ipsets' . Have seen that Firehol extended their logic with DNSbl --> https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh which might be worth a try ?

Beneath info, have deleted also a recognizable higher amount of spammers in the past weeks from the forum. It seems that before a Core update (starting at testing time) the amount grows also there.

Just as another idea to ease the whole patching scenario a little

Best,

Erik
Comment 19 Michael Tremer 2019-05-13 14:35:25 UTC
I guess we should start looking into having a good way (including a UI) on how to block things based on an IP blacklist.

That is a different topic and should have an own ticket, but the IPS would benefit from this indeed.
Comment 20 Michael Tremer 2019-09-11 15:50:12 UTC
I consider this closed since we did not have any massive spam issues recently apart from our forums.