You have been removed from the list (repeatedly)

[Greg Wooledge]

In the last 24 hours, I've been dropped from this list at least 3 times.
I am able to re-subscribe, but it's a real pain in the ass.

It seems to happen after I post a message to the list while subscribed.
In each case, I receive a message like the one I've quoted below.

Is this happening to anyone else? Is there anything I can do to stop it,
other than simply re-subscribing every time I post?

What is this "vps268904.ovh.net", why is it sending messages with the
subject "**stop**", why do no such messages appear in the web archive
of debian-user, and why are these messages causing me to become
unsubscribed?

My best guess is that someone is spamming debian-user, the messages are
being sent to everyone, my local MTA's spam filters are blocking them,
and the mailing list is getting mad at me for blocking the spam that it's
sending to me. This might not be the case, but it would explain why the
messages aren't showing up in the web archive (they're removed because
they're spam).

On Tue, Oct 05, 2021 at 08:28:57PM +0000, debian-us...@lists.debian.org wrote:
> Your mail address gr...@wooledge.org has been removed
> from the debia...@lists.debian.org mailinglist.
> It generated an excessive amount of bounced mails.
>
> Before sending in a subscription request to
> debian-us...@lists.debian.org again, please ensure that
> this problem has been resolved. When in doubt, ask your system
> administrator or send mail to "postmaster".
>
> The last one of those bounced mails has been quoted below:
> >From postm...@vps268904.ovh.net Tue Oct 5 20:28:57 2021
> >Return-Path: <postm...@vps268904.ovh.net>
> >X-Original-To: lists-de...@bendel.debian.org
> >Delivered-To: lists-de...@bendel.debian.org
> >Received: from localhost (localhost [127.0.0.1])
> > by bendel.debian.org (Postfix) with ESMTP id A34E220455
> > for <lists-de...@bendel.debian.org>; Tue, 5 Oct 2021 20:28:57 +0000 (UTC)
> >X-Virus-Scanned: at lists.debian.org with policy bank en-ht
> >X-Spam-Flag: NO
> >X-Spam-Score: 1.399
> >X-Spam-Level: *
> >X-Spam-Status: No, score=1.399 tagged_above=-10000 required=5.3
> > tests=[BAYES_20=-1, KHOP_HELO_FCRDNS=0.399, ONEWORD=2]
> > autolearn=no autolearn_force=no
> >Received: from bendel.debian.org ([127.0.0.1])
> > by localhost (lists.debian.org [127.0.0.1]) (amavisd-new, port 2525)
> > with ESMTP id V1u0M6nx3IlZ for <lists-de...@bendel.debian.org>;
> > Tue, 5 Oct 2021 20:28:53 +0000 (UTC)
> >X-policyd-weight: using cached result; rate:hard: -5.5
> >Received: from vps268904.ovh.net (mail.data3v.com [51.254.223.75])
> > (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
> > key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
> > (Client did not present a certificate)
> > by bendel.debian.org (Postfix) with ESMTPS id 2D0D820413
> > for <debia...@lists.debian.org>; Tue, 5 Oct 2021 20:28:53 +0000 (UTC)
> >X-Kerio-Anti-Spam: Build: [Engines: 2.16.1.1366, Stamp: 3], Multi: [Enabled, t: (0.000033,0.002846)], BW: [Enabled, t: (0.000055,0.000021)], RTDA: [Enabled, t: (0.033185), Hit: No, Details: v2.7.195; Id: 15.52k5as.1fh92a0an.5p5s], total: 0(700)
> >Received: from localhost
> > by vps268904.ovh.net (Kerio Connect 9.3.1 patch 1); Tue, 5 Oct 2021 22:28:47 +0200
> >Date: Tue, 5 Oct 2021 22:28:47 +0200
> >Message-ID: <1641278...@vps268904.ovh.net>
> >MIME-Version: 1.0
> >From: "Mail Delivery Subsystem" <postm...@vps268904.ovh.net>
> >To: <debia...@lists.debian.org>
> >Subject: **stop**
> >X-Kerio-Notification: yes
> >Content-Type: text/plain; charset="utf-8"
> >X-Rc-Virus: 2007-09-13_01
> >X-Rc-Spam: 2008-11-04_01
> >
> ><gr...@wooledge.org>: Re: network problem
> >On Tue, Oct 05, 2021 at 10:00:45PM +0200, Pierre Frenkiel wrote:
> >> hi,
> >> I have the following problem on my laptop.
> >> my /etc
> >Please stop the message. we have already unsubscribed our email address.
> >

[piorunz]

On 05/10/2021 21:40, Greg Wooledge wrote:
> Your mail addre...@wooledge.org has been removed
> from thedebi...@lists.debian.org mailinglist.

> It generated an excessive amount of bounced mails.

That's the explanation. My guess, based on this, is:
Your e-mail system bounces spam back, meaning it sends it back to the
list. That's unnecessary. Configure your e-mail system to accept all
spam or send it to /dev/null, but don't send it back.

--
With kindest regards, Piotr.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

[Thomas Schmitt]

Hi,

Greg Wooledge wrote:
> In the last 24 hours, I've been dropped from this list at least 3 times.

> [...]

> Is this happening to anyone else?

Not to me.

> > >Date: Tue, 5 Oct 2021 22:28:47 +0200

> > >Subject: **stop**

I am not aware to have seen this.
So the theory seems not plausible that your problem would be due to
rejections of debian-user mails by your receiving mail server.

I get warnings about such rejections from time to time.
This one is still in my mailbox:
---------------------------------------------------------------------
Date: Fri, 21 Aug 2020 16:45:11 +0000 (UTC)
From: Debian Listmaster Team <listm...@lists.debian.org>
To: scdb...@gmx.net
Subject: lists.debian.org has received bounces from you

Dear subscriber,

We've encountered some problems while sending listmail to your
emailaddress scdb...@gmx.net.

In the last seven days we've seen bounces for the following list:
* debian-user
1 bounce out of 34 mails in one day (2%, kick-score is 80%)
(https://lists.debian.org/bounces/466k6zCluxiU7cYm51NzHA)

(The link above points to a copy of the latest bounce
and will be valid for seven days.)

If the bounce-rate passes the kick-score, our bounce-detection will forcibly
remove your subscription.

Bounces happen from time to time when spam slips through our filters but are
rejected by your mail provider. If you are your own mail provider and use
'Before-Queue Content filtering', you should whitelist bendel.debian.org
from
Content filtering.

However: You can safely ignore this message (and you will not be unsubscribed
:-) ) if your bounce rate remains low.

For more information see https://wiki.debian.org/Teams/ListMaster/FAQ

You are welcome to contact listm...@lists.debian.org if you think this
message was sent in error.

Sincerely,
The Listmaster Team
--
http://lists.debian.org

---------------------------------------------------------------------
End of mail quote.


Are you sure that you really have been unsubscribed - and not spoofed ?
Do you really miss out mails which show up in the archives ?

This quoted header from your mail body:

> > >X-Spam-Status: No, score=1.399 tagged_above=-10000 required=5.3
> > > tests=[BAYES_20=-1, KHOP_HELO_FCRDNS=0.399, ONEWORD=2]
> > > autolearn=no autolearn_force=no

looks quite different from samples out of my debian-user mail collection:

Yours:
> X-Spam-Status: No, score=-6.6 required=4.0 tests=DIGITS_LETTERS,FOURLA,
> LDOSUBSCRIBER,LDO_WHITELIST,MURPHY_DRUGS_REL8,RDNS_NONE,YOUTHERE
> autolearn=unavailable autolearn_force=no version=3.4.2

Mine:
> X-Spam-Status: No, score=-11.9 required=4.0 tests=DKIM_SIGNED,DKIM_VALID,
> DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FREEMAIL_FROM,LDOSUBSCRIBER,
> LDO_WHITELIST,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL
> autolearn=unavailable autolearn_force=no version=3.4.2

Others:

> X-Spam-Status: No,
> score=-4.9 required=4.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,
> LDO_WHITELIST,NUMERIC_HTTP_ADDR,RCVD_IN_DNSWL_LOW
> autolearn=unavailable autolearn_force=no version=3.4.2

> X-Spam-Status: No, score=2.3 required=4.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
> DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,HTML_IMAGE_ONLY_16,HTML_MESSAGE,
> RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL autolearn=no
> autolearn_force=no version=3.4.2


Have a nice day :)

Thomas

[Cindy Sue Causey]

On 10/5/21, Greg Wooledge <gr...@wooledge.org> wrote:
> In the last 24 hours, I've been dropped from this list at least 3 times.
> I am able to re-subscribe, but it's a real pain in the ass.
>
> It seems to happen after I post a message to the list while subscribed.
> In each case, I receive a message like the one I've quoted below.
>
> Is this happening to anyone else? Is there anything I can do to stop it,
> other than simply re-subscribing every time I post?
>
> What is this "vps268904.ovh.net", why is it sending messages with the
> subject "**stop**", why do no such messages appear in the web archive
> of debian-user, and why are these messages causing me to become
> unsubscribed?

Apparently OVH is possibly some kind of cloud thing.. and/or also a
web domain registrar kind of deal.. or not. I took a quick peek at my
insanely massive inbox. Found maybe 20 references.

Seven references were sent by me to "s/pam" at UCE dot gov.. back in
2012. Ouch. OVH dot net appeared to be the "real" sender, the conduit,
while something "dot fr" was also listed as the sender in the random
email I viewed.

A more recent email is "OVH dot it" this past March, 2021. The message
is Italian, as confirmed by Google's translator. The email is advising
that the recipient needs to immediately renew their expired website
services.

> My best guess is that someone is spamming debian-user, the messages are
> being sent to everyone, my local MTA's spam filters are blocking them,
> and the mailing list is getting mad at me for blocking the spam that it's
> sending to me. This might not be the case, but it would explain why the
> messages aren't showing up in the web archive (they're removed because
> they're spam).
>
> On Tue, Oct 05, 2021 at 08:28:57PM +0000,
> debian-us...@lists.debian.org wrote:
>> Your mail address gr...@wooledge.org has been removed
>> from the debia...@lists.debian.org mailinglist.
>> It generated an excessive amount of bounced mails.
>>
>> Before sending in a subscription request to
>> debian-us...@lists.debian.org again, please ensure that
>> this problem has been resolved. When in doubt, ask your system
>> administrator or send mail to "postmaster".
>>
>> The last one of those bounced mails has been quoted below:
>> >From postm...@vps268904.ovh.net Tue Oct 5 20:28:57 2021
>> >Return-Path: <postm...@vps268904.ovh.net>
>> >X-Original-To: lists-de...@bendel.debian.org
>> >Delivered-To: lists-de...@bendel.debian.org
>> >Received: from localhost (localhost [127.0.0.1])
>> > by bendel.debian.org (Postfix) with ESMTP id A34E220455
>> > for <lists-de...@bendel.debian.org>; Tue, 5 Oct 2021 20:28:57

Interesting because the newer hinky looking email I'm looking at was
sent from a gmx.de email address and was sent directly to online at
bendel dot debian dot org as the public, immediately visible
recipient.

Found one last reference which was a thread about Debian sponsors
and/or service providers where OVH appeared to be given a positive
thumbs up due to their support, by the way.


< snipped for brevity >

>> ><gr...@wooledge.org>: Re: network problem
>> >On Tue, Oct 05, 2021 at 10:00:45PM +0200, Pierre Frenkiel wrote:
>> >> hi,
>> >> I have the following problem on my laptop.
>> >> my /etc
>> >Please stop the message. we have already unsubscribed our email address.

Did you write the "Please stop" part? It appears to be attributing the
"we have already unsubscribed" to you, Greg, which is certainly not
what you're trying to do. :)

Cindy :)
--
Cindy-Sue Causey
Talking Rock, Pickens County, Georgia, USA
* runs with birdseed *

[Andy Smith]

Hi Greg,

On Tue, Oct 05, 2021 at 04:40:41PM -0400, Greg Wooledge wrote:
> My best guess is that someone is spamming debian-user, the messages are
> being sent to everyone, my local MTA's spam filters are blocking them,
> and the mailing list is getting mad at me for blocking the spam that it's
> sending to me. This might not be the case, but it would explain why the
> messages aren't showing up in the web archive (they're removed because
> they're spam).

I believe this is the correct answer and answers all the previous
questions you asked, except what to do about it.

My approach is to have a hardcoded list of senders in my Exim
configuration whose emails I will silently discard instead of
rejecting during the SMTP conversation, if a reject decision is
reached.

It's not a great solution since rejecting during the SMTP
conversation is the right thing to do in the general case, but
Debian mailing lists are open and tend to receive quite a bit more
spam than your average closed Mailman list.

Cheers,
Andy

--
https://bitfolk.com/ -- No-nonsense VPS hosting

[Reco]

Hi.

On Tue, Oct 05, 2021 at 04:40:41PM -0400, Greg Wooledge wrote:

> Is this happening to anyone else?

Not yet.

> Is there anything I can do to stop it, other than simply
> re-subscribing every time I post?

It says there plain and clear:

> > When in doubt, ... or send mail to "postmaster".

Lists' postmasters were very helpful in pointing at errors in my setup
when I had the problems with the list in the past. Mail them, ask for
help.

The most probable cause of your troubles - you do not have DMARC policy
published, which means the whole Internet could send bounces to the list
on your behalf. SPF policy that you have published is not enough.

> What is this "vps268904.ovh.net",

"whois ovh.net" will tell you all you need to know about it,
specifically - an abuse e-mail. Consider sending an e-mail there as
well.
Long story short - that host belongs to OVH, one of the Europe largest
hosting provider, and it's withing their power to excommunicate one of
their clients.

> why is it sending messages with the subject "**stop**",

Because it's host owner who misconfigured that sorry excuse for an MTA
called "Kerio Connect", so it's sending bounces.

> why do no such messages appear in the web archive of debian-user,

Because the list archive does not store bounces.

> and why are these messages causing me to become unsubscribed?

This e-mail is the consequence, not the reason of it. After all, it says
"we have already unsubscribed", so it was some other e-mail that got you
into this trouble.

> My best guess is that someone is spamming debian-user, the messages are
> being sent to everyone, my local MTA's spam filters are blocking them,
> and the mailing list is getting mad at me for blocking the spam that it's
> sending to me.

Silently discarding spam was always OK.
Replying to the spammer via list was not and is not.
Bouncing spammer e-mail (which could happen due to MTA misconfiguration
on your part) will get you removed from the list.

Reco

[Greg Wooledge]

On Wed, Oct 06, 2021 at 08:27:36AM +0300, Reco wrote:
> On Tue, Oct 05, 2021 at 04:40:41PM -0400, Greg Wooledge wrote:
> > Is there anything I can do to stop it, other than simply
> > re-subscribing every time I post?
>
> It says there plain and clear:
>
> > > When in doubt, ... or send mail to "postmaster".
>
> Lists' postmasters were very helpful in pointing at errors in my setup
> when I had the problems with the list in the past. Mail them, ask for
> help.

That paragraph is telling me to talk to "postm...@wooledge.org" which
is, unfortunately, me.

> The most probable cause of your troubles - you do not have DMARC policy
> published, which means the whole Internet could send bounces to the list
> on your behalf. SPF policy that you have published is not enough.

Another thing I have to learn?! Crap. Well, maybe some day I'll find
the time and energy to think about it.

I still don't understand how a bounce message that was received by
the Debian mail server ("Delivered-To: lists-de...@bendel.debian.org")
with a "From postm...@vps268904.ovh.net" on top of it can cause *me*
to become unsubscribed. The only place my email address is mentioned
is at the top of the body.

Is a message sent from Alice to lists-de...@bendel.debian.org with
Bob's address at the top of the body considered a "bounce from Bob"?
That sounds like a huge bug in bendel.debian.org to me.

Either that, or they're not showing me enough context to understand how
this particular message from ovh.net got *me* in trouble.

I guess the only thing I can do *right now* is hope that whoever this
ovh user is, they'll fix their setup and/or *actually* unsubscribe
instead of just thinking they have unsubbed.

[Andrew M.A. Cater]

On Wed, Oct 06, 2021 at 07:39:26AM -0400, Greg Wooledge wrote:
> On Wed, Oct 06, 2021 at 08:27:36AM +0300, Reco wrote:
> > On Tue, Oct 05, 2021 at 04:40:41PM -0400, Greg Wooledge wrote:
> > > Is there anything I can do to stop it, other than simply
> > > re-subscribing every time I post?
> >
> > It says there plain and clear:
> >
> > > > When in doubt, ... or send mail to "postmaster".
> >
> > Lists' postmasters were very helpful in pointing at errors in my setup
> > when I had the problems with the list in the past. Mail them, ask for
> > help.
>

I just got bounced and have resubscribed :(

I sent a quick email to listm...@lists.debian.org to let them know what's
happening.

I'm guessing this user / users can be added to a deny list / deny block -
I thought OVH was already deny-listed a while back.

All best,

Andy C.

[Reco]

On Wed, Oct 06, 2021 at 07:39:26AM -0400, Greg Wooledge wrote:

> On Wed, Oct 06, 2021 at 08:27:36AM +0300, Reco wrote:
> > On Tue, Oct 05, 2021 at 04:40:41PM -0400, Greg Wooledge wrote:
> > > Is there anything I can do to stop it, other than simply
> > > re-subscribing every time I post?
> >
> > It says there plain and clear:
> >
> > > > When in doubt, ... or send mail to "postmaster".
> >
> > Lists' postmasters were very helpful in pointing at errors in my setup
> > when I had the problems with the list in the past. Mail them, ask for
> > help.
>
> That paragraph is telling me to talk to "postm...@wooledge.org" which
> is, unfortunately, me.

There's no harm in asking for help from lists' postmaster, given a
circumstances like this.
I'm sure you're familiar with [1].

> > The most probable cause of your troubles - you do not have DMARC policy
> > published, which means the whole Internet could send bounces to the list
> > on your behalf. SPF policy that you have published is not enough.
>
> Another thing I have to learn?! Crap. Well, maybe some day I'll find
> the time and energy to think about it.

Some consider SMTP an old protocol, but it's a moving target actually.
Even a perfect setup can get outdated with time.
And, DMARC is a simple TXT DNS record, unless you want to implement
a proper checking of receiving mails.

> I still don't understand how a bounce message that was received by
> the Debian mail server ("Delivered-To: lists-de...@bendel.debian.org")
> with a "From postm...@vps268904.ovh.net" on top of it can cause *me*
> to become unsubscribed. The only place my email address is mentioned
> is at the top of the body.

It's my understanding that this particular bounce did not get you
unsubscribed. It's a consequence.
There was another, earlier bounce that did, which is a reason.
I may be wrong here, of course. I haven't seen the logs of your qmail,
for starters.

> Is a message sent from Alice to lists-de...@bendel.debian.org with
> Bob's address at the top of the body considered a "bounce from Bob"?
> That sounds like a huge bug in bendel.debian.org to me.

It may seem that way, but it's not. Your e-mail address is a part of the
e-mail body, and does not included in e-mail headers. And headers are
pretty clear on who's the sender is.

> Either that, or they're not showing me enough context to understand how
> this particular message from ovh.net got *me* in trouble.

IMO you're looking at the wrong e-mail.

> I guess the only thing I can do *right now* is hope that whoever this
> ovh user is, they'll fix their setup and/or *actually* unsubscribe
> instead of just thinking they have unsubbed.

Of course they won't. Why should they bother with fixing anything if it
does not break anything *for them*?
Receiving a "friendly" advice (in other words - be a good netizen or
take your spam machine elsewhere) from their hosting provider can do the
trick. And sending an abuse e-mail is the actual action you *can* do
right now.

Reco

[1] https://www.debian.org/MailingLists/

[Reco]

Hi.

On Wed, Oct 06, 2021 at 11:43:02AM +0000, Andrew M.A. Cater wrote:
> On Wed, Oct 06, 2021 at 07:39:26AM -0400, Greg Wooledge wrote:
> > On Wed, Oct 06, 2021 at 08:27:36AM +0300, Reco wrote:
> > > On Tue, Oct 05, 2021 at 04:40:41PM -0400, Greg Wooledge wrote:
> > > > Is there anything I can do to stop it, other than simply
> > > > re-subscribing every time I post?
> > >
> > > It says there plain and clear:
> > >
> > > > > When in doubt, ... or send mail to "postmaster".
> > >
> > > Lists' postmasters were very helpful in pointing at errors in my setup
> > > when I had the problems with the list in the past. Mail them, ask for
> > > help.
> >
>
> I just got bounced and have resubscribed :(

And the most interesting thing is that your domain does not have DMARC
policy, but has SPF. Same as Greg.

We just need someone else to finish establishing the pattern here.

Reco

[Bret Busby]

I believe that the solution is simple, and, what the list
administrator(s) of the Debian User list will not do; simply disallow
messages posted to the list, from non-subscribers.

It is simple, will minimise spurious removals from the list, and,
minimise spamming of the list.

--
Bret Busby
Armadale
West Australia
(UTC+0800)
..............

[Greg Wooledge]

On Wed, Oct 06, 2021 at 09:09:11PM +0800, Bret Busby wrote:
> I believe that the solution is simple, and, what the list administrator(s)
> of the Debian User list will not do; simply disallow messages posted to the
> list, from non-subscribers.
>
> It is simple, will minimise spurious removals from the list, and, minimise
> spamming of the list.

Well, you already know that this won't happen. They don't want to close
the list in that way.

That said, this would *not* stop the problem that I'm having right now.
The "forged bounce messages" (for lack of a better term) are coming
from someone who *is* subscribed. They've set up some sort of auto-responder
which is generating one of these messages every time they receive a
message from the list. Because they're still subscribed.

[Dan Ritter]

Sorry, I have SPF but not DMARC and am not seeing any of these
bounce issues.

-dsr-

[Thomas Schmitt]

Hi,

Greg Wooledge wrote:
> The "forged bounce messages" (for lack of a better term) are coming
> from someone who *is* subscribed. They've set up some sort of auto-responder
> which is generating one of these messages every time they receive a
> message from the list.

This would be a novel application of mail Bounce Attack aka Backscatter,
which is normally used to smuggle spam content around the filters.
If so, then not you get spoofed but rather the Debian list server is
too credulent towards DSN messages.

This would also explain why the headers of the quoted message from
postm...@vps268904.ovh.net do not look like a message that was
resent from debian-user. Instead it was payload of a forged bounce
message.

[Dan Ritter]

It just happened to me, and then it happened again 10 minutes
later.

I suspect that this is a deliberate attack against debian-user,
not a misconfigured anti-spam bot.

My temporary work-around is to use separate addresses to
subscribe to the list (and thus receive copies) and to post to
the list (which will be targeted by the attacker, but cannot be
unsubscribed because they aren't subscribed.)

We probably need a change to the mail-handling system to only
accept its own SMTP-time delivery failures as proof that a
subscriber address has disappeared.

-dsr-