Folks,
I think we have a bit of a problem with administration of the mailing lists
on lists.osgeo.org. The basic issue is that many of the mailing lists do
not have a clear person responsible (most list several "administrators"
and/or moderators) but there is only one admin password per list. Some
folks have gone in and changed the admin passwords (as was suggested during
the migration I believe).
But now, I get moderator emails for the www_international-discuss list (still
not loving the name) but I don't know the admin password for the list.
I would like to suggest we use a communal admin password for "shared" lists.
That is lists with multiple admin/moderators. This would be provided to anyone
helping to admin lists. But it would not preclude single-admined lists.
Normally I don't like communal passwords but it seems to me that "list
security" is not terribly important and mailman doesn't *seem* to offer an
easy option for LDAP based administration as far as I know (does it?)
If SAC is agreeable, I suggest we pick a memorable password but one not quite
as obvious as the original one that was assigned and distribute it privately
by email to anyone interested. Shawn, is there a script that can be run to
forcable apply a new admin password?
If folks are agreeable, I will prepare a list of initial lists that I think
should be handled communally. I will give a couple days for statements of
support or raising concerns.
Best regards,
--
---------------------------------------+--------------------------------------
I set the clouds in motion - turn up | Frank Warmerdam, warmerdam@pobox.com
light and sound - activate the windows | http://pobox.com/~warmerdam
and watch the world go round - Rush | President OSGeo, http://osgeo.org
Frank Warmerdam wrote:
Normally I don't like communal passwords but it seems to me that "list
security" is not terribly important and mailman doesn't *seem* to offer an
easy option for LDAP based administration as far as I know (does it?)
How'bout setting up HTTP Basic authentication (i.e. good old web browser password prompt) on http://lists.osgeo.org/mailman/* to require authenticated users for all the mailman admin scripts (I believe that's admin and admindb but there may be others) and leaving the other public scripts (i.e. listinfo, options and others?) not password-protected.
The HTTP Basic authentication could likely pull login names from LDAP to check for authorized list admins, and then you could safely use a communal password for the mailman password prompt.
Daniel
--
Daniel Morissette
http://www.mapgears.com/
Frank Warmerdam wrote:
Folks,
I think we have a bit of a problem with administration of the mailing lists
on lists.osgeo.org. The basic issue is that many of the mailing lists do
not have a clear person responsible (most list several "administrators"
and/or moderators) but there is only one admin password per list. Some
folks have gone in and changed the admin passwords (as was suggested during
the migration I believe).
But now, I get moderator emails for the www_international-discuss list (still
not loving the name) but I don't know the admin password for the list.
I would like to suggest we use a communal admin password for "shared" lists.
That is lists with multiple admin/moderators. This would be provided to anyone
helping to admin lists. But it would not preclude single-admined lists.
Normally I don't like communal passwords but it seems to me that "list
security" is not terribly important and mailman doesn't *seem* to offer an
easy option for LDAP based administration as far as I know (does it?)
If SAC is agreeable, I suggest we pick a memorable password but one not quite
as obvious as the original one that was assigned and distribute it privately
by email to anyone interested. Shawn, is there a script that can be run to
forcable apply a new admin password?
If folks are agreeable, I will prepare a list of initial lists that I think
should be handled communally. I will give a couple days for statements of
support or raising concerns.
Best regards,
Hello,
I support this idea and suggest to change the current low security password right away. We had some legal issues with personal information being too easily available. Just share the new password for the lists currently administered by sbarnes, tylermitchell and fwarmerdam. If pressing issues have to be done the entitled list admin can request for them.
Best regards, Arnulf.
PS:
I had to change my email address (for the first time in 7 years) and could do this globally for all OSGeo mailing lists. That is cool! I will have to change each of the other 10 dozen mailing list subscriptions manually. Thats a pain. OSGeo Foundation relieves form pain.
PSS:
If this mail gets through it worked. Thanks!
That sounds like a good approach to me. Managing all these passwords is a nightmare without a central system like LDAP.
I am also pulling myself off of the lists as an administrator, but fear that some admins don't really realise what they should be doing. I think we need to revisit some lists and change default settings - especially turning on auto-reject posts from non-list members, etc. We may also need to give a tutorial for some list admins. Note that any "Project Owners" from the old infrastructure were instantly made list admins through our upgrade.
Tyler
On 3-Jan-07, at 8:05 AM, Daniel Morissette wrote:
Frank Warmerdam wrote:
Normally I don't like communal passwords but it seems to me that "list
security" is not terribly important and mailman doesn't *seem* to offer an
easy option for LDAP based administration as far as I know (does it?)
How'bout setting up HTTP Basic authentication (i.e. good old web browser password prompt) on http://lists.osgeo.org/mailman/* to require authenticated users for all the mailman admin scripts (I believe that's admin and admindb but there may be others) and leaving the other public scripts (i.e. listinfo, options and others?) not password-protected.
The HTTP Basic authentication could likely pull login names from LDAP to check for authorized list admins, and then you could safely use a communal password for the mailman password prompt.
Daniel
--
Daniel Morissette
http://www.mapgears.com/
_______________________________________________
Sac mailing list
Sac@lists.osgeo.org
http://lists.osgeo.org/mailman/listinfo/sac