Justin, any thoughts about implementing a temporary lockout or at least an alert when a password is clearly trying to be hacked? The thought of someone succeeding in accessing a list is frightening

Well,

Let's see what the docs have:

http://dadamailproject
com/support/documentation-4_0_4/Config
pm
html#security

First off:

$SHOW_ADMIN_LINK

Quote: Set $SHOW_ADMIN_LINK to '0' to take off the 'Administration' link that you see on the Dada Mail default page

Yeah, let's def use that If you use an outside config file, use, "2", instead of 0 What else?

$ADMIN_FLAVOR_NAME

Quote:

Complementary to the $SHOW_ADMIN_LINK variable, $ADMIN_FLAVOR_NAME allows you to set the URL needed to access the screen 
that has the form to log into all the lists administrated by Dada Mail and to the form to create a new list

That's sounds pretty useful too I use both myself If you look at:

http://dadamailproject
com/cgi-bin/dada/mail
cgi

You'll notice there isn't an administration link, and just going to the default one:

http://dadamailproject
com/cgi-bin/dada/mail
cgi/admin

Doesn't work (you just go to the default screen)

That seems like we're doing some good - but couldn't some one just make a query string, with the correct variables? Something like,

http://dadamailproject
com/cgi-bin/dada/mail
cgi?f=login&process=true&admin_list=dada_announce&admin_password=secret

I mean, what's the point of hiding the form, if you can just bypass the form?

If you try the above, it doesn't work, because:

$DISABLE_OUTSIDE_LOGINS

If set to, 1, The only forms that will allow you to log into a Dada Mail list will be by a form supplied by Dada Mail itself
 
This means, you can't create a different form, outside the program to provide a way to login


More so than any other option, this variable attempts to stop attempts of logging into a list by automated means

So, contrary to what I think John says is happening, someone (or something - a 'bot? is this a similar problem we had with bots following links in archived messages?) is just trying to login by guessing the password, it's not working and they click the button to get it reset

If you use set the three variables above, that above scenario will quickly dissipate