# The Secure List Server: an OpenPGP and S/MIME aware Mailman

This patch is an effort to include OpenPGP and S/MIME support in Mailman, as part of the Secure List Server project. The project is made possible by NLnet.

The Secure List Server project's home is at http://non-gnu.uvt.nl/mailman-pgp-smime/. Sources are available from http://non-gnu.uvt.nl/pub/mailman/.

New versions of this patch will be announced on the Mailman developers list

This is Mailman patch #1167696.

Beware! This code is not mature, and not yet suitable for production use. Inspect the code to find out if it's good enough for you.

## Specs

This patch handles both RFC 2633 (S/MIME) and RFC 2440 (OpenPGP) email messages.

A post will be distributed only if the PGP (or S/MIME) signature on the post is from one of the list members.

For sending encrypted email, a list member encrypts to the public key of the list. The post will be decrypted and re-encrypted to the public keys of all list members.

In order to achieve this, each list has a public and private key. (These private keys can optionally be protected by passphrases.) Furthermore, new list settings are defined:

- gpg_post_encrypt: Are postings which are encrypted with the GPG list key decrypted? Are subcribers forced to encrypt their posts?
- gpg_distrib_encrypt: Are posts encrypted to the subscribers GPG public key before being distributed? Is such encryption (and uploading of a public key) mandatory?
- gpg_post_sign: Should posts be GPG signed with an acknowledged subscriber key before being distributed?
- gpg_distrib_sign: Should the server sign messages with the list key before distributing?

Similar settings are defined for S/MIME.

Finally, each subscriber can upload her PGP and S/MIME public key using the webinterface.

## Installation

Additional requirements: gpg binary in path of qrunner, GnuPGInterface python library from http://py-gnupg.sourceforge.net/ and (for now) openssl.

### upgrading from earlier and/or unpatched versions

PGP and S/MIME support needs to store additional information for the mailing lists, thus new variables were introduced. Have a look at bin/update and search for "GPG" and "smime".

The automatic upgrade procedure occuring on a change of the version number is implemented yet untested. You can either modify the version number in Version.py to trigger the automatic patch, or run bin/update --force (worked for me, but I won't give any guarantees).

### fresh installs

If you're installing on a Debian(-based) hosts, you can "apt-get install" the patched package from

    deb http://non-gnu.uvt.nl/debian sarge mailman

If you're on another platform, you can apply the patch to a pristine official mailman tarball, and install using the official installation instructions.

### setting up lists

Create a list. Go to the admin menu. Open "Privacy options", select "GPG options" and "S/MIME options". Make the settings appropriate for your list (yes, there is some help text!). Create a keypair for your list. Make sure the list-posting-address is in one of the keys identities. Publish the public key for your list, e.g. on the list info page. Ask all subscribers to upload their public key. A good idea is to set up the web interface to only run over https.

Very likely, you'd prefer "Confirm and approve" as subscribe_policy (Privacy Options; Subscribtion Rules).

Very likely, you'd prefer "No" for archive (Archiving Options): no effort was made to do something "sane" w.r.t. the archiving of encrypted posts. Just don't archive.

Subscribers who do not upload their public keys will miss posts. Errors show up in `/var/log/mailman/smtp-failure`:

    Mar 24 15:29:28 2005 (5267) delivery to joe@example.com failed with
      code 550: Encryption forced, but no keys found

Tell your subscribers where to upload their keys: list Info Page, Subscribers section. Visit "Subscriber List", choose your address, list membership configuration, "Your GPG key for postings".

Distribute the list public key to your subscribers, e.g. by posting it to the list after they've subscribed, or by pasting it in "[General Options], info" in the list admin webinterface.

### l10n

I only updated the english html template for the user preferences; that means that users using a different language setting will be unable to upload their public key. Either allow English only, or make the patches to other language templates (and send the diff to me).

### lost emails

Users won't get warnings when mails are not delivered to them due to the encryption send policy. Failures to send due to a missing public key will be treated like bounces.

## Hacking

If you're interested in helping with the work, you might like to subscribe to the developer list for a GPG/SMIME-enhanced mailman ssls-dev /a/ ulm.ccc.de. (Thanks a lot to Stefan Schlott for hosting this list.) If you'd like to contact the author directly, mail Joost van Baal on <joostvb-mailman-pgp-smime /a/ mdcc.cx>.

If you'd like to contribute patches, check out the code using Bazaar: See https://code.launchpad.net/~joostvb/mailman/2.1-pgp-smime for instructions.

A fancy webinterface to this version control system is available at Launchpad's Bazaar page.

## History, credits, copyright

This patch is based upon prior work by Stefan Schlott in mailman-2.1.5-gpg_2005-02-22.diff.gz. Copyright on the code is held by Stefan Schlott (stuff from mailman-2.1.5-gpg_2005-02-22.diff.gz) and Tilburg University (stuff written by Joost van Baal), see the individual files for details. Some contributions are from Michael Feiri.

Biggest lumps of changes by Joost van Baal are in Mailman/GPGUtils.py (function verifyMessage added) and in Mailman/Handlers/Moderate.py (code which deals with gpg_post_sign added). These are likely nontrivial so copyright-able. Check with a specialist if you'd like to know for sure. Likely, Mailman upstream wants a copyright assignment to FSF before patch gets included.

In 2005, this project was known as the SURFnet Secure List Server (mailman-ssls). SURFnet and Tilburg University made the project possible. Since 2008, the project is made possible by NLnet.

## See also

There are some alternative approaches on building a general re-encrypting secure list server (e.g. by integrating PGP and/or S/MIME with Mailman):

- mmreencrypt, dating from 2000-10.
- mailman.patch.645297.tar.gz, Mailman patch #645297 by Ben Laurie, dating from 2002-11.
- secure-list-10-212.patch.gz, the NAH6 secure list patch, patch #646989, dating from 2002-12
- Sympa is a mailing list manager with support for S/MIME, no PGP.
- gpg-ezmlm enhances the ezmlm mailing list manager with PGP. Latest release 2005-04 (first release 2002-05). No S/MIME. Since 2008-10, a webinterface (for both ezmlm and gpg-ezmlm) is supplied by Lars Kruse's ezmlm-web v3.3.
- Shibboleth is a mailing list manager optimized for privacy and security. No significant work after 2001: project seems abandoned. Support for PGP, not S/MIME.
- gpgmailalias is not a mailing list system, but a semi-static list of aliases with PGP support. Probably no support for S/MIME. Was active in 2004-09. The tarball seems no longer published.
- firma is a "gnupg mailing list manager", written in bash. As of 2008-10, the last code update in the revision control system happened 2008-01.
- Parlement is a general purpose direct democracy framework, with likely some limited support for PGP-enabled mailing lists. Not S/MIME.
- MMReencrypt, another Mailman patch. No longer maintained (reported Mar 2008).
- Schleuder, a standalone 'crypto mailinglist'. Still maintained (according to their versioning system), but last release (as of Mar 2008) dates back to 2006.

## ChangeLog, BUGS, Roadmap and Reports

See NEWS.PGP-SMIME for user visible (and some other) changes. See TODO.PGP-SMIME for known bugs and plans for improvement. See the pgp-smime directory for some extra project documents (Security Audit reports, project reports).