Thomas,

The headers (helper and list unsubscribe) are in there ok.  It's the Mailing list Settings - Distribution - Signature File that does not show up on emails sent to the list if the originating email is sent as HTML vs plain text.

Again, I did not ugrade to latest version yet.

Thanks,

MP 

Hi,

 I'm new to MercuryB.  I want members of mailing list to be able to visit a web site to remove themselves from a mialing list.

It seems to me that mercuryB is running on my machine, opening it up as a "WEB SERVER" and people can connect on Port 80 to it from the outside world?

Is this not a security issue? 

Basically, I'm not sure how this is really supposed to work. 

I have reviewed the old MLSS, where I could create a web site and have it send the commands to mercury to remove people. 

Can I still do this or has MercuryB taken its place?  Either way, I'm not sure where to start with these.

I just want subscribers to be able to goto a web site, where they can remove themselves from the list.

Thanks much,

Mark 

[quote user="Mrpush"]

Hi,

 I'm new to MercuryB.  I want members of mailing list to be able to visit a web site to remove themselves from a mialing list.

It seems to me that MercuryB is running on my machine, opening it up as a "WEB SERVER" and people can connect on Port 80 to it from the outside world?

Is this not a security issue? 

Yes, no and maybe.  MercuryB and port 80 though is not so much of a problem as having your system connected directly to the internet rather than having a router between your system and the internet.  In addition, MercuryB is not really a webserver, it only performs very limited functions and only talks to Mercury.

Basically, I'm not sure how this is really supposed to work. 

I have reviewed the old MLSS, where I could create a web site and have it send the commands to mercury to remove people. 

You can still send the sub/unsub/etc commands to Mercury/32 directly via email, MercuryB does pretty much the same thing directly.

Can I still do this or has MercuryB taken its place?  Either way, I'm not sure where to start with these.

I just want subscribers to be able to go to a web site, where they can remove themselves from the list.

Then that is using MercuryB.

Thanks much,

Mark 

Thomas,

Thanks for the info.  I'm a little lost on the setup however.

I have MercuryB loaded, it has all default settings.  I have a LIST set to use MercuryB, but now what? 

How does the e-mail post know how to the list link to MercuryB? 

I have no Hyper links displayed in the list e-mail posts, how would a hyperlink get through my firewall?

I do know there are pre-made mlss html files, but do they go on my externally ISP hosted web server or do they reside in the mercury install directory?

If they are on my web hosting server, how would MercuryB get the variables to or form the HTML pages? 

I have no idea how to set this up. Is there a setup guide?

 Thanks much,

MP

[quote user="Mrpush"]

Thomas,

Thanks for the info.  I'm a little lost on the setup however.

I have MercuryB loaded, it has all default settings.  I have a LIST set to use MercuryB, but now what? 

How does the e-mail post know how to the list link to MercuryB? 

The email goes to the maiser@your.domain.com and it uses the formats as shown in the help.  MercuryB comes in via HTTP and uses the port yuo have set on yuor system.  For example, T use port 85 on my system so http://tstephenson,com:85/mlss  connects to my router, is transferred to the system running Mercury/32 and opens the web page.

I have no Hyper links displayed in the list e-mail posts, how would a hyperlink get through my firewall?

You open the port that you are using  for MercuryB.

I do know there are pre-made mlss html files, but do they go on my externally ISP hosted web server or do they reside in the mercury install directory?

The default is c:\mercury\mlss

If they are on my web hosting server, how would MercuryB get the variables to or form the HTML pages? 

I have no idea how to set this up. Is there a setup guide?

You can use the Configuration | MercuryB to make changes but the rest is really just doing an http:// into the hostname and port.

 Thanks much,

MP

[/quote]

Thomas,

 Thanks for the information.

Due to security issues, we would never want to open tcp port 85 on our routers.  This could allow for direct attacks on our systems.  This could be a possibility if we had a DMZ, but we currently do not.

Can I somehow use the MLSS site pages, that are running on our ISP's servers (outside the company), to pass subscription information to Mercury32? 

I though that before MercuryB, there was a way to use the MLSS pages externally?

If not, I'll assume the only other way to manage subscriptions is via commands in e-mails sent to maiser@mydomain then?

Thanks much,

MP

[quote user="Mrpush"]

Thomas,

 Thanks for the information.

Due to security issues, we would never want to open tcp port 85 on our routers.  This could allow for direct attacks on our systems.  This could be a possibility if we had a DMZ, but we currently do not.

You can use a port like 8085 however the opening of port 85 on the router and passing it only to a specific system via NAT has no particular security problems.

Can I somehow use the MLSS site pages, that are running on our ISP's servers (outside the company), to pass subscription information to Mercury32? 

The web pages moved to an outside server would be way more of a security problem since the outside system must have full access to the Mercury/32 system to perform it's tasks.

I though that before MercuryB, there was a way to use the MLSS pages externally?

Nope.  There is a HTTPServer available to manage the Mercury/32 server but that also requires opening a port.

If not, I'll assume the only other way to manage subscriptions is via commands in e-mails sent to maiser@mydomain then?

Correct.  I assume you do have some ports open to the outside world to get and send the mail.

Thanks much,

MP

Thomas,

How about this option.   When subscribers receive their e-mail, it would have a hyperlink in it that passes the List_name and members e-mail address (as varaibles) to a web form I have created on my ISP servers.

The form opens and has a submit button that sends the info as an e-mail form to maiser@mydomain.com.  Mercury receives it and removes them.

This would require Mercury simply to generate a hyperlink in the e-mails with the 2 variables. (kind of like it does with the mailto:headers )

ex.  Hyperlink generated in emails:  http://www.mysite.com/listsub.html?listname=~p2(listname)&emailaddress=~???(email address)

Then my html form, on submit, creates an e-mail (I already have a for that does this on my web site) that would goto maiser@mydomain.com. 

The list subscription is them managed by an auto-populated web page (which I prefer) from off site.

Can Mercury generate a hyperlink or does it understand the variables (~p2 as "listname") if I put them in a hyperlink say in the Help URL or in a signature? 

(if I create a hyperlink  http://www.mysite.com/listsub.html?listname=~p2 in my helper URL or signature, would Mercury see the ~p2 and enter the list name?)

I will review the port 85 situation. 

Thanks much,

MP

When you 'open' the port on your router, all you are doing is making only one port on only one internal machine available to the world.

There is no way for an external user to gain access to any other internal machine, or even any other port on the target machine.

The only possible security concern, is what the application listening on that port does with any incoming commands.

[quote user="Mrpush"]

Thomas,

How about this option.   When subscribers receive their e-mail, it would have a hyperlink in it that passes the List_name and members e-mail address (as varaibles) to a web form I have created on my ISP servers.

The form opens and has a submit button that sends the info as an e-mail form to maiser@mydomain.com.  Mercury receives it and removes them.

This would require Mercury simply to generate a hyperlink in the e-mails with the 2 variables. (kind of like it does with the mailto:headers )

You can use a filter to add any header you want to a message but they will not be useful at all unless it's in the body of the message.  I would try using a outgoing Mercury/32 rule based on the address in the To: field which should contain the list address.  The filter would use the option "Insert a text fragment (Disclaimer) " to provide anything you want to the outbound message.

ex.  Hyperlink generated in emails:  http://www.mysite.com/listsub.html?listname=~p2(listname)&emailaddress=~???(email address)

Then my html form, on submit, creates an e-mail (I already have a for that does this on my web site) that would goto maiser@mydomain.com. 

The list subscription is them managed by an auto-populated web page (which I prefer) from off site.

Can Mercury generate a hyperlink or does it understand the variables (~p2 as "listname") if I put them in a hyperlink say in the Help URL or in a signature? 

The disclaimer can be HTML text.

(if I create a hyperlink  http://www.mysite.com/listsub.html?listname=~p2 in my helper URL or signature, would Mercury see the ~p2 and enter the list name?)

I will review the port 85 situation. 

This whole process looks like a real pain in the rear though since it's generally re-inventing the wheel.  Using port 8080 or similar  would be a lot safer, provide more security and be a lot simpler.

Thanks much,

MP[/quote]

Dilberts,

So you are saying that the security issue then lies in what Mercury allows the intruder to do.  Could there be some unforseen security hole in Mercury that could give the intruder the ability to do damage?

It's seems to happen with most OS's and apps, hence my concern.

What port do you guys use and what is considered to be the safest?

I don't have lots of security experience and tend toward the more conservative side.

Thanks much,

MP 

Thomas,

Thanks for the information.

If I add text to the body (a disclaimer) with a filter rule will it understand the Mercuy variables (i.e. ~p1, ~p2, etc) so that the text will show the list name and  subscribers email address automatically like in a *.mer file?

Many list subscription sites I have used auto-populate the list name and e-mail address of the subscriber and are a "single click" operation to un-subscribe. I really like that.

Are there more simplified MLSS HTML pages that would include just the list name & email adress, and an unsubscribe button?

Thanks much,

MP

[quote user="Mrpush"]

Thomas,

Thanks for the information.

If I add text to the body (a disclaimer) with a filter rule will it understand the Mercuy variables (i.e. ~p1, ~p2, etc) so that the text will show the list name and  subscribers email address automatically like in a *.mer file?

Nope, the outbound filter would be looking at the message headers and picking up the name of the list and sending the attached file specific to that list.   The user would have to enter their own email address.

Many list subscription sites I have used auto-populate the list name and e-mail address of the subscriber and are a "single click" operation to un-subscribe. I really like that.

You can do that as with the headers on the list sent from the list.  From the Mercury/32 help:

Headers and URLs  If the Generate helper URL headers option is turned on, Mercury will add specially-formatted headers to messages distributed to the list which will permit compliant mail programs like Pegasus Mail to perform automatic subscription management for the user. If you have a web page that describes the operation of the mailing list, enter its URL in the Help URL field. Using Helper headers and URLs can result in a considerable improvement in the usability and friendliness of your lists. For more information on the format and function of Helper URLs, please see Internet Standards Document RFC2369.

These headers allow the user to automatically unsubscribe from the list.

Are there more simplified MLSS HTML pages that would include just the list name & email adress, and an unsubscribe button?

Nope, but if you know how the do HTML you can write your own.

Thanks much,

MP

[quote user="Mrpush"]

Dilberts,

So you are saying that the security issue then lies in what Mercury allows the intruder to do.[/quote]Yes[quote]Could there be some unforseen security hole in Mercury that could give the intruder the ability to do damage?[/quote]Yes, in theory, however there are no known issues at present[quote]

It's seems to happen with most OS's and apps, hence my concern.[/quote]I would be FAR more concerned about the browsers you use to look at websites, There are plenty of unresolved security issues with all of them, does that stop you using them?[quote]

What port do you guys use and what is considered to be the safest?[/quote]Don't currently use MercB, but have many servers running that require incoming connections. Running on non-standard / high ports generally reduces the chances of basic service port scans from finding them, but then any full portscan will find any port that responds. Also incoming connections need to know what port a particular service is running on. Running the listening service as a user with restricted rights is also a good idea to decrease the perceived exposure, for the paranoid. [:)][quote]

I don't have lots of security experience and tend toward the more conservative side.

Thanks much,

MP 

Thomas,

 I have read about the helper URL, turned it on and reviewed the headers.  I have no idea how these are supposed to work however directly from an e-mail.

How does one "activate" the helper URL in the headers from the e-mail?

I don't understand this.

 Thanks much,

MP

Thomas,

I actually figured it out.  The special headers are linked to some buttons in mail clients that "open" the links.

I guess not all clients have this type feature however, so having something in the footer may be good as well.

Can I change the list-unsubscribe headers myself?

Thanks,

MP 

[quote user="Mrpush"]

Thomas,

I actually figured it out.  The special headers are linked to some buttons in mail clients that "open" the links.

Correct

I guess not all clients have this type feature however, so having something in the footer may be good as well.

Agreed

Can I change the list-unsubscribe headers myself?

Not the ones that are put into the message.  That's pretty canned in that the unsub goes to maiser with the list name with the From: field the users email addrerss.  You can create a mailto: header that goes in the message I guess as part of the disclaimer that might work.  I've not tried this.

 mailto:maiser@domain.com?subject=unsub&body=signoff%20listname

Thanks,

MP 

Thomas,

Thanks very much, I will try it.

Also, this may be best for another post, but I have noticed that if I send an email to a list from an "external moderator", it send out the email but it does NOT include the signature file in the email.

Is this a known problem?

(humm, I'm runnig 4.01b on this instance)

Thanks,

MP

[quote user="Mrpush"]Thomas,

Thanks very much, I will try it.

Also, this may be best for another post, but I have noticed that if I send an email to a list from an "external moderator", it send out the email but it does NOT include the signature file in the email.

Is this a known problem?

Not that I have seen and all of my lists are moderator post only.

(humm, I'm runnig 4.01b on this instance)

Should really upgrade.

Thanks,

MP

[/quote]

Thomas,

I believe I have the figured out the issue.  I have not upgraded yet, however the issue stems from the e-mail being sent to the list as HTML vs plain text.  The HTML version will not include the list signature file.  A text version works fine.

Thanks much,

MP