[Pkg-mailman-hackers] Bug#371074: mailman: web interface gives internal server error

[Lionel Elie Mamane]

On Wed, Jun 07, 2006 at 02:39:30AM -0500, Rob Ristroph wrote:

> I installed mailman with apt-get.

> It worked at least well enough to create some lists at some point.
> Since then the system has been apt-get upgraded several times.

Did you install 2.1.8 or an older version originally?

> Now, when I go to any of the mailman links, such as listinfo or the
> admin page of a list, I get this in my browser:

> ====================================
> Internal Server Error

> The server encountered an internal error or misconfiguration and was
> unable to complete your request.

Isn't your _web server_ CGI configuration fucked up? Do other CGIs
work?

This looks more like an Apache error message than a Mailman one to
me.

> Among other background information you should know:

> -- I had to "ln -s /usr/lib/cgi-bin/mailman /usr/lib/mailman/cgi-bin/"
> before the gforge apache configs would find mailman properly

That is gforge's bug. Please file a separate bug against
gforge-lists-mailman and tell them (add
pkg-mailman-hackers at lists.alioth.debian.org to the CC list for that
bug; reportbug will give you the opportunity to do that).

> -- The output of check_perms:
> =================================
>  check_perms -f

>  /var/lib/mailman/mail bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/cgi-bin bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/logs bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/Mailman bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/bin bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/icons bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/templates bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/locks bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/scripts bad group (has: root, expected list) (fixing)
>  /var/lib/mailman/cron bad group (has: root, expected list) (fixing)

These are false positives; on a Debian system, those are symlinks, and
check_perms looks at the symlink and not at its target; the targets
have the right group, as far as I can see.

>  Warning: Private archive directory is other-executable (o+x).
>  This could allow other users on your system to read private
>  archives.

Yes, but that's the only sane way to ensure that the web server can
serve these files, too.

> Also, instead of apache running as www-data on this system, it is
> running as another user;

What is the uid of this user, and its gid?

> however, it runs mailman as the user it expects via the suexec
> directive,

The mailman in Debian, in contrast to the upstream mailman, doesn't
care as what group (and user?) it runs as long as the group is 65534
or strictly less than 100.

> I have this in the apache conf file:

> SuexecUserGroup www-data www-data

Are you sure this does what you think it does? It seems to me that
suexec will refuse to execute the cgi's as a user/group below 100, and
www-data is 33. Additionally, suexec will only work if launched by
www-data, that is only of Apache is running as www-data, it seems to
me. Check /var/log/apache/suexec.log and check that it is having the
effect you think it has.

> I see no messages in the logs when the error happens, except for this
> in the gforge apache logs:

> [Wed Jun 07 02:24:31 2006] [error] [client 70.112.100.20] Premature end
> of script headers:
>  admin, referer:
>  http://gforge.mydomain.com/mail/admin/index.php?group_id=7

Hmm... Weird.

-- 
Lionel