Blogging via mail, securely 18

Posted by alex on February 01, 2003

Since I couldn’t find a decent (for me) desktop blogging client for Movable Type for Linux, I have decided to make it possible to blog from my favourite application: mutt
To add some security to the script, it only posts entries that have a good GnuPG signature, and even then only if the fingerprint of the key used to sign is allowed to post. And signing emails with gpg is a snap with mutt.
By adding custom headers to the mail, you can even set the category of the entry and ping TrackBack URLs.
The script takes the value of the X-MT-Category header, and if that matches the name of an existing category, this is set as the primary category for that entry. Unfortunately, this category doesn’t show up on the main index after the script rebuilds the entry, even though it does show up in the admin section and after a manual rebuild. Maybe someone with a better understanding of the MT Perl API can shed some light on this…Kevin Shay found the reason for this, it had to do with MT doing some caching. Disabling this caching for the rebuild removes this problem
And pinging TrackBack URLs happens via the X-MT-Ping header. This header can appear multiple times, and each URL gets pinged.
It’s still the first version of the script, so it’s still a little rough. I have been running it under qmail and vpopmail, and to get the script to rebuild the entry, I had to make blog directory writable to the vpopmail group. It works, but if someone has a more elegant approach to this, I am all ears.
This script uses a few CPAN modules:

  • GnuPG
  • MIME::Parser
  • Mail::Header
  • MIME::QuotedPrint

And here’s the code: mail2blog.pl. Use at your own risk, if it eats your server, sets your house on fire or lets your hair fall out, I will say “I told you so” :-)

Trackbacks

Trackbacks are closed.

Comments

Comments are closed.

  1. Ben Hammersley.com Sun, 02 Feb 2003 00:12:29 CET

    Secure blogging by email

    Alex at Slackerbit.ch has a new script available for Blogging by email securely with GnuPG and Movable Type: To add

  2. hebig.org/blog Mon, 03 Feb 2003 06:39:41 CET

    Blogging News

    MT BLOGGING VIA EMAIL, SECURELY Alex at Slackerbit.ch has a new script available for blogging by email securely with GnuPG

  3. Six Log Mon, 03 Feb 2003 09:06:56 CET

    Secure Email-to-Blog

    Alex at slackerbit.ch came up with a mail2blog script that uses PGP signatures to securely authenticate the sender. Specifically, it

  4. David Raynes Mon, 03 Feb 2003 16:56:32 CET

    Blogging Via Email

    Alex threw together a script to allow you to post to your blog via a signed email. After playing around

  5. JayAllen - The Daily Journey Tue, 04 Feb 2003 02:21:22 CET

    The coolest page in Blogland

    Sam Ruby has the one single coolest page in Blogland today thanks to TWO other developers…

  6. Jitterin' Thoughts Sun, 09 Feb 2003 06:18:00 CET

    Damn! Email-to-Weblog…

    Aaron asked the world sometime ago about email-to-weblog posting. I think his idea (I’m too lazy to look up the

  7. cogito ergo sum Sun, 09 Feb 2003 06:18:05 CET

    Damn! Email-to-Weblog…

    Aaron asked the world sometime ago about email-to-weblog posting. I think his idea (I’m too lazy to look up the

  8. james Sun, 23 Feb 2003 09:47:40 CET

    hmm, authenticate the sender using gpg ?

  9. Nos Devolvemos Thu, 06 Mar 2003 04:19:26 CET

    Novedades técnicas sobre publicar correo automáticamente (II)

    El MhonArc está instalado en un servidor de la universidad que funciona con Linux, podéis ver cómo va quedando, pero

  10. Nos Devolvemos Wed, 19 Mar 2003 03:26:00 CET

    Una semana de correo público

    Lee mi correo Pues debe ser la semana en que menos flujo de correo he tenido. En cambio casi que

  11. Snappy the Clam Wed, 19 Mar 2003 21:56:31 CET

    Last test for now

    OK, this should about do it. I grabbed a mail to MT script from href=”http://slackerbit.ch/archives/2003/02/01/blogging_via_mail_securely.html”>slackerbit.ch, and with a bit of…

  12. Snappy the Clam Wed, 19 Mar 2003 21:59:22 CET

    Last test for now

    OK, this should about do it. I grabbed a mail to MT script from slackerbit.ch, and with a bit of…

  13. Clay Johnson Fri, 28 Mar 2003 19:19:12 CET

    Thatnks for the inspiration. While I didn’t use your script for a base (I’m a php head, not a perl one), I made a multi-user mail 2 blog (which is very insecure) here:

    http://www.clayjohnson.org/xmlrpc/mt_register.html

    Check it out!

  14. Nos Devolvemos Tue, 01 Apr 2003 22:05:17 CEST

    Puliendo el sistema

    Tema plantillas del MhonArc: he encontrado las variables que definen el TAG <LITEMPLATE>, que es el encargado de la configuración…

  15. Reverend Jim Mon, 21 Apr 2003 19:03:54 CEST

    There is a small bug. RFC3156 states that:

    —
    Upon receipt of a signed message, an application MUST:

    (1) Convert line endings to the canonical [CR][LF] sequence before the signature can be verified. This is necessary since the local MTA may have converted to a local end of line convention.
    —

    Since your script doesn’t do this, it breaks when used with MTAs that do convert line endings. In particular, when using Evolution through Exim.

    The fix is simple.

    After you gather the body of the message (the text/plain) part, instead of spitting it out directly to the file, do this…

    my $tmp = $part->stringify;
    $tmp =~ s/\n/\r\n/g;
    print $bodyfh $tmp;

    Thanks for providing a great tool. It works wonderfully.

  16. LinkLog - Stuff to read Wed, 25 Jun 2003 16:45:02 CEST

    Secure blogging via email

    I have been thinking for a while about how to make email-publishing more secure. Obvious solution is to add a personal signature, based on something like PGP……

  17. Anders Wed, 14 Jan 2004 13:32:51 CET

    The above comment is a spam from a “Penis enlargement” netfirms .com company. I recommend the installation of MT blacklist with a proper primer blacklist to avoid your comments sections being abused for this purpose

    Links here:

    http://www.jacobsen.no/anders/blog/archives/2004/01/02/blacklisting_spammers.html
    http://www.jayallen.org/projects/mt-blacklist/

  18. Jacob Taylor Mon, 19 Apr 2004 12:26:41 CEST

    Great site and great information.

    Jacob Taylor