<div>
Your SMTP banner alone can not allow enumeration of users! <br />
Your smtp banner should match your A record for your mail server. &nbsp;You should also have a correctly configured reverse DNS record that this will utilise to help avoid spam on the internet. &nbsp;More and more mail providers and ISPs and using reverse DNS mismatch as a reason to reject your outgoing email as spam.<br />
<br />
Did they advise you what to set it to?
</div>


<div>
I agree with Neilsr. &nbsp;Saying that the SMTP banner allows the enumeration of users is like saying that the house address allows enumeration of the occupants.<br />
<br />
If the doors are locked and windows covered, you cannot know how many people are occupying a house simply because you have the address.<br />
<br />
However, the internal domain name is an issue. &nbsp;The smtp banner should answer with &quot;mail.yourdomain.com&quot; and not &quot;mailserver.yourdomain.loc<wbr />al&quot;. &nbsp;<br />
<br />
-saige-
</div>


<div>
Here is the remediation recommendation:<br />
<br />
Disable the VRFY and EXPN commands. If feasible, configure the host to respond identically to requests to send to both legitimate user mailboxes and non-existent mailboxes. &nbsp;Messages to non-existent mailboxes can be silently dropped later without generating a non-delivery report, which may also inform a potential attacker about which usernames are valid.<br />
<br />
Thanks,<br />
Cheese
</div>


<div>
Okay, I was slightly askew on the SMTP banner issue. &nbsp;Our internal domain name is disclosed by the banner. &nbsp;On the user enumeration issue, the assessor used telnet to mail.domain.com on port 25 and it revealed valid email addresses.
</div>


<div>
yes because of &quot;Disable the VRFY and EXPN commands&quot; not being done before now.
</div>


<div>
Neilsr,<br />
<br />
How would I disable those commands? &nbsp;I am using an Ironport email gateway and MDaemon as the email service. &nbsp;I see that the &quot;Add Received Header&quot; is checked in the Listener.
</div>


<div>
I have a support call with Cisco on this and will report back when I get an answer.
</div>


<div>
This SMTP banner can be modified under Mail Policies&gt;Mail Flow Policies&gt;Default Parameters on an Ironport C160 email gateway appliance.<br />
<br />
Thanks,<br />
Mike
</div>


<div>
<div class="content wysiwyg-content">
Hello,<br />
<br />
We are a financial institution and every year we have an outside company come in and do a security assessment on our systems. &nbsp;A couple of the items that need remediation involve changing our SMTP banner that is permitting user enumeration and discloses our internal domain name. &nbsp;We are a Windows network (Server 03 and 08) running MDaemon as our email service. &nbsp;If any more information is needed, please let me know. &nbsp;We also utilize Cisco Ironport email and web gateway devices.<br />
<br />
Thanks,<br />
Cheese
</div>
</div>


Hello,

We are a financial institution and every year we have an outside company come in and do a security assessment on our systems.  A couple of the items that need remediation involve changing our SMTP banner that is permitting user enumeration and discloses our internal domain name.  We are a Windows network (Server 03 and 08) running MDaemon as our email service.  If any more information is needed, please let me know.  We also utilize Cisco Ironport email and web gateway devices.

Thanks,
Cheese

Change SMTP banner

A vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness, known as the attack surface. Vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities. Other vulnerabilities include security risks, security defects and constructs in programming languages that are difficult to use properly.

Vulnerabilities

Network security consists of the policies adopted to prevent and monitor authorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves the authorization of access to data in a network, and covers a variety of computer networks; conducting transactions and communications among businesses, government agencies and individuals. Networks can be private, such as within a company, and others which might be open to public access.

Network Security

Interactions between email servers and clients are governed by email protocols. The three most common email protocols are POP, IMAP and MAPI. Most email software operates under one of these (and many products support more than one).  The correct protocol must be selected, and correctly configured, if you want your email account to work.