Solved

Change SMTP banner

Posted on 2014-11-19
11
205 Views
Last Modified: 2015-01-22
Hello,

We are a financial institution and every year we have an outside company come in and do a security assessment on our systems.  A couple of the items that need remediation involve changing our SMTP banner that is permitting user enumeration and discloses our internal domain name.  We are a Windows network (Server 03 and 08) running MDaemon as our email service.  If any more information is needed, please let me know.  We also utilize Cisco Ironport email and web gateway devices.

Thanks,
Cheese
0
Comment
Question by:cheesebugah
  • 6
  • 3
  • 2
11 Comments
 
LVL 37

Expert Comment

by:Neil Russell
ID: 40453365
Your SMTP banner alone can not allow enumeration of users!
Your smtp banner should match your A record for your mail server.  You should also have a correctly configured reverse DNS record that this will utilise to help avoid spam on the internet.  More and more mail providers and ISPs and using reverse DNS mismatch as a reason to reject your outgoing email as spam.

Did they advise you what to set it to?
0
 
LVL 33

Expert Comment

by:it_saige
ID: 40453425
I agree with Neilsr.  Saying that the SMTP banner allows the enumeration of users is like saying that the house address allows enumeration of the occupants.

If the doors are locked and windows covered, you cannot know how many people are occupying a house simply because you have the address.

However, the internal domain name is an issue.  The smtp banner should answer with "mail.yourdomain.com" and not "mailserver.yourdomain.local".  

-saige-
0
 

Author Comment

by:cheesebugah
ID: 40453570
Here is the remediation recommendation:

Disable the VRFY and EXPN commands. If feasible, configure the host to respond identically to requests to send to both legitimate user mailboxes and non-existent mailboxes.  Messages to non-existent mailboxes can be silently dropped later without generating a non-delivery report, which may also inform a potential attacker about which usernames are valid.

Thanks,
Cheese
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 37

Accepted Solution

by:
Neil Russell earned 250 total points
ID: 40453600
"Disable the VRFY and EXPN commands" Yep thats standard security practice on a Linux mail server.

I dont see anything there about SMTP Banners though?

Standard practice again to just DROP main to non existent addresses.  If you get spammed to 10,000 mail addresses and the spammer gets 99990 NDR's back then he now has 10 real addresses to work on.  Tell nobody anything.
0
 
LVL 33

Assisted Solution

by:it_saige
it_saige earned 250 total points
ID: 40453612
In other words, don't send back replies for non-existent addresses.  If a (would you call them spammers??? In my mind they are trying to get a list of addresses to spoof) spammer/spoofer gets back NDRs, you are telling them which addresses are valid and which addresses are not.

-saige-
0
 

Author Comment

by:cheesebugah
ID: 40453653
Okay, I was slightly askew on the SMTP banner issue.  Our internal domain name is disclosed by the banner.  On the user enumeration issue, the assessor used telnet to mail.domain.com on port 25 and it revealed valid email addresses.
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 40453668
yes because of "Disable the VRFY and EXPN commands" not being done before now.
0
 

Author Comment

by:cheesebugah
ID: 40453694
Neilsr,

How would I disable those commands?  I am using an Ironport email gateway and MDaemon as the email service.  I see that the "Add Received Header" is checked in the Listener.
0
 

Author Comment

by:cheesebugah
ID: 40489479
I have a support call with Cisco on this and will report back when I get an answer.
0
 

Author Comment

by:cheesebugah
ID: 40560368
This SMTP banner can be modified under Mail Policies>Mail Flow Policies>Default Parameters on an Ironport C160 email gateway appliance.

Thanks,
Mike
0
 

Author Closing Comment

by:cheesebugah
ID: 40565240
Thank you very much.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Transferring data across the virtual world became simpler but protecting it is becoming a real security challenge.  How to approach cyber security  in today's business world!
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question