Prev: Fixing reverse DNS lookup for a virtual domain
Next: Mail server responded 5.7.1
From: Wietse Venema on 20 Apr 2010 14:03
Linux Addict:
> On Tue, Apr 20, 2010 at 1:33 PM, Brian Evans - Postfix List <
> grknight(a)scent-team.com> wrote:
>
> > On 4/20/2010 1:23 PM, Linux Addict wrote:
> > >
> > >
> > > On Mon, Apr 19, 2010 at 11:37 AM, Wietse Venema <wietse(a)porcupine.org
> > > <mailto:wietse(a)porcupine.org>> wrote:
> > >
> > > Gaby L:
> > > > Hi
> > > > I scan with my postfix server with NMap from other location.
> > > > The NMAP creats report smtp port open (It is OK) but apear
> > > Postfix smtpd and other information about MTA program.
> > > > I dont want to apear any information about my MTA server.
> > >
> > > To disclose no information, close the SMTP port.
> > >
> > > Seriously.
> > >
> > > Even when you change the smtpd_banner value to say "$myhostname
> > > ESMTP Sendmail" (this text MUST start with the hostname), the
> > > server's replies (especially error messages) still reveal that it's
> > > really Postfix.
> > >
> > > Wietse
> > >
> > >
> > >
> > > Disclaimer :- It may violate some RFCs and possibly break the smtp
> > > system itself.
> > >
> > > [root(a)stick ~]# grep ^smtpd_banner /etc/postfix/main.cf <http://main.cf>
> > > smtpd_banner = "unknown"
> > >
> > > [root(a)stick ~]# telnet 0 25
> > > Trying 0.0.0.0...
> > > Connected to 0.
> > > Escape character is '^]'.
> > > 220 "unknown"
> > >
> > >
> >
> > As Wietse mentioned, the above has no effect on determining the server
> > type.
> >
> > Just because the banner doesn't say Postfix, doesn't mean a
> > script/person couldn't figure it out from the response/error messages.
> >
> >
> True. seems nmap doesn't even check the banner, it does an EHLO and picks
> the mta from response code.
>
> 25/tcp open smtp Postfix smtpd
> postfix/smtpd[21190]: lost connection after EHLO from stick127.0.0.1]

Different MTAs have different error messages:

Postfix: 501 Syntax: EHLO hostname
Sendmail: 501 5.0.0 ehlo requires domain address
Exim: 501 Syntactically invalid EHLO argument(s)

And so on.

Wietse

From: Linux Addict on 20 Apr 2010 13:45
On Tue, Apr 20, 2010 at 1:33 PM, Brian Evans - Postfix List <
grknight(a)scent-team.com> wrote:

> On 4/20/2010 1:23 PM, Linux Addict wrote:
> >
> >
> > On Mon, Apr 19, 2010 at 11:37 AM, Wietse Venema <wietse(a)porcupine.org
> > <mailto:wietse(a)porcupine.org>> wrote:
> >
> > Gaby L:
> > > Hi
> > > I scan with my postfix server with NMap from other location.
> > > The NMAP creats report smtp port open (It is OK) but apear
> > Postfix smtpd and other information about MTA program.
> > > I dont want to apear any information about my MTA server.
> >
> > To disclose no information, close the SMTP port.
> >
> > Seriously.
> >
> > Even when you change the smtpd_banner value to say "$myhostname
> > ESMTP Sendmail" (this text MUST start with the hostname), the
> > server's replies (especially error messages) still reveal that it's
> > really Postfix.
> >
> > Wietse
> >
> >
> >
> > Disclaimer :- It may violate some RFCs and possibly break the smtp
> > system itself.
> >
> > [root(a)stick ~]# grep ^smtpd_banner /etc/postfix/main.cf <http://main.cf>
> > smtpd_banner = "unknown"
> >
> > [root(a)stick ~]# telnet 0 25
> > Trying 0.0.0.0...
> > Connected to 0.
> > Escape character is '^]'.
> > 220 "unknown"
> >
> >
>
> As Wietse mentioned, the above has no effect on determining the server
> type.
>
> Just because the banner doesn't say Postfix, doesn't mean a
> script/person couldn't figure it out from the response/error messages.
>
>
True. seems nmap doesn't even check the banner, it does an EHLO and picks
the mta from response code.

25/tcp open smtp Postfix smtpd
postfix/smtpd[21190]: lost connection after EHLO from stick127.0.0.1]
 | 
Pages: 1
Prev: Fixing reverse DNS lookup for a virtual domain
Next: Mail server responded 5.7.1