From: Olivier Fauchon (olivier@aixmarseille.com)
Date: Wed Mar 09 2005 - 19:09:12 EST
* On Tue, Mar 08, 2005 at 05:49:56PM +0100, Joachim Schipper <j.schipper@math.uu.nl> wrote:
> On Tue, Mar 08, 2005 at 12:20:24PM +0100, Isidro Labrador wrote:
> > I have run nessus against a remote machine, and it has discovered that the
> > server is running postfix 1.1.11. Nessus has fingerprinted the server
> > through smtpscan (plugin 11421). The question is: is there a way to avoid
> > being fingerprinted in Postfix?
> >
> > Thanks in advance for your answers,
> >
> > Regardes
> > Isidro Labrador Rodr?guez
>
> See postconf(5), under smtpd_banner. (I'm pretty sure Nessus just grabs
> the banner; however, some more advanced fingerprinting is possible, if
> someone is very knowledgeable.)
>
> Joachim
smtpscan sends a couple of SMTP commands with bad order, bad parameters, and
compares the responses codes (500 series responses codes) to a database of
known SMTP servers responses.
Last time i patched Postfix for anti-fingerprint purposes, all error return
codes 5xx where hard-coded in the source, so you'll need to
grep -r 5[0-9][0-9] *.c , and change some of the return codes
(ex 501 becomes 502, or anything else). You should read the SMTP rfc
http://www.ietf.org/rfc/rfc0821.txt
http://www.faqs.org/rfcs/rfc2034.html
... to find what are the meaning of all error codes.
SmtpScan won't be able to fingerprint you if you change the way your SMTP
server handles the errors.
Hope that helps
-- Olivier Fauchon Linux/Security/Wireless CWNA-CWSP certified mail: olivier@aixmarseille.com www : www.aixmarseille.com cell: +33(0)610493763
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:17 EDT