Get APLawrence.com by RSSSendmail VRFY
Sun Sep 19 14:11:23 2004 Sendmail
VRFY
Posted by Tony Lawrence
Search Keys: security,mail
In the process of doing some testing of a mail server, I noticed a piece of spam mail delivered to an address that no one should have known about. This disturbed me greatly, because the only place that address appeared was in the mail alias file on my server. Had my server been compromised?
Well, no, but as they say "mistakes had been made". After I had checked everything I could, I was reasonably sure that I hadn't been hacked, which meant that sendmail had to have coughed up that information through a VRFY command. But I have VRFY turned off.. or did I?
Well, no, I didn't. I THOUGHT I had, but I misunderstood the configuration on my hosted server and had put the options in the wrong file. Amazingly, that was a long, long time ago and I swear I remember testing this, but when I tried it again, my sendmail happily spit back alias addresses.
Ooops. Well, easily fixed. I replaced
O PrivacyOptions=authwarnings
in sendmail.cf with
O PrivacyOptions=goaway,restrictmailq,restrictqrun
"goaway" expands to "authwarnings, noexpn, novrfy, needmailhelo, needexpnhelo,needvrfyhelo".
Test your server by telneting to it on port 25 and try "vrfy yourname". If it doesn't reject you, you don't have these options set.
[root@kerio bin]# telnet aplawrence.com 25 Trying 64.226.42.29... Connected to aplawrence.com (64.226.42.29). Escape character is '^]'. 220 vps.pcunix.com ESMTP SMTP Ready; Sun, 19 Sep 2004 14:32:19 GMT vrfy tony 252 2.5.2 Cannot VRFY user; try RCPT to attempt delivery (or try finger) expn root 502 5.7.0 Sorry, we do not allow this operation quit 221 2.0.0 vps.pcunix.com closing connection Connection closed by foreign host.
Have you tried Searching this site?
Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates
This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.
Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.
Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.
We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.
I sell and support
Kerio Mail server
Click here to add your comments
It seems that this sort of configuration oversite is more common than one might suspect.
I log everything that goes through my mailserver (the info helps me to fine-tune the antispam features). Often, in perusing the log, I have entries where a remote server, responding to my server's EHLO command, has anounced that EXTN, VRFY, etc., are active. And this is on servers run by folks who really should know better!
--BigDumbDinosaur
It seems that this sort of configuration oversite is more common than one might suspect.
I log everything that goes through my mailserver (the info helps me to fine-tune the antispam features). Often, in perusing the log, I have run across entries where a remote server, responding to my server's EHLO command, has anounced that EXTN, VRFY, etc., are active. And this is on servers run by folks who really should know better!
--BigDumbDinosaur
It seems that this sort of configuration oversite is more common than one might suspect.
I log everything that goes through my mailserver (the info helps me to fine-tune the antispam features). Often, in perusing the log, I have run across entries where a remote server, responding to my server's EHLO command, has anounced that EXPN, VRFY, etc., are active. And this is on servers run by folks who really should know better!
--BigDumbDinosaur
Don't miss responses! Subscribe to Comments by RSS or by Email
Click here to add your comments
If you want a picture to show with your comment, go get a Gravatar