Penetration Testing mailing list archives
Re: Avoiding Postfix Fingerprinting
From: Olivier Fauchon <olivier () aixmarseille com>
Date: Thu, 10 Mar 2005 01:09:12 +0100
* On Tue, Mar 08, 2005 at 05:49:56PM +0100, Joachim Schipper <j.schipper () math uu nl> wrote:
On Tue, Mar 08, 2005 at 12:20:24PM +0100, Isidro Labrador wrote:I have run nessus against a remote machine, and it has discovered that the server is running postfix 1.1.11. Nessus has fingerprinted the server through smtpscan (plugin 11421). The question is: is there a way to avoid being fingerprinted in Postfix? Thanks in advance for your answers, Regardes Isidro Labrador Rodr?guezSee postconf(5), under smtpd_banner. (I'm pretty sure Nessus just grabs the banner; however, some more advanced fingerprinting is possible, if someone is very knowledgeable.) Joachim
smtpscan sends a couple of SMTP commands with bad order, bad parameters, and compares the responses codes (500 series responses codes) to a database of known SMTP servers responses. Last time i patched Postfix for anti-fingerprint purposes, all error return codes 5xx where hard-coded in the source, so you'll need to grep -r 5[0-9][0-9] *.c , and change some of the return codes (ex 501 becomes 502, or anything else). You should read the SMTP rfc http://www.ietf.org/rfc/rfc0821.txt http://www.faqs.org/rfcs/rfc2034.html ... to find what are the meaning of all error codes. SmtpScan won't be able to fingerprint you if you change the way your SMTP server handles the errors. Hope that helps -- Olivier Fauchon Linux/Security/Wireless CWNA-CWSP certified mail: olivier () aixmarseille com www : www.aixmarseille.com cell: +33(0)610493763
Current thread:
- Null Session Wbsony (Mar 07)
- Re: Null Session H D Moore (Mar 07)
- Avoiding Postfix Fingerprinting Isidro Labrador (Mar 08)
- Re: Avoiding Postfix Fingerprinting Joachim Schipper (Mar 08)
- Re: Avoiding Postfix Fingerprinting Javier Fernandez-Sanguino (Mar 09)
- Re: Avoiding Postfix Fingerprinting Olivier Fauchon (Mar 09)
- Re: Avoiding Postfix Fingerprinting Michel Arboi (Mar 10)
- Re: Avoiding Postfix Fingerprinting Michel Arboi (Mar 10)
- Avoiding Postfix Fingerprinting Isidro Labrador (Mar 08)
- Re: Null Session H D Moore (Mar 07)