The SMTP service must not have the EXPN feature active.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-4692 | GEN004660 | SV-35076r1_rule | ECSC-1 | Low |
| Description |
|---|
| The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners. |
| STIG | Date |
|---|---|
| HP-UX 11.31 Security Technical Implementation Guide | 2017-01-27 |
Details
| Check Text ( None ) |
|---|
| None |
| Fix Text (F-31943r1_fix) |
|---|
| Edit the /etc/mail/sendmail.cf file and add or edit the following line: O PrivacyOptions=goaway Then restart the Sendmail service. |