The SMTP service must not have the EXPN feature active.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-4692 | GEN004660 | SV-62833r1_rule | Low |
| Description |
|---|
| The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners. |
| STIG | Date |
|---|---|
| Oracle Linux 5 Security Technical Implementation Guide | 2020-02-25 |
Details
| Check Text ( C-51699r3_chk ) |
|---|
| This vulnerability is applicable only to sendmail. If Postfix is the SMTP service for the system this will never be a finding. Procedure: Determine if EXPN is disabled. # grep -v "^#" /etc/mail/sendmail.cf |grep -i PrivacyOptions If nothing is returned or the returned line does not contain "noexpn", this is a finding. |
| Fix Text (F-53411r2_fix) |
|---|
| Rebuild /etc/mail/sendmail.cf with the "noexpn" Privacy Flag set. Procedure: Edit /etc/mail/sendmail.mc resetting the Privacy Flags to the default: define('confPRIVACYFLAGS', 'authwarnings,novrfy,noexpn,restrictqrun')dnl Rebuild the sendmail.cf file with: # make -C /etc/mail Restart the sendmail service. # service sendmail restart |