The SMTP service must not have the Verify (VRFY) feature active.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-4693 | GEN004680 | SV-37511r1_rule | ECSC-1 | Low |
| Description |
|---|
| The VRFY command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY may provide additional information about users on the system, such as the full names of account owners. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 5 Security Technical Implementation Guide | 2014-07-02 |
Details
| Check Text ( None ) |
|---|
| None |
| Fix Text (F-31422r1_fix) |
|---|
| Add the "novrfy" flag to your sendmail in /etc/mail/sendmail.cf. Procedure: Edit the definition of "confPRIVACY_FLAGS" in /etc/mail/sendmail.mc to include "novrfy". Rebuild the sendmail.cf file with: # make -C /etc/mail Restart the sendmail service. # service sendmail restart |