Re: Avoiding Postfix Fingerprinting
From: Olivier Fauchon (olivier_at_aixmarseille.com)
Date: Thu, 10 Mar 2005 01:09:12 +0100 To: firstname.lastname@example.org
* On Tue, Mar 08, 2005 at 05:49:56PM +0100, Joachim Schipper <email@example.com> wrote:
> On Tue, Mar 08, 2005 at 12:20:24PM +0100, Isidro Labrador wrote:
> > I have run nessus against a remote machine, and it has discovered that the
> > server is running postfix 1.1.11. Nessus has fingerprinted the server
> > through smtpscan (plugin 11421). The question is: is there a way to avoid
> > being fingerprinted in Postfix?
> > Thanks in advance for your answers,
> > Regardes
> > Isidro Labrador Rodr?guez
> See postconf(5), under smtpd_banner. (I'm pretty sure Nessus just grabs
> the banner; however, some more advanced fingerprinting is possible, if
> someone is very knowledgeable.)
smtpscan sends a couple of SMTP commands with bad order, bad parameters, and
compares the responses codes (500 series responses codes) to a database of
known SMTP servers responses.
Last time i patched Postfix for anti-fingerprint purposes, all error return
codes 5xx where hard-coded in the source, so you'll need to
grep -r 5[0-9][0-9] *.c , and change some of the return codes
(ex 501 becomes 502, or anything else). You should read the SMTP rfc
... to find what are the meaning of all error codes.
SmtpScan won't be able to fingerprint you if you change the way your SMTP
server handles the errors.
Hope that helps
-- Olivier Fauchon Linux/Security/Wireless CWNA-CWSP certified mail: firstname.lastname@example.org www : www.aixmarseille.com cell: +33(0)610493763