Re: Avoiding Postfix Fingerprinting

From: Olivier Fauchon (olivier_at_aixmarseille.com)
Date: 03/10/05

  • Next message: Michel Arboi: "Re: Avoiding Postfix Fingerprinting"
    Date: Thu, 10 Mar 2005 01:09:12 +0100
    To: pen-test@securityfocus.com
    
    

    * On Tue, Mar 08, 2005 at 05:49:56PM +0100, Joachim Schipper <j.schipper@math.uu.nl> wrote:
    > On Tue, Mar 08, 2005 at 12:20:24PM +0100, Isidro Labrador wrote:
    > > I have run nessus against a remote machine, and it has discovered that the
    > > server is running postfix 1.1.11. Nessus has fingerprinted the server
    > > through smtpscan (plugin 11421). The question is: is there a way to avoid
    > > being fingerprinted in Postfix?
    > >
    > > Thanks in advance for your answers,
    > >
    > > Regardes
    > > Isidro Labrador Rodr?guez
    >
    > See postconf(5), under smtpd_banner. (I'm pretty sure Nessus just grabs
    > the banner; however, some more advanced fingerprinting is possible, if
    > someone is very knowledgeable.)
    >
    > Joachim

    smtpscan sends a couple of SMTP commands with bad order, bad parameters, and
    compares the responses codes (500 series responses codes) to a database of
    known SMTP servers responses.

    Last time i patched Postfix for anti-fingerprint purposes, all error return
    codes 5xx where hard-coded in the source, so you'll need to
    grep -r 5[0-9][0-9] *.c , and change some of the return codes
    (ex 501 becomes 502, or anything else). You should read the SMTP rfc

    http://www.ietf.org/rfc/rfc0821.txt
    http://www.faqs.org/rfcs/rfc2034.html

    ... to find what are the meaning of all error codes.

    SmtpScan won't be able to fingerprint you if you change the way your SMTP
    server handles the errors.

    Hope that helps

    --
    Olivier Fauchon
    Linux/Security/Wireless
    CWNA-CWSP certified
    mail: olivier@aixmarseille.com
    www : www.aixmarseille.com
    cell: +33(0)610493763
    

  • Next message: Michel Arboi: "Re: Avoiding Postfix Fingerprinting"