Title

The SMTP service must not have the EXPN feature active. (Cat III impact)

Discussion

The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute-force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners.

Check Content

Determine if EXPN is disabled. Procedure: # grep -v "^#" /etc/sendmail.cf | egrep -i "(goaway|noexpn)" Verify the EXPN command is disabled with an entry in the sendmail.cf file that reads as one of the following: Opnoexpn O PrivacyOptions=noexpn Opgoaway O PrivacyOptions=goaway (Other privacy options, such as novrfy or noetrn, may be included in the same line, separated by commas. The goaway option encompasses a number of privacy options, including noexpn.) If the EXPN command is not disabled, this is a finding.

Fix Text

Edit the sendmail.cf file and add Opnoexpn option.

Additional Identifiers

Rule ID:

Vulnerability ID: V-4692

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.