Title

The SMTP service must not have the EXPN feature active. (Cat III impact)

Discussion

The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute-force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners. False Positives: False positives may occur with the SMTP EXPN check. According to RFC821, it is acceptable for a server to respond with a 250 (success) or 550 (failure) when the server supports the EXPN command. For example, some servers return "550 EXPN command not available", meaning the command is not supported and the machine is not vulnerable. However, a result of "550 That is a mailing list, not a user" would be a failure code, but not an indication of an error, and the machine would be vulnerable. If false positive is suspected, check the log file for the response from the server.

Check Content

Determine if EXPN is disabled. Procedure: # telnet localhost 25 expn root If the command does not return a 500 error code of command unrecognized, this is a finding. OR Locate the sendmail.cf configuration file. Procedure: # find / -name sendmail.cf -print # grep -v "^#" <sendmail.cf location> | egrep -i "(goaway|noexpn)" Verify the EXPN command is disabled with an entry in the sendmail.cf file that reads as one of the following: Opnoexpn O PrivacyOptions=noexpn Opgoaway O PrivacyOptions=goaway (Other privacy options, such as novrfy or noetrn, may be included in the same line, separated by commas. The goaway option encompasses a number of privacy options, including noexpn.) If the EXPN command is not disabled, this is a finding.

Fix Text

Edit the sendmail.cf file and add Opnoexpn option. Restart the Sendmail service.

Additional Identifiers

Rule ID: SV-226941r603265_rule

Vulnerability ID: V-226941

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.