Title

The SMTP service must not have the Verify (VRFY) feature active. (Cat III impact)

Discussion

The VRFY command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY may provide additional information about users on the system, such as the full names of account owners.

Check Content

Determine if VRFY is disabled. Procedure: for sendmail: # telnet localhost 25 vrfy root If the command does not return a 500 error code of "command unrecognized", this is a finding. or: # grep -v "^#" /etc/mail/sendmail.cf |grep -i vrfy Verify the VRFY command is disabled with an entry in the sendmail.cf file. The entry could be any one of "Opnovrfy", "novrfy", or "goaway", which could also have other options included, such as "noexpn". The "goaway" argument encompasses many things, such as "novrfy" and "noexpn". If no setting to disable VRFY is found, this is a finding. For Postfix: Check if the VRFY command has been disabled: # postconf disable_vrfy_command If the command output is not “disable_vrfy_command = yes”, this is a finding.

Fix Text

For sendmail: Add the "novrfy" flag to your sendmail in /etc/mail/sendmail.cf. Procedure: Edit the definition of "confPRIVACY_FLAGS" in /etc/mail/sendmail.mc to include "novrfy". Rebuild the sendmail.cf file with: # make -C /etc/mail Restart the sendmail service. # service sendmail restart for Postfix: Use the postconf utility to disable the VRFY command: # postconf -ev disable_vrfy_command=yes Restart the postfix service: # rcpostfix restart

Additional Identifiers

Rule ID: SV-45873r1_rule

Vulnerability ID: V-4693

Group Title: GEN004680

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.