Re: Avoiding Postfix Fingerprinting

* On Tue, Mar 08, 2005 at 05:49:56PM +0100, Joachim Schipper 
<j.schipper@math.uu.nl> wrote:
> On Tue, Mar 08, 2005 at 12:20:24PM +0100, Isidro Labrador wrote:
> > I have run nessus against a remote machine, and it has discovered that the
> > server is running postfix 1.1.11. Nessus has fingerprinted the server
> > through smtpscan (plugin 11421). The question is: is there a way to avoid
> > being fingerprinted in Postfix?
> >
> > Thanks in advance for your answers,
> >
> > Regardes
> > Isidro Labrador Rodr?guez
>
> See postconf(5), under smtpd_banner. (I'm pretty sure Nessus just grabs
> the banner; however, some more advanced fingerprinting is possible, if
> someone is very knowledgeable.)
>
>               Joachim


smtpscan sends a couple of SMTP commands with bad order, bad parameters, and
compares the responses codes (500 series responses codes) to a database of
known SMTP servers responses.

Last time i patched Postfix for anti-fingerprint purposes, all error return
codes 5xx where hard-coded in the source, so you'll need to 
grep -r 5[0-9][0-9] *.c , and change some of the return codes 
(ex 501 becomes 502, or anything else). You should read the SMTP rfc 

http://www.ietf.org/rfc/rfc0821.txt
http://www.faqs.org/rfcs/rfc2034.html

... to find what are the meaning of all error codes. 

SmtpScan won't be able to fingerprint you if you change the way your SMTP 
server handles the errors.

Hope that helps

--
Olivier Fauchon
Linux/Security/Wireless
CWNA-CWSP certified

mail: olivier@aixmarseille.com
www : www.aixmarseille.com
cell: +33(0)610493763