Linux Addict:
> On Tue, Apr 20, 2010 at 1:33 PM, Brian Evans - Postfix List <
> grkni...@scent-team.com> wrote:
>
> > On 4/20/2010 1:23 PM, Linux Addict wrote:
> > >
> > >
> > > On Mon, Apr 19, 2010 at 11:37 AM, Wietse Venema <wie...@porcupine.org
> > > <mailto:wie...@porcupine.org>> wrote:
> > >
> > > Gaby L:
> > > > Hi
> > > > I scan with my postfix server with NMap from other location.
> > > > The NMAP creats report smtp port open (It is OK) but apear
> > > Postfix smtpd and other information about MTA program.
> > > > I dont want to apear any information about my MTA server.
> > >
> > > To disclose no information, close the SMTP port.
> > >
> > > Seriously.
> > >
> > > Even when you change the smtpd_banner value to say "$myhostname
> > > ESMTP Sendmail" (this text MUST start with the hostname), the
> > > server's replies (especially error messages) still reveal that it's
> > > really Postfix.
> > >
> > > Wietse
> > >
> > >
> > >
> > > Disclaimer :- It may violate some RFCs and possibly break the smtp
> > > system itself.
> > >
> > > [r...@stick ~]# grep ^smtpd_banner /etc/postfix/main.cf <http://main.cf>
> > > smtpd_banner = "unknown"
> > >
> > > [r...@stick ~]# telnet 0 25
> > > Trying 0.0.0.0...
> > > Connected to 0.
> > > Escape character is '^]'.
> > > 220 "unknown"
> > >
> > >
> >
> > As Wietse mentioned, the above has no effect on determining the server
> > type.
> >
> > Just because the banner doesn't say Postfix, doesn't mean a
> > script/person couldn't figure it out from the response/error messages.
> >
> >
> True. seems nmap doesn't even check the banner, it does an EHLO and picks
> the mta from response code.
>
> 25/tcp open smtp Postfix smtpd
> postfix/smtpd[21190]: lost connection after EHLO from stick127.0.0.1]
Different MTAs have different error messages:
Postfix: 501 Syntax: EHLO hostname
Sendmail: 501 5.0.0 ehlo requires domain address
Exim: 501 Syntactically invalid EHLO argument(s)
And so on.
Wietse
