Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are some things, one should know when setting up an SMTP server, which supports ESMTP protocol. I have disabled relaying, and only enabled TLS authenticated transfers. when I telnet to my server, this is the reply:

250-mail.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Should any of these be turned off? should anything else be enabled

share|improve this question
    
Have you tried to send a message through telnet to see if you can relay or if SMTP Authentication is required? –  AbsoluteƵERØ Jun 10 '13 at 18:56
2  
This looks like a job for the principle of least privilege - disable everything then enable (only) what you need. –  James Snell Jun 10 '13 at 18:59
add comment

1 Answer

up vote 1 down vote accepted

You should disable the VRFY and / or EXPN these commands can expose user information to people probing a system in preparation for an attack.

share|improve this answer
    
DSN - Delivery Status Notification should be also disabled for the same reasons. –  Hugo Jun 17 '13 at 11:10
    
Depending on the objective of the server it might be better to check which options should be configured about the types of notifications that you wish the others to receive. –  Hugo Jun 17 '13 at 11:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.