LinuxSA Mailing list archives

  From: Alan Kennington <akenning@dog.topology.org>
  To  : Glen Turner <glen.turner@aarnet.edu.au>
  Date: Sat, 9 Dec 2000 16:30:09 +1030

Re: attack against sendmail - clues?

On Sat, Dec 09, 2000 at 04:20:28PM +1030, Glen Turner wrote:
> 
> You can turn off VFRY and EXPN, and most sites do.
> 
> Edit /etc/sendmail.mc to say
> 
>   dnl Do not leak user names
>   define(`confPRIVACY_FLAGS', `goaway')
> 
> and maybe also
> 
>   dnl Do not give away version info
>   define(`confSMTP_LOGIN_MSG', `$j Mail; $b')

Glen,

Yet another thing to lock down!
Yet another thing for the linuxSA SecureFest!
When it happens...

If the SecureFest does happen, then there should be at least
a half-hour on "how to lock down sendmail".
There should be a series of 30-minute talks, with
15-minute intervals for free discussion (i.e. noisy rabble).

Alright, now I have 7 sendmails to fix.
Grrr....


Cheerio,
Alan Kennington.

-- 
LinuxSA WWW: http://www.linuxsa.org.au/  IRC: #linuxsa on irc.linux.org.au
To unsubscribe from the LinuxSA list:
  mail linuxsa-request@linuxsa.org.au with "unsubscribe" as the subject