V-4693

Discussion

The VRFY command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY may provide additional information about users on the system, such as the full names of account owners.

Check Content

Determine if VRFY is disabled.

Procedure:
for sendmail:
# telnet localhost 25
vrfy root

If the command does not return a 500 error code of "command unrecognized", this is a finding.

or:
# grep -v "^#" /etc/mail/sendmail.cf |grep -i vrfy

Verify the VRFY command is disabled with an entry in the sendmail.cf file. The entry could be any one of "Opnovrfy", "novrfy", or "goaway", which could also have other options included, such as "noexpn". The "goaway" argument encompasses many things, such as "novrfy" and "noexpn".

If no setting to disable VRFY is found, this is a finding.

For Postfix:
Check if the VRFY command has been disabled:
# postconf disable_vrfy_command

If the command output is not “disable_vrfy_command = yes”, this is a finding.