STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The SMTP service must not have the EXPN feature active.

DISA Rule

SV-227848r603266_rule

Vulnerability Number

V-227848

Group Title

SRG-OS-000480

Rule Version

GEN004660

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Edit the sendmail.cf file and add Opnoexpn option.
Restart the Sendmail service.

Check Contents

Determine if EXPN is disabled.

Procedure:
# telnet localhost 25
expn root

If the command does not return a 500 error code of command unrecognized, this is a finding.

OR

Locate the sendmail.cf configuration file.

Procedure:
# find / -name sendmail.cf -print
# grep -v "^#" <sendmail.cf location> | egrep -i "(goaway|noexpn)"

Verify the EXPN command is disabled with an entry in the sendmail.cf file that reads as one of the following:

Opnoexpn
O PrivacyOptions=noexpn
Opgoaway
O PrivacyOptions=goaway

(Other privacy options, such as novrfy or noetrn, may be included in the same line, separated by commas. The goaway option encompasses a number of privacy options, including noexpn.) If the EXPN command is not disabled, this is a finding.

Vulnerability Number

V-227848

Documentable

False

Rule Version

GEN004660

Severity Override Guidance

Determine if EXPN is disabled.

Procedure:
# telnet localhost 25
expn root

If the command does not return a 500 error code of command unrecognized, this is a finding.

OR

Locate the sendmail.cf configuration file.

Procedure:
# find / -name sendmail.cf -print
# grep -v "^#" <sendmail.cf location> | egrep -i "(goaway|noexpn)"

Verify the EXPN command is disabled with an entry in the sendmail.cf file that reads as one of the following:

Opnoexpn
O PrivacyOptions=noexpn
Opgoaway
O PrivacyOptions=goaway

(Other privacy options, such as novrfy or noetrn, may be included in the same line, separated by commas. The goaway option encompasses a number of privacy options, including noexpn.) If the EXPN command is not disabled, this is a finding.

Check Content Reference

M

Target Key

4061

Comments