VMware ESX 3 Server

The VMware ESX 3 Server (V1 R2) has 630 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

630STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Fri Jul 22 2016

The SMTP service must not have the EXPN feature active.

VMware ESX 3 Server

Assessment Title

Rule Text

The SMTP service must not have the EXPN feature active.

Description

Discussion Text

The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute-force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-4692

Rule

SV-4692r2_rule

Severity

low

Rule Version

GEN004660

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Determine if EXPN is disabled.

Procedure:
# telnet localhost 25
expn root

If the command does not return a 500 error code of command unrecognized, this is a finding.

OR

Locate the sendmail.cf configuration file.

Procedure:
# find / -name sendmail.cf -print
# grep -v "^#" <sendmail.cf location> | egrep -i "(goaway|noexpn)"

Verify the EXPN command is disabled with an entry in the sendmail.cf file that reads as one of the following:

Opnoexpn
O PrivacyOptions=noexpn
Opgoaway
O PrivacyOptions=goaway

(Other privacy options, such as novrfy or noetrn, may be included in the same line, separated by commas.  The goaway option encompasses a number of privacy options, including noexpn.)  If the EXPN command is not disabled, this is a finding.

Implementation Procedure

Fix Text

Edit the sendmail.cf file and add Opnoexpn option.
Restart the Sendmail service.

STIG check 484 of 630 in the VMware ESX 3 Server STIG checklist

← Previous · V-4691The SMTP service must not have a uudecode alias active.Next · V-4693 →The SMTP service must not have the VRFY feature active.