Bugtraq mailing list archives

Re: SMTP server account probing


From: brett () LARIAT ORG (Brett Glass)
Date: Tue, 9 Mar 1999 13:51:28 -0700


At 09:36 AM 3/9/99 -0800, John E. Martin wrote:

While the 'goaway' option may not prevent the program from continuing to
verify addresses, it will keep your users address from being picked up by
the program.

Perhaps someone with better sendmail experience could come up with an idea
to automatically disconnect connections that are issuing more than 25 VRFY
statements at a time?

Unfortunately, the program was designed to defeat the "goaway" option by
using RCPT TO: commands instead of VRFY commands. What's needed is
the ability to kill the connection after more than two or three recipient
names have generated errors.

--Brett



Current thread: