Hi Daniel,
The issue only arose after one of our customers hired an outside company to
perform a security audit - now they've got it in their heads that the help command
is a vulnerability. I've never considered it a problem before.
If there was a simple way for me to disable it and keep them happy, all would be
well. As it is, I'll just tell them to deal with it. ;)
cheers & thanks,
Nick
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Daniel Donnelly
Sent: Saturday, 18 November 2000 1:44 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] smtp security: disabling 'help' cmd?
Nick,
Sorry, I've never seen a way to disable any particular SMTP commands, except
those in the SMTP/SMTP Security settings.
I wonder why you think it needs to be disabled?
All it returns is a list of supported standard SMTP commands which anyone
can get from the RFCs. For a person to see this, he must already know
something about SMTP (or have a tool that stores that knowledge) to be able
to connect to the port and issue the 'help' command. So, I personally do not
see it reveling anything more than one would already know. It does not
reveal anything about the order of useage or syntax, either, so few clues to
help a novice or hacker. Again, IMHO, it is a pretty useless form of 'help'.
To my knowledge, you are the first to express any concern about theSMTP HELP
command. Could you tell us what your concern is? That way we can attempt to
see things from your perspective.
Daniel Donnelly
________________________________________________________
----- Original Message -----
From: "Nick Lehman" <[EMAIL PROTECTED]>
To: "IMail Forum" <[EMAIL PROTECTED]>
Sent: Thursday, November 16, 2000 7:57 PM
Subject: [IMail Forum] smtp security: disabling 'help' cmd?
> Hi all,
>
> I'd like to disable the smtp 'help' command in Imail 6.05, but there
doesn't seem
> to be an option in the SMTP Security tab or the registry to do so. Does
anyone
> here know of a way I can disable it? Or can someone give a solid reason
why I
> shouldn't feel the need to disable it? :)
>
> thanks,
> Nick
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
