Sascha Wuestemann wrote:
Hi,
when sending email over cyrus imap, it gives full information about version. So, an attacker has just to telnet at port 25 to see if his bunch of exploits fits to it.
That is a dangerous and I would like to suppress all version information, even that it is cyrus answering, if possible.
Security by obscurity never works. Do you really think an attacker would be deterred by the version number that he sees? He'll probably try his attack regardless of the version reported.
Can you do that by just configuring it somehow, or does it need a patch?
Modify the source.
-- Kenneth Murchison Oceana Matrix Ltd. Software Engineer 21 Princeton Place 716-662-8973 x26 Orchard Park, NY 14127 --PGP Public Key-- http://www.oceana.com/~ken/ksm.pgp --- Cyrus Home Page: http://asg.web.cmu.edu/cyrus Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
