SmtpServer icon indicating copy to clipboard operation
SmtpServer copied to clipboard

Add option to hide SmtpServer version

Open bogdanst24 opened this issue 2 years ago • 4 comments

When the connection is made, the server automatically responds with a 220 code followed by the Name and version. In a security audit, it was brought to our attention that this could constitute information leakage, consisting of a potential (very unlikely) security risk.

It is not a make-or-break change, but it would be helpful to either have the possibility of not showing it, or overwriting it. It would be very appreciated.

image

bogdanst24 avatar Jan 23 '23 15:01 bogdanst24

just fork the project and change line 179 of SmtpSession.cs and remove the "v{version} " from that line.

When new versions of SMTP are checked in just pull them down to your fork and make sure that line always stays the way you want it :)

BrewingCoder avatar Apr 01 '23 01:04 BrewingCoder

For several reasons I'd not recommend to run this server on a public port, but as a local SMTP filter instead. SMTP filters are commonly supported by MTAs like Postfix and easy to configure, too. The proxy MTA will then hide the version information of this SMTP server. However, running as SMTP filter would disable the authentication feature.

nd1012 avatar Aug 14 '24 15:08 nd1012

For several reasons I'd not recommend to run this server on a public port, but as a local SMTP filter instead. SMTP filters are commonly supported by MTAs like Postfix and easy to configure, too. The proxy MTA will then hide the version information of this SMTP server. However, running as SMTP filter would disable the authentication feature.

Would you please list reasons?

intergavg avatar Aug 14 '24 15:08 intergavg