* * * * *

                              Expanding on EXPN

Once again Spring [1] is having problems with mailing her journal entries,
[2] only this time it's with Yahoo. [3]

What is it? EXPN is all the rage now? Must expand email addresses?

Sigh.

So I decide to fix it once and for all. I check the configuration file for
Sendmail [4] and don't see any obvious way to disable the EXPN command. Not
wanting to hack the source code to remove the EXPN command I figure the next
easiest way is to hack the actual binary and change any occurence of E-S-P-N-
NULBYTE such that sendmail will no longer be able to actually respond to the
EXPN command. I have some software I wrote years ago that makes this
relatively easy to do.

So, I find the occurences of E-X-P-N-NULBYTE and make the changes.

No go. Sendmail still reponds to the EXPN command.

Okay, so next it's occurrences of e-x-p-n-NULLBYTE and that's when I find the
curious string “noexpn” in the executable. Hmmmmmmmm …  I think to myself.
Might there actually be a way to disable the EXPN command?

So I search the site [5] for noexpn and I find this: [6]

> PrivacyOptions=opt,opt,…

>         Set the privacy options. “Privacy” is really a misnomer; many of
>         these are just a way of insisting on stricter adherence to the SMTP
>         protocol. The options can be selected from:
>
>         public

>                 Allow open access
>         needmailhelo

>                 Insist on HELO or EHLO command before MAIL
>         needexpnhelo

>                 Insist on HELO or EHLO command before EXPN
>         noexpn

>                 Disallow EXPN entirely
>         needvrfyhelo

>                 Insist on HELO or EHLO command before VRFY
>         novrfy

>                 Disallow VRFY entirely
>         restrictmailq

>                 Restrict mailq command
>         restrictqrun

>                 Restrict -q command line flag
>         noreceipts

>                 Don't return success DSNs
>         goaway

>                 Disallow essentially all SMTP status queries
>         authwarnings

>                 Put X-Authentication-Warning: headers in messages
>
>         The goaway pseudo-flag sets all flags except restrictmailq and
>         restrictqrun. If mailq is restricted, only people in the same group
>         as the queue directory can print the queue. If queue runs are
>         restricted, only root and the owner of the queue directory can run
>         the queue. Authentication Warnings add warnings about various
>         conditions that may indicate attempts to spoof the mail system,
>         such as using an non-standard queue directory.
>
>

I don't know if it's A Good Thing or A Bad Thing that you can learn more
about a program from scanning the executable than you could probably get
reading the documentation.

[1] http://www.springdew.com/
[2] gopher://gopher.conman.org/1Phlog:2000/08/23
[3] http://www.yahoo.com/
[4] http://www.sendmail.org/
[5] http://www.altavista.com/cgi-bin/query?pg=q&text=yes&what=web&fmt=&fmt=&q=%2Bhost%3Awww.sendmail.org+noexpn
[6] http://www.sendmail.org/~ca/email/doc8.8/op-sh-5.html

Email author at [email protected]

You are viewing proxied material from gopher.conman.org. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.