Bugtraq: Re: SMTP server account probing

[brett () LARIAT ORG (Brett Glass)]

At 09:36 AM 3/9/99 -0800, John E. Martin wrote:

> While the 'goaway' option may not prevent the program from continuing to
> verify addresses, it will keep your users address from being picked up by
> the program.
>
> Perhaps someone with better sendmail experience could come up with an idea
> to automatically disconnect connections that are issuing more than 25 VRFY
> statements at a time?
Unfortunately, the program was designed to defeat the "goaway" option by
using RCPT TO: commands instead of VRFY commands. What's needed is
the ability to kill the connection after more than two or three recipient
names have generated errors.

--Brett