Postscreen compatibility
fgcle opened this issue · comments
Talking to a Postfix instance that is protected by Postscreen, the checker does not wait until it is allowed to talk:
RECV: 220-mail.doma.in ESMTP Postfix
SEND: EHLO example.org
RECV: 521 5.5.1 Protocol error
At the next statement, it gets error 104 (connection reset by peer), and additionally Postscreen registers the IP for some time (this IP has violated pregreet test).
Granted, I could have contacted that server before (using nc mail.doma.in 25), and have waited with my EHLO until the 220<space>some text response. Then, the checker works as expected as Postscreen already 'knows' that my IP is a conforming one.
But People taking this script and trying to see if their servers are vulnerable, and then falling into this trap, may think their server is vulnerable even if it isn't.
What exactly would we have to do to make this compliant? It looks to me it is receiving the server banner and sending the EHLO. (Of course the whole script is very simple and not implementing fully compliant SMTP, probably for a variety of reasons, but if we can fix this easily we should do so.)