stalwart version showing version in smtp greeting

[D3an1el]

Hi

How do i remove or change the greeting/banner for listener 465 and 587 as it is showing the emails server product name and version which is an attack vector. I have tried the below but doesn't affect :

[server.listener."submission"]
bind = ["[::]:587"]
greeting = "SMTP at your service 587"
protocol = "smtp"

[server.listener."submissions"]
bind = ["[::]:465"]
protocol = "smtp"
greeting = "SMTP at your service 465"
tls.implicit = true

[williamdes]

Thanks for sharing this!
So this project has already minimum 1.6K servers deployed 🎉
Not counted all the people that block scanners with block lists 😄

[mdecimus]

Just tested the greeting setting and it is working properly:

2023-10-22T19:18:57.421662Z TRACE session{instance="smtp" protocol=Smtp remote.ip="::1" remote.port=50602}: smtp::inbound::session: event="write" data="220 mail.example.org Stalwart SMTP at your service\r\n" size=52
2023-10-22T19:18:59.943159Z TRACE session{instance="smtp" protocol=Smtp remote.ip="::1" remote.port=50602}: smtp::inbound::session: event="read" data="quit\r\n" size=6
2023-10-22T19:18:59.943325Z TRACE session{instance="smtp" protocol=Smtp remote.ip="::1" remote.port=50602}: smtp::inbound::session: event="write" data="221 2.0.0 Bye.\r\n" size=16

And here is the config file:

[server.listener."smtp"]
bind = ["[::]:25"]
greeting = "Stalwart SMTP at your service"
protocol = "smtp"

[D3an1el]

ok it must of been cached on the scanner website,but it lets me change the greetings on the other smtp listerners. But it looks like by default it shows stalwart and version number in banner. With any smtp and imap listed ie 587 & 465. I dont think thats a great default as you can see from williamdes post above. Also i removed the link from the scanner dont want to intentionally dox servers.

[server.listener."smtp"]
bind = ["[::]:25"]
greeting = "SMTP at your service"
protocol = "smtp"

[server.listener."submission"]
bind = ["[::]:587"]
greeting = "SMTP at your service 587"
protocol = "smtp"

[server.listener."submissions"]
bind = ["[::]:465"]
protocol = "smtp"
greeting = "SMTP at your service 465"
tls.implicit = true

Also as you can see it appears in imap

993/IMAP

* OK [CAPABILITY IMAP4rev2 IMAP4rev1 ENABLE SASL-IR LITERAL+ ID UTF8=ACCEPT AUTH=OAUTHBEARER AUTH=PLAIN] Stalwart IMAP4rev2 v0.3.7 at your service.\r\n

[williamdes]

The server version is clearly something that should be hidden since scanners are a f*cking curse and waste our resources 24/7
Hosting an email service means beeing constantly spammed and probed
Hopefully there is block lists out in the wild

I will open new issues when I start using this server a bit more intensively

But all actions must be taken by this project to protect us, or it will be just as secure as other ones.

Password probing is... the most horrible curse I endure all day on my servers, filling out my logs.
Account probing too.

The logs are sent in live to CrowdSec and the IPs get banned but anyway, IPv6 is there..What can you even do to block them

Summary: think ahead about scanners and account+password probing

It must never succeed

[williamdes]

This video is definitely a good ressource on how to protect depending on what you want to protect
https://youtu.be/lr1KuL8OmJY?si=b_idy0A1MW3HxF99

[D3an1el]

So i guess its not important......Do i need to create a github issue?

[mdecimus]

There is an option to change the SMTP greeting if you would like to remove the version number.