Subject: smap: what does EXPN root mean ???

From: "Dirk.Nerling" <[email-masked]>
Date: Tue, 21 Mar 2000 08:16:45 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello all,

somebody tried to access my firewall. As far as I see there is nothing to
worry about. But what does "EXPN root" mean? 

Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:8.0 212.159.70.114
194.139.111.2 in via de1
Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2
212.159.70.114 out via de1
Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:13.0 212.159.70.114
194.139.111.2 in via de1
Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:14.0 194.139.111.2
212.159.70.114 out via de1
Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:17.0 212.159.70.114
194.139.111.2 in via de1
Mar 20 23:46:48 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2
212.159.70.114 out via de1
Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:8.0 212.159.70.114
194.139.111.2 in via de1
Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2
212.159.70.114 out via de1
Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:13.0 212.159.70.114
194.139.111.2 in via de1
Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:14.0 194.139.111.2
212.159.70.114 out via de1
Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:17.0 212.159.70.114
194.139.111.2 in via de1
Mar 21 05:38:37 wall netacl[17972]: deny
host=114.03-02.quay.dial.plus.net.uk/212.159.70.114s service=in.ftpd
Mar 21 05:38:37 wall smap[17974]: connect
host=114.03-02.quay.dial.plus.net.uk/212.159.70.114
Mar 21 05:38:43 wall smap[17974]: EXPN root
(114.03-02.quay.dial.plus.net.uk/212.159.70.114)
Mar 21 05:38:46 wall smap[17974]: deny
host=114.03-02.quay.dial.plus.net.uk/212.159.70.114 use of gateway
Mar 21 05:39:32 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2
212.159.70.114 out via de1

best regards Dirk
--
Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone:
++49-361-4407144
           PGP Fingerprint: C559 FF0E BAD0 9E09 F720  20F3 683E 357F 69B5
CC83
				http://www.pdv.de

---

From: Martin Machacek <[email-masked]>
Date: Tue, 21 Mar 2000 11:03:39 +0100 (MET)

> worry about. But what does "EXPN root" mean? 

User from address 212.159.70.114 (114.03-02.quay.dial.plus.net.uk - apparently
some dial-up account) connected to your SMTP port (serviced by smap) and issued
SMTP command EXPN root. EXPN <some e-mail address> command if implemented by
the server (bad idea) could be used to expand local aliases, i.e. get the real
address where mail for <some e-mail address> will be forwarded. EXPN command is
not neccessary for normal operation of SMTP server and on the other hand could
cause unpleasent information leak. So, it is not supported by smap.

> (114.03-02.quay.dial.plus.net.uk/212.159.70.114)

        Martin 

---
[PGP KeyID F3F409C4]

---

From: Donald J Smith <[email-masked]>
Date: Tue, 21 Mar 2000 06:30:20 -0700

>worry about. But what does "EXPN root" mean? 
The "cracker" was trying to find out who the root account mapped to.
You have EXPN turned off so nothing was discovered that way (except that
you've running smap and EXPN is turned off;-)
You might be more concerned with the ICMP but I really can't help you there.

You were definetly scanned.
------------------------------------------------------------------------------
Don Smith                               General Dynamics Information Systems
Systems Administrator                   8005 South Chester St
                                        EngleWood, Co. 80112
Phone (303) 649-7554
FAX   (303) 649-7504			[email-masked]
Error msgs that I love: 
"Keyboard not found press F1 to continue" (pc bios)
"Harddrive controller failure insert new disk and press any key to
continue" (pc bios)
"The disk is write protected Remove the write protect or
 use another disk." (nt)
User must change his password before he logs in the first time. (nt)
------------------------------------------------------------------------------