Cisco PIX 525 Specifikace stáhnout pdf (Strana 377)

21-51

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing SMTP and Extended SMTP Inspection

SMTP and Extended SMTP Inspection Overview

ESMTP application inspection provides improved protection against SMTP-based attacks by restricting

the types of SMTP commands that can pass through the security appliance and by adding monitoring

capabilities.

ESMTP is an enhancement to the SMTP protocol and is similar is most respects to SMTP. For

convenience, the term SMTP is used in this document to refer to both SMTP and ESMTP. The

application inspection process for extended SMTP is similar to SMTP application inspection and

includes support for SMTP sessions. Most commands used in an extended SMTP session are the same

as those used in an SMTP session but an ESMTP session is considerably faster and offers more options

related to reliability and security, such as delivery status notification.

The inspect esmtp command includes the functionality previously provided by the inspect smtp

command, and provides additional support for some extended SMTP commands. Extended SMTP

application inspection adds support for eight extended SMTP commands, including AUTH, DATA,

EHLO, ETRN, SAML, SEND, SOML and VRFY. Along with the support for seven RFC 821 commands

(HELO, HELP, MAIL, NOOP, QUIT, RCPT, RSET), the security appliance supports a total of fifteen

SMTP commands.

Other extended SMTP commands, such as ATRN, STARTLS, ONEX, VERB, CHUNKING, and private

extensions and are not supported. Unsupported commands are translated into Xs, which are rejected by

the internal server. This results in a message such as “500 Command unknown: 'XXX'.” Incomplete

commands are discarded.

If you enter the inspect smtp command, the security appliance automatically converts the command into

the inspect esmtp command, which is the configuration that is shown if you enter the show

running-config command.

The inspect esmtp command changes the characters in the server SMTP banner to asterisks except for

the “2”, “0”, “0” characters. Carriage return (CR) and linefeed (LF) characters are ignored.

With SMTP inspection enabled, a Telnet session used for interactive SMTP may hang if the following

rules are not observed: SMTP commands must be at least four characters in length; must be terminated

with carriage return and line feed; and must wait for a response before issuing the next reply.

An SMTP server responds to client requests with numeric reply codes and optional human-readable

strings. SMTP application inspection controls and reduces the commands that the user can use as well

as the messages that the server returns. SMTP inspection performs three primary tasks:

• Restricts SMTP requests to seven basic SMTP commands and eight extended commands.

• Monitors the SMTP command-response sequence.

• Generates an audit trail—Audit record 108002 is generated when invalid character embedded in the

mail address is replaced. For more information, see RFC 821.

SMTP inspection monitors the command and response sequence for the following anomalous signatures:

• Truncated commands.

• Incorrect command termination (not terminated with <CR><LR>).

• The MAIL and RCPT commands specify who are the sender and the receiver of the mail. Mail

addresses are scanned for strange characters. The pipeline character (|) is deleted (changed to a blank

space) and “<” ‚”>” are only allowed if they are used to define a mail address (“>” must be preceded

by “<”).

• Unexpected transition by the SMTP server.

1 2 ... 372 373 374 375 376 377 378 379 380 381 382 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 377

Komentáře k této Příručce