Removing FTP banner - altogether

[Simon Hargrave]

On our HP servers, the FTP banner (as default) reads: -

220 hostname FTPserver (Version 1.1.214.4 PHNE_29461) ready.

We would like to disable this, as it's clear that it gives a hostname, a version and a patch level, all useful for a hacker to determine the potential use/vulnerability of a host.

I know we can add a banner using the banner clause in /etc/ftpd/ftpaccess, but this keeps this version banner in place.

Is there a way to remove this?

On the same subject, we'd also like to remove this for SMTP and SSH if possible?

[Sanjay_6 · Accepted solution]

Hi simon,

Maybe this will help,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062974927

The itrc doc id is UARPAKBQA00000205.

Hope this helps.

Regds

[Sanjay_6]

Hi,

to remove the banner from ssh, check/ comment the banner line in sshd_config.

Hope this helps.

Regds

[Pete Randall]

Simon,


See Craig's final response here:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=112737

I don't know about SSH, though.


Pete

[Doug Burton]

In the ftpaccess file:

suppresshostname yes
suppressversion yes

Uncomment the "#Banner /some/path" line in the /opt/ssh/etc/sshd_config file to "Banner /etc/issue"

[Ranjith_5]

Hi

1.)http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=204670

2.) see manpage of ftpaccess (#man ftpaccess)

Also you can put banner for your security warnings by specifing the file name.

eg: banner /etc/issue

Regards,
Syam

[Simon Hargrave]

Right, that's the FTP sorted, cheers.

The SSH doesn't work quite that way though. It's not so much the banner given by the SSH client, it's the banner advertised by the SSH daemon itself.

For example: -

% telnet localhost 22
Trying...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_3.8


Similarly for SMTP: -

% telnet localhost 25
Trying...
Connected to localhost.
Escape character is '^]'.
220 hostname ESMTP Sendmail 8.9.3 (PHNE_29774)/8.9.3; Mon, 15 Nov 2004 15:39:05 GMT

[Doug Burton]

Doh! The ssh part was to ADD the banner. Sorry. Don't have the info handy for version suppression.

Try this for email, changes to the /etc/mail/sendmail.cf file:

From: O SmtpGreetingMessage=$j Sendmail $v/$Z; $b
To: O SmtpGreetingMessage=
and
From: O PrivacyOptions=authwarnings
To: O PrivacyOptions=goaway

[Simon Hargrave]

Excellent! 2 down, 1 to go :)

[Simon Hargrave]

Hmm, according to this website: -

http://projects.vanscherpenseel.nl/documents/howto_banners.html

The way to disable the version on sshd is to edit the version string in version.h and recompile the source.

Given we use the (supported) HP delivered depot rather than compiling OpenSSH from scratch (and therefore unsupported I guess?) I guess this leaves us high and dry?