I'm trying to configure sendmail to prevent it from allowing username enumeration through the RCPT TO: command.
I've been googling endlessly and, from what I can see, the best way to achieve this is by adding a catch all email account to the virtusertable.
So I generated a new sendmail.cf file, with this directive included:
FEATURE(`virtusertable', `hash /etc/mail/virtusertable')dnl
To the virtusertable.db file, I then add:
@ubuntu test
and restart sendmail, but it doesn't work:
mail from:root@ubuntu
250 2.1.0 root@ubuntu... Sender ok
rcpt to:root
250 2.1.5 root... Recipient ok
rcpt to:fake
550 5.1.1 fake... User unknown
Am I going wrong somewhere? Or is there a better way to achieve this?
Thanks for any help