From owner-freebsd-security  Thu Mar  6  7:36:45 2003
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3AC2037B401
	for <freebsd-security@freebsd.org>; Thu,  6 Mar 2003 07:36:42 -0800 (PST)
Received: from lava.sentex.ca (pyroxene.sentex.ca [199.212.134.18])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 768A443FBD
	for <freebsd-security@freebsd.org>; Thu,  6 Mar 2003 07:36:41 -0800 (PST)
	(envelope-from mike@sentex.net)
Received: from simian.sentex.net (simeon.sentex.ca [192.168.43.27])
	by lava.sentex.ca (8.12.8/8.12.8) with ESMTP id h26Fae57042411
	for <freebsd-security@freebsd.org>; Thu, 6 Mar 2003 10:36:40 -0500 (EST)
	(envelope-from mike@sentex.net)
Message-Id: <5.2.0.9.0.20030306094902.06e759a8@marble.sentex.ca>
X-Sender: mdtpop@marble.sentex.ca (Unverified)
X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9
Date: Thu, 06 Mar 2003 10:41:43 -0500
To: freebsd-security@freebsd.org
From: Mike Tancsa <mike@sentex.net>
Subject: network audit of sendmail
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-Virus-Scanned: By Sentex Communications (lava/20020517)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


I want to go through my network to a) ensure all my machines are updated 
and b)look for customer machines running vulnerable versions of 
sendmail.  I put together a quick perl script, but its sequential and does 
not scan in parallel. (this is slow for 16,000 hosts). Can anyone recommend 
a tool to do this ? Essentially all I want to do is connect to port 25, 
grab the banner and record it next to the IP address.  Nessus seems to be 
way overkill and I dont see a way in nmap to record the banner 
output.  Before I spend time to figure out how to use threads (or fork off 
processes) in perl, am I re-inventing the wheel so to speak ?  Is there a 
script out there to do this ? I tried looking through google but didnt find 
anything

	---Mike

#!/usr/bin/perl -w
use NetAddr::IP;
use Net::SMTP;

my ($range, $i,$totalhosts);

#give it something like scan  ./smtp-scan.pl  192.168.0.0/16
$range = $ARGV[0];

print "\ntarget range is $range \n";

my $host = new NetAddr::IP($range);

$i=1;
$totalhosts = $host->num();
print "total hosts $totalhosts \n";

while ($i < $totalhosts) {
         $t="\n";
         $ip = $host->addr;

         if ($smtp = Net::SMTP->new($ip, Helo => 'sendmail-version-check', 
Timeout => 10) ){
                 $t = $smtp->banner();
                 $smtp->quit;
         }
         $host=$host+1;
         print "$ip,\t$t";
         $i++;
}

	---Mike
--------------------------------------------------------------------
Mike Tancsa,                          	          tel +1 519 651 3400
Sentex Communications,     			  mike@sentex.net
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada			  www.sentex.net/mike


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message