Add option to hide SmtpServer version

[bogdanst24]

When the connection is made, the server automatically responds with a 220 code followed by the Name and version. In a security audit, it was brought to our attention that this could constitute information leakage, consisting of a potential (very unlikely) security risk.

It is not a make-or-break change, but it would be helpful to either have the possibility of not showing it, or overwriting it. It would be very appreciated.

[BrewingCoder]

just fork the project and change line 179 of SmtpSession.cs and remove the "v{version} " from that line.

When new versions of SMTP are checked in just pull them down to your fork and make sure that line always stays the way you want it :)

[nd1012]

For several reasons I'd not recommend to run this server on a public port, but as a local SMTP filter instead. SMTP filters are commonly supported by MTAs like Postfix and easy to configure, too. The proxy MTA will then hide the version information of this SMTP server. However, running as SMTP filter would disable the authentication feature.

[intergavg]

For several reasons I'd not recommend to run this server on a public port, but as a local SMTP filter instead. SMTP filters are commonly supported by MTAs like Postfix and easy to configure, too. The proxy MTA will then hide the version information of this SMTP server. However, running as SMTP filter would disable the authentication feature.

Would you please list reasons?

[tinohager]

The version can be used to determine exactly which vulnerabilities the server has, i would also prefer to be able to switch this off.

• No Timeout after DATA #226
• MaxMessageSize not checked after DATA #225
• StartTls or SecureEnpoint do not have a timeout #234