Check: GEN004510
HP-UX 11.31 STIG:
GEN004510
(in versions v1 r19 through v1 r13)
Title
The SMTP service log file must not have an extended ACL. (Cat II impact)
Discussion
If the SMTP service log file has an extended ACL, unauthorized users may be allowed to access or to modify the log file.
Check Content
Examine /etc/syslog.conf and determine the log file(s) receiving logs for mail.crit, mail.debug, mail.*, or *.crit. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ egrep -i "mail.crit|mail.\*|\*.crit|mail.debug|\*.debug" | cut -f 2,2 -d " " | \ uniq | xargs -n1 ls -lL Check the permissions on these log files. # ls -lL <log file> If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix Text
Remove the optional ACL from the log file. # chacl -z <log file>
Additional Identifiers
Rule ID: SV-38368r1_rule
Vulnerability ID: V-22442
Group Title: GEN004510
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
Number | Title |
---|---|
AC-6 |
Least Privilege |