Check: GEN004480
HP-UX 11.31 STIG:
GEN004480
(in versions v1 r19 through v1 r13)
Title
The SMTP service log file must be owned by root. (Cat II impact)
Discussion
If the SMTP service log file is not owned by root, then unauthorized personnel may modify or delete the file to hide a system compromise.
Check Content
Locate any Sendmail log files by checking the syslog configuration file. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ egrep -i "mail.info|mail.debug|mail.\*|\*.info|\*.debug|\*.\*" | cut -f 2,2 -d " " | uniq | xargs -n1 ls -lL Identify any log files configured for the "mail" service at any severity level, or those configured for all services. Check the ownership of these log files. If any mail log file is not owned by root, this is a finding.
Fix Text
Change the ownership of the sendmail log file. # chown root <sendmail log file>
Additional Identifiers
Rule ID: SV-35053r1_rule
Vulnerability ID: V-837
Group Title: GEN004480
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
Number | Title |
---|---|
AC-6 |
Least Privilege |