Check: GEN004370
Title
The aliases file must be group-owned by root, sys, smmsp, or bin. (Cat II impact)
Discussion
If the alias file is not group-owned by root or a system group, an unauthorized user may modify the file to add aliases to run malicious code or redirect email.
Check Content
Find the alias files on the system. Procedure: Check the group ownership of the alias file and the hashed version of it used by sendmail. Procedure: # ls -lL /etc/aliases If the file is not group-owned by root, sys, smmsp, or bin, this is a finding.
Fix Text
Change the group owner of the /etc/mail/aliases files. Procedure: # chgrp bin /etc/aliases
Additional Identifiers
Rule ID:
Vulnerability ID: V-22438
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000225 |
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks. |
Controls
Number | Title |
---|---|
AC-6 |
Least Privilege |