Title

The alias file must be owned by root. (Cat II impact)

Discussion

If the alias file is not owned by root, an unauthorized user may modify the file to add aliases to run malicious code or redirect email.

Check Content

Find the alias file on the system. Procedure: # egrep '^O(A| AliasFile)' /etc/mail/sendmail.cf If the "alias file" is an NIS or LDAP map, this check is not applicable. The default location is /etc/mail/aliases. Check the ownership of the alias file. Procedure: # ls -lL <alias file> If the alias file is not owned by root, this is a finding.

Fix Text

Change the owner of the /etc/mail/aliases file (or equivalent, such as /usr/lib/aliases) to root. Procedure: # chown root /etc/mail/aliases

Additional Identifiers

Rule ID: SV-227837r603266_rule

Vulnerability ID: V-227837

Group Title: SRG-OS-000312

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.