Navigate

Check: GEN004360

Solaris 10 X86 STIG: GEN004360 (in versions v2 r4 through v2 r3)

Title

The alias file must be owned by root. (Cat II impact)

Discussion

If the alias file is not owned by root, an unauthorized user may modify the file to add aliases to run malicious code or redirect email.

Check Content

Note: If sendmail is not installed, this requirement is not applicable. Find the alias file on the system. Procedure: # egrep '^O(A| AliasFile)' /etc/mail/sendmail.cf If the "alias file" is an NIS or LDAP map, this check is not applicable. The default location is /etc/mail/aliases. Check the ownership of the alias file. Procedure: # ls -lL /etc/mail/aliases /etc/mail/aliases.db If the alias files are not owned by root, this is a finding.

Fix Text

Change the owner of the /etc/mail/aliases file (or equivalent, such as /usr/lib/aliases) to root. Procedure: # chown root /etc/mail/aliases

Additional Identifiers

Rule ID: SV-227837r858555_rule

Vulnerability ID: V-227837

Group Title: SRG-OS-000312

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-002195	The organization defines the information flows against which the organization-defined security policy filters are to be enforced.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AC-4 (8)	Security Policy Filters