Check: GEN004380
SUSE Linux Enterprise Server v11 for System z STIG:
GEN004380
(in versions v1 r12 through v1 r9)
Title
The alias file must have mode 0644 or less permissive. (Cat II impact)
Discussion
Excessive permissions on the aliases file may permit unauthorized modification. If the alias file is modified by an unauthorized user, they may modify the file to run malicious code or redirect e-mail.
Check Content
Check the permissions of the alias file. Procedure: for sendmail: # ls -lL /etc/aliases /etc/aliases.db If an alias file has a mode more permissive than 0644, this is a finding. for postfix: Verify the location of the alias file. # postconf alias_maps This will return the location of the "aliases" file. # ls -lL <postfix aliases file> <postfix aliases.db file> If an alias file has a mode more permissive than 0644, this is a finding.
Fix Text
Change the mode of the alias files as needed to function. No higher than 0644. Procedure: for sendmail: # chmod 0644 /etc/aliases /etc/aliases.db for postfix: # chmod 0644 <postfix aliases file> <postfix aliases.db file>
Additional Identifiers
Rule ID: SV-45849r1_rule
Vulnerability ID: V-832
Group Title: GEN004380
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
| Number | Title |
|---|---|
| AC-6 |
Least Privilege |