Detections
Analytics

4.3.2.12 Ensure sendmail is not in use

Information

The sendmail daemon means that the system can operate as a mail server.

sendmail is a service with many historical vulnerabilities and where possible should be disabled. Unless a system is specifically designated to act as a mail server, it is recommended that the sendmail fileset be removed to reduce the potential attack surface.

Note: Historically, the AIX sendmail build has not supported the AUTH feature. Since AIX 7.2 TL4 a new packaging of sendmail (still as version 8.15.2, so version number is not the way to verify suitability) allows AUTH support indirectly via the SASLv2 (Simple Authentication and Security Layer) API interface. Our recommendation is to disable/remove sendmail programs that do not provide SASLv2 support.

Solution

Run the following command to remove the software:

# /usr/sbin/installp -u bos.net.tcp.sendmail bos.net.tcp.server

- OR -

- IF - the bos.net.tcp.sendmail fileset is required as a dependency:

Run the following script to stop and disable sendmail

#!/usr/bin/ksh
DAEMONS="sendmail"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-215360r958478_rule, Vuln-ID|V-215353

Plugin: Unix

Control ID: 908d5e62e612b0e6087567e790fb2783265803eb67832e130bd8a4c87256aceb