Detections
Analytics

1.154 OL09-00-000815

Information

OL 9 must forward mail from postmaster to the root account using a postfix alias.

GROUP ID: V-271589
RULE ID: SV-271589r1091479

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.

Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.

Solution

Configure a valid email address as an alias for the root account.

Append the following line to "/etc/aliases":

postmaster: root

Then, run the following command:

$ sudo newaliases

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5a., CCI|CCI-000139, Rule-ID|SV-271589r1091479_rule, STIG-ID|OL09-00-000815, Vuln-ID|V-271589

Plugin: Unix

Control ID: 07f7daa0a29f7b0e7d4c9e07b2b3e3c5839d48e2baa927c8432448ad128a1b1d