Detections
Analytics

1.339 RHEL-10-700670

Information

RHEL 10 must forward mail from postmaster to the root account using a postfix alias.

GROUP ID: V-281270RULE ID: SV-281270r1166762

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.

Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.

Solution

Configure RHEL 10 to have a valid email address as an alias for the root account.

Append the following line to "/etc/aliases":

postmaster: root

Run the following command:

$ sudo newaliases

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5a., CAT|II, CCI|CCI-000139, Rule-ID|SV-281270r1166762_rule, STIG-ID|RHEL-10-700670, Vuln-ID|V-281270

Plugin: Unix

Control ID: d1df97004756d1d4939046f07b1686cde81fd6579cbe8febcd7f8ce14656349f