Detections
Analytics

1.178 RHEL-09-252060

Information

RHEL 9 must forward mail from postmaster to the root account using a postfix alias.

GROUP ID: V-257953
RULE ID: SV-257953r958424

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.

Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.

Solution

Configure a valid email address as an alias for the root account.

Append the following line to "/etc/aliases":

postmaster: root

Then, run the following command:

$ sudo newaliases

See Also

https://workbench.cisecurity.org/benchmarks/22008

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5a., CAT|II, CCI|CCI-000139, Rule-ID|SV-257953r958424_rule, STIG-ID|RHEL-09-252060, Vuln-ID|V-257953

Plugin: Unix

Control ID: 45495d0d61b2fd944893750bb0e4115cbb363543d528de8b81bc87b658a10370