Detections
Analytics

RHEL-10-700670 - RHEL 10 must forward mail from postmaster to the root account using a postfix alias.

Information

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.

Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.

Solution

Configure RHEL 10 to have a valid email address as an alias for the root account.

Append the following line to "/etc/aliases":

postmaster: root

Run the following command:

$ sudo newaliases

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5a., CAT|II, CCI|CCI-000139, Rule-ID|SV-281270r1166762_rule, STIG-ID|RHEL-10-700670, Vuln-ID|V-281270

Plugin: Unix

Control ID: bc09b242ee19a1257466b9f75aa05ea85b5af22abcf19c98bbd6112acb37c66f