Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-22438 | GEN004370 | SV-40683r1_rule | ECLP-1 | Medium |
Description |
---|
If the alias file is not group-owned by a system group, an unauthorized user may modify the file to add aliases to run malicious code or redirect e-mail. |
STIG | Date |
---|---|
AIX 5.3 Security Technical Implementation Guide | 2012-05-25 |
Check Text ( C-39413r1_chk ) |
---|
Check the group ownership of the /etc/mail/aliases file. Procedure: # ls -lL /etc/mail/aliases If the file is not group-owned by sys, bin, or system, this is a finding. |
Fix Text (F-34538r1_fix) |
---|
Change the group owner of the /etc/mail/aliases file. Procedure: # chgrp system /etc/mail/aliases |