UCF STIG Viewer Logo

The system syslog service must log informational and more severe SMTP service messages.


Overview

Finding ID Version Rule ID IA Controls Severity
V-836 GEN004460 SV-35051r1_rule ECSC-1 Medium
Description
If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.
STIG Date
HP-UX 11.31 Security Technical Implementation Guide 2018-09-14

Details

Check Text ( C-36565r1_chk )
The syslog.conf file critical mail logging option line will typically appear as one of the following examples:

mail.crit /var/adm/messages
mail.* /var/adm/messages
*.* /var/adm/messages
*.crit /var/adm/messages

Check the syslog configuration file for mail.crit logging configuration.

# cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | egrep -i "mail.crit|mail.\*|\*.crit|\*.\*"

If syslog is not configured to log critical sendmail messages, this is a finding.
Fix Text (F-31933r1_fix)
Edit the syslog.conf file and add a configuration line specifying an appropriate destination for critical "mail" syslogs, for example:

mail.crit /var/adm/messages
mail.* /var/adm/messages
*.* /var/adm/messages
*.crit /var/adm/messages