The SMTP service log file must be owned by root.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-837	GEN004480	SV-37501r1_rule	ECLP-1	Medium

Description
If the SMTP service log file is not owned by root, then unauthorized personnel may modify or delete the file to hide a system compromise.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2013-07-03

Details

Check Text ( C-36158r1_chk )
Locate any mail log files by checking the syslog configuration file. Procedure: The check procedure is the same for both sendmail and Postfix. Identify any log files configured for the "mail" service (excluding mail.none) at any severity level and check the ownership # egrep "mail\.[^n][^/]" /etc/syslog.conf\|sed 's/^[^/]//'\|xargs ls -lL If any mail log file is not owned by root, this is a finding.

Check Text ( C-36158r1_chk )

Locate any mail log files by checking the syslog configuration file.

Procedure:
The check procedure is the same for both sendmail and Postfix.
Identify any log files configured for the "mail" service (excluding mail.none) at any severity level and check the ownership
# egrep "mail\.[^n][^/]*" /etc/syslog.conf|sed 's/^[^/]*//'|xargs ls -lL

If any mail log file is not owned by root, this is a finding.

Fix Text (F-31408r1_fix)
Change the ownership of the sendmail log file. Procedure: The fix procedure is the same for both sendmail and Postfix. # chown root