The system syslog service must log informational and more severe SMTP service messages.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-88539	VROM-SL-000575	SV-99189r1_rule		Medium

Description
If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.

STIG	Date
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide	2018-10-11

Details

Check Text ( C-88231r1_chk )
Check the "/etc/syslog-ng/syslog-ng.conf" file for the following log entries: filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; If any of the above log entries are present, this is not a finding.

Fix Text (F-95281r1_fix)

Edit the "/etc/syslog-ng/syslog-ng.conf" file and add the following log entries: filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); };