The system syslog service must log informational and more severe SMTP service messages.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239534	VROM-SL-000575	SV-239534r662053_rule		Medium

Description
If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.

STIG	Date
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide	2021-07-01

Details

Check Text ( C-42767r662051_chk )
Check the "/etc/syslog-ng/syslog-ng.conf" file for the following log entries: filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; If any of the above log entries are present, this is not a finding.

Fix Text (F-42726r662052_fix)

Edit the "/etc/syslog-ng/syslog-ng.conf" file and add the following log entries: filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); };