V-22438

Discussion

If the alias file is not group-owned by root or a system group, an unauthorized user may modify the file adding aliases to run malicious code or redirect e-mail.

Check Content

If the “sendmail” or “postfix” packages are not installed, this is not applicable.

Check the group ownership of the alias files.

Procedure:
for sendmail:
# ls -lL /etc/aliases
If the file is not group-owned by root, this is a finding.

# ls -lL /etc/aliases.db
If the file is not group-owned by root, this is a finding.

for postfix:
Verify the location of the alias file.
# postconf alias_maps

This will return the location of the "aliases" file, by default "/etc/aliases".

# ls -lL <postfix aliases file>
If the file is not group-owned by root, this is a finding.

# ls -lL <postfix aliases.db file>
If the file is not group-owned by root, this is a finding.