Ensure access to /var/spool/clientmqueue is configured

MoyenneNiveau 1Automatiséeaix

Description

The recommended DAC (discretionary access control) settings for the /var/spool/clientmqueue directory are applied. Queued messages are the messages that have not yet reached their final destination. To ensure the integrity of the messages during storage, the mail queue directory must be secured from unauthorized access. Audit: compares `ls -ld` mode (this mode or more restrictive), owner and group with the CIS values; ACLs are not evaluated.

Méthode de vérification

Méthode d'audit: Commande shell

shell

r=compliant; for f in /var/spool/clientmqueue/; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rwxrwx---' -v o='smmsp' -v g='smmsp' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; echo "$r"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Set the recommended permissions and ownership on /var/spool/mqueue: chmod ug=rwx,o= /var/spool/clientmqueue chown smmsp.smmsp /var/spool/clientmqueue

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: aixpermissions
Référence: CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.4.4 Ensure access to /var/spool/clientmqueue is configured

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target aix