V-831

Discussion

If the alias file is not owned by root, an unauthorized user may modify the file adding aliases to run malicious code or redirect e-mail.

Check Content

Check the ownership of the alias files.

Procedure:
for sendmail:
# ls -lL /etc/aliases
# ls -lL /etc/aliases.db
If all the files are not owned by root, this is a finding.

for postfix:
Verify the location of the alias file.
# postconf alias_maps

This will return the location of the "aliases" file.

# ls -lL <postfix aliases file>
# ls -lL <postfix aliases.db file>
If all the files are not owned by root, this is a finding.