<Group id="mail">
<title>Mail Server Software</title>
<description>
Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that machines are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
<br /><br />
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
<br /><br />
The <tt>alternatives</tt> program in Red Hat Enterprise Linux permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, http://www.postfix.org.
</description>

<Rule id="mail_up_to_date" severity="high">
<title>Mail Server Software Updates</title>
<description>
If sendmail is installed, perform the following command:
<pre># rpm -q sendmail</pre>
The version indicated should be equal to or greater than the following:
<pre>8.13.8-8</pre>
If postfix is installed, perform the following command:
<pre># rpm -q postfix</pre>
The version indicated should be equal to or greater than the following:
<pre>2.3.3-6</pre>
</description>
<rationale>
The SMTP service version on the system must be current to avoid exposing 
vulnerabilities present in unpatched versions.
</rationale>
<ident stig="GEN004600" />
<oval id="mail_up_to_date" />
<ref nist="VIVM-1" disa="1230" />
</Rule>

<Group id="mail_logging">
<title>Mail Server Logging</title>
<description>
It is important to ensure adequate logging of mail server connections so as to 
support detecting any unauthorized activity.
</description>

<Rule id="mail_log_enabled" severity="medium">
<title>Enable Mail Server Logging</title>
<description>
To ensure logging is enabled, perform the following command:
<pre>grep "mail\." /etc/syslog.conf</pre>
The output received should indicate either <tt>mail.crit</tt> or <tt>mail.*</tt>.
</description>
<rationale>
If informational and more severe SMTP service messages are not 
logged, malicious activity on the system may go unnoticed.
</rationale>
<ident stig="GEN004460" />
<oval id="mail_log_enabled" />
<ref nist="ECAR-1,ECAR-2,ECAR-3,ECSC-1" disa="126" />
</Rule>

<Rule id="mail_log_level" severity="low">
<title>Configure Mail Server Logging Level</title>
<description>
If sendmail is installed, perform the following checks:
Edit the file <tt>/etc/mail/sendmail.cf</tt> and confirm that the following line appears:
<pre>O LogLevel=9</pre>
If postfix is installed, this check is not applicable.
</description>
<rationale>
If Sendmail is not configured to log at level 9, system logs may not contain the 
information necessary for tracking unauthorized use of the sendmail service.
</rationale>
<ident stig="GEN004440" />
<oval id="mail_log_level" />
<ref nist="ECAR-1,ECAR-2,ECAR-3" disa="366" />
</Rule>

</Group>

<Group id="mail_features">
<title>Mail Server Features</title>
<description>
Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that machines are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
<br /><br />
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
<br /><br />
The <tt>alternatives</tt> program in Red Hat Enterprise Linux permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, http://www.postfix.org.
</description>

<Rule id="mail_debug_enabled" severity="high">
<title>Disable Debug Command</title>
<description>
From a terminal, type the following commands:
<pre># telnet localhost 25</pre>
<pre># debug</pre>
If debug is disabled, one of the following errors should be returned:
<pre>500 error code of "command unrecognised"</pre>
<pre>550 error code of "access denied"</pre>
</description>
<rationale>
Debug mode is a feature present in older versions of sendmail which, 
if not disabled, may allow an attacker to gain access to a system 
through the sendmail service.
</rationale>
<ident stig="GEN004620" />
<oval id="mail_debug_enabled" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="mail_decode_active" severity="high">
<title>Disable Decode Command</title>
<description>
Edit the file(s) <tt>/etc/aliases</tt> and <tt>/usr/lib/aliases</tt>, if either exist, 
to ensure that the <tt>decode:</tt> and <tt>uudecode:</tt> entries do NOT include 
the file path to uudecode, such as the following:
<pre>decode: |/usr/bin/uudecode</pre>
<pre>uudecode: |/usr/bin/uuencode -d</pre>
</description>
<rationale>
A common configuration for older Mail Transfer Agents (MTAs) is to include an alias for 
the decode user. All mail sent to this user is sent to the uudecode program, which automatically 
converts and stores files. By sending mail to the decode or the uudecode aliases present on some 
systems, a remote attacker may be able to create or overwrite files on the remote host. This 
could possibly be used to gain remote access.
</rationale>
<ident stig="GEN004640" />
<oval id="mail_decode_active" />
<ref nist="ECSC-1" disa="1230" />
</Rule>

<Rule id="mail_expn_active" severity="low">
<title>Disable EXPN Command</title>
<description>
If sendmail is installed, perform the following checks:
Edit the file <tt>/etc/mail/sendmail.cf</tt> to ensure that the following
<tt>PrivacyOptions</tt> line appears and includes <tt>noexpn</tt>:
<pre>O PrivacyOptions=authwarnings,novrfy,noexpn,restrictqrun</pre>
If postfix is installed, this check is not applicable.
</description>
<rationale>
The SMTP EXPN function allows an attacker to determine if an account exists 
on a system, providing significant assistance to a brute force attack on user 
accounts. EXPN may also provide additional information concerning users on 
the system, such as the full names of account owners.
</rationale>
<ident stig="GEN004660" />
<oval id="mail_expn_active" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="mail_help_command" severity="medium">
<title>Disable Help Command</title>
<description>
If sendmail is installed, perform the following checks:
Edit the file <tt>/etc/mail/helpfile</tt> to ensure that the file is empty.
If postfix is installed, this check is not applicable.
</description>
<rationale>
The HELP command should be disabled to mask version information.  The version 
of the SMTP service software could be used by attackers to target vulnerabilities 
present in specific software versions.
</rationale>
<ident stig="GEN004540" />
<oval id="mail_help_command" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="mail_vrfy_active" severity="low">
<title>Disable VRFY Command</title>
<description>
If sendmail is installed, perform the following checks:
Edit the file <tt>/etc/mail/sendmail.cf</tt> to ensure that the following
<tt>PrivacyOptions</tt> line appears and includes <tt>novrfy</tt>:
<pre>O PrivacyOptions=authwarnings,novrfy,noexpn,restrictqrun</pre>
If postfix is installed, this check is not applicable.
</description>
<rationale>
The VRFY command allows an attacker to determine if an account exists 
on a system, providing significant assistance to a brute force attack 
on user accounts. VRFY may provide additional information about users 
on the system, such as the full names of account owners.
</rationale>
<ident stig="GEN004680" />
<oval id="mail_vrfy_active" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="mail_wiz_active" severity="low">
<title>Disable WIZ Command</title>
<description>
From a terminal, type the following commands:
<pre># telnet localhost 25</pre>
<pre># wiz</pre>
If wiz is disabled, the following error should be returned:
<pre>500 error code of "command unrecognised"</pre>
</description>
<rationale>
Very old installations of the Sendmail mailing system contained a feature whereby 
a remote user connecting to the SMTP port can enter the WIZ command and be given 
an interactive shell with root privileges.
</rationale>
<ident stig="GEN004700" />
<oval id="mail_wiz_active" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="mail_version_info" severity="low">
<title>Don't Display Version</title>
<description>
If sendmail is installed, perform the following checks:
Edit the file <tt>/etc/mail/sendmail.cf</tt> to ensure that the following
<tt>SmtpGreetingMessage</tt> line does not appear as:
<pre>O SmtpGreetingMessage=$j Sendmail $v/$Z; $b</pre>
If the above line appears, it should be changed to:
<pre>O SmtpGreetingMessage= Mail Server Ready ; $b</pre>
If postfix is installed, perform the following checks:
Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that the following
<tt>smtpd_banner</tt> line does not appear with <tt>$mail_version</tt>. If so,
remove the <tt>$mail_version</tt> entry or comment out the entire line to use 
the default value.
</description>
<rationale>
The version of the SMTP service can be used by attackers to plan an attack based 
on vulnerabilities present in the specific version.
</rationale>
<ident stig="GEN004560" />
<oval id="mail_version_info" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="mail_forward_files" severity="medium">
<title>Restrict Mail Forwarding</title>
<description>
If sendmail is installed, perform the following checks:
Edit the file <tt>/etc/mail/sendmail.cf</tt> to ensure that the following
<tt>ForwardPath</tt> line appears without any file path specified:
<pre>0 ForwardPath</pre>
Perform a search on the system for any <tt>.forward</tt> files by issuing the following command:
<pre># find / -name .forward</pre>
The above command should not return any results. If so, delete each file returned.
</description>
<rationale>
The .forward file allows users to automatically forward mail to another system. 
Use of .forward files could allow the unauthorized forwarding of mail and could 
potentially create mail loops which could degrade system performance.
</rationale>
<ident stig="GEN004580" />
<oval id="mail_forward_files" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="mail_relaying_disabled" severity="medium">
<title>Restrict Mail Relaying</title>
<description>
If sendmail is installed, perform the following checks:
Edit the file <tt>/etc/mail/sendmail.cf</tt> to ensure that only the following
<tt>DaemonPortOptions</tt> line appears:
<pre>O DaemonPortOptions=Port=smtp,Addr=127.0.0.1, Name=MTA</pre>
Edit the file <tt>/etc/mail/sendmail.mc</tt> to ensure that the following
<tt>promiscuous_relay</tt> line does NOT appear:
<pre>promiscuous_relay</pre>
If postfix is installed, perform the following checks:
Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the following
<tt>inet_interfaces</tt> line appears:
<pre>inet_interfaces = localhost</pre>
Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the following
<tt>smtpd_client_restrictions</tt> line appears:
<pre>smtpd_client_restrictions = reject</pre>
</description>
<rationale>
If unrestricted mail relaying is permitted, unauthorized senders could use this host 
as a mail relay for the purpose of sending SPAM or other unauthorized activity.
</rationale>
<ident stig="GEN004710" />
<oval id="mail_relaying_disabled" />
<ref nist="ECSC-1" disa="1305" />
</Rule>

</Group>

</Group>