From 74e9b069ac61e409cf7b1a16fc29bb26a11f5d72 Mon Sep 17 00:00:00 2001 From: Shawn Wells <shawn@redhat.com> Date: Fri, 16 Nov 2012 07:31:56 -0500 Subject: [PATCH 10/13] DISA FSO copy editing of RHEL6/input/services/mail.xml DISA FSO copy editing of RHEL6/input/services/mail.xml --- RHEL6/input/services/mail.xml | 48 ++++++++++++++++++++-------------------- 1 files changed, 24 insertions(+), 24 deletions(-) diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml index e54d610..4136da7 100644 --- a/RHEL6/input/services/mail.xml +++ b/RHEL6/input/services/mail.xml @@ -71,16 +71,16 @@ e-mail configuration.</description> <title>Disable Postfix Network Listening</title> <description> Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the following -<tt>inet_interfaces</tt> line appears: +<tt>inet_interfaces</tt> line appears. <pre>inet_interfaces = localhost</pre> </description> <ocil clause="it does not"> -Run the following command to ensure postfix accepts mail messages from only the local system: +Run the following command to ensure postfix accepts mail messages from only the local system. <pre>$ grep inet_interfaces /etc/postfix/main.cf</pre> If properly configured, the output should show only <tt>localhost</tt>. </ocil> <rationale> -This ensures that <tt>postfix</tt> accepts mail messages +This ensures <tt>postfix</tt> accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack. </rationale> @@ -146,12 +146,12 @@ that access, while keeping other ports on the server in their default protected <Rule id="postfix_logging"> <title>Verify System Logging and Log Permissions for Mail</title> -<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct the following line if necessary (this is the default): +<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct the following line if necessary (this is the default). <pre>mail.* -/var/log/maillog</pre> Run the following commands to ensure correct permissions on the mail log: <pre># chown root:root /var/log/maillog # chmod 600 /var/log/maillog</pre> -Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt> (this is the default): +Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt> (this is the default). <pre>/var/log/maillog</pre> </description> <!-- <ident cce="TODO:CCE" /> --> @@ -170,16 +170,16 @@ an SSL certificate are independent of the MTA in use, and are described here. <Group id="postfix_create_cert"> <title>Create an SSL Certificate</title> <description> -Change into the CA certificate directory: +Change into the CA certificate directory. <pre># cd /etc/pki/tls/certs</pre> -Generate a key pair for the mail server: +Generate a key pair for the mail server. <pre># openssl genrsa -out mailserverkey.pem 2048</pre> Next, generate a certificate signing request (CSR) for the CA to sign, making sure to supply your mail -server's fully qualified domain name as the Common Name: +server's fully qualified domain name as the Common Name. <pre># openssl req -new -key mailserverkey.pem -out mailserver.csr</pre> Next, the mail server CSR must be signed to create the mail server certificate. You can either send the CSR to an established CA or sign it with your CA. -To sign mailserver.csr using your CA: +To sign mailserver.csr using your CA. <pre># openssl ca -in mailserver.csr -out mailservercert.pem</pre> </description> <rationale>This step creates a private key, <tt>mailserverkey.pem</tt>, and a public certificate, <tt>mailservercert.pem</tt>. @@ -195,21 +195,21 @@ purpose.</warning> <Rule id="postfix_install_ssl_cert"> <title>Install the SSL Certificate</title> -<description>Create the PKI directory for mail certificates, if it does not already exist: +<description>Create the PKI directory for mail certificates, if it does not already exist. <pre># mkdir /etc/pki/tls/mail # chown root:root /etc/pki/tls/mail # chmod 755 /etc/pki/tls/mail</pre> Using removable media or some other secure transmission format, install the files generated in the previous -step onto the mail server: +step onto the mail server. <pre>/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem /etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem</pre> -Verify the ownership and permissions of these files: +Verify the ownership and permissions of these files. <pre># chown root:root /etc/pki/tls/mail/serverkey.pem # chown root:root /etc/pki/tls/mail/servercert.pem # chmod 600 /etc/pki/tls/mail/serverkey.pem # chmod 644 /etc/pki/tls/mail/servercert.pem</pre> Verify that the CA's public certificate file has been installed as <tt>/etc/pki/tls/CA/cacert.pem</tt>, and has the -correct permissions: +correct permissions. <pre># chown root:root /etc/pki/tls/CA/cacert.pem # chmod 644 /etc/pki/tls/CA/cacert.pem</pre> </description> @@ -229,7 +229,7 @@ correct permissions: <Rule id="postfix_server_denial_of_service"> <title>Limit Denial of Service Attacks</title> -<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the following lines: +<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the following lines. <pre>default_process_limit = 100 smtpd_client_connection_count_limit = 10 smtpd_client_connection_rate_limit = 30 @@ -259,7 +259,7 @@ typical at your site, look in <tt>/var/log/maillog</tt> for lines with the daemo <Rule id="postfix_server_banner" severity="medium"> <title>Configure SMTP Greeting Banner</title> <description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following line, substituting some other wording for the -banner information if you prefer: +banner information if you prefer. <pre>smtpd_banner = $myhostname ESMTP</pre> </description> <rationale>The default greeting banner discloses that the listening mail process is Postfix. @@ -286,15 +286,15 @@ with SSL support. <Rule id="postfix_server_mail_relay_set_trusted_networks"> <title>Configure Trusted Networks and Hosts</title> -<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the contents of the mynetworks variable in one of the following -ways: +<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the contents of the <tt>mynetworks</tt> variable in one of the following +ways. <ul> -<li>If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the line: +<li>If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the following line. <pre>mynetworks_style = subnet</pre></li> -<li>If only the MTA host itself is trusted to relay messages, add or correct: +<li>If only the MTA host itself is trusted to relay messages, add or correct the following line. <pre>mynetworks_style = host</pre></li> <li>If the set of machines which can relay is more complicated, manually specify an entry for each netblock -or IP address which is trusted to relay by setting the mynetworks variable directly: +or IP address which is trusted to relay by setting the <tt>mynetworks</tt> variable directly. <pre>mynetworks = 10.0.0.0/16 , 192.168.1.0/24 , 127.0.0.1</pre></li> </ul> </description> @@ -312,7 +312,7 @@ mail. <Rule id="postfix_server_mail_relay_for_trusted_networks"> <title>Allow Unlimited Relaying for Trusted Networks Only</title> <description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the <tt>smtpd_recipient_restrictions</tt> definition so that it -contains at least: +contains at least. <pre>smtpd_recipient_restrictions = ... permit_mynetworks, @@ -338,7 +338,7 @@ This section describes how to configure authentication using the Cyrus-SASL impl discussion of other options. <br /><br /> To enable the use of SASL authentication, edit <tt>/etc/postfix/main.cf</tt> and add or correct the following -settings: +settings. <pre>smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = ... @@ -347,7 +347,7 @@ smtpd_recipient_restrictions = reject_unauth_destination, ...</pre> Then edit <tt>/usr/lib/sasl2/smtpd.conf</tt> and add or correct the following line with the correct authentication -mechanism for SASL to use: +mechanism for SASL to use. <pre>pwcheck_method: saslauthd</pre> <service-enable-macro service="saslauthd" /> </description> @@ -373,7 +373,7 @@ work via PAM, look at the <tt>saslauthd(8)</tt> manpage to find out how to confi <Rule id="postfix_server_mail_relay_require_tls_for_smtp_auth"> <title>Require TLS for SMTP AUTH</title> -<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following lines: +<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following lines. <pre>smtpd_tls_CApath = /etc/pki/tls/CA smtpd_tls_CAfile = /etc/pki/tls/CA/cacert.pem smtpd_tls_cert_file = /etc/pki/tls/mail/servercert.pem-- 1.7.1