>From 74e9b069ac61e409cf7b1a16fc29bb26a11f5d72 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 16 Nov 2012 07:31:56 -0500 Subject: [PATCH 10/13] DISA FSO copy editing of RHEL6/input/services/mail.xml DISA FSO copy editing of RHEL6/input/services/mail.xml --- RHEL6/input/services/mail.xml | 48 ++++++++++++++++++++-------------------- 1 files changed, 24 insertions(+), 24 deletions(-) diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml index e54d610..4136da7 100644 --- a/RHEL6/input/services/mail.xml +++ b/RHEL6/input/services/mail.xml @@ -71,16 +71,16 @@ e-mail configuration. Disable Postfix Network Listening Edit the file /etc/postfix/main.cf to ensure that only the following -inet_interfaces line appears: +inet_interfaces line appears.
inet_interfaces = localhost
-Run the following command to ensure postfix accepts mail messages from only the local system: +Run the following command to ensure postfix accepts mail messages from only the local system.
$ grep inet_interfaces /etc/postfix/main.cf
If properly configured, the output should show only localhost.
-This ensures that postfix accepts mail messages +This ensures postfix accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack. @@ -146,12 +146,12 @@ that access, while keeping other ports on the server in their default protected Verify System Logging and Log Permissions for Mail -Edit the file /etc/rsyslog.conf. Add or correct the following line if necessary (this is the default): +Edit the file /etc/rsyslog.conf. Add or correct the following line if necessary (this is the default).
mail.*					-/var/log/maillog
Run the following commands to ensure correct permissions on the mail log:
# chown root:root /var/log/maillog
 # chmod 600 /var/log/maillog
-Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of /etc/logrotate.d/syslog (this is the default): +Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of /etc/logrotate.d/syslog (this is the default).
/var/log/maillog
@@ -170,16 +170,16 @@ an SSL certificate are independent of the MTA in use, and are described here. Create an SSL Certificate -Change into the CA certificate directory: +Change into the CA certificate directory.
# cd /etc/pki/tls/certs
-Generate a key pair for the mail server: +Generate a key pair for the mail server.
# openssl genrsa -out mailserverkey.pem 2048
Next, generate a certificate signing request (CSR) for the CA to sign, making sure to supply your mail -server's fully qualified domain name as the Common Name: +server's fully qualified domain name as the Common Name.
# openssl req -new -key mailserverkey.pem -out mailserver.csr
Next, the mail server CSR must be signed to create the mail server certificate. You can either send the CSR to an established CA or sign it with your CA. -To sign mailserver.csr using your CA: +To sign mailserver.csr using your CA.
# openssl ca -in mailserver.csr -out mailservercert.pem
This step creates a private key, mailserverkey.pem, and a public certificate, mailservercert.pem. @@ -195,21 +195,21 @@ purpose. Install the SSL Certificate -Create the PKI directory for mail certificates, if it does not already exist: +Create the PKI directory for mail certificates, if it does not already exist.
# mkdir /etc/pki/tls/mail
 # chown root:root /etc/pki/tls/mail
 # chmod 755 /etc/pki/tls/mail
Using removable media or some other secure transmission format, install the files generated in the previous -step onto the mail server: +step onto the mail server.
/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem
 /etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem
-Verify the ownership and permissions of these files: +Verify the ownership and permissions of these files.
# chown root:root /etc/pki/tls/mail/serverkey.pem
 # chown root:root /etc/pki/tls/mail/servercert.pem
 # chmod 600 /etc/pki/tls/mail/serverkey.pem
 # chmod 644 /etc/pki/tls/mail/servercert.pem
Verify that the CA's public certificate file has been installed as /etc/pki/tls/CA/cacert.pem, and has the -correct permissions: +correct permissions.
# chown root:root /etc/pki/tls/CA/cacert.pem
 # chmod 644 /etc/pki/tls/CA/cacert.pem
@@ -229,7 +229,7 @@ correct permissions: Limit Denial of Service Attacks -Edit /etc/postfix/main.cf. Add or correct the following lines: +Edit /etc/postfix/main.cf. Add or correct the following lines.
default_process_limit = 100
 smtpd_client_connection_count_limit = 10
 smtpd_client_connection_rate_limit = 30
@@ -259,7 +259,7 @@ typical at your site, look in /var/log/maillog for lines with the daemo
 
 Configure SMTP Greeting Banner
 Edit /etc/postfix/main.cf, and add or correct the following line, substituting some other wording for the
-banner information if you prefer:
+banner information if you prefer.
 
smtpd_banner = $myhostname ESMTP
The default greeting banner discloses that the listening mail process is Postfix. @@ -286,15 +286,15 @@ with SSL support. Configure Trusted Networks and Hosts -Edit /etc/postfix/main.cf, and configure the contents of the mynetworks variable in one of the following -ways: +Edit /etc/postfix/main.cf, and configure the contents of the mynetworks variable in one of the following +ways.
    -
  • If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the line: +
  • If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the following line.
    mynetworks_style = subnet
  • -
  • If only the MTA host itself is trusted to relay messages, add or correct: +
  • If only the MTA host itself is trusted to relay messages, add or correct the following line.
    mynetworks_style = host
  • If the set of machines which can relay is more complicated, manually specify an entry for each netblock -or IP address which is trusted to relay by setting the mynetworks variable directly: +or IP address which is trusted to relay by setting the mynetworks variable directly.
    mynetworks = 10.0.0.0/16 , 192.168.1.0/24 , 127.0.0.1
@@ -312,7 +312,7 @@ mail. Allow Unlimited Relaying for Trusted Networks Only Edit /etc/postfix/main.cf, and add or correct the smtpd_recipient_restrictions definition so that it -contains at least: +contains at least.
smtpd_recipient_restrictions =
     ...
     permit_mynetworks,
@@ -338,7 +338,7 @@ This section describes how to configure authentication using the Cyrus-SASL impl
 discussion of other options.
 

To enable the use of SASL authentication, edit /etc/postfix/main.cf and add or correct the following -settings: +settings.
smtpd_sasl_auth_enable = yes
 smtpd_recipient_restrictions =
     ...
@@ -347,7 +347,7 @@ smtpd_recipient_restrictions =
     reject_unauth_destination,
     ...
Then edit /usr/lib/sasl2/smtpd.conf and add or correct the following line with the correct authentication -mechanism for SASL to use: +mechanism for SASL to use.
pwcheck_method: saslauthd
@@ -373,7 +373,7 @@ work via PAM, look at the saslauthd(8) manpage to find out how to confi Require TLS for SMTP AUTH -Edit /etc/postfix/main.cf, and add or correct the following lines: +Edit /etc/postfix/main.cf, and add or correct the following lines.
smtpd_tls_CApath = /etc/pki/tls/CA
 smtpd_tls_CAfile = /etc/pki/tls/CA/cacert.pem
 smtpd_tls_cert_file = /etc/pki/tls/mail/servercert.pem
-- 
1.7.1