On 11/16/12 5:55 PM, Shawn Wells wrote:
0010-DISA-FSO-copy-editing-of-RHEL6-input-services-mail.x.patch
From 74e9b069ac61e409cf7b1a16fc29bb26a11f5d72 Mon Sep 17 00:00:00 2001
From: Shawn Wells<shawn(a)redhat.com>
Date: Fri, 16 Nov 2012 07:31:56 -0500
Subject: [PATCH 10/13] DISA FSO copy editing of RHEL6/input/services/mail.xml
DISA FSO copy editing of RHEL6/input/services/mail.xml
---
RHEL6/input/services/mail.xml | 48 ++++++++++++++++++++--------------------
1 files changed, 24 insertions(+), 24 deletions(-)
diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index e54d610..4136da7 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -71,16 +71,16 @@ e-mail configuration.</description>
<title>Disable Postfix Network Listening</title>
<description>
Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the
following
-<tt>inet_interfaces</tt> line appears:
+<tt>inet_interfaces</tt> line appears.
<pre>inet_interfaces = localhost</pre>
</description>
<ocil clause="it does not">
-Run the following command to ensure postfix accepts mail messages from only the local
system:
+Run the following command to ensure postfix accepts mail messages from only the local
system.
<pre>$ grep inet_interfaces /etc/postfix/main.cf</pre>
If properly configured, the output should show only <tt>localhost</tt>.
</ocil>
<rationale>
-This ensures that <tt>postfix</tt> accepts mail messages
+This ensures <tt>postfix</tt> accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack.
</rationale>
@@ -146,12 +146,12 @@ that access, while keeping other ports on the server in their
default protected
<Rule id="postfix_logging">
<title>Verify System Logging and Log Permissions for Mail</title>
-<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct
the following line if necessary (this is the default):
+<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct
the following line if necessary (this is the default).
<pre>mail.* -/var/log/maillog</pre>
Run the following commands to ensure correct permissions on the mail log:
<pre># chown root:root /var/log/maillog
# chmod 600 /var/log/maillog</pre>
-Ensure log will be rotated as appropriate by adding or correcting the following line if
needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt>
(this is the default):
+Ensure log will be rotated as appropriate by adding or correcting the following line if
needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt>
(this is the default).
<pre>/var/log/maillog</pre>
</description>
<!-- <ident cce="TODO:CCE" /> -->
@@ -170,16 +170,16 @@ an SSL certificate are independent of the MTA in use, and are
described here.
<Group id="postfix_create_cert">
<title>Create an SSL Certificate</title>
<description>
-Change into the CA certificate directory:
+Change into the CA certificate directory.
<pre># cd /etc/pki/tls/certs</pre>
-Generate a key pair for the mail server:
+Generate a key pair for the mail server.
<pre># openssl genrsa -out mailserverkey.pem 2048</pre>
Next, generate a certificate signing request (CSR) for the CA to sign, making sure to
supply your mail
-server's fully qualified domain name as the Common Name:
+server's fully qualified domain name as the Common Name.
<pre># openssl req -new -key mailserverkey.pem -out mailserver.csr</pre>
Next, the mail server CSR must be signed to create the mail server certificate. You can
either send the CSR
to an established CA or sign it with your CA.
-To sign mailserver.csr using your CA:
+To sign mailserver.csr using your CA.
<pre># openssl ca -in mailserver.csr -out mailservercert.pem</pre>
</description>
<rationale>This step creates a private key,
<tt>mailserverkey.pem</tt>, and a public certificate,
<tt>mailservercert.pem</tt>.
@@ -195,21 +195,21 @@ purpose.</warning>
<Rule id="postfix_install_ssl_cert">
<title>Install the SSL Certificate</title>
-<description>Create the PKI directory for mail certificates, if it does not
already exist:
+<description>Create the PKI directory for mail certificates, if it does not
already exist.
<pre># mkdir /etc/pki/tls/mail
# chown root:root /etc/pki/tls/mail
# chmod 755 /etc/pki/tls/mail</pre>
Using removable media or some other secure transmission format, install the files
generated in the previous
-step onto the mail server:
+step onto the mail server.
<pre>/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem
/etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem</pre>
-Verify the ownership and permissions of these files:
+Verify the ownership and permissions of these files.
<pre># chown root:root /etc/pki/tls/mail/serverkey.pem
# chown root:root /etc/pki/tls/mail/servercert.pem
# chmod 600 /etc/pki/tls/mail/serverkey.pem
# chmod 644 /etc/pki/tls/mail/servercert.pem</pre>
Verify that the CA's public certificate file has been installed as
<tt>/etc/pki/tls/CA/cacert.pem</tt>, and has the
-correct permissions:
+correct permissions.
<pre># chown root:root /etc/pki/tls/CA/cacert.pem
# chmod 644 /etc/pki/tls/CA/cacert.pem</pre>
</description>
@@ -229,7 +229,7 @@ correct permissions:
<Rule id="postfix_server_denial_of_service">
<title>Limit Denial of Service Attacks</title>
-<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the
following lines:
+<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the
following lines.
<pre>default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
@@ -259,7 +259,7 @@ typical at your site, look in <tt>/var/log/maillog</tt>
for lines with the daemo
<Rule id="postfix_server_banner" severity="medium">
<title>Configure SMTP Greeting Banner</title>
<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct
the following line, substituting some other wording for the
-banner information if you prefer:
+banner information if you prefer.
<pre>smtpd_banner = $myhostname ESMTP</pre>
</description>
<rationale>The default greeting banner discloses that the listening mail process
is Postfix.
@@ -286,15 +286,15 @@ with SSL support.
<Rule id="postfix_server_mail_relay_set_trusted_networks">
<title>Configure Trusted Networks and Hosts</title>
-<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the
contents of the mynetworks variable in one of the following
-ways:
+<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the
contents of the <tt>mynetworks</tt> variable in one of the following
+ways.
<ul>
-<li>If any machine in the subnet containing the MTA may be trusted to relay
messages, add or correct the line:
+<li>If any machine in the subnet containing the MTA may be trusted to relay
messages, add or correct the following line.
<pre>mynetworks_style = subnet</pre></li>
-<li>If only the MTA host itself is trusted to relay messages, add or correct:
+<li>If only the MTA host itself is trusted to relay messages, add or correct the
following line.
<pre>mynetworks_style = host</pre></li>
<li>If the set of machines which can relay is more complicated, manually specify
an entry for each netblock
-or IP address which is trusted to relay by setting the mynetworks variable directly:
+or IP address which is trusted to relay by setting the <tt>mynetworks</tt>
variable directly.
<pre>mynetworks = 10.0.0.0/16 , 192.168.1.0/24 ,
127.0.0.1</pre></li>
</ul>
</description>
@@ -312,7 +312,7 @@ mail.
<Rule id="postfix_server_mail_relay_for_trusted_networks">
<title>Allow Unlimited Relaying for Trusted Networks Only</title>
<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct
the <tt>smtpd_recipient_restrictions</tt> definition so that it
-contains at least:
+contains at least.
<pre>smtpd_recipient_restrictions =
...
permit_mynetworks,
@@ -338,7 +338,7 @@ This section describes how to configure authentication using the
Cyrus-SASL impl
discussion of other options.
<br /><br />
To enable the use of SASL authentication, edit
<tt>/etc/postfix/main.cf</tt> and add or correct the following
-settings:
+settings.
<pre>smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =
...
@@ -347,7 +347,7 @@ smtpd_recipient_restrictions =
reject_unauth_destination,
...</pre>
Then edit <tt>/usr/lib/sasl2/smtpd.conf</tt> and add or correct the
following line with the correct authentication
-mechanism for SASL to use:
+mechanism for SASL to use.
<pre>pwcheck_method: saslauthd</pre>
<service-enable-macro service="saslauthd" />
</description>
@@ -373,7 +373,7 @@ work via PAM, look at the <tt>saslauthd(8)</tt> manpage
to find out how to confi
<Rule id="postfix_server_mail_relay_require_tls_for_smtp_auth">
<title>Require TLS for SMTP AUTH</title>
-<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct
the following lines:
+<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct
the following lines.
<pre>smtpd_tls_CApath = /etc/pki/tls/CA
smtpd_tls_CAfile = /etc/pki/tls/CA/cacert.pem
smtpd_tls_cert_file = /etc/pki/tls/mail/servercert.pem
-- 1.7.1
Ack
(note these patches were created by FSO, not myself. I only posted
publicly.)