[PATCH 10/13] DISA FSO copy editing of RHEL6/input/services/mail.xml DISA FSO copy editing of RHEL6/input/services/mail.xml

Shawn Wells shawn at redhat.com
Fri Nov 16 12:31:56 UTC 2012


---
 RHEL6/input/services/mail.xml |   48 ++++++++++++++++++++--------------------
 1 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
index e54d610..4136da7 100644
--- a/RHEL6/input/services/mail.xml
+++ b/RHEL6/input/services/mail.xml
@@ -71,16 +71,16 @@ e-mail configuration.</description>
 <title>Disable Postfix Network Listening</title>
 <description>
 Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the following
-<tt>inet_interfaces</tt> line appears:
+<tt>inet_interfaces</tt> line appears.
 <pre>inet_interfaces = localhost</pre>
 </description>
 <ocil clause="it does not">
-Run the following command to ensure postfix accepts mail messages from only the local system:
+Run the following command to ensure postfix accepts mail messages from only the local system.
 <pre>$ grep inet_interfaces /etc/postfix/main.cf</pre>
 If properly configured, the output should show only <tt>localhost</tt>.
 </ocil>
 <rationale>
-This ensures that <tt>postfix</tt> accepts mail messages
+This ensures <tt>postfix</tt> accepts mail messages
 (such as cron job reports) from the local system only,
 and not from the network, which protects it from network attack.
 </rationale>
@@ -146,12 +146,12 @@ that access, while keeping other ports on the server in their default protected
 
 <Rule id="postfix_logging">
 <title>Verify System Logging and Log Permissions for Mail</title>
-<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct the following line if necessary (this is the default):
+<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct the following line if necessary (this is the default).
 <pre>mail.*					-/var/log/maillog</pre>
 Run the following commands to ensure correct permissions on the mail log:
 <pre># chown root:root /var/log/maillog
 # chmod 600 /var/log/maillog</pre>
-Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt> (this is the default):
+Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt> (this is the default).
 <pre>/var/log/maillog</pre>
 </description>
 <!-- <ident cce="TODO:CCE" /> -->
@@ -170,16 +170,16 @@ an SSL certificate are independent of the MTA in use, and are described here.
 <Group id="postfix_create_cert">
 <title>Create an SSL Certificate</title>
 <description>
-Change into the CA certificate directory:
+Change into the CA certificate directory.
 <pre># cd /etc/pki/tls/certs</pre>
-Generate a key pair for the mail server:
+Generate a key pair for the mail server.
 <pre># openssl genrsa -out mailserverkey.pem 2048</pre>
 Next, generate a certificate signing request (CSR) for the CA to sign, making sure to supply your mail
-server's fully qualified domain name as the Common Name:
+server's fully qualified domain name as the Common Name.
 <pre># openssl req -new -key mailserverkey.pem -out mailserver.csr</pre>
 Next, the mail server CSR must be signed to create the mail server certificate. You can either send the CSR
 to an established CA or sign it with your CA.
-To sign mailserver.csr using your CA:
+To sign mailserver.csr using your CA.
 <pre># openssl ca -in mailserver.csr -out mailservercert.pem</pre>
 </description>
 <rationale>This step creates a private key, <tt>mailserverkey.pem</tt>, and a public certificate, <tt>mailservercert.pem</tt>.
@@ -195,21 +195,21 @@ purpose.</warning>
 
 <Rule id="postfix_install_ssl_cert">
 <title>Install the SSL Certificate</title>
-<description>Create the PKI directory for mail certificates, if it does not already exist:
+<description>Create the PKI directory for mail certificates, if it does not already exist.
 <pre># mkdir /etc/pki/tls/mail
 # chown root:root /etc/pki/tls/mail
 # chmod 755 /etc/pki/tls/mail</pre>
 Using removable media or some other secure transmission format, install the files generated in the previous
-step onto the mail server:
+step onto the mail server.
 <pre>/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem
 /etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem</pre>
-Verify the ownership and permissions of these files:
+Verify the ownership and permissions of these files.
 <pre># chown root:root /etc/pki/tls/mail/serverkey.pem
 # chown root:root /etc/pki/tls/mail/servercert.pem
 # chmod 600 /etc/pki/tls/mail/serverkey.pem
 # chmod 644 /etc/pki/tls/mail/servercert.pem</pre>
 Verify that the CA's public certificate file has been installed as <tt>/etc/pki/tls/CA/cacert.pem</tt>, and has the
-correct permissions:
+correct permissions.
 <pre># chown root:root /etc/pki/tls/CA/cacert.pem
 # chmod 644 /etc/pki/tls/CA/cacert.pem</pre>
 </description>
@@ -229,7 +229,7 @@ correct permissions:
 
 <Rule id="postfix_server_denial_of_service">
 <title>Limit Denial of Service Attacks</title>
-<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the following lines:
+<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the following lines.
 <pre>default_process_limit = 100
 smtpd_client_connection_count_limit = 10
 smtpd_client_connection_rate_limit = 30
@@ -259,7 +259,7 @@ typical at your site, look in <tt>/var/log/maillog</tt> for lines with the daemo
 <Rule id="postfix_server_banner" severity="medium">
 <title>Configure SMTP Greeting Banner</title>
 <description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following line, substituting some other wording for the
-banner information if you prefer:
+banner information if you prefer.
 <pre>smtpd_banner = $myhostname ESMTP</pre>
 </description>
 <rationale>The default greeting banner discloses that the listening mail process is Postfix.
@@ -286,15 +286,15 @@ with SSL support.
 
 <Rule id="postfix_server_mail_relay_set_trusted_networks">
 <title>Configure Trusted Networks and Hosts</title>
-<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the contents of the mynetworks variable in one of the following
-ways:
+<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the contents of the <tt>mynetworks</tt> variable in one of the following
+ways.
 <ul>
-<li>If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the line:
+<li>If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the following line.
 <pre>mynetworks_style = subnet</pre></li>
-<li>If only the MTA host itself is trusted to relay messages, add or correct:
+<li>If only the MTA host itself is trusted to relay messages, add or correct the following line.
 <pre>mynetworks_style = host</pre></li>
 <li>If the set of machines which can relay is more complicated, manually specify an entry for each netblock
-or IP address which is trusted to relay by setting the mynetworks variable directly:
+or IP address which is trusted to relay by setting the <tt>mynetworks</tt> variable directly.
 <pre>mynetworks = 10.0.0.0/16 , 192.168.1.0/24 , 127.0.0.1</pre></li>
 </ul>
 </description>
@@ -312,7 +312,7 @@ mail.
 <Rule id="postfix_server_mail_relay_for_trusted_networks">
 <title>Allow Unlimited Relaying for Trusted Networks Only</title>
 <description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the <tt>smtpd_recipient_restrictions</tt> definition so that it
-contains at least:
+contains at least.
 <pre>smtpd_recipient_restrictions =
     ...
     permit_mynetworks,
@@ -338,7 +338,7 @@ This section describes how to configure authentication using the Cyrus-SASL impl
 discussion of other options.
 <br /><br />
 To enable the use of SASL authentication, edit <tt>/etc/postfix/main.cf</tt> and add or correct the following
-settings:
+settings.
 <pre>smtpd_sasl_auth_enable = yes
 smtpd_recipient_restrictions =
     ...
@@ -347,7 +347,7 @@ smtpd_recipient_restrictions =
     reject_unauth_destination,
     ...</pre>
 Then edit <tt>/usr/lib/sasl2/smtpd.conf</tt> and add or correct the following line with the correct authentication
-mechanism for SASL to use:
+mechanism for SASL to use.
 <pre>pwcheck_method: saslauthd</pre>
 <service-enable-macro service="saslauthd" />
 </description>
@@ -373,7 +373,7 @@ work via PAM, look at the <tt>saslauthd(8)</tt> manpage to find out how to confi
 
 <Rule id="postfix_server_mail_relay_require_tls_for_smtp_auth">
 <title>Require TLS for SMTP AUTH</title>
-<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following lines:
+<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following lines.
 <pre>smtpd_tls_CApath = /etc/pki/tls/CA
 smtpd_tls_CAfile = /etc/pki/tls/CA/cacert.pem
 smtpd_tls_cert_file = /etc/pki/tls/mail/servercert.pem
-- 
1.7.1


--envbJBWh7q8WU6mo--


More information about the scap-security-guide mailing list