4.5.4.5 /var/spool/clientmqueue - access control

Information

The recommended DAC (discretionary access control) settings for the /var/spool/clientmqueue directory are applied.

Rationale:

Queued messages are the messages that have not yet reached their final destination. To ensure the integrity of the messages during storage, the mail queue directory must be secured from unauthorized access. The clientmqueue (/var/spool/clientmqueue) is the mail queue for handling locally generated outbound emails. This queue is used when mail is submitted to sendmail as an MSP rather than as an MTA.

NOTE: It is possible to specify an alternate spool directory in the /etc/mail/submit.cf file via the QueueDirectory parameter. When this is used that directory name needs identical DAC settings.

Solution

Set the recommended permissions and ownership on /var/spool/mqueue:

chmod ug=rwx,o= /var/spool/clientmqueue
chown smmsp.smmsp /var/spool/clientmqueue

Default Value:

drwxrwx--- smmsp smmsp /var/spool/clientmqueue

See Also

https://workbench.cisecurity.org/benchmarks/13069

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3

Plugin: Unix

Control ID: d176ccf6080d20b6278d4d20f245ce87515ef42e46263a330af8675fc10bb972