4.5.4.6 /var/spool/mqueue - access control

Information

The recommended DAC (discretionary access control) settings for the /var/spool/mqueue directory are applied.

Rationale:

The sendmail daemon stores its queued mail in the /var/spool/mqueue directory. Queued messages are the messages that have not yet reached their final destination. To ensure the integrity of the messages during storage, the mail queue directory must be secured from unauthorized access.

NOTE: It is possible to specify an alternate spool directory in the /etc/mail/sendmail.cf file via the QueueDirectory parameter. When this is used that directory name needs identical DAC settings.

Solution

Set the recommended permissions and ownership on /var/spool/mqueue:

chmod u=rwx,go= /var/spool/mqueue
chown root /var/spool/mqueue

Default Value:

drwxrwx--- root system /var/spool/mqueue

See Also

https://workbench.cisecurity.org/benchmarks/13069

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3

Plugin: Unix

Control ID: e8e58b139b5d760b5b89df31b1d18b281b130699e90064cdafac592e4f338fea