GEN004710 - Mail relaying must be restricted - sendmail

Information

If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending SPAM or other unauthorized activity.

Solution

If the system uses sendmail, edit the sendmail.mc file and remove the 'promiscuous_relay' configuration.

Rebuild the sendmail.cf file from the modified sendmail.mc and restart the service.

If the system does not need to receive mail from external hosts, add one or more DaemonPortOptions lines referencing system loopback addresses (such as 'O DaemonPortOptions=Addr=127.0.0.1,Port=smtp,Name=MTA') and remove lines containing non-loopback addresses.

Restart the service.

If the system uses Postfix, edit the main.cf file and add or edit the 'smtpd_client_restrictions' line to have contents 'permit_mynetworks, reject' or a similarly restrictive rule.

If the system does not need to receive mail from external hosts, add or edit the 'inet_interfaces' line to have contents 'loopback-only' or a set of loopback addresses for the system.

Restart the service.

If the system is using other SMTP software, consult the software's documentation for procedures to restrict mail relaying.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_5_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-6b., 800-53|SI-8a., CAT|II, CCI|CCI-000366, CCI|CCI-001305, Rule-ID|SV-218553r603259_rule, STIG-ID|GEN004710, STIG-Legacy|SV-62879, STIG-Legacy|V-23952, Vuln-ID|V-218553

Plugin: Unix

Control ID: 099178d142338e50f9b471b9d5452b4cc7f5779c34f67c1318ae1ce22a34c22b