UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system syslog service must log informational and more severe SMTP service messages.


Overview

Finding ID Version Rule ID IA Controls Severity
V-240440 VRAU-SL-000595 SV-240440r671061_rule Medium
Description
If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.
STIG Date
VMware vRealize Automation 7.x SLES Security Technical Implementation Guide 2023-09-22

Details

Check Text ( C-43673r671059_chk )
Check the /etc/syslog-ng/syslog-ng.conf for the following log entries:

filter f_mailinfo { level(info) and facility(mail); };
filter f_mailwarn { level(warn) and facility(mail); };
filter f_mailerr { level(err, crit) and facility(mail); };
filter f_mail { facility(mail); };

If present, this is not a finding.
Fix Text (F-43632r671060_fix)
Edit the /etc/syslog-ng/syslog-ng.conf file and add the following log entries:

filter f_mailinfo { level(info) and facility(mail); };
filter f_mailwarn { level(warn) and facility(mail); };
filter f_mailerr { level(err, crit) and facility(mail); };
filter f_mail { facility(mail); };

destination mailinfo { file("/var/log/mail.info"); };
log { source(src); filter(f_mailinfo); destination(mailinfo); };

destination mailwarn { file("/var/log/mail.warn"); };
log { source(src); filter(f_mailwarn); destination(mailwarn); };

destination mailerr { file("/var/log/mail.err" fsync(yes)); };
log { source(src); filter(f_mailerr); destination(mailerr); };