ComplianceAsCode / ComplianceAsCode/content
Bad `separator_regex` value for validation of Postfix's `smtpd_client_restrictions` configuration-item.
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
The scan-regex for the Postfix `smtpd_client_restrictions` is too fragile.
#### SCAP Security Guide Version:
0.1.77
#### Operating System Version:
EL 9.6
- Red Hat
- Oracle
- Rocky
- Alma
#### Steps to Reproduce:
1. Launch a fresh, EL9-based system
2. Update `/etc/postfix/main.cf` file's `smtpd_client_restrictions` parameter to a suitable value
3. Install oscap contents
4. Execute `oscap xccdf eval --remediate --profile xccdf_org.ssgproject. `
5. View scan results
#### Actual Results:
Find that `oscap` is still reporting an insecure configuration
#### Expected Results:
Find that `oscap` is reporting a secured configuration
#### Fix Recommendation:
Update the `separator_regex` value (presumably in the [linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/oval/shared.xml](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/oval/shared.xml) file?), changing from `' = '` to something like `'\s*=\s*'`.
Contributor guide
Assessment
This issue has not been assessed yet.