ComplianceAsCode / ComplianceAsCode/content

Bad `separator_regex` value for validation of Postfix's `smtpd_client_restrictions` configuration-item.

Open
#13,891 1 comment 4 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

The scan-regex for the Postfix `smtpd_client_restrictions` is too fragile.

#### SCAP Security Guide Version:

0.1.77

#### Operating System Version:

EL 9.6
- Red Hat
- Oracle
- Rocky
- Alma

#### Steps to Reproduce:

1. Launch a fresh, EL9-based system
2. Update `/etc/postfix/main.cf` file's `smtpd_client_restrictions` parameter to a suitable value
3. Install oscap contents
4. Execute `oscap xccdf eval --remediate --profile xccdf_org.ssgproject. `
5. View scan results

#### Actual Results:

Find that `oscap` is still reporting an insecure configuration

#### Expected Results:

Find that `oscap` is reporting a secured configuration

#### Fix Recommendation:

Update the `separator_regex` value (presumably in the [linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/oval/shared.xml](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/oval/shared.xml) file?), changing from `' = '` to something like `'\s*=\s*'`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.