The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:299
# Mail relaying must be restricted.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# sendmail not installed
# rpminfo_object (rpminfo_test)
test_1() {
! ( rpm -q --quiet 'sendmail' &>/dev/null )
}
# DaemonPortOptions are loopbacks
# textfilecontent54_object (textfilecontent54_test)
test_2() {
(sed -En 's/^O DaemonPortOptions=[^#
]*Addr=([-_A-Za-z.0-9]*)/\1/p' '/etc/mail/sendmail.cf') | grep -Pq '^(localhost|localhost\.localdomain|127\.0\.0\.1|::1)$'
}
# no sendmail promisc_relay
# textfilecontent54_object (textfilecontent54_test)
test_3() {
! ( grep -Pq '^[ ]*FEATURE\('\''promiscuous_relay'\''\)' '/etc/mail/sendmail.mc' &>/dev/null )
}
# postfix not installed
# rpminfo_object (rpminfo_test)
test_4() {
! ( rpm -q --quiet 'postfix' &>/dev/null )
}
# inet_interfaces are loopbacks
# textfilecontent54_object (textfilecontent54_test)
test_5() {
(sed -En 's/^[ ]*inet_interfaces[ ]*=[ ]*([-A-Za-z0-9:\.]+[, ]*)/\1/p' '/etc/postfix/main.cf') | grep -Pq '^(localhost\.localdomain|localhost|127\.0\.0\.1|::1|loopback-only)'
}
# postfix smtpd_client_restrictions has reject
# textfilecontent54_object (textfilecontent54_test)
test_6() {
grep -Pq '^[ ]*smtpd_client_restrictions[ ]*=[ ]*([a-zA-Z0-9\._ ]*[, ]*)reject[^_]$' '/etc/postfix/main.cf' &>/dev/null
}
# postfix smtpd_client_restrictions no permit before reject
# textfilecontent54_object (textfilecontent54_test)
test_7() {
(sed -En 's/^[ ]*smtpd_client_restrictions[ ]*=[ ]*([a-zA-Z0-9\._ ]*[, ]*)reject[^_]$/\1/p' '/etc/postfix/main.cf') | grep -Pq '[ ]*permit[ ,]+'
}
if ( ! ( test_1 || ! ( test_2 || test_3 ) ) && ! ( test_4 || ! ( test_5 || ! ( test_6 && test_7 ) ) ) ); then
echo "PASS"
else
echo "FAIL"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# oval:mil.disa.fso.rhel11:def:299
if ! command -v rpm &> /dev/null; then
echo "PASS"
exit 0
fi
if rpm -qa | grep -q sendmail; then
grep -q "FEATURE\\('promiscuous_relay'\\)" /etc/mail/sendmail.mc || \
grep -q "^O DaemonPortOptions=Addr=127\\.0\\.0\\.1" /etc/mail/sendmail.cf && \
echo "PASS"
else
if ! command -v postmap &> /dev/null; then
echo "PASS"
exit 0
fi
if postmail -v -t | grep -q "postfix"; then
grep -q "permit_" /etc/postfix/main.cf && \
echo "PASS"
else
echo "FAIL"
exit 1
fi
fi
echo "FAIL"
exit 1