STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

The information system security officer (ISSO) and system administrator (SA), at a minimum, must have mail aliases to be notified of a SLEM 5 audit processing failure.

DISA Rule

SV-261423r996677_rule

Vulnerability Number

V-261423

Group Title

SRG-OS-000046-GPOS-00022

Rule Version

SLEM-05-653075

Severity

CAT II

CCI(s)

CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Weight

Fix Recommendation

Configure the auditd service to notify the administrators in the event of a SLEM 5 audit processing failure.

Configure an alias value for the postmaster with the following command:

> sudo sh -c 'echo "postmaster: root" >> /etc/aliases'

Configure an alias for root that forwards to a monitored email address with the following command:

> sudo sh -c 'echo "root: box@server.mil" >> /etc/aliases'

The following command must be run to implement changes to the /etc/aliases file:

> sudo newaliases

Check Contents

Verify the administrators are notified in the event of a SLEM 5 audit processing failure with the following commands:

> grep -i "^postmaster:" /etc/aliases
postmaster: root

If the above command does not return a value of "root", or the output is commented out, this is a finding.

Verify the alias for root forwards to a monitored e-mail account:

> grep -i "^root:" /etc/aliases
root: person@server.mil

If the alias for root does not forward to a monitored e-mail account, or the output is commented out, this is a finding.

Vulnerability Number

V-261423

Documentable

False

Rule Version

SLEM-05-653075

Severity Override Guidance

Check Content Reference

Target Key

5596