Forward mail for root to a monitored mailbox

Description

System services send their reports and alerts to the root account by mail. A root: line in /etc/aliases forwards that mail to a person or team mailbox that is actually read.

Ubuntu installs no MTA by default, so the control is usually not applicable; when Postfix or exim4 is installed later, /etc/aliases has no root: line. The recipient is site-specific, so the fix is manual.

Rationale

Failed jobs, disk errors, security update failures and audit alerts are reported by mail. If they stay in /var/mail/root, problems and intrusions go unnoticed.

Impact

Mail for root leaves the system: the destination must be trusted, since reports can contain host names, paths and errors.

Applies when

Detected: when: A mail transfer agent is installed A scanner reports the control not applicable when one is false.

Audit

Run grep -E '^[[:space:]]*root[[:space:]]*:' /etc/aliases. It must return a line with a recipient other than root itself.

Automated: every check must pass. Scanners report each check by its id.

root-alias

/etc/aliases forwards root to another recipient.

script: |
  o=$(grep -E '^[[:space:]]*root[[:space:]]*:' /etc/aliases 2>/dev/null | tail -n 1)
  if [ -z "$o" ]; then echo "no root alias in /etc/aliases"; exit 1; fi
  echo "$o"
  printf '%s\n' "$o" | sed 's/^[^:]*://' | tr ',' '\n' | sed 's/[[:space:]]//g' | grep -qvx -e root -e ''

Remediation

Add or edit the line root: <administrator address or account> in /etc/aliases, then run newaliases. Send a test with echo test | mail -s test root (package bsd-mailx).

Rollback

Remove the root: line from /etc/aliases and run newaliases.

References

• aliases(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R75) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle