Verify No .forward Files Exist
Ensures no .forward file exists under /root or /home, blocking unauthorized mail redirection and command-on-delivery.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A user's ~/.forward file tells the local MTA (sendmail/Postfix) to redirect that user's mail elsewhere, to an external address, or to a pipe that runs an arbitrary command. This is a security risk twofold: it can silently exfiltrate sensitive mail outside the organization, and the pipe form lets a user (or an attacker who plants the file) execute commands on mail delivery. On hardened systems no .forward files should exist under /root or /home.
What Pavois checks
Pavois runs a live find over /root and /home (staying on one filesystem via -xdev) for any file named .forward. Enumerating the actual files present on disk, rather than guessing from a fixed list of users, is what catches forward files in any home directory, including recently created accounts.
describe command('find /root /home -xdev -name .forward 2>/dev/null') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Search for any forward file:
find /root /home -xdev -name .forward 2>/dev/null, expected output is empty (no path printed).
Inspect & investigate
Mail-forwarding activity surfaces in the MTA logs:
grep -E 'forward|to=<' /var/log/mail.log(Debian/Ubuntu) //var/log/maillog(RHEL), shows deliveries redirected by a.forward, including pipe (|command) deliveries.journalctl -u postfixcorrelates the redirection with its trigger.
Remediation
No automated harden plan is defined for this rule yet, so it must be applied manually: review each file found (find /root /home -xdev -name .forward), confirm its intent with the account owner, then delete it with rm <path>. Investigate any .forward that pipes to a command, as it may be malicious.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find /home /root -maxdepth 2 -name .forward 2>/dev/null # rm -f <path> per file after confirming the forwarding is not required |
|---|---|
| reason | deleting user .forward files can drop mail forwarding, review each before removing |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: mail can be silently exfiltrated and, via pipe forwards, arbitrary commands can run on delivery.
Precautions before applying: some legitimate users intentionally forward mail (e.g. to a team alias). Confirm with the owner before deleting, and prefer a centrally managed alias in /etc/aliases over per-user .forward. Deleting a file in use only stops further redirection; it does not break the user's login or shell.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.2.10, 7.2.9 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.