← Rules Catalog
mediumnetworkverified

Ensure MTA is configured for local-only mode

mta-local-only · RHEL ≥ 8 · 1 impl

Description

Mail Transfer Agents (MTA) should be configured to only listen on the localhost interface (127.0.0.1) unless the system is a designated mail server.

Rationale

An MTA listening on all interfaces provides an unnecessary network service that could be exploited. Restricting to localhost allows local mail delivery for system notifications while reducing attack surface.

Check → Remediate

Checkcommand
ss -lntu | grep ':25\s' | grep -v '127.0.0.1:25' | grep -v '::1:25'
expected_exit:
1
Remediatemanual
note:
Configure your MTA to listen only on localhost. For Postfix, set 'inet_interfaces = loopback-only' in /etc/postfix/main.cf and restart postfix. For Sendmail, configure the DAEMON_OPTIONS in /etc/mail/sendmail.mc.

Framework references

CIS

rhel9 2.1.21rhel10 2.1.21rhel8 2.1.23

NIST 800-53

CM-7SC-7

Live verification

rhel10:checkrhel8:checkrhel9:check
#mail#mta#network#postfix#sendmail