mediumnetworkverified ✓
Ensure MTA is configured for local-only mode
mta-local-only · RHEL ≥ 8 · 1 impl
Description
Mail Transfer Agents (MTA) should be configured to only listen on the localhost interface (127.0.0.1) unless the system is a designated mail server.
Rationale
An MTA listening on all interfaces provides an unnecessary network service that could be exploited. Restricting to localhost allows local mail delivery for system notifications while reducing attack surface.
Check → Remediate
Checkcommand
ss -lntu | grep ':25\s' | grep -v '127.0.0.1:25' | grep -v '::1:25'
- expected_exit:
- 1
Remediatemanual
- note:
- Configure your MTA to listen only on localhost. For Postfix, set 'inet_interfaces = loopback-only' in /etc/postfix/main.cf and restart postfix. For Sendmail, configure the DAEMON_OPTIONS in /etc/mail/sendmail.mc.
Framework references
CIS
rhel9 2.1.21rhel10 2.1.21rhel8 2.1.23
NIST 800-53
CM-7SC-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#mail#mta#network#postfix#sendmail