mediumservicesverified ✓rollback-safe

Ensure mail transfer agents are configured for local-only mode

postfix-local-only · RHEL ≥ 8 · 1 impl

Description

The mail transfer agent must be configured for local-only mode.

Rationale

A mail server listening on external interfaces exposes an unnecessary attack surface if remote mail delivery is not required.

Check → Remediate

Checkcommand

if ! rpm -q postfix >/dev/null 2>&1; then exit 0; fi
ifaces=$(postconf -h inet_interfaces 2>/dev/null)
if [ -z "$ifaces" ]; then
  echo "FAIL: cannot query postfix effective config"
  exit 1
fi
case "$ifaces" in
  loopback-only|localhost|"127.0.0.1") echo "OK: inet_interfaces=$ifaces"; exit 0 ;;
esac
echo "FAIL: inet_interfaces=$ifaces (expected loopback-only)"
exit 1

expected_exit:: 0

Remediateconfig_set

path:: /etc/postfix/main.cf
key:: inet_interfaces
value:: loopback-only
separator:: =
restart:: postfix

Framework references

CIS

rhel9 2.1.21rhel10 2.1.21rhel8 2.1.23

NIST 800-53

CM-7

Live verification

rhel10:checkrhel8:checkrhel9:check

#postfix#mail#network