mediumservicesunverified

Ensure postfix prevents unrestricted mail relaying

postfix-relay-restrictions · RHEL ≥ 8 · 1 impl

Description

If postfix is installed, smtpd_client_restrictions must reject connections from unknown/untrusted networks — i.e. contain only permit_mynetworks and reject.

Rationale

An MTA that accepts mail from arbitrary clients can be abused as an open relay for spam or to spoof internal mail. Restricting to permit_mynetworks then reject confines relaying to trusted networks.

Check → Remediate

Checkcommand

if ! rpm -q postfix >/dev/null 2>&1; then exit 0; fi
val=$(postconf -h smtpd_client_restrictions 2>/dev/null)
if [ -z "$val" ]; then
  echo "FAIL: smtpd_client_restrictions not configured"
  exit 1
fi
# STIG V-257951/V-230550: a finding if any entry other than
# permit_mynetworks / reject is present (undocumented).
bad=$(printf '%s' "$val" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' |
  grep -vE '^(permit_mynetworks|reject)?$')
if [ -n "$bad" ]; then
  echo "FAIL: smtpd_client_restrictions has unexpected entries: $bad"
  exit 1
fi
echo "OK: smtpd_client_restrictions=$val"
exit 0

expected_exit:: 0

Remediateconfig_set

path:: /etc/postfix/main.cf
key:: smtpd_client_restrictions
value:: permit_mynetworks,reject
separator:: =
restart:: postfix

Framework references

STIG

V-280999 / RHEL-10-200692V-257951 / RHEL-09-252050V-230550

NIST 800-53

CM-7SC-7

#postfix#mail#relay#stig