Skip to content

2.1.21 Ensure mail transfer agent is configured for local-only mode

Audit#

Run the following command to verify that the MTA is not listening on any non-loopback address (127.0.0.1 or ::1). 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
#!/usr/bin/env bash
{
a_output=(); a_output2=(); a_port_list=("25" "465" "587")
for l_port_number in "${a_port_list[@]}"; do
if ss -plntu | grep -P -- ':'"$l_port_number"'\b' | grep -Pvq -- '\h+(127\.0\.0\.1|\[?::1\]?):'"$l_port_number"'\b'; then
a_output2+=(" - Port \"$l_port_number\" is listening on a non-loopback network interface")
else
a_output+=(" - Port \"$l_port_number\" is not listening on a non-loopback network interface")
fi
done
if command -v postconf &> /dev/null; then
l_interfaces="$(postconf -n inet_interfaces)"
elif command -v exim &> /dev/null; then
l_interfaces="$(exim -bP local_interfaces)"
elif command -v sendmail &> /dev/null; then
l_interfaces="$(grep -i "0 DaemonPortOptions=" /etc/mail/sendmail.cr | grep -oP '?<=Addr=)[^,+]+')"
fi
if [ -n "$l_interfaces" ]; then
if grep -Pqi '\ball\b' <<< "$l_interfaces"; then
a_output2+=(" - MTA is bound to all network interfaces")
elif ! grep -Pqi '(inet_interfaces\h*=\h*)?(0\.0\.0\.0|::1|loopback-only)' <<< "$l_interfaces"; then
a_output2+=(" - MTA is bound to a network interface" "\"$l_interfaces\"")
else
a_output+=(" - MTA is not bound to a non loopback network interface"
"
\"$l_interfaces\"")
fi
else
a_output+=(" - MTA not detected or in use")
fi
if [ "${#a_output2[@]}" -le 0 ]; then
printf '%s\n' "" "- Audit Result:" " ** PASS **" "${a_output[@]}"
else
printf '%s\n' "" "- Audit Result:" " ** FAIL **" " * Reasons for audit failure *" "${a_output2[@]}" ""
[ "${#a_output[@]}" -gt 0 ] && printf '%s\n' "- Correctly set:" "${a_output[@]}"
fi
}

Remediation#

Edit /etc/postfix/main.cf and add the following line to the RECEIVING MAIL section. If the line already exists, change it to look like the line below: 

inet_interfaces = loopback-only

Run the following command to restart postfix: 

# systemctl restart postfix

Note: - This recommendation is designed around the postfix mail server. - Depending on your environment you may have an alternative MTA installed such as exim4. If this is the case consult the documentation for your installed MTA to configure the recommended state.