Ensure mail transfer agent is configured for local-only mode

MediumLevel 1Automatedros

Description

Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail. The audit requires nothing to listen on port 25 except 127.0.0.1 and ::1 (ss). Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

How it is checked

Audit method: Shell command

shell

command -v ss >/dev/null 2>&1 || exit 1
l=$(ss -Hlntu 2>/dev/null | awk '$5 ~ /:25$/ {print $5}' | grep -Ev '^(127\.0\.0\.1|\[::1\]|::1):25$')
[ -z "$l" ] && echo compliant || echo "MTA listening on: $(printf '%s ' $l)"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit /etc/postfix/main.cf and add the following line to the RECEIVING MAIL section. If the line already exists, change it to look like the line below: inet_interfaces = loopback-only Restart postfix: # systemctl restart postfix

Properties

Operating systems: Any
Tags: rosros1melodicservices
Reference: CIS ROS Melodic Benchmark v1.0.0 - 2.2.15 Ensure mail transfer agent is configured for local-only mode

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target ros