Disable Postfix Network Listening
Restricts Postfix to listen only on the loopback interface so it delivers local mail (cron, system reports) and never accepts mail from the network.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Most systems run Postfix only to deliver internal mail (cron job output, system notifications). When inet_interfaces is left at all, Postfix listens on every interface and exposes an open SMTP service to the network. This widens the attack surface to remote exploitation, spam relay abuse and information disclosure. Binding to loopback-only/localhost removes that exposure while keeping local mail working.
What Pavois checks
Pavois queries the effective Postfix parameter with postconf -h inet_interfaces, which returns the value actually resolved by Postfix after parsing main.cf and any included settings. Reading /etc/postfix/main.cf directly would miss overrides, multi-instance setups and the compiled-in default, producing false results; postconf reports what the daemon truly uses.
only_if { command('command -v postconf').exit_status.zero? }
describe command('postconf -h inet_interfaces 2>/dev/null | grep -qiE \'loopback-only|localhost\' && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run postconf -h inet_interfaces. The expected output is loopback-only (or localhost). You can also confirm no external listener with ss -ltnp | grep ':25', port 25 should bind only to 127.0.0.1/::1.
Inspect & investigate
Postfix activity is logged via journalctl -u postfix (or /var/log/mail.log). After applying the change, the restart and the new bind appear there; connection attempts from the network will no longer be accepted.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set inet_interfaces = loopback-only in /etc/postfix/main.cf (e.g. postconf -e 'inet_interfaces = loopback-only') and reload Postfix with systemctl restart postfix.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | postconf -e 'inet_interfaces = loopback-only' 2>/dev/null && systemctl restart postfix 2>/dev/null; true |
|---|---|
| name | postfix-loopback |
| not_if | postconf -h inet_interfaces 2>/dev/null | grep -qiE 'loopback-only|localhost' |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If the host is an intended mail server (MX, smarthost receiving network mail), restricting Postfix to loopback will break inbound delivery, apply this only to hosts that send local mail only. Before applying, confirm no remote system relies on this SMTP listener (ss -ltnp | grep ':25' and review firewall rules). After the change, test local delivery with echo test | mail -s test root and check journalctl -u postfix.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R74 | direct | 2.0 | high |
| CIS | 1.4.2, 2.1.21, 2.1.23 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.