Uninstall cyrus-imapd Package
Ensures the cyrus-imapd IMAP/POP3 mail server is not installed on hosts that do not serve mailboxes.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
If there is no need to make the cyrus-imapd software available, removing it provides a safeguard against its activation.
What Pavois checks
Pavois verifies that the cyrus-imapd package is absent via the package manager. Removing the package guarantees the IMAP/POP3 daemon cannot be started or auto-enabled, which is stronger than disabling a service that could later be re-activated.
describe package('cyrus-imapd') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL family run rpm -q cyrus-imapd (expected package cyrus-imapd is not installed); on Debian/Ubuntu run dpkg -s cyrus-imapd. Confirm nothing listens on IMAP/POP ports with ss -tlnp | grep -E ':(143|993|110|995)'.
Inspect & investigate
Confirm removal with rpm -q cyrus-imapd or dpkg -l cyrus-imapd; while present, the service logs to the system journal (journalctl -u cyrus-imapd) and the mail facility in syslog.
Remediation
Pavois's harden plan removes the cyrus-imapd package (resource package, action remove) and is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | cyrus-imapd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing cyrus-imapd disables IMAP/POP3 mailbox access provided by this server. Before applying, confirm the host is not a mail server and that no clients retrieve mail from it; on a dedicated mail server this rule should be exempted. On general-purpose hosts there is no impact.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.8 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.