Uninstall dovecot Package
Ensures the Dovecot IMAP/POP3 mail-delivery server is not installed on hosts that do not serve mailboxes.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
If there is no need to make the Dovecot software available, removing it provides a safeguard against its activation.
What Pavois checks
Pavois verifies that the dovecot package is absent via the package manager. Removing the package guarantees the IMAP/POP3 daemon cannot be started or auto-enabled, which is stronger than disabling a service that could later be re-activated and still carries CVEs while installed.
describe package('dovecot-core') do
it { should_not be_installed }
endHow to verify it is applied
On Debian/Ubuntu run dpkg -s dovecot-core; on RHEL family run rpm -q dovecot. Both should report the package is not installed. Confirm nothing listens on IMAP/POP ports with ss -tlnp | grep -E ':(143|993|110|995)'.
Inspect & investigate
Confirm removal with dpkg -l dovecot-core or rpm -q dovecot; while present, Dovecot logs to /var/log/mail.log and via journalctl -u dovecot.
Remediation
Pavois's harden plan removes the dovecot package (resource package, action remove) and is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | dovecot-core |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing Dovecot disables IMAP/POP3 mailbox access it provided. Before applying, confirm the host is not a mail server and that no clients retrieve mail from it; on a dedicated mail server this rule should be exempted. On general-purpose hosts there is no impact.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.8 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.