The mailx Package Is Installed
Ensures the mailx package is installed so security tooling can send email notifications of important system events.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
mailx provides the mail/mailx command-line mail client. Many security mechanisms, cron jobs, aide integrity checks, logwatch, audit dispatchers and custom scripts, rely on mailx to notify designated personnel of important events such as failures, integrity violations or warnings. Without it, those notifications are silently dropped and operators may never learn of a problem in time to react.
What Pavois checks
Pavois queries the package database through the InSpec package('mailx') resource and asserts should be_installed, resolving via rpm/dnf on RHEL 8. This reflects the effective inventory rather than checking for the /usr/bin/mail symlink alone, which could be provided by an alternative or left dangling. The package state is the reliable indicator that the mail client is actually available to scripts.
describe package('mailx') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q mailx. Applied: mailx-12.x-...el8.x86_64; not applied: package mailx is not installed. Confirm the command resolves with which mail (expect /usr/bin/mail).
Inspect & investigate
Package install is recorded in dnf history / rpm -q --last mailx. Sent mail and delivery problems appear in the MTA log (/var/log/maillog) and in journalctl -u postfix (or the configured mail service). Test delivery with echo test | mail -s test root.
Remediation
Pavois's harden plan declares a package resource for mailx with action install; pavois harden apply installs it through the native package manager (dnf). Note that mailx only sends mail, it needs a working local MTA (e.g. postfix) and an alias for root for notifications to actually be delivered; configure those separately.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | mailx |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without mailx, scripts and security tools that call mail fail silently and event notifications never reach operators. Precautions: installing the package is non-disruptive. To make notifications actually work, ensure a local MTA is running and root mail is aliased to a monitored mailbox (/etc/aliases + newaliases); otherwise mail queues locally and is never read. There is no lockout risk from this rule.