The Postfix package is installed
Ensures a local MTA (postfix) is installed so the system can send email notifications for important events.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A local Mail Transfer Agent (MTA) such as Postfix is needed so the system can deliver email notifications about important events, service failures, audit-system warnings, cron job output and security alerts. Many monitoring and compliance mechanisms (including auditd's space_left_action = email) rely on a working local mailer. Without an MTA, these notifications are silently dropped, and operators may miss the early signal of a failure or a compromise.
What Pavois checks
Pavois checks the effective package state with package('postfix') (resolved through dpkg-query or rpm). The presence of a mail alias in a config file does not guarantee a working mailer; Pavois confirms the Postfix package is actually installed rather than inferring mail capability from configuration text.
describe package('postfix') do
it { should be_installed }
endHow to verify it is applied
On Debian/Ubuntu run dpkg-query -W -f='${Status}\n' postfix (expected install ok installed); on RHEL run rpm -q postfix (expected a versioned name). Confirm the service with systemctl status postfix.
Inspect & investigate
Mail delivery and queue activity are logged in /var/log/mail.log (Debian/Ubuntu) or via journalctl -u postfix. Installation history is in /var/log/dpkg.log or /var/log/dnf.log.
Remediation
Pavois's harden plan installs the postfix package via the package resource (action: install). It is applied with pavois harden apply. By default Postfix should be configured for local-only delivery; relay/relayhost settings and ensuring it does not listen on external interfaces are governed by separate hardening controls.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | postfix |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing Postfix is generally safe, but be aware it provides a network-facing service: a default install may bind to a port and, if exposed, could be abused as an open relay. - After install, confirm Postfix listens only on loopback (inet_interfaces = loopback-only) unless this host is an intended mail server. - If another MTA (e.g. sendmail, exim) is already present, installing Postfix can conflict or change the default /usr/sbin/sendmail provider; reconcile MTAs before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 10.5.1, 6.3.2.4 | direct | per OS, see the benchmark table | high |
| PCI DSS | 10.5.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.