The s-nail Package Is Installed
Ensures the s-nail package is installed so the system can send mail/mailx notifications for security and operational events.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
s-nail provides the mail/mailx command-line MUA used by system tooling to send notifications. Emails are used to notify designated personnel about important system events such as cron job output, AIDE integrity reports, audit-disk-full warnings, and service failures. Without a mail client installed, these automated alerts are silently dropped and operators lose visibility into the health and security posture of the host.
What Pavois checks
Pavois reads the effective install state from the RPM database via CINC/InSpec's package resource and asserts s-nail is present. This is more reliable than checking for a /usr/bin/mail symlink, because the package state is what dnf/the audit subsystem depend on to provide a working mail transport for notifications.
describe package('s-nail') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q s-nail; a compliant host returns a version string such as s-nail-14.9.24-... (not package s-nail is not installed). Confirm the command exists with command -v mail.
Inspect & investigate
- Installation is logged in
/var/log/dnf.logand visible viarpm -q --last s-nail. - Outgoing mail attempts and delivery are recorded by the MTA in
/var/log/maillog.
Remediation
The harden plan declares a package resource for s-nail with action install; pavois harden apply installs it via dnf. Note that s-nail only provides the client, actual delivery still requires a configured MTA (e.g. Postfix) listening locally.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | s-nail |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing s-nail is low-risk and adds no listening service. The precaution is completeness, not breakage: a mail client without a working local MTA still cannot deliver notifications, so pair this with a configured Postfix/sendmail. There is no lockout risk and no reboot required.