Uninstall the Sendmail Package
Ensures the sendmail MTA package is not installed (use Postfix instead if an MTA is needed).
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The sendmail MTA was not designed with security in mind and its monolithic architecture makes it hard to confine effectively with SELinux, increasing the impact of any compromise of the mail service. Where a mail transfer agent is needed, Postfix (better isolated and SELinux-confinable) should be used instead. Removing sendmail reduces the attack surface and avoids running an exposed, hard-to-contain network service.
What Pavois checks
Pavois queries the package database with describe package('sendmail') and asserts it should_not be_installed, reading the real installed state rather than checking for /etc/mail files that could linger without the daemon.
describe package('sendmail') do
it { should_not be_installed }
endHow to verify it is applied
Debian/Ubuntu: dpkg -s sendmail → package 'sendmail' is not installed. RPM: rpm -q sendmail → package sendmail is not installed. Confirm nothing listens on SMTP with ss -ltnp | grep :25 (or that it is Postfix, not sendmail).
Inspect & investigate
Removal is logged in /var/log/dpkg.log (Debian/Ubuntu) or dnf history / /var/log/dnf.rpm.log (RPM). Mail activity, if sendmail ran, appears in /var/log/maillog (RPM) or /var/log/mail.log (Debian/Ubuntu). Confirm state with dpkg -l sendmail / rpm -q sendmail.
Remediation
Pavois's harden plan removes the sendmail package (resource package, action remove). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | sendmail |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing sendmail stops local and outbound mail delivery handled by it. Before applying, check whether system tools, cron jobs or monitoring rely on a local MTA to send mail; if so, install and configure Postfix first so the sendmail compatibility command still works. Without an MTA, scheduled-job and alert emails will be silently dropped.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.