documentation_complete: true

title: 'Disable Postfix Network Listening'

description: |-
    Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the following
    <tt>inet_interfaces</tt> line appears:
    <pre>inet_interfaces = localhost</pre>

rationale: |-
    This ensures <tt>postfix</tt> accepts mail messages
    (such as cron job reports) from the local system only,
    and not from the network, which protects it from network attack.

severity: medium

identifiers:
    cce: 26780-7

references:
    disa: 382
    nist: CM-7
    srg: SRG-OS-000096
    stigid: RHEL-06-000249

ocil_clause: 'it does not'

ocil: |-
    Run the following command to ensure postfix accepts mail messages from only the local system:
    <pre>$ grep inet_interfaces /etc/postfix/main.cf</pre>
    If properly configured, the output should show only <tt>localhost</tt>.
