3.16 Configure Mail Transfer Agent for Local-Only Mode - O DaemonPortOptions=Port=smtp, Addr=127.0.0.1, Name=MTA

Information

Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail. By default, the MTA is set to loopback mode on RHEL5 and RHEL6.

Rationale:

The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems.

Note: RHEL5 uses sendmail as the default MTA while RHEL6 uses Postfix. The recommendation to set the default MTA to local-only mode applies regardless of the MTA that is used.

Solution

Edit /etc/mail/sendmail.cf and add or edit the following line to the Options section.

O DaemonPortOptions=Port=smtp, Addr=127.0.0.1, Name=MTA

Run the following command to restart sendmail:

# service sendmail restart




Default Value:

OS Default: Yes

See Also

https://workbench.cisecurity.org/files/3096

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CSCv6|3.1, CSCv7|9

Plugin: Unix

Control ID: 15707957f075ff024b9b3b7a6da58deb022ee8c2191a3802352135829b96f929