Description
IMAP and POP3 servers let mail clients read mailboxes stored on the system. Debian packages
Dovecot (dovecot.service and dovecot.socket) and Cyrus (cyrus-imapd.service).
The control passes when each unit is masked or not installed at all.
A unit that does not exist counts as compliant, so removing the package is an equally valid fix.
Rationale
These servers authenticate users with their passwords, so they are a target for password guessing, and a flaw in them exposes every mailbox on the system.
Impact
Masking a unit stops it and prevents it from starting again. Sending mail through the local mail transfer agent is not affected. Mail servers must exclude this control in their tailoring file.
Audit
For each unit, run systemctl is-enabled <unit>. It must print masked, or fail because the
unit does not exist: dovecot.service, dovecot.socket, cyrus-imapd.service.
Automated: every check must pass. Scanners report each check by its id.
dovecot
Dovecot IMAP and POP3 server.
unit: dovecot.service
state: masked
dovecot-socket
Dovecot socket activation.
unit: dovecot.socket
state: masked
cyrus-imapd
Cyrus IMAP and POP3 server.
unit: cyrus-imapd.service
state: masked
Remediation
Stop and mask each unit that is installed: systemctl mask --now <unit>. If the package is not
needed at all, remove it instead: apt purge dovecot-core cyrus-imapd cyrus-common.
| Restart | none |
| Disruption | low |
Rollback
Run systemctl unmask <unit> then systemctl enable --now <unit>.
dovecot-socket
Generated from check dovecot-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.
dovecot
Generated from check dovecot: the engine writes the fix for every output, it sets the expected value and the check runs again after.
cyrus-imapd
Generated from check cyrus-imapd: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- dovecot(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R62 | partial | R62 asks to disable every unneeded service; this control covers mail access servers. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1210 |
| MITRE ATT&CK | T1110 |
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Fresh image passes; with dovecot-imapd installed the checks fail, fix masks service and socket, audit passes after reboot; dovecot-core still purges cleanly. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Fresh image passes; with dovecot-imapd installed the checks fail, fix masks service and socket, audit passes after reboot; dovecot-core still purges cleanly. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
