# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-SVC-005
title: Disable IMAP and POP3 mail access servers the system does not provide
finding:
  title: An IMAP or POP3 server can run on a system that does not provide mailboxes
  description: A mail access server accepts user passwords from the network and exposes stored mail.
status: active
profiles: [core]
risk:
  severity: medium
assessment: automated
tags: [services, mail, imap, pop3, attack-surface]

description: |
  IMAP and POP3 servers let mail clients read mailboxes stored on the system. Debian packages
  Dovecot (`dovecot.service` and `dovecot.socket`) and Cyrus (`cyrus-imapd.service`).

  The control passes when each unit is masked or not installed at all.
rationale: |
  These servers authenticate users with their passwords, so they are a target for password
  guessing, and a flaw in them exposes every mailbox on the system.
impact: |
  Masking a unit stops it and prevents it from starting again. Sending mail through the local
  mail transfer agent is not affected. Mail servers must exclude this control in their
  tailoring file.
notes: |
  A unit that does not exist counts as compliant, so removing the package is an equally valid fix.

audit:
  manual: |
    For each unit, run `systemctl is-enabled <unit>`. It must print `masked`, or fail because the
    unit does not exist: `dovecot.service`, `dovecot.socket`, `cyrus-imapd.service`.
  logic: all
  checks:
    - id: dovecot
      engine: systemd-unit
      description: Dovecot IMAP and POP3 server.
      spec: { unit: dovecot.service, state: masked }
    - id: dovecot-socket
      engine: systemd-unit
      description: Dovecot socket activation.
      spec: { unit: dovecot.socket, state: masked }
    - id: cyrus-imapd
      engine: systemd-unit
      description: Cyrus IMAP and POP3 server.
      spec: { unit: cyrus-imapd.service, state: masked }

remediation:
  manual: |
    Stop and mask each unit that is installed: `systemctl mask --now <unit>`. If the package is not
    needed at all, remove it instead: `apt purge dovecot-core cyrus-imapd cyrus-common`.
  effects:
    restart: none
    disruption: low
    lockout_risk: false
  rollback: |
    Run `systemctl unmask <unit>` then `systemctl enable --now <unit>`.
  scripts:
    - id: dovecot-socket
      from_check: dovecot-socket
    - id: dovecot
      from_check: dovecot
    - id: cyrus-imapd
      from_check: cyrus-imapd

references:
  - title: dovecot(1), Debian manual pages
    url: https://manpages.debian.org/trixie/dovecot-core/dovecot.1.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: systemctl(1), Debian manual pages
    url: https://manpages.debian.org/trixie/systemd/systemctl.1.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-18
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R62
    relation: partial
    note: R62 asks to disable every unneeded service; this control covers mail access servers.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-7
    relation: partial
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "2.1.11"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "2.1.8"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1210
  - framework: mitre-attack
    id: T1110

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: "Fresh image passes; with dovecot-imapd installed the checks fail, fix masks service and socket, audit passes after reboot; dovecot-core still purges cleanly."
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: "Fresh image passes; with dovecot-imapd installed the checks fail, fix masks service and socket, audit passes after reboot; dovecot-core still purges cleanly."
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18