{
  "id": "CB-UBU-SVC-010",
  "standard": "ubuntu",
  "version": "0.1.1",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-SVC-010",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-SVC-010.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-SVC-010.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-SVC-010",
    "title": "Restrict the mail transfer agent to local delivery",
    "finding": {
      "title": "The mail transfer agent accepts connections from the network",
      "description": "An MTA listening on external interfaces can be abused as a relay or attacked remotely."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "services",
      "mail",
      "mta",
      "attack-surface"
    ],
    "applicability": {
      "facts": [
        "mta"
      ]
    },
    "description": "Most systems only need a mail transfer agent (MTA) to send local notifications (cron output,\nsecurity alerts) to an administrator. Such an MTA must listen on the loopback interface only,\non the SMTP ports 25, 465 and 587.\n\nOn Ubuntu the MTA is usually Postfix (`inet_interfaces` in `/etc/postfix/main.cf`) or exim4\n(`dc_local_interfaces` in `/etc/exim4/update-exim4.conf.conf`).\nSendmail, harder to configure safely, must not be installed.\n",
    "rationale": "An MTA reachable from the network can be turned into an open relay for spam or phishing, and\nexposes a complex parser to remote attackers. Local notifications work just as well through\nthe loopback interface.\n",
    "impact": "The system no longer receives mail from other hosts. Mail servers and relays must exclude this\ncontrol in their tailoring file. Removing `sendmail-bin` also removes packages that depend on\nit; install exim4 or Postfix first if the system must still send mail.\n",
    "notes": "The control applies only when an MTA is installed (`/usr/sbin/sendmail` exists): Ubuntu installs\nnone by default. Postfix installed with the \"Internet Site\" answer listens on every interface;\nthe exim4 default configuration listens on loopback only. The fix restarts exim4 or Postfix\nitself, and only when it changed their configuration.\n",
    "audit": {
      "manual": "1. Run `ss -Hltn`. No socket on port 25, 465 or 587 may be bound to an address other than\n   `127.0.0.0/8` or `::1`.\n2. Run `dpkg-query -W -f='${Status}\\n' sendmail-bin`. It must not print `install ok installed`.\n",
      "logic": "all",
      "checks": [
        {
          "id": "loopback-only",
          "engine": "shell",
          "description": "SMTP ports are bound to loopback addresses only.",
          "spec": {
            "script": "command -v ss >/dev/null 2>&1 || { echo \"ss not found\"; exit 3; }\no=$(ss -Hltn 2>/dev/null | awk '{ print $4 }' | grep -E ':(25|465|587)$' |\n  grep -Ev '^(127\\.[0-9.]+(%[a-z0-9]+)?|\\[::1\\]|\\[::ffff:127\\.[0-9.]+\\]):')\nif [ -n \"$o\" ]; then\n  echo \"SMTP listening on:\" $o\n  exit 1\nfi\necho \"no SMTP port bound outside loopback\"\n"
          }
        },
        {
          "id": "sendmail",
          "engine": "package",
          "description": "Sendmail MTA package.",
          "spec": {
            "name": "sendmail-bin",
            "state": "absent"
          }
        }
      ]
    },
    "remediation": {
      "manual": "- exim4: set `dc_local_interfaces='127.0.0.1 ; ::1'` in `/etc/exim4/update-exim4.conf.conf`,\n  then run `update-exim4.conf` and `systemctl restart exim4`.\n- Postfix: run `postconf -e 'inet_interfaces = loopback-only'` then `systemctl restart postfix`.\n- Sendmail: install exim4 or Postfix, then `apt purge sendmail-bin`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Restore the configuration file from the backup directory, then run `update-exim4.conf` and\nrestart the MTA.\n",
      "scripts": [
        {
          "id": "loopback-only",
          "engine": "shell",
          "file": "fix.sh"
        },
        {
          "id": "sendmail",
          "from_check": "sendmail"
        }
      ]
    },
    "references": [
      {
        "title": "update-exim4.conf(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/update-exim4.conf.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "postconf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/postconf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu Server documentation - How to install and configure Postfix",
        "url": "https://documentation.ubuntu.com/server/how-to/mail-services/install-postfix/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62, R74)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R74",
        "relation": "equivalent"
      },
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R62",
        "relation": "partial",
        "note": "Covers the removal of Sendmail only."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "partial"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1210"
      },
      {
        "framework": "mitre-attack",
        "id": "T1090"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Not applicable on the stock image (no MTA); Postfix installed as Internet Site listens on 0.0.0.0:25 and fails, fix sets inet_interfaces = loopback-only and restarts it, audit passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Not applicable on the stock image (no MTA); Postfix installed as Internet Site listens on 0.0.0.0:25 and fails, fix sets inet_interfaces = loopback-only and restarts it, audit passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Not applicable on the stock image (no MTA); Postfix installed as Internet Site listens on 0.0.0.0:25 and fails, fix sets inet_interfaces = loopback-only and restarts it, audit passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Not applicable on the stock image (no MTA); Postfix installed as Internet Site listens on 0.0.0.0:25 and fails, fix sets inet_interfaces = loopback-only and restarts it, audit passes after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}