# Ensure mail transfer agent is configured for local-only mode

Necessity: A Mail Transfer Agent (MTA) configured to listen on network-accessible interfaces exposes the system to significant security risks. It can be targeted for spam relaying, denial-of-service attacks, or exploited by vulnerabilities in the mail server software. For systems not intended to function as public mail servers, the MTA should only be accessible locally to handle system-generated messages (e.g., from cron jobs). Misconfiguration is a high risk, as it can turn the server into an open relay, potentially leading to its IP address being blacklisted. Auditing and Remediation: The audit script inspects the network sockets using `ss` to determine if the service on port 25 is bound to the loopback interface or a public one. The remediation script specifically targets the Postfix MTA, altering its `main.cf` configuration file to set the `inet_interfaces` directive to `loopback-only`, which explicitly prevents it from accepting connections from any network interface except the local machine itself. Recommended State Rationale: Basic & Moderate: `['local-only']`. This is the universally recommended secure baseline for any server not acting as a dedicated mail server. It allows essential local mail delivery to function without exposing the MTA to external threats. Strict: `['local-only', 'not-listening']`. The strict level adds 'not-listening' as an acceptable state. For highly hardened systems, containers, or appliances where local mail notifications are not required, the most secure configuration is to have no MTA running at all. This completely removes the service's attack surface from the system, representing the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['local-only']` |
| **Moderate** | `['local-only']` |
| **Strict** | `['local-only', 'not-listening']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `ss` command to check for services listening on TCP port 25. If a service is listening only on a loopback interface (127.0.0.1 or ::1), the script must output the string 'local-only'. If a service is listening on any non-loopback interface (e.g., 0.0.0.0 or a specific network IP), it must output 'network-listening'. If no service is listening on port 25, it must output 'not-listening'. The script must not return any other text.

## Remediation Script Working

Bash script that accepts one argument to configure the system's Mail Transfer Agent (MTA) for local-only mode. The script should primarily target Postfix, as it is the default MTA on modern Ubuntu. It must modify the Postfix configuration file (`/etc/postfix/main.cf`) to set the `inet_interfaces` parameter to `loopback-only`. After modifying the configuration, the script must restart the Postfix service to apply the change. The script must output `true` upon successful completion and `false` if it fails to find the configuration file or restart the service.

