# Ensure message access server services are not in use

Necessity: Message access server services, such as IMAP (Dovecot) and POP3 (Cyrus), are used for email retrieval. If the system is not intended to be a mail server, these services provide a significant and unnecessary attack surface. They are network-facing daemons that handle authentication and data access, making them prime targets for brute-force attacks, credential harvesting, and remote code execution vulnerabilities. Disabling or removing them on non-mail servers is a critical step in minimizing the system's exposure to external threats.

Auditing and Remediation: The audit script verifies if common message access server packages (`dovecot`, `cyrus-imapd`) are installed and if their corresponding services are enabled to accept connections. The remediation script provides two levels of enforcement: disabling the services to stop them from running, or purging the packages entirely to remove the software from the system.

Recommended State Rationale:
- Basic: ['Disabled'] - This state ensures the services are not running and cannot accept connections, providing an immediate mitigation of the risk. It is considered basic because the software binaries and configuration remain on the system and could potentially be re-enabled accidentally.
- Moderate: ['Not Installed'] - Uninstalling the packages is a more robust security measure. It removes the service binaries, libraries, and configuration files, ensuring the service cannot be started and reducing the overall software footprint on the system. This aligns with the security principle of least functionality.
- Strict: ['Not Installed'] - For a system not explicitly designated as a mail server, there is no state more secure than having the software completely removed. This is the strictest and most effective control, as it eliminates any possibility of the services being misconfigured or exploited.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the presence and status of Dovecot (`dovecot`) and Cyrus (`cyrus-imapd`) services. The script should first check if either package is installed. If neither is installed, it must output 'Not Installed'. If one or both are installed, it must check if the services are enabled. If any relevant service is enabled, it must output 'Enabled'. If the packages are installed but the services are disabled, it must output 'Disabled'. The output must be only one of these three strings, with no additional text.

## Remediation Script Working

Bash script that accepts a single command-line argument: 'Disabled' or 'Not Installed'. If the argument is 'Disabled', the script must disable and stop the `dovecot` and `cyrus-imapd` services if they exist. If the argument is 'Not Installed', the script must use the package manager to completely remove the `dovecot-*` and `cyrus-*` packages. The script must return `true` on successful completion or `false` if an error occurs.

