# Ensure mail transfer agent is configured for local-only mode

Necessity: A Mail Transfer Agent (MTA) configured to listen on all network interfaces (a common default) can be misused as an open mail relay for sending spam or be exploited by attackers if vulnerabilities exist. For systems not intended to be public mail servers, the MTA should be restricted to local-only mode. This ensures that only local applications and services can use it (e.g., for sending system notifications to local user accounts), significantly reducing the system's attack surface by preventing network exposure.

Auditing and Remediation: The audit script queries the active Postfix configuration to retrieve the value of the 'inet_interfaces' parameter, which controls the network interfaces on which the MTA listens for mail. The remediation script modifies this parameter using the 'postconf' utility, setting it to a specified value, and then restarts the Postfix service to ensure the new configuration is loaded and applied.

Recommended State Rationale: 
- Basic, Moderate, and Strict: All levels recommend setting 'inet_interfaces' to 'localhost'. For this specific control, there is no graduated scale of security. A system is either configured as a public-facing mail server or it is not. If the system's role does not include acting as a mail server for external clients, any configuration other than 'localhost' introduces unnecessary risk. Therefore, 'localhost' is the only recommended state across all security postures, as it effectively binds the mail service to the internal loopback interface, making it inaccessible from the network while preserving its functionality for local system processes.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['localhost']` |
| **Moderate** | `['localhost']` |
| **Strict** | `['localhost']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the Postfix configuration for the 'inet_interfaces' parameter value. The script must use the 'postconf -h inet_interfaces' command and output only the resulting value, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts one positional command-line argument to set the 'inet_interfaces' parameter in the Postfix configuration. The script must use 'postconf -e "inet_interfaces=$1"' to apply the setting and then execute 'systemctl restart postfix' to reload the service. The script must return 'true' if both commands succeed and 'false' otherwise.

