Detections
Analytics

2.2.3 Ensure message access server services are not in use

Information

The dovecot and cyrus-imapd services are open source IMAP and POP3 server packages.

Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the package be removed to reduce the potential attack surface.

Note: Several IMAP/POP3 servers exist and can use other service names. These should also be audited and the packages removed if not required.

Solution

Run the following commands to stop dovecot and cyrus_imapd, and remove dovecot and cyrus-imapd packages:

# service dovecot onestop
# service cyrus_imapd onestop
# pkg remove -g 'dovecot*' 'cyrus-imap*'

-OR-

-IF- a package is installed and is required for dependencies:

Run the following commands to stop and disable dovecot and cyrus_imapd :

# service dovecot onestop
# service cyrus_imapd onestop
# service dovecot onedisable
# service cyrus_imapd onedisable

Impact:

There may be packages that are dependent on dovecot and cyrus-imapd packages. If dovecot and cyrus-imapd packages are removed, these dependent packages will be removed as well. Before removing dovecot and cyrus-imapd packages, review any dependent packages to determine if they are required on the system.

-IF- a dependent package is required: stop and disable dovecot and cyrus_imapd leaving dovecot and cyrus-imapd packages installed.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 2fb7064cdf4771037251476f2f89e3a904bdb70b5e458dd0b54792b6f2a63eb5