CIS Postfix Benchmark

This recommendation verifies that Postfix is up to date on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Postfix version:
postconf mail_version
postconf -d | grep mail_version
dpkg -l postfix 2>/dev/null || rpm -qa postfix

# Update Postfix:
sudo apt-get update && sudo apt-get install -y postfix
# or
sudo yum update -y postfix
sudo systemctl restart postfix

This recommendation verifies that default configuration restricts relay scope on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Postfix configuration:
postconf -n
postconf inet_interfaces mydestination mynetworks

# Configure Postfix main.cf essentials:
postconf -e 'inet_interfaces = loopback-only'
postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost'
postconf -e 'mynetworks = 127.0.0.0/8 [::1]/128'
postconf -e 'relayhost = [smtp-relay.example.com]:587'
sudo systemctl reload postfix

This recommendation verifies that configuration file permissions are correct on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check file permissions:
ls -la /etc/postfix/main.cf /etc/postfix/master.cf
find /etc/postfix -type f -exec stat -c '%a %U:%G %n' {} \;

# Set correct permissions:
chown root:root /etc/postfix/main.cf /etc/postfix/master.cf
chmod 644 /etc/postfix/main.cf
chmod 644 /etc/postfix/master.cf
chmod 755 /etc/postfix

This recommendation verifies that SASL authentication is enabled with secure options on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SASL authentication:
postconf smtpd_sasl_auth_enable smtpd_sasl_type smtpd_sasl_security_options
grep -i sasl /etc/postfix/main.cf

# Enable SASL authentication:
postconf -e 'smtpd_sasl_auth_enable = yes'
postconf -e 'smtpd_sasl_type = dovecot'
postconf -e 'smtpd_sasl_path = private/auth'
postconf -e 'smtpd_sasl_security_options = noanonymous, noplaintext'
postconf -e 'smtpd_sasl_tls_security_options = noanonymous'
sudo systemctl reload postfix

This recommendation ensures that relay restrictions require authentication on the Postfix mail transfer agent. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Postfix mail transfer agent may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check relay restrictions:
postconf smtpd_relay_restrictions smtpd_recipient_restrictions

# Configure relay restrictions:
postconf -e 'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'
postconf -e 'smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_recipient'
sudo systemctl reload postfix

This recommendation verifies that TLS is enabled for inbound connections on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS settings:
postconf smtpd_tls_cert_file smtpd_tls_key_file smtpd_tls_security_level
postconf smtp_tls_security_level smtp_tls_loglevel

# Enable mandatory TLS:
postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/mail.pem'
postconf -e 'smtpd_tls_key_file = /etc/ssl/private/mail.key'
postconf -e 'smtpd_tls_security_level = may'
postconf -e 'smtpd_tls_auth_only = yes'
postconf -e 'smtpd_tls_loglevel = 1'
postconf -e 'smtpd_tls_received_header = yes'
sudo systemctl reload postfix

This recommendation verifies that TLS is enabled for outbound connections on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check outgoing TLS:
postconf smtp_tls_security_level smtp_tls_mandatory_protocols smtp_tls_mandatory_ciphers

# Configure outgoing TLS:
postconf -e 'smtp_tls_security_level = may'
postconf -e 'smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1'
postconf -e 'smtp_tls_mandatory_ciphers = high'
postconf -e 'smtp_tls_loglevel = 1'
postconf -e 'smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache'
sudo systemctl reload postfix

This recommendation verifies that only TLS 1.2 or higher is accepted on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS protocol versions:
postconf smtpd_tls_mandatory_protocols smtpd_tls_protocols
postconf tls_preempt_cipherlist

# Restrict to TLS 1.2+:
postconf -e 'smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1'
postconf -e 'smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1'
postconf -e 'tls_preempt_cipherlist = yes'
postconf -e 'smtpd_tls_mandatory_ciphers = high'
sudo systemctl reload postfix

This recommendation verifies that HELO restrictions are configured on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check HELO restrictions:
postconf smtpd_helo_required smtpd_helo_restrictions

# Enable HELO restrictions:
postconf -e 'smtpd_helo_required = yes'
postconf -e 'smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname'
sudo systemctl reload postfix

This recommendation verifies that sender restrictions reject invalid domains on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check sender restrictions:
postconf smtpd_sender_restrictions

# Configure sender restrictions:
postconf -e 'smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain'
sudo systemctl reload postfix

This recommendation verifies that rate limiting is enabled on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check rate limiting:
postconf smtpd_client_message_rate_limit smtpd_client_recipient_rate_limit anvil_rate_time_unit

# Enable rate limiting:
postconf -e 'smtpd_client_message_rate_limit = 100'
postconf -e 'smtpd_client_recipient_rate_limit = 50'
postconf -e 'smtpd_client_connection_rate_limit = 20'
postconf -e 'anvil_rate_time_unit = 60s'
sudo systemctl reload postfix

This recommendation verifies that SPF policy checking is enabled on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SPF:
dig TXT $(postconf -h mydomain) | grep spf
postconf smtpd_recipient_restrictions | grep policy-spf

# Enable SPF checking:
sudo apt-get install -y postfix-policyd-spf-python

# Add to master.cf:
# policy-spf  unix  -  n  n  -  0  spawn
#   user=policyd-spf argv=/usr/bin/policyd-spf

# Add to main.cf:
postconf -e 'smtpd_recipient_restrictions = ... check_policy_service unix:private/policy-spf'
postconf -e 'policy-spf_time_limit = 3600s'

This recommendation verifies that DKIM signing is configured on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DKIM:
apt list --installed 2>/dev/null | grep opendkim
rpm -qa | grep opendkim
systemctl status opendkim

# Install and configure OpenDKIM:
sudo apt-get install -y opendkim opendkim-tools

# /etc/opendkim.conf:
# Mode sv
# KeyFile /etc/dkimkeys/default.private
# Selector default
# Domain example.com
# Socket inet:12301@localhost

# Add to main.cf:
postconf -e 'milter_default_action = accept'
postconf -e 'milter_protocol = 2'
postconf -e 'smtpd_milters = inet:localhost:12301'
postconf -e 'non_smtpd_milters = inet:localhost:12301'

This recommendation verifies that mail logging is configured on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check mail logging:
postconf syslog_facility syslog_name
tail -20 /var/log/mail.log 2>/dev/null || tail -20 /var/log/maillog

# Configure logging:
postconf -e 'syslog_facility = mail'
postconf -e 'syslog_name = postfix'

# Ensure rsyslog routes mail facility:
# /etc/rsyslog.d/50-default.conf:
# mail.*    /var/log/mail.log
# mail.err  /var/log/mail.err
sudo systemctl restart rsyslog

This recommendation verifies that mail queue is monitored on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check mail queue monitoring:
mailq
postqueue -p
qshape deferred | head -20

# Monitor mail queue:
# Cron job to alert on large queue:
# */5 * * * * [ $(mailq | tail -1 | awk '{print $5}') -gt 100 ] && echo 'Mail queue > 100' | mail admin@example.com

# Check deferred queue:
postqueue -p | tail -1
qshape deferred

This recommendation verifies that Postfix services run in chroot on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check chroot status in master.cf:
awk '/^[a-z]/ {print $1, $5}' /etc/postfix/master.cf

# Enable chroot for services in /etc/postfix/master.cf:
# Ensure column 5 (chroot) is 'y' for smtp, smtpd, cleanup, etc.:
# smtp      inet  n       -       y       -       -       smtpd
# pickup    unix  n       -       y       60      1       pickup
# cleanup   unix  n       -       y       -       0       cleanup

sudo systemctl restart postfix

This recommendation verifies that Postfix runs as dedicated unprivileged user on the Postfix mail transfer agent. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Postfix mail transfer agent vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Postfix process ownership:
ps aux | grep postfix
postconf mail_owner setgid_group

# Ensure Postfix runs as dedicated user:
postconf -e 'mail_owner = postfix'
postconf -e 'setgid_group = postdrop'

# Verify user exists:
id postfix
id postdrop