<Group id="imap">
<title>IMAP and POP3 Server</title>
<description>Dovecot provides IMAP and POP3 services. It is not
installed by default. The project page at http://www.dovecot.org
contains more detailed information about Dovecot
configuration.</description>

<Group id="disabling_dovecot">
<title>Disable Dovecot</title>
<description>If the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed.
</description>


<Rule id="disable_dovecot">
<title>Disable Dovecot Service</title>
<description>
<service-disable-macro service="dovecot" />
</description>
<ocil>
<service-disable-check-macro service="dovecot" />
</ocil>
<rationale>
Running an IMAP or POP3 server provides a network-based
avenue of attack, and should be disabled if not needed.
</rationale>
<ident cce="26922-5" />
<oval id="service_dovecot_disabled" />
</Rule>

<Rule id="package_dovecot_removed">
<title>Uninstall dovecot Package</title>
<description>The <tt>dovecot</tt> package can be uninstalled
with the following command:
<pre>$ sudo yum erase dovecot</pre>
</description>
<ocil>
<package-check-macro package="dovecot" />
</ocil>
<rationale>
If there is no need to make the Dovecot software available,
removing it provides a safeguard against its activation.
</rationale>
<ident cce="27039-7" />
<oval id="package_dovecot_removed" />
</Rule>

</Group> <!-- <Group id="disabling_dovecot"> -->

<Group id="configure_dovecot">
<title>Configure Dovecot if Necessary</title>
<description>If the system will operate as an IMAP or
POP3 server, the dovecot software should be configured securely by following
the recommendations below.
</description>

<Group id="dovecot_support_necessary_protocols">
<title>Support Only the Necessary Protocols</title>
<description>Dovecot supports the IMAP and POP3 protocols, as well as 
SSL-protected versions of those protocols. Configure the Dovecot server 
to support only the protocols needed by your site. Edit <tt>/etc/dovecot/dovecot.conf</tt>. 
Add or correct the following lines, replacing <tt>PROTOCOL</tt> with 
only the subset of protocols (<tt>imap</tt>, <tt>imaps</tt>, 
<tt>pop3</tt>, <tt>pop3s</tt>) required:
<pre>protocols = PROTOCOL</pre>
If possible, require SSL protection for all transactions. The SSL 
protocol variants listen on alternate ports (995 instead of 110 for 
pop3s, and 993 instead of 143 for imaps), and require SSL-aware clients. 
An alternate approach is to listen on the standard port and require the 
client to use the STARTTLS command before authenticating.
</description>

<rationale>
Configuring Dovecot to only support the protocols the protocols needed by
your site reduces the risk of an attacker using one of the unused protocols
to base an attack.</rationale>
</Group>

<Group id="dovecot_enabling_ssl">
<title>Enable SSL Support</title>
<description>SSL should be used to encrypt network traffic between the 
Dovecot server and its clients. Users must authenticate to the Dovecot 
server in order to read their mail, and passwords should never be 
transmitted in clear text. In addition, protecting mail as it is 
downloaded is a privacy measure, and clients may use SSL certificates 
to authenticate the server, preventing another system from impersonating 
the server.
</description>

<Rule id="dovecot_enable_ssl">
<title>Enable the SSL flag in <tt>/etc/dovecot.conf</tt></title>
<description>To allow clients to make encrypted connections the <tt>ssl</tt>
flag in Dovecot's configuration file needs to be set to <tt>yes</tt>.
<br /><br />
Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the following line:
<pre>ssl = yes</pre>
</description>
<rationale>
SSL encrypt network traffic between the Dovecot server and its clients 
protecting user credentials, mail as it is downloaded, and clients may use 
SSL certificates to authenticate the server, preventing another system from 
impersonating the server.
</rationale>
<ident cce="27571-9" />
<oval id="dovecot_enable_ssl" />
</Rule>

<Rule id="dovecot_configure_ssl_cert">
<title>Configure Dovecot to Use the SSL Certificate file</title>
<description>This option tells Dovecot where to find the the mail 
server's SSL Certificate.
<br /><br />
Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the following 
line (<i>note: the path below is the default path set by the Dovecot installation. If 
you are using a different path, ensure you reference the appropriate file</i>):
<pre>ssl_cert = &lt;/etc/pki/dovecot/certs/dovecot.pem</pre>
</description>
<rationale>
SSL certificates are used by the client to authenticate the identity
of the server, as well as to encrypt credentials and message traffic.
Not using SSL to encrypt mail server traffic could allow unauthorized
access to credentials and mail messages since they are sent in plain 
text over the network.
</rationale>
<ident cce="27459-7" />
<!-- <oval id="dovecot_configure_ssl_cert" /> -->
</Rule>

<Rule id="dovecot_configure_ssl_key">
<title>Configure Dovecot to Use the SSL Key file</title>
<description>This option tells Dovecot where to find the the mail 
server's SSL Key.
<br /><br />
Edit <tt>/etc/dovecot/conf.d/10-ssl.conf</tt> and add or correct the following 
line (<i>note: the path below is the default path set by the Dovecot installation. If 
you are using a different path, ensure you reference the appropriate file</i>):
<pre>ssl_key = &lt;/etc/pki/dovecot/private/dovecot.pem</pre>
</description>
<rationale>
SSL certificates are used by the client to authenticate the identity
of the server, as well as to encrypt credentials and message traffic.
Not using SSL to encrypt mail server traffic could allow unauthorized
access to credentials and mail messages since they are sent in plain 
text over the network.
</rationale>
<ident cce="27633-7" />
<!-- <oval id="dovecot_configure_ssl_key" /> -->
</Rule>

<Rule id="dovecot_disable_plaintext_auth">
<title>Disable Plaintext Authentication</title>
<description>To prevent Dovecot from attempting plaintext 
authentication of clients, edit <tt>/etc/dovecot/conf.d/10-auth.conf</tt> and add
or correct the following line:
<pre>disable_plaintext_auth = yes</pre>
</description>
<rationale>
Using plain text authentication to the mail server could allow an 
attacker access to credentials by monitoring network traffic.
</rationale>
<ident cce="27144-5" />
<oval id="dovecot_disable_plaintext_auth" />
</Rule>

</Group> <!-- <Group id="dovecot_enabling_ssl" -->

<Group id="dovecot_allow_imap_access">
<title>Allow IMAP Clients to Access the Server</title>
<description>The default iptables configuration does not allow inbound 
access to any services. This modification will allow remote hosts to 
initiate connections to the IMAP daemon, while keeping all other ports 
on the server in their default protected state. 
<iptables-desc-macro proto="tcp" port="143" />
</description>

</Group> <!-- <Group id="dovecot_allow_imap_access"> -->

</Group> <!-- <Group id="configure_dovecot"> -->

</Group> <!-- <Group id="imap"> -->

