1.7. Disabling the IMAP or POP3 service in Dovecot
By default, Dovecot provides IMAP and POP3 services. If you require only one of them, you can disable the other to reduce the surface for attack.
Prerequisites
- Dovecot is installed.
Procedure
Uncomment the
protocolsparameter in the/etc/dovecot/dovecot.conffile, and set it to use the required protocols. For example, if you do not require POP3, set:protocols = imap lmtpBy default, the
imap,pop3, andlmtpprotocols are enabled.Reload Dovecot:
# systemctl reload dovecotClose the ports that are no longer required in the local firewall. For example, to close the ports for the POP3S and POP3 protocols, enter:
# firewall-cmd --remove-service=pop3s --remove-service=pop3 # firewall-cmd --reload
Verification
Display all ports in
LISTENmode opened by thedovecotprocess:# ss -tulp | grep dovecot tcp LISTEN 0 100 0.0.0.0:993 0.0.0.0:* users:(("dovecot",pid=1405,fd=44)) tcp LISTEN 0 100 0.0.0.0:143 0.0.0.0:* users:(("dovecot",pid=1405,fd=42)) tcp LISTEN 0 100 [::]:993 [::]:* users:(("dovecot",pid=1405,fd=45)) tcp LISTEN 0 100 [::]:143 [::]:* users:(("dovecot",pid=1405,fd=43))In this example, Dovecot listens only on the TCP ports
993(IMAPS) and143(IMAP).Note that Dovecot only opens a port for the LMTP protocol if you configure the service to listen on a port instead of using a socket.