Postfix, port 25 ,iptables, firewallD and SELinux

[indeed]

Hello everyone,
i'm learning Centos 7 basic administration, I have installed Minimal and have some questions:

1-Why is the mail server (Postfix) enabled by default? (I don't remember installing it)

2- Postfix is using port 25

Code: Select all

 netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      2711/master         
tcp6       0      0 ::1:25                  :::*                    LISTEN      2711/master       

How was it made to be enabled by default when the postfix.service is running?
I mean, Iptables service is disabled in Centos7 and replaced with FirewallD, but I can't see the port 25 present in

Code: Select all

firewall-cmd --list-ports

It lists only the ports that were added manually (as far as I know).

I even tried listing iptables (i know it's disabled but just in case)

Code: Select all

iptables -L -n

and

cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

I want to know what software is actually allowing 25 port to be available as soon as Postfix service starts.

Is it in a state of "Listen" only because SELinux,

Code: Select all

└─╼ semanage port --list |grep smtp
smtp_port_t                    tcp      25, 465, 587

is allowing it and the service is running but in fact I wouldn't be able to connect until I add this port to FirewallD? (I haven't tried this service yet) o am I missing something else?


Thanks.

[TrevorH]

Postfix is a standard part of all installs as many things need to send mail - for example logwatch. It is set up to listen only on localhost so doesn't need any special iptables rules as all traffic to/from localhost is allowed by default. You don't need to open any other ports for it to do its current job, only if you need an externally accessible mail server.

[indeed]

Thanks I appreciate your fast reply, I should have read about this before posting.