Mail Submission Ports That Refuse Plaintext

postfix-tls

An EL host has no mail submission service, so every client sends on port 25 - where plaintext is accepted by design. The package's own configuration does enable opportunistic TLS there, with a certificate it creates at install time, so a client that asks for STARTTLS gets TLS 1.3 and one that does not asks for nothing and is served anyway. This role adds the two ports where encryption is not optional: 587, which refuses mail until the session is encrypted, and 465, which is TLS from the first byte.

No download, and no version to pin. postfix is an EL 10 package. What the role owns is a handful of main.cf parameters - written with postconf, Postfix's own editor, so the file keeps its documentation - two master.cf services, and the proof that each port accepts and refuses what it should.

Port 25 is left accepting plaintext on purpose, and the live test asserts it. A mail exchanger that demanded STARTTLS would refuse mail from every sender that does not offer it, silently, and that is a worse outcome than an unencrypted hop. Mandatory encryption belongs on the submission ports, where the clients are yours.

This role does not enable TLS, because the package already did. Rocky's main.cf ships smtpd_tls_security_level = may and names /etc/pki/tls/certs/postfix.pem, and that certificate is really there after installation - measured on a fresh host, where STARTTLS on port 25 negotiated TLS 1.3 before this role ran at all. What is missing on a stock host is a port where TLS is required, and that is what this adds.

The TLS 1.0 refusal on EL 10 is the crypto policy's work, not Postfix's. smtpd_tls_mandatory_protocols is >=TLSv1 out of the box, while the DEFAULT system crypto policy sets TLS.MinProtocol = TLSv1.2 - so an openssl s_client -tls1 fails before it reaches Postfix, with "no protocols available" from the CLIENT. The role sets >=TLSv1.2 in Postfix as well, so the floor is stated where a reader looks for it, but the README says plainly which component is doing the refusing. A catalogue entry claiming otherwise would be taking credit for the platform, which is a mistake this catalogue has made once already and written down.

postfix check catches syntax, not spelling. A malformed line gives rc 1, names the line number - "missing '=' after attribute name" - and postfix then fails to start. A well-formed parameter it has never heard of gets a warning and rc 0. So the role runs the check every time AND the live test holds real SMTP conversations afterwards, because a configuration can pass the check and still serve the wrong thing.

postconf -e says nothing about whether it changed anything. Every parameter is read with postconf -h first and written only when it differs, which is what keeps the role idempotent; the same applies to master.cf, where postconf -M prints nothing at all for a service that is not defined.

inet_interfaces is not touched. The package ships localhost, so the two new ports listen on loopback until somebody widens it deliberately. A role that opened a mail port to the network as a side effect of hardening TLS would be doing something nobody asked for.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.