Alliance-Boreale/Set-OPS-Public
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Zéro-confiance : flux Courriel chiffré (LMTP verify + client_smtp STARTTLS)

Browse source 
Deux sauts est-ouest en clair, corrigés :
- LMTP edge-mta -> infra-mail:24 : lmtp_tls_security_level=verify +
  lmtp_tls_CAfile=root_ca (le CONTENU des courriels). Dovecot LMTP offrait
  déjà STARTTLS (cert step-ca, SAN infra-mail-01) : aucun changement Dovecot.
- client_smtp -> edge-mta:25 : msmtp tls_starttls on + tls_trust_file root_ca.

Prouvé : livraison LMTP status=sent (verify ⇒ TLS obligatoire), msmtp tls=on
smtpstatus=250. Déjà chiffrés : submission :587, Postfix->LDAP ldaps, IMAP :993.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Daniel Allaire 2026-07-04 21:47:29 -04:00
parent 660aee91fa
commit 20329895f7
4 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
roles/client_smtp/defaults/main.yml
View file

@ -10,3 +10,6 @@ client_smtp_from: "{{ ansible_hostname }}@{{ domaine_interne }}"
# TLS : off sur le reseau interne pour l'instant ; on avec certificats step_ca.
client_smtp_tls: false
# Zero-confiance : verifier le cert du relais (STARTTLS) contre le root_ca step-ca.
client_smtp_tls_trust_file: "/etc/step/certs/root_ca.crt"

4
roles/client_smtp/templates/msmtprc.j2
View file

@ -1,6 +1,10 @@
# Gere par Set-OPS (role client_smtp). Ne pas editer a la main.
defaults
tls {{ 'on' if client_smtp_tls | bool else 'off' }}
{% if client_smtp_tls | bool %}
tls_starttls on
tls_trust_file {{ client_smtp_tls_trust_file }}
{% endif %}
syslog on
account default

4
roles/serveur_postfix/defaults/main.yml
View file

@ -38,3 +38,7 @@ serveur_postfix_tls_actif: true
serveur_postfix_tls_source_cert: "/etc/step/certs/{{ ansible_fqdn | default(ansible_hostname) }}.crt"
serveur_postfix_tls_source_cle: "/etc/step/certs/{{ ansible_fqdn | default(ansible_hostname) }}.key"
serveur_postfix_tls_dir: "/etc/postfix/tls"
# Zero-confiance : verifier le TLS de la livraison LMTP vers Dovecot (cert step-ca).
serveur_postfix_lmtp_tls_verify: false
serveur_postfix_lmtp_tls_cafile: "/etc/step/certs/root_ca.crt"

5
roles/serveur_postfix/templates/main.cf.j2
View file

@ -29,6 +29,11 @@ smtpd_tls_key_file = {{ serveur_postfix_tls_dir }}/key.pem
smtpd_tls_security_level = may
smtpd_tls_protocols = >=TLSv1.2, !SSLv2, !SSLv3
smtp_tls_security_level = may
{% if serveur_postfix_lmtp_tls_verify | default(false) %}
# Zero-confiance : livraison LMTP vers Dovecot chiffree ET verifiee (cert step-ca).
lmtp_tls_security_level = verify
lmtp_tls_CAfile = {{ serveur_postfix_lmtp_tls_cafile }}
{% endif %}
{% endif %}
{% if serveur_postfix_rspamd_milter %}