audit 5: findings of the two reviews

- The e2e's numeric-settings test ran a container that passed every gate
  and never ended: the good values are checked beside a bad one after
  them; each run is named, bounded to a minute and removed.
- The gates refuse a value under the parameter's minimum (a zero window
  kills anvil, a zero milter timeout smtpd) and one past an int, in
  seconds for a time value (src/global/conv_time.c, src/anvil/anvil.c).
- OpenDKIM waits, five seconds at most, for the relay's socket.
- The relay marks its lines `syslog: `, writes control characters out,
  reads into a queue at once and drops past 200 lines a second, saying
  how many (security F1, F2; a stuck relay would hold OpenDKIM in
  syslog(3)).
- smtp_tls_mandatory_protocols >=TLSv1.2 too.
- extract-cert.sh keeps the old files' group and sets its trap before
  mktemp.
- crashexit spares cert-reload; architecture.md "four times running" and
  what else exits the container; security.md the restart after five panel
  exits and the /dev/log socket.
- Measured against the technical review: smtpd has the selfpost group
  (Groups 104 998), so it did reach the supervisor socket before this
  stage.
Accepted, reasons in the plan: the logrotate state file in the postfix
user's directory, envdoc_test's reading of `${VAR:-}` only, crashexit's
window pruning untested.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 592 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/process_check.go

@@ -141,3 +141,18 @@ func checkOpenDKIMLogs(s *stack) error {
 		return strings.Contains(out, "opendkim[") && strings.Contains(out, "OpenDKIM Filter v"), fmt.Errorf("no OpenDKIM line in the log")
 	})
 }
+
+// checkPostfixHardening reads back what postfix-config.sh sets against
+// downgrade and enumeration (audit 2026-10-12, L31).
+func checkPostfixHardening(s *stack) error {
+	out, err := s.execIn("selfpost", "postconf", "-h", "smtpd_tls_protocols", "smtpd_tls_mandatory_protocols", "disable_vrfy_command", "smtpd_banner")
+	if err != nil {
+		return fmt.Errorf("postconf: %v\n%s", err, out)
+	}
+	got := strings.Split(strings.TrimSpace(out), "\n")
+	want := []string{">=TLSv1.2", ">=TLSv1.2", "yes", "$myhostname ESMTP"}
+	if strings.Join(got, "|") != strings.Join(want, "|") {
+		return fmt.Errorf("postconf -h of the hardened settings = %q, want %q", got, want)
+	}
+	return nil
+}