TetraWiki - User contributions [en]

DR Triburg

2014-05-03T12:29:39Z

Faisal: Created page with "category:Triburg category:Zimbra Secondary MX of Triburg - dr.triburg.co.in Zimbra Version - Release 7.2.5_GA_2906.RHEL6_64_20130911101145 CentOS6_64 FOSS edition ..."

[[category:Triburg]]
[[category:Zimbra]]

Secondary MX of Triburg - dr.triburg.co.in

Zimbra Version - Release 7.2.5_GA_2906.RHEL6_64_20130911101145 CentOS6_64 FOSS edition

Processs:- Installed Zimbra on the server.

domain: triburg.co.in

Migrated All the users from their mail.triburg.co.in to dr.triburg.co.in

Migrated the Distribution List to mail.triburg.co.in to dr.triburg.co.in

Changes made on mail.triburg.co.in

An additional port 2525 has been added for receiving of the mails.

vim /opt/zimbra/postfix/conf/master.cf.in

2525 inet n - n - - smtpd

Ref: https://wiki.zimbra.com/wiki/Adding_additional_SMTP_listener_ports

zmmtactl stop
zmmtactl start

Changes made on dr.triburg.co.in

zmprov ma username@triburg.co.in zimbraMailTransport smtp:124.30.5.188:2525

All the mails coming to dr.triburg.co.in will be redirected to mail.triburg.co.in on port 2525

To verify check the logs on both server properly.

HOW TO PERMITE USER AS SENDER IN MAILING GROUP IN ZIMBRA ORIENTBELL

2014-04-08T07:41:25Z

Faisal:

[[category:Orient Bell]]

==Objective ==

Orient bell has many distribution list on Zimbra , which are sender restricted ( at postfix level) . There are request when client want to add / deleteb senders . So he mentions the addition of sender in a specific distribution list . In the example shown , the Requirement to add sender rights to user (kumar.ashutosh@orientbell.com) to Distribution list (all.staff@orientbell.com)

== Procedure==

become zimbra user
su - zimbra

Change to the conf directory

cd /opt/zimbra/postfix/conf

Open permitted_senders_allstaff in vi

enter the user kumar.ashutosh@orientbell.com as below

kumar.ashutosh@orientbell.com OK

save it

and then

/opt/zimbra/postfix/sbin/postmap /opt/zimbra/postfix/conf/permitted_senders_allstaff

and then

postfix reload

'''Please Note: This is only for permitting the user in the group all.staff@orientbell.com. Also If you are doing it for the first time, please do consult seniors before doing it'''

Bacula CapitalBank

2014-03-05T14:58:28Z

Faisal:

[[category:Capital Bank]]
'''Installation of Bacula for Capital Bank'''

tar -xvzf bacula-5.2.13.tar.gz
cd bacula-5.2.13

CFLAGS="-g -Wall" ./configure \
--sbindir=/opt/bacula/bin \
--sysconfdir=/opt/bacula/etc \
--enable-smartalloc \
--with-mysql \
--with-openssl \
--with-working-dir=/opt/bacula/working \
--with-pid-dir=/opt/bacula/working \
--with-subsys-dir=/opt/bacula/working \
--enable-batch-insert \
--enable-tray-monitor \
--enable-bat \
--enable-readline

OUTPUT = Host: x86_64-unknown-linux-gnu -- redhat Enterprise release
Bacula version: Bacula 5.2.13 (19 February 2013)
Source code location: .
Install binaries: /opt/bacula/bin
Install libraries: /usr/lib64
Install config files: /opt/bacula/etc
Scripts directory: /opt/bacula/etc
Archive directory: /tmp
Working directory: /opt/bacula/working
PID directory: /opt/bacula/working
Subsys directory: /opt/bacula/working
Man directory: ${datarootdir}/man
Data directory: /usr/share
Plugin directory: /usr/lib64
C Compiler: gcc 4.4.7
C++ Compiler: /usr/bin/g++ 4.4.7
Compiler flags: -g -Wall -fno-strict-aliasing -fno-exceptions -fno-rtti
Linker flags:
Libraries: -lpthread -ldl -ldl
Statically Linked Tools: no
Statically Linked FD: no
Statically Linked SD: no
Statically Linked DIR: no
Statically Linked CONS: no
Database backends: MySQL
Database port:
Database name: bacula
Database user: bacula
Job Output Email: root@localhost
Traceback Email: root@localhost
SMTP Host Address: localhost
Director Port: 9101
File daemon Port: 9102
Storage daemon Port: 9103
Director User:
Director Group:
Storage Daemon User:
Storage DaemonGroup:
File Daemon User:
File Daemon Group:
Large file support: yes
Bacula conio support: no
readline support: no
TCP Wrappers support: no
TLS support: yes
Encryption support: yes
ZLIB support: yes
LZO support: no
enable-smartalloc: yes
enable-lockmgr: no
bat support: yes
enable-gnome: no
enable-bwx-console: no
enable-tray-monitor: yes
client-only: no
build-dird: yes
build-stored: yes
Plugin support: yes
AFS support: no
ACL support: no
XATTR support: yes
Python support: no
systemd support: no
Batch insert enabled: MySQL

make
make install

yum install mysql mysql-server mysql-devel
mysqladmin -u root password capitalbank

/opt/bacula/etc/create_mysql_database -u root -p
/opt/bacula/etc/make_mysql_tables -uroot -p
/opt/bacula/etc/grant_mysql_privileges -uroot -p
/opt/bacula/etc/grant_bacula_privileges -uroot -p

mysql -uroot -p

mysql> UPDATE mysql.user SET password=PASSWORD("capitalbank321") WHERE user='bacula';

cd /opt/bacula/etc/

Change the password in each of the conf file and set accordingly.

vim bconsole.conf

Director {
Name = backup.capitalbank.com-dir
DIRport = 9101
address = backup
Password = "root123"
}

vim bacula-sd.conf ----> change password where required.

#add new entry for Tape Drive
Device {
Name = LTO-4
Media Type = LTO-4
Archive Device = /dev/nst0
AutomaticMount = yes; # when device opened, read it
AlwaysOpen = yes;
RemovableMedia = yes;
Requires Mount = no;
RandomAccess = no;
Maximum File Size = 100GB
LabelMedia = yes;
}

vim bacula-dir.conf ---> change the password where required

Job {
Name = Backup_Oracle
Type = Backup
Level = Incremental
Client = backup.capitalbank.com-fd
FileSet = "Full Set"
Schedule = DailyCycle
Storage = LTO-4
Messages = Standard
Pool = File
Priority = 10
Write Bootstrap = "/opt/bacula/working/%c.bsr"
}
Job {
Name = BackupCatalog
Level = Full
Client = backup.capitalbank.com-fd
Type = Backup
FileSet = Catalog
Storage = LTO-4
Schedule = DailyCycle
Messages = Standard
Pool = File
# This creates an ASCII copy of the catalog
# Arguments to make_catalog_backup.pl are:
# make_catalog_backup.pl <catalog-name>
Run Before Job = "/opt/bacula/etc/make_catalog_backup.pl MyCatalog"
# This deletes the copy of the catalog
Run After Job = /opt/bacula/etc/delete_catalog_backup
Write Bootstrap = "/opt/bacula/working/%n.bsr"
Priority = 11
}
Job {
Name = "RestoreFiles"
Type = Restore
Client=backup.capitalbank.com-fd
FileSet="Full Set"
Storage = File
Pool = File
Messages = Standard
Where = /restore
}
# List of files to be backed up
FileSet {
Name = "Full Set"
Include {
Options {
signature = MD5
}
File = /backup
}
Schedule {
Name = DailyCycle
Run = Level=Incremental Pool=File at 14:13
}
FileSet {
Name = "Catalog"
Include {
Options {
signature = MD5
}
File = "/opt/bacula/working/bacula.sql"
}
}
Client {
Name = backup.capitalbank.com-fd
Address = backup
FDPort = 9102
Catalog = MyCatalog
Password = "root123" # password for FileDaemon
File Retention = 600 days # 30 days
Job Retention = 24 months # six months
AutoPrune = yes # Prune expired Jobs/Files
}
Storage {
Name = File
Address = backup # N.B. Use a fully qualified name here
SDPort = 9103
Password = "root123"
Device = FileStorage
Media Type = File
}
# Definition of tape storage device
Storage {
Name = LTO-4
Address = backup # N.B. Use a fully qualified name here
SDPort = 9103
Password = "root123" # password for Storage daemon
Device = LTO-4 # must be same as Device in Storage daemon
Media Type = LTO-4 # must be same as MediaType in Storage daemon
}
# File Pool definition
Pool {
Name = File
Pool Type = Backup
Recycle = yes # Bacula can automatically recycle Volumes
AutoPrune = yes # Prune expired volumes
Volume Retention = 600 days # one year
Maximum Volume Bytes = 2000G # Limit Volume size to something reasonable
Maximum Volumes = 100
LabelFormat = "Vol" # Limit number of Volumes in Pool
}
Catalog {
Name = MyCatalog
# Uncomment the following line if you want the dbi driver
# dbdriver = "dbi:mysql"; dbaddress = 127.0.0.1; dbport =
dbname = "bacula"; dbuser = "bacula"; dbpassword = "capitalbank321"
}
Console {
Name = backup.capitalbank.com-mon
Password = "root123"
CommandACL = status, .status
}

Now start bacula
/opt/bacula/bin/bacula start

access console via:
/opt/bacula/bin/bconsole

It will prompt for option of selecting the backup process and then start the backup process.

run

Install webmin for graphical interface

rpm -ivh webmin-1.660-1.noarch.rpm

/etc/init.d/webmin start

You can access webmin via browser, localhost:10000

Select the option of Bacula backup system from left drop down menu

and you can schedule backup and run backup from the GUI

Bacula CapitalBank

2014-03-05T14:56:23Z

Faisal: Created page with "category:Capital Bank '''Installation of Bacula for Capital Bank''' tar -xvzf bacula-5.2.13.tar.gz cd bacula-5.2.13 CFLAGS="-g -Wall" ./configure \ --sbindir=/opt/ba..."

Vardhman spam blocking

2014-02-14T12:39:16Z

Faisal: Created page with "Category:Zimbra Category:Vardhman Normal blacklist process of zimbra is not working in vardhman, this is why blocking was implemented on postfix at smtp level. Same..."

[[Category:Zimbra]]
[[Category:Vardhman]]

Normal blacklist process of zimbra is not working in vardhman, this is why blocking was implemented on postfix at smtp level.

Same has been done on all the three servers of vardhman.

su - zimbra

vim /opt/zimbra/postfix/conf/sender_access

user@domain.com REJECT
*@domain2.com REJECT

vim /opt/zimbra/conf/postfix_recipient_restrictions.cf

Add following as 2nd line

check_sender_access hash:/opt/zimbra/postfix/conf/sender_access

Create hash and restart postfix

postmap /opt/zimbra/postfix/conf/sender_access
postfix stop
postfix start

Reference:- http://wiki.zimbra.com/wiki/Rejecting_Emails_at_SMTP_Level

Ireport Java Issue

2014-01-24T06:45:23Z

Faisal:

[[category:Tetra Local]]

''' == Ireport Issue: Showing Null Value at the time of Preview == '''

'''[[Solution]] - Upgrade JDK to JDK-7'''

'''OS - Ubuntu 13.04'''

'''Login As root'''

add-apt-repository ppa:openjdk/ppa
apt-get update
apt-get install openjdk-7-jdk
/usr/sbin/update-alternatives --config java
/usr/sbin/update-alternatives --config javac
/usr/sbin/update-alternatives --config javaws

'''Ireport was running and preview was showing properly and was confirmed by Java team'''

Ireport Java Issue

2014-01-24T06:24:09Z

Faisal: Created page with "''' == Ireport Issue: Showing Null Value at the time of Preview == ''' '''OS - Ubuntu 13.04''' '''Login As root''' add-apt-repository ppa:openjdk/ppa apt-get update..."

''' == Ireport Issue: Showing Null Value at the time of Preview == '''

'''OS - Ubuntu 13.04'''

'''Login As root'''

add-apt-repository ppa:openjdk/ppa

apt-get update

apt-get install openjdk-7-jdk

/usr/sbin/update-alternatives --config java

/usr/sbin/update-alternatives --config javac

/usr/sbin/update-alternatives --config javaws

'''Ireport was running and preview was showing properly and was confirmed by Java team'''

Zimbra logo change

2014-01-21T11:11:43Z

Faisal: Created page with "Category:Zimbra ''' == Changing Logo for the second Domain besmech.com for witalsee zimbra server == ''' su - zimbra mkdir /opt/zimbra/jetty/webapps/zimbra/skins/l..."

[[Category:Zimbra]]

''' == Changing Logo for the second Domain besmech.com for witalsee zimbra server == '''

su - zimbra

mkdir /opt/zimbra/jetty/webapps/zimbra/skins/logos

'''Create two logos of pixels :- 459x218(LoginBanner.png) & 74x35(AppBanner.png)'''

'''move the images in the directory /opt/zimbra/jetty/webapps/zimbra/skins/logos/'''

zmprov modifyDomain besmech.com zimbraSkinLogoLoginBanner /zimbra/skins/logos/LoginBanner.png

zmprov modifyDomain besmech.com zimbraSkinLogoAppBanner /zimbra/skins/logos/AppBanner.png

zmmailboxdctl restart

'''Open mail.besmech.com to confirm (Clear browser cache/cookies)'''

Vardhman ldap issue

2014-01-14T12:26:37Z

Faisal:

[[Category:Zimbra]]
[[Category:Vardhman]]

'''

'''Issue:- Replication not working on vardhman Ldap.'''

Error:- slap_client_connect: URI=ldap://ldh.vardhman.com:389 Error, ldap_start_tls failed (-11)

1. Edit the following file on both ROAMING & BDD:

vi /opt/zimbra/data/ldap/config/cn=config/olcDatabase={2}hdb.ldif

2. Search for "starttls=critical" in the file and remove it.

3. Save the file and restart ldap on both master(LDH) and replica(ROAMING & BDD).

ldap stop

ldap start

4. Verify replication by checking messages in zimbra.log

Reference Page:- http://wiki.zimbra.com/wiki/Turning_off_starttls_for_replication

Vardhman ldap issue

2014-01-14T12:06:39Z

Faisal: /* Vardhman Ldap Issue */

[[Category:Zimbra]]
[[Category:Vardhman]]

'''

'''Issue:- Replication not working on vardhman Ldap.'''

1. Edit the following file on both ROAMING & BDD:

vi /opt/zimbra/data/ldap/config/cn=config/olcDatabase={2}hdb.ldif

2. Search for "starttls=critical" in the file and remove it.

3. Save the file and restart ldap on both master(LDH) and replica(ROAMING & BDD).

ldap stop

ldap start

4. Verify replication by checking messages in zimbra.log

Vardhman ldap issue

2014-01-14T12:04:37Z

Faisal: Created page with "Category:Zimbra Category:Vardhman ''' == Vardhman Ldap Issue == ''' Issue:- Replication not working on vardhman Ldap. 1. Edit the following file on both ROAMING & ..."

[[Category:Zimbra]]
[[Category:Vardhman]]

'''
== Vardhman Ldap Issue ==
'''

Issue:- Replication not working on vardhman Ldap.

1. Edit the following file on both ROAMING & BDD:

vi /opt/zimbra/data/ldap/config/cn=config/olcDatabase={2}hdb.ldif

2. Search for "starttls=critical" in the file and remove it.

3. Save the file and restart ldap on both master(LDH) and replica(ROAMING & BDD).

ldap stop

ldap start

4. Verify replication by checking messages in zimbra.log

Pahwa ssl

2013-12-07T13:03:13Z

Faisal:

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]

= '''Objective''' =
* '''Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)
'''

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl genrsa -des3 -out servercert.key.enc 2048

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650 [self signed cert]

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

'''IMPLEMENTATION OF POP3S'''

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

To Verify-

openssl s_client -connect localhost:995

'''IMPLEMENTATION OF IMAPS'''

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3

TLS_STARTTLS_PROTOCOL=TLS1

TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"

TLS_CERTFILE=/var/qmail/control/servercert.pem

To Verfiy -

openssl s_client -connect localhost:993

'''SSL IMPLEMENTATION ON APACHE'''

vim /etc/httpd/conf.d/

SSLEngine on

SSLProtocol -ALL +SSLv3 +TLSv1

SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)

SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

'''For SMTPS on POSTFIX'''

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

'''Test the settings on thunderbird/outlook/evolution'''

incoming mailserver - mail21c.pahwa.com
outgoing mailserver - mail21c.pahwa.com
smtps port - 587
imaps port - 993
pop3s port - 995
https://mail21c.pahwa.com

'''Reference''' http://192.168.1.15/wiki/index.php/Implementation_of_smtps_pop3s_imaps_and_Https_on_Qmail_Based_Server

Pahwa ssl

2013-12-07T13:01:39Z

Faisal:

Pahwa ssl

2013-12-07T12:59:01Z

Faisal:

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]

= '''Objective''' =
* '''Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)
'''

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl genrsa -des3 -out servercert.key.enc 2048

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650 [self signed cert]

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

'''IMPLEMENTATION OF POP3S'''

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

To Verify-

openssl s_client -connect localhost:995

'''IMPLEMENTATION OF IMAPS'''

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3

TLS_STARTTLS_PROTOCOL=TLS1

TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"

TLS_CERTFILE=/var/qmail/control/servercert.pem

To Verfiy -

openssl s_client -connect localhost:993

'''SSL IMPLEMENTATION ON APACHE'''

vim /etc/httpd/conf.d/

SSLEngine on

SSLProtocol -ALL +SSLv3 +TLSv1

SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)

SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

'''
For SMTPS on POSTFIX'''

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

'''Test the settings on thunderbird/outlook/evolution'''

incoming mailserver - mail21c.pahwa.com
outgoing mailserver - mail21c.pahwa.com
smtps port - 587
imaps port - 993
pop3s port - 995
https://mail21c.pahwa.com

Pahwa ssl

2013-12-07T12:54:59Z

Faisal:

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]

= '''Objective''' =
* '''Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)
'''

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl genrsa -des3 -out servercert.key.enc 2048

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

'''IMPLEMENTATION OF POP3S'''

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

To Verify-

openssl s_client -connect localhost:995

'''IMPLEMENTATION OF IMAPS'''

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3
TLS_STARTTLS_PROTOCOL=TLS1
TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"
TLS_CERTFILE=/var/qmail/control/servercert.pem

To Verfiy -

openssl s_client -connect localhost:993

'''SSL IMPLEMENTATION ON APACHE'''

vim /etc/httpd/conf.d/

SSLEngine on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)
SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

'''
For SMTPS on POSTFIX'''

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

'''Test the settings on thunderbird/outlook/evolution'''

incoming mailserver - mail21c.pahwa.com
outgoing mailserver - mail21c.pahwa.com
smtps port - 587
imaps port - 993
pop3s port - 995
https://mail21c.pahwa.com

Pahwa ssl

2013-12-07T12:48:27Z

Faisal: /* Objective */

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]

= '''Objective''' =
* '''Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)
'''

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl genrsa -des3 -out servercert.key.enc 2048

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

'''IMPLEMENTATION OF POP3S'''

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

openssl s_client -connect localhost:995

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3
TLS_STARTTLS_PROTOCOL=TLS1
TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"
TLS_CERTFILE=/var/qmail/control/servercert.pem

openssl s_client -connect localhost:993

'''SSL IMPLEMENTATION ON APACHE'''

vim /etc/httpd/conf.d/

SSLEngine on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)
SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

'''
For SMTPS on POSTFIX'''

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

Pahwa ssl

2013-12-07T12:46:44Z

Faisal:

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]

= Objective =
* Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl genrsa -des3 -out servercert.key.enc 2048

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

'''IMPLEMENTATION OF POP3S'''

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

openssl s_client -connect localhost:995

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3
TLS_STARTTLS_PROTOCOL=TLS1
TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"
TLS_CERTFILE=/var/qmail/control/servercert.pem

openssl s_client -connect localhost:993

'''SSL IMPLEMENTATION ON APACHE'''

vim /etc/httpd/conf.d/

SSLEngine on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)
SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

For SMTPS //

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

Pahwa ssl

2013-12-07T12:43:39Z

Faisal: Created page with "category:Qmail category:Installation category:Pahwa Group = Objective = * Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imap..."

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]

= Objective =
* Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl genrsa -des3 -out servercert.key.enc 2048

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

IMPLEMENTATION OF POP3S

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

openssl s_client -connect localhost:995

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3
TLS_STARTTLS_PROTOCOL=TLS1
TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"
TLS_CERTFILE=/var/qmail/control/servercert.pem

openssl s_client -connect localhost:993

SSL IMPLEMENTATION ON APACHE

vim /etc/httpd/conf.d/

SSLEngine on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)
SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

For SMTPS //

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

Phdcci zimbra backup process

2013-11-09T10:37:48Z

Faisal: Zimbra Backup Process of PHDCCI

'''
== Zimbra Backup Process ==
'''

'''Login on the server from root user:'''

'''First we rsync the data without stoppping the zimbra to the external hard disk'''

'''External Hard drive is mounted at /media/drive/'''

----

''# rsync -alHKP /opt/zimbra /media/drive/backup_091213(Folder Name)/''

----

'''this will transfer zimbra to the external drive in the folder (backup_091213)'''

'''After the transfer gets completed, stop zimbra'''

----

''# su – zimbra''

----

'''This will switch you to zimbra user, now run this command'''

----

''$ zmcontrol stop''

----

'''This will stop zimbra'''

----

''$ exit''

----

'''this will switch back to root user'''

----

''# pkill -9 zimbra''

----

'''This will kill all the process related to zimbra incase if it is still running.'''

'''Now we take the final rsync'''

----

''# rsync -alHKP --delete /opt/zimbra /media/drive/backup_091213/''

----

'''It should get completed without giving any errors.'''

'''Now we start zimbra'''

----

''# su – zimbra''

''$ zmcontrol start''

''$ zmcontrol status''

----

'''check the status of zimbra by running this command, everything should be running.'''

----

''$ exit''

----

Main Page/Samba Password Policy

2013-09-21T10:51:53Z

Faisal: Created page with "''' == Samba bad lockout attempt Password Policy == ''' Take Backup of smb.conf cp -pvr /etc/samba/smb.conf /etc/samba/smb.conf_20thsept //To list details of the account//..."

'''
== Samba bad lockout attempt Password Policy ==
'''

Take Backup of smb.conf

cp -pvr /etc/samba/smb.conf /etc/samba/smb.conf_20thsept

//To list details of the account//

pdbedit -v username

//To check Password Policy 'bad lockout attempt'//

pdbedit -P "bad lockout attempt"

output:- account policy value for bad lockout attempt is 0

//set policy to maximum 3 attempts//

pdbedit -P "bad lockout attempt" -C 3

output:- account policy value for bad lockout attempt was 0
account policy value for bad lockout attempt is now 3

//To check account lockup duration//

pdbedit -P "lockout duration"

output:- account policy "lockout duration" description: Lockout duration in minutes (default: 30, -1 => forever)
account policy "lockout duration" value is: 30

//To change account lockup duration//

pdbedit -P "lockout duration" -C 45

Output:- account policy "lockout duration" description: Lockout duration in minutes (default: 30, -1 => forever)
account policy "lockout duration" value was: 30
account policy "lockout duration" value is now: 45

//To unlock a locked account//

pdbedit -r -c "[]" username