TetraWiki - User contributions [en]

User:Ranjit

2014-01-08T15:22:24Z

Ranjit:

[[category:Qmail]]
[[category:KLOXO]]

'''Mails are not going from kloxo'''

sendmail daemon was not linked with /var/qmail/bin/sendmail therefore mails are going from server.

1. check link location of sendmail.

# ls -la /usr/sbin/sendmail

2. Remove current link of sendmail.

# rm /usr/sbin/sendmail

3. create new link.

# ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

Note:- Mail log was also not generating therefore we restart rsyslog service.

#/etc/init.d/rsyslog restart

Pahwa ssl

2013-12-14T08:53:16Z

Ranjit: /* Objective */

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]

= '''Objective''' =
* '''Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)
'''

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl rsa -in servercert.key.enc -out servercert.key

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650 [self signed cert]

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

'''IMPLEMENTATION OF POP3S'''

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

To Verify-

openssl s_client -connect localhost:995

'''IMPLEMENTATION OF IMAPS'''

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3

TLS_STARTTLS_PROTOCOL=TLS1

TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"

TLS_CERTFILE=/var/qmail/control/servercert.pem

To Verfiy -

openssl s_client -connect localhost:993

'''SSL IMPLEMENTATION ON APACHE'''

vim /etc/httpd/conf.d/

SSLEngine on

SSLProtocol -ALL +SSLv3 +TLSv1

SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)

SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

'''For SMTPS on POSTFIX'''

vim /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 3
smtpd_tls_key_file = /certificate/servercert.key
smtpd_tls_cert_file = /certificate/servercert.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes

'''Test the settings on thunderbird/outlook/evolution'''

incoming mailserver - mail21c.pahwa.com
outgoing mailserver - mail21c.pahwa.com
smtps port - 587
imaps port - 993
pop3s port - 995
https://mail21c.pahwa.com

'''Reference''' http://192.168.1.15/wiki/index.php/Implementation_of_smtps_pop3s_imaps_and_Https_on_Qmail_Based_Server

Jboss-HTTPS-Integration

2013-12-14T08:49:39Z

Ranjit: /* Download */

[[category:JBOSS Related‏‎]]
[[category:Muthoot group‏‎]]

== JBOSS-HTTPS-Integration (at Muthoot Group ) ==

==='''Purpose'''===

We have to ensure that access to the HRMS / ERP portal (JBOSS based Applications) is secure and based of standard mechanism with HTTPS / SSL access.

==='''Objective'''===

Move JBOSS access to SSL based access and that too on direct URL like https://Hostname/

and

Not on like http://hostname:port/ which is currently used .

==='''Method'''===

Mod_JK is used to integrate Apache with JBOSS

==='''Referance document'''===

http://www.jaysonjc.com/programming/configuring-apache-in-front-of-jboss-application-server-using-mod_jk.html

==='''Download'''===

Download for mod_jk for Centos / RHEL 5-32bit
http://ftp-hk.tmapy.cz/tmapy-twist/centos/5/updates/i386/RPMS/mod_jk-ap20-1.2.28-2.el5.i386.rpm

Download for mod_jk for Centos / RHEL 6-64bit
http://ftp.tmapy.cz/tmapy-twist/centos/5/updates/x86_64/RPMS/mod_jk-ap20-1.2.28-2.el5.x86_64.rpm

==='''Test Bed'''===

Local Server - 192.168.1.215

==='''Assumptions'''===

The Actual URL is http://Servername-IP:port/ and is not in form of http://Servername-IP:port/app1

==='''Process '''===

1. Make Sure you have ssl for apache installed i.e yum install mod_ssl

2. Install mod_jk-ap20 , by downloading from http://ftp-hk.tmapy.cz/tmapy-twist/centos/5/updates/i386/RPMS/mod_jk-ap20-1.2.28-2.el5.i386.rpm and installaing via rpm -Uvh

3. check for file mod_jk.so in /etc/httpd/modules/

4. Add in /etc/httpd/conf/httpd.conf

<VirtualHost *:80>
ServerName www.muthootonline.in
ServerAlias muthootonline.in
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

5. Add following line at the top of /etc/httpd/conf.d/ssl.conf
LoadModule jk_module modules/mod_jk.so
JkWorkersFile conf/workers.properties
JkShmFile logs/mod_jk.shm
JkLogFile logs/mod_jk.log

6 . Add following line after <VirtualHost _default_:443>
JkLogLevel info
JkMount /* worker1

Modify the Line below
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
SSLCertificateFile /etc/httpd/conf/ssl/Muthootonline.in.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl/server.key
SSLCertificateChainFile /etc/httpd/conf/ssl/gd_bundle.crt

Copy the ssl ( Certificates and Keys ) to this server by
scp -r /etc/httpd/conf/ssl 192.168.1.146:/etc/httpd/conf/

7. Make a new file /etc/httpd/conf/workers.properties having following entry

worker.list=worker1
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

8. Restart httpd . and test https://<Servername>/ . It should open the page which is opening at http://<ServerName>:8080/

==='''Testing'''===

Go to URL https://192.168.1.215/ page and it should display the moothod login page . Enter the application with right credentials , you should be seamlessly working .

Also , normal http ( not https) should give you pages like test page of apache or for pgadmin you should get it via http://192.168.1.215/phpPgAdmin and so on . That means your old apache application / URLs should work as it is.

User talk:Ranjit

2013-11-30T13:00:18Z

Ranjit: /* Disabled Non SSL Authentication in Zimbra on Aimil. */

[[Category:Zimbra]]

==Disabled Non SSL Authentication in Zimbra on Aimil.==

Login in to Zimbra Web Admin Panel:-

1. Go to the Global Setting and Click on MTA Tab and do check mark on TLS Authentication only.

2.Click on IMAP Tab and do check on Enable SSL for IMAP service and uncheck clear text login then uncheck Enable IMAP services respectively.

3.Click on POP Tab and do check on Enable SSL for POP services and uncheck clear text login then uncheck Enable POP services respectively.

4.Go to the Servers and Right click on server's hostname and go to Edit option then click on MTA Tab and do check on TLS Authentication
only.

5.Restart Zimbra Services.

zmcontrol stop

zmcontrol start

and do Respective Setting on outlook and check port 465 and 995 port is working or not.

User talk:Ranjit

2013-11-30T12:59:44Z

Ranjit:

User talk:Ranjit

2013-11-30T12:58:42Z

Ranjit: Created page with " ==Disabled Non SSL Authentication in Zimbra on Aimil.== Login in to Zimbra Web Admin Panel:- 1. Go to the Global Setting and Click on MTA Tab and do check mark on TLS ..."

==Disabled Non SSL Authentication in Zimbra on Aimil.==

Login in to Zimbra Web Admin Panel:-

1. Go to the Global Setting and Click on MTA Tab and do check mark on TLS Authentication only.

2.Click on IMAP Tab and do check on Enable SSL for IMAP service and uncheck clear text login then uncheck Enable IMAP services respectively.

3.Click on POP Tab and do check on Enable SSL for POP services and uncheck clear text login then uncheck Enable POP services respectively.

4.Go to the Servers and Right click on server's hostname and go to Edit option then click on MTA Tab and do check on TLS Authentication
only.

5.Restart Zimbra Services.

zmcontrol stop

zmcontrol start

and do Respective Setting on outlook and check port 465 and 995 port is working or not.

Spi-nagiosclient

2013-10-31T06:02:01Z

Ranjit: /* Client Configuration */

[[category: Spi Nagios ]]

== Spi Nagios Client Configuration ==

== Client Configuration ==

Install Rpmforge Epelrepo

#mkdir /downloads

#cd /downloads

#wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

#rpm -Uvh rpmforge-release-0.5.2-2.el6.rf.x86_64.rp

#wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

#wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm

#rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm

# vim /etc/yum.repos.d/remi.repo
enable 1

#yum install nrpe nagios-plugins-all

#vim /etc/nagios/nrpe.cfg
allowed_hosts=127.0.0.1, your nagios server ip

command[check_users]=/usr/lib64/nagios/plugins/check_users -w 5 -c 10
command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20
command[check_disk_space]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -X tmpfs
command[check_zombie_procs]=/usr/lib64/nagios/plugins/check_procs -w 5 -c 10 -s Z
command[check_cpu]=/usr/lib64/nagios/plugins/check_cpu.sh -w 20 -c 60
command[check_zimbra_queue]=/usr/lib64/nagios/plugins/check_zimbra_queue -w 30 -c 60
command[check_mem_avail]=/usr/lib64/nagios/plugins/check_mem_avail -w 20 -c 10
command[check_pop]=/usr/lib64/nagios/plugins/check_pop -w 10 -c 20
command[check_smtp]=/usr/lib64/nagios/plugins/check_smtp -w 10 -c 20
command[check_imap]=/usr/lib64/nagios/plugins/check_imap -w 10 -c 20
command[check_zimbra_lmtp]=/usr/lib64/nagios/plugins/check_smtp -H localhost -p 7025 -e '220 spimail.spi.com Zimbra LMTP server ready'

Note: define all plugin in above given path.

# chown nagios.nagios /usr/lib64/nagios/plugins -R

Now restart nrpe service

== Server configuration ==

#vim /usr/local/nagios/etc/objects/linux-box.cfg

== Define client details ==

define host{
use linux-server
host_name spimail.spi.com
alias Spi Mail Server
address 64.128.141.50
hostgroups Tetra Clients ; Host groups
}

#cd ../services
#vim spimail.spi.com.cfg

define service{
use generic-service
host_name spimail.spi.com
service_description Current Users
check_command check_nrpe!check_users
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Cpu Load
check_command check_nrpe!check_load
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Cpu Utilization
check_command check_nrpe!check_cpu
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Memory Utilization
check_command check_nrpe!check_mem_avail
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Disk Check
check_command check_nrpe!check_disk_space
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Zombie Process
check_command check_nrpe!check_zombie_procs
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Mail Queue
check_command check_nrpe!check_zimbra_queue
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}
define service{
use generic-service
host_name spimail.spi.com
service_description Pop
check_command check_nrpe!check_pop
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}
define service{
use generic-service
host_name spimail.spi.com
service_description Smtp
check_command check_nrpe!check_smtp
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}
define service{
use generic-service
host_name spimail.spi.com
service_description Imap
check_command check_nrpe!check_imap
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Http
check_command check_http_spi // this is not define in client side , check in command.cfg
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

define service{
use generic-service
host_name spimail.spi.com
service_description Lmtp
check_command check_nrpe!check_zimbra_lmtp
contact_groups mailtest
notification_options w,u,c,r
normal_check_interval 3
}

== Configuration Of Warning and Critical Mail send by Nagios: ==

#Vim /usr/local/nagios/etc/objects/contacts.cfg

DEFINE CONTACT

define contact{
contact_name mailtest ; Short name of user
use generic-contact ; Inherit default values from generic-contact template (defined above)
alias Nagios Admin ; Full name of user

email test@tetrain.com ; <<***** CHANGE THIS TO YOUR EMAIL ADDRESS ******

define contactgroup{
contactgroup_name client-group
alias Nagios Administrators
members mailtest
}

Note : Now the client have to see only there services not all clients services for that we made new contact group i.e mailtest and now we want that they can wacth there services but do not change any thing for that we do one entry in below :

# vim /usr/local/nagios/etc/cgi.cfg
#authorized_for_read_only=user1,user2
authorized_for_read_only=mailtest

Note : Set password for user mailtest

# htpasswd htpasswd.users mailtest

Then check your mail.

TROUBLESHOOTING----------------

1. Check nagios port is open on client server
#nc -z client ip 5666

2. check client server is connected or not
#./usr/local/nagios/libexec/check_nrpe -n -H spimail.spi.com

3. check service
#/usr/local/nagios/libexec/check_nrpe -n -t 50 -H spimail.spi.com -c check_mem_avail

Qmail Server with Courier IMAP with Master/Slave LDAP for MiraExim

2013-10-29T04:41:06Z

Ranjit: /* Coiguration of Qmail related files */

[[category:Mira Exim]]

'''Qmail Implementation with Courier IMAP,Master-Slave Openldap'''

'''MIRAEXIM LTD. NOIDA'''

'''BY- NAVDEEP MATHUR'''

='''IMPLEMENTING FIRST INSTANCE OF QMAIL'''=

'''Ensure rpmforge and epel repos are enabled.'''

* Switch off SELinux
* Flush Iptables rules

'''Create directory for downloading required packages '''

* mkdir /downloads
* cd /downloads

=='''DOWNLOAD AND EXTRACT PACKAGES'''==

'''Download all required packages for qmail-ldap installation '''

* wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz
* wget http://cr.yp.to/software/qmail-1.03.tar.gz
* wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz
* wget http://www.qmailrocks.org/downloads/patches/ucspi-tcp-0.88.errno.patch
* wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz
* wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/daemontools-0.76.errno.patch
* wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz
* wget http://lifewithqmail.org/inst_check
* wget https://sourceforge.net/projects/courier/files/maildrop/2.5.4/maildrop-2.5.4.tar.bz2/download --no-check-certificate
* wget http://prdownloads.sourceforge.net/qmail-scanner/qmail-scanner-2.08.tgz?download
* wget http://www.qmailrocks.org/downloads/scripts/finalize/qmailctl
* wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm

'''Extract all packages : '''

* tar -xvzf qmailrocks.tar.gz
* tar -xvzf squirrelmail-webmail-1.4.22.tar.gz
* tar -xvjf maildrop-2.5.4.tar.bz2
* tar -xvzf qmail-scanner-2.08.tgz
* tar -xvzf qmailrocks/autorespond-2.0.5.tar.gz

=='''INSTALLATION OF PACKAGES AND CREATING USERS ,GROUPS'''==

'''Install all required packages before qmail-ldap installation '''

yum install vim-enhanced httpd php* php-ldap perl gcc* gcc-c++ gcc44* openssl openssl-devel kernel-headers openssl-devel kernel-headers patch pcre* db4*
openldap* glibc* zlib* glib* gdbm* php

'''Create initial qmail '''

* mkdir /usr/src/qmail

'''Creating all needed users and groups '''

groupadd nofiles
useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp
groupadd qmail
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails
groupadd vmail
useradd -g vmail -s /bin/true vmail

'''Unpack qmail and apply the qmail-ldap patch '''

cd /usr/src/qmail
tar -xvzf /downloads/qmail-1.03.tar.gz
gunzip /downloads/qmail-ldap-1.03-20060201.patch.gz
cd qmail-1.03
<nowiki>patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch</nowiki>

'''Make changes on "Makefile" to qmail work properly with ldap'''

Make these entries :

LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE
<nowiki># ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS</nowiki>
ZLIB=-lz
<nowiki># to enable the auto-maildir-make feature</nowiki>
MDIRMAKE=-DAUTOMAILDIRMAKE
<nowiki># to enable the auto-homedir-make feature</nowiki>
HDIRMAKE=-DAUTOHOMEDIRMAKE
<nowiki># on most systems we need this to make auth_pop and auth_imap</nowiki>
SHADOWLIBS=-lcrypt
<nowiki># to enable the possibility to log and debug imap and pop</nowiki>
DEBUG=-DDEBUG

Now Complie the Qmail

make man
make setup check

==Configuration of Qmail related files ==

'''Creating qmail control files '''

cd /var/qmail/control
echo 100 > concurrencyincoming
echo 255 > concurrencyremote
echo ./Maildir/ > defaultdelivery
echo /var/qmail/bin/dirmaker > dirmaker
echo 0 > ldapcluster
id -g vmail > ldapgid
echo /home/vmail > ldapmessagestore
echo qmailUser > ldapobjectclass
echo secret > ldappassword
echo 127.0.0.1 > ldapserver
id -u vmail > ldapuid
echo 80000000 > qmail-smtpd-softlimit
echo 80000000 > qmail-pop3d-softlimit
echo 3 > qmail-pop3d-loglevel
echo 3 > qmail-start-loglevel
echo groupvama.com > defaultdomain
echo dc=groupvama,dc=com > ldapbasedn
echo cn=Manager,dc=groupvama,dc=com > ldaplogin
echo mail.groupvama.com > me
echo groupvama.com >> rcpthosts
echo miraexim.com >? rcpthosts
echo vogueserv.com >> rcpthosts
ln -s rcpthosts locals

'''Unpacking ucspi-tcpi and apply the error patch '''

cd /usr/src/qmail
tar -xvzf /downloads/ucspi-tcp-0.88.tar.gz
cd ucspi-tcp-0.88
<nowiki>patch < /downloads/ucspi-tcp-0.88.errno.patch</nowiki>
make && make setup check

'''Unpacking daemontools and apply daemontools-error patch'''

mkdir -p /package
chmod 1755 /package
cd /package
tar -xvzf /downloads/daemontools-0.76.tar.gz
cd /package/admin/daemontools-0.76/src
<nowiki>patch < /downloads/daemontools-0.76.errno.patch</nowiki>
cd /package/admin/daemontools-0.76
package/install

'''Creating the supervise script directories'''

mkdir /var/qmail/supervise
cd /var/qmail/supervise
mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log
chmod +t qmail-smtpd qmail-send qmail-pop3d

'''Creating qmail-smtpd run supervise '''

'''vim qmail-smtpd/run'''
<nowiki>#!/bin/sh</nowiki>
QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE
QUID=`id -u qmaild`
QGID=`id -g qmaild`
MAXD=`head -1 /var/qmail/control/concurrencyincoming`
HOST=`head -1 /var/qmail/control/me`
SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit`
CDBF="/etc/tcp.smtp.cdb"
<nowiki>if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then</nowiki>
echo QUID, QGID, MAXD, or HOST is unset in
echo /var/qmail/supervise/qmail-smtpd/run
exit 1
fi
exec /usr/local/bin/softlimit -m $SOFT \
/usr/local/bin/tcpserver -v \
-H \
-R \
-l $HOST \
-x $CDBF \
-c $MAXD \
-u $QUID \
-g $QGID \
0 \
smtp \
/var/qmail/bin/qmail-smtpd \
/var/qmail/bin/auth_smtp /usr/bin/true 2>&1

'''Creating qmail-smtpd log run supervise script'''

'''vim qmail-smtpd/log/run'''
<nowiki>#!/bin/sh</nowiki>
export PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1

'''Creating qmail rc supervise script'''

'''vim /var/qmail/rc'''
<nowiki>#!/bin/sh</nowiki>
QLOG="`cat /var/qmail/control/qmail-start-loglevel`"
DEFD="`cat /var/qmail/control/defaultdelivery`"
exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

'''Creating qmail-send run supervise script'''

'''vim qmail-send/run'''
<nowiki>#!/bin/sh</nowiki>
exec /var/qmail/rc

'''Creating qmail-send log run supervise script '''

'''vim qmail-send/log/run'''
<nowiki>#!/bin/sh</nowiki>
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1

'''Creating qmail-pop3d run supervise script '''

'''vim qmail-pop3d/run'''
<nowiki>#!/bin/sh</nowiki>
IP=`head -1 /var/qmail/control/me`
LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel`
SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit`
exec \
env LOGLEVEL=$LL \
softlimit -m $SL \
/usr/local/bin/tcpserver -v -R -H -l 0 0 pop3 \
/var/qmail/bin/qmail-popup $IP \
/var/qmail/bin/tcp-env \
/var/qmail/bin/auth_pop \
/var/qmail/bin/qmail-pop3d Maildir 2>&1

'''Creating qmail-pop3d log run supervise script'''

'''vim qmail-pop3d/log/run'''
<nowiki>#!/bin/sh</nowiki>
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1

'''Creating auto directory maker script'''

'''vim /var/qmail/bin/dirmaker'''
<nowiki>#!/bin/sh</nowiki>
echo '----------------------------------------------' >> /tmp/dirmaker
date >> /tmp/dirmaker
echo $1 >> /tmp/dirmaker
id >> /tmp/dirmaker
mkdir --parents -m 700 -p $1/Maildir
mkdir --parents -m 700 -p $1/Maildir/tmp
mkdir --parents -m 700 -p $1/Maildir/cur
mkdir --parents -m 700 -p $1/Maildir/new
chown -R vmail:vmail $1

'''Set permissions of all qmail supervise run scripts'''

chmod 755 qmail-pop3d/run qmail-smtpd/run qmail-send/run
chmod 755 qmail-pop3d/log/run qmail-smtpd/log/run qmail-send/log/run
chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker

'''Create tcp.smtp file to appy tcprules'''

'''vim /etc/tcp.smtp'''
127.:allow,RELAYCLIENT="",MAXRCPTCOUNT="200"
192.168.:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHPREPEND="Authenticated user:",SANITYCHECK="",SMTPAUTH="",LOGLEVEL="3",AUTHREQUIRED="",MAXRCPTCOUNT="100"
:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SANITYCHECK="",RETURNMXCHECK="STRICT",RBL="",REJECTEXEC="",LOGLEVEL="3",TARPITCOUNT="10",TARPITDELAY="10",SMTPAUTH="",MAXRCPTCOUNT="25"

'''Creating qmail logging directories and set permissions'''

mkdir /var/log/qmail
cd /var/log/qmail
mkdir qmail-send qmail-smtpd qmail-pop3d
chown -R qmaill:root /var/log/qmail
chmod -R 750 /var/log/qmail

'''Creating qmail alias users, links and set permissions'''

cd /var/qmail
cp -p /downloads/qmailctl /var/qmail/bin/.
chmod 755 /var/qmail/bin/qmailctl
ln -s /var/qmail/bin/qmailctl /usr/bin/
qmailctl cdb

'''Creating links of supervise scripts'''

mkdir -p /service
cd /service/
ln -s /var/qmail/supervise/qmail-* .

'''Creating aliases '''

echo qmailadmin@groupvama.com > /var/qmail/alias/.qmail-root
echo qmailadmin@ groupvama.com > /var/qmail/alias/.qmail-postmaster
echo qmailadmin@ groupvama.com > /var/qmail/alias/.qmail-mailer-daemon
ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous
chmod 644 /var/qmail/alias/.qmail*

'''Stop sendmail and remove all related files'''

/etc/init.d/sendmail stop
chkconfig sendmail off
mv /usr/lib/sendmail /usr/lib/sendmail.org
mv /usr/sbin/sendmail /usr/sbin/sendmail.org
ln -s /var/qmail/bin/sendmail /usr/lib/sendmail
ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

='''COURIER IMAP INSTALLATION'''=

'''Compile courier-authlib and install'''

cd /downloads/qmailrocks/
tar jxvf courier-authlib-0.55.tar.bz2
cd courier-authlib-0.55
./configure --prefix=/usr/local --exec-prefix=/usr/local --with-authldap --without-authmysql --disable-root-check --with-ssl –with-authchangepwdir=/usr/local/libexec/authlib --with-redhat
make && make check
make install-strip && make install-configure

'''Create IMAP certificate and make changes on configuration files '''

'''vim /usr/local/etc/imapd.cnf'''
(Change postmaser@example.com an administrative email address)
emailAddress=qmailadmin@groupvama.com

'''vim /usr/local/etc/imapd'''
IMAPDSTART=YES

'''vim /usr/local/etc/imapd-ssl'''
IMAPDSSLSTART=YES
TLS_CERTFILE=/var/qmail/control/clientcert.pem

'''vim /usr/local/etc/authlib/authdaemonrc'''
authmodulelist="authldap"
authmodulelistorig="authldap"

'''vim /usr/local/etc/authlib/authldaprc'''
LDAP_SERVER 127.0.0.1
LDAP_PORT 389
LDAP_BASEDN dc=groupvama,dc=com
LDAP_BINDDN cn=Manager,dc=groupvama,dc=com
LDAP_BINDPW MiraE#1920
LDAP_TIMEOUT 5
LDAP_AUTHBIND 1
LDAP_MAIL uid
LDAP_GLOB_UID vmail
LDAP_GLOB_GID vmail
LDAP_HOMEDIR mailMessageStore
LDAP_MAILROOT /home/vmail
LDAP_MAILDIR mailbox
LDAP_DEFAULTDELIVERY defaultDelivery
LDAP_FULLNAME cn
LDAP_CLEARPW clearPassword
LDAP_CRYPTPW userPassword
LDAP_DEREF never
LDAP_TLS 0

'''Copy imap and imaps script in init.d directory'''

cp /usr/local/libexec/imapd.rc /etc/rc.d/init.d/imap
cp /usr/local/libexec/imapd-ssl.rc /etc/rc.d/init.d/imaps

'''Make imap and imaps services start on boot'''

'''vim /etc/rc.local'''
/usr/local/sbin/authdaemond start
/etc/rc.d/init.d/imap start
/etc/rc.d/init.d/imaps start

'''Restart authdaemon and imap services'''

/usr/local/sbin/authdaemond stop
/usr/local/sbin/authdaemond start
/etc/rc.d/init.d/imap stop
/etc/rc.d/init.d/imaps stop
/etc/rc.d/init.d/imap start
/etc/rc.d/init.d/imaps start

=='''Install autoresponder and maildrop '''==

cd /downloads/autorespond-2.0.5/
make && make install
cd /downloads/maildrop-2.5.4
./configure --prefix=/usr/local --exec-prefix=/usr/local --enable-maildrop-uid=root
make && make install-strip && make install-man

'''Install all required packages for Qmail-Scanner '''

yum perl-suidperl perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS perl-Time-HiRes* perl-HTML-Tagset perl-HTML-Parser perl-Pod-Usage* perl-Parse-Syslog perl-Statistics-Distributions spamassassin clamav clamd

'''Add user "qscand" for scanning '''

useradd -c "Qmail-Scanner Account" -s /bin/false -m qscand

'''Change user clamav to qscand '''

* vim /etc/logrotate.d/clamav<nowiki>[Change clamav to qscand]</nowiki>

/var/log/clamav/clamd.log {

missingok

notifempty

create 644 qscand qscand

postrotate

killall -HUP clamd 2>/dev/null || :

endscript

}

* vim /etc/logrotate.d/freshclam<nowiki>[Change clamav to qscand]</nowiki>

/var/log/clamav/freshclam.log {

missingok

notifempty

create 644 qscand qscand

}

* vim /etc/clamd.conf

User qscand

* vim /etc/freshclam.conf

DatabaseOwner qscand

* chown qscand.qscand /var/log/clamav/ -R
* chown -R qscand.qscand /var/run/clamav/
* /etc/init.d/clamd restart
* /etc/init.d/spamassassin restart

'''Install Qmail-Scanner '''

* cd /downloads/qmail-scanner-2.08
* ./configure --admin admin --domain groupvama.com
* mkdir -p /var/spool/qscan
* mkdir -p /var/spool/qscan/quarantine/viruses/tmp /var/spool/qscan/quarantine/viruses/cur /var/spool/qscan/quarantine/viruses/new
* mkdir -p /var/spool/qscan/quarantine/spam/tmp /var/spool/qscan/quarantine/spam/cur /var/spool/qscan/quarantine/spam/new
* mkdir -p /var/spool/qscan/quarantine/policy/tmp /var/spool/qscan/quarantine/policy/cur /var/spool/qscan/quarantine/policy/new
* mkdir -p /var/spool/qscan/working/tmp /var/spool/qscan/working/cur /var/spool/qscan/working/new
* mkdir -p /var/spool/qscan/archive/tmp /var/spool/qscan/archive/cur /var/spool/qscan/archive/new
* cp /downloads/qmail-scanner-2.08/quarantine-events.txt /var/spool/qscan/
* chown -R qscand:qscand /var/spool/qscan/
* cp -pv /downloads/qmail-scanner-2.08/qmail-scanner-queue.pl /var/qmail/bin/
* chown qscand.qscand /var/qmail/bin/qmail-scanner-queue.pl
* chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl
* /var/qmail/bin/qmail-scanner-queue.pl -z
* /var/qmail/bin/qmail-scanner-queue.pl -g
* cp -v /downloads/qmail-scanner-2.08/contrib/logrotate.qmail-scanner /etc/logrotate.d/qmail-scanner
* /etc/init.d/syslog restart

'''Integrate Qmail-scanner with qmail queue'''

* vim /var/qmail/supervise/qmail-smtpd/run

QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE

<center>'''IMPLEMENTING SECOND INSTANCE OF QMAIL WITH DISCLAIMER AND COPY OF ALL OUTGOING MESSAGES'''</center>

<center>'''CONCEPT'''</center>

Disclaimer on Qmail is Added to the Second Instance so that only Out going mails to different domains are uploaded with Common Signature / Disclaimer. Here this is used for multiple domains. Also second instance use to copy of all outgoing messages at log@groupvama.com.

<center>'''IMPLEMENTAION PROCESS'''</center>

* Implement Qmail-2 , i.e Second Qmail Instance
* Define Qmail-send and Qmail-smtpd daemons
* Define 2nd Qmail smtp port ( say 900)
* Install Qmail-qfilter , altermime and bglibs to satisfy the requirement.
* Define Multiple domain's text and HTML disclaimer
* Integrate Qmail's both the instances

<center>'''INSTALLATION OF QMAIL2'''</center>

'''Creating directories for installing qmail2'''

* mkdir -p /var/qmail2
* mkdir /usr/src/qmail2
* cd /usr/src/qmail2

'''Unpack qmail in /usr/src/qmail2 and apply qmail-ldap patch(this patch contain qmail queue and qmail error patch)'''

* tar xvzf /downloads/qmailrocks/qmail-1.03.tar.gz ( Assuming that you have downloaded Qmailrocks earlier )
* cd qmail-1.03
* <nowiki>patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch</nowiki>
* echo 255 > /usr/src/qmail2/qmail-1.03/conf-spwan
* echo 211 > /usr/src/qmail2/qmail-1.03/conf-split

'''Make changes on "Makefile" to qmail work properly with ldap'''

Make these entries :

LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE

ZLIB=-lz

SHADOWLIBS=-lcrypt

DEBUG=-DDEBUG

* vim conf-qmail

( replace qmail with qmail2 )

'''Caution:''' This is very critical Step as, not doing do will cause the main Qmail instance will get over written .

'''Keep a copy of all outgoing mail messages '''

* vim extra.h

QUEUE_EXTRA "Tlog\0"

QUEUE_EXTRALEN 5

* make man
* make setup check

'''Qmail2 Control Files'''

* cd /var/qmail2/control/

* echo 100 > concurrencyincoming
* echo 255 > concurrencyremote
* echo ./Maildir/ > defaultdelivery
* echo /var/qmail/bin/dirmaker > dirmaker
* echo 0 > ldapcluster
* id -g vmail > ldapgid
* echo /home/vmail > ldapmessagestore
* echo qmailUser > ldapobjectclass
* echo secret > ldappassword
* echo 127.0.0.1 > ldapserver
* id -u vmail > ldapuid
* echo 80000000 > qmail-smtpd-softlimit
* echo 80000000 > qmail-pop3d-softlimit
* echo 3 > qmail-pop3d-loglevel
* echo 3 > qmail-start-loglevel
* echo groupvama.com > defaultdomain
* echo dc=groupvama,dc=com > ldapbasedn
* echo cn=Manager,dc=groupvama,dc=com > ldaplogin
* echo mail.groupvama.com > me

'''Qmail2 Daemons '''

Now create qmail2-smtpd and qmail2-send daemons

* Create /var/qmail2/rc

<nowiki>#!/bin/sh</nowiki>

QLOG="`cat /var/qmail2/control/qmail-start-loglevel`"

DEFD="`cat /var/qmail2/control/defaultdelivery`"

exec env - PATH="/var/qmail2/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

* chmod 755 /var/qmail2/rc

'''Create supervise directories for Qmail2-send and Qmail2-smtpd and log directories '''

* mkdir -p /var/qmail2/supervise/qmail2-smtpd/log
* mkdir -p /var/qmail2/supervise/qmail2-send/log
* mkdir -p /var/log/qmail2/qmail2-smtpd/
* mkdir -p /var/log/qmail2/qmail2-send/
* chown -R qmaill.nofiles /var/log/qmail2/

'''Daemon for Qmail2-send '''

* vim /var/qmail2/supervise/qmail2-send/run

<nowiki>#!/bin/sh</nowiki>

exec /var/qmail2/rc

* chmod 755 /var/qmail2/supervise/qmail2-send/run

'''Log daemon for Qmail2-send '''

* vim/var/qmail2/supervise/qmail2-send/log/run

<nowiki>#!/bin/sh</nowiki>

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail2/qmail2-send 2>&1

'''Daemon for Qmail2-smtpd '''

* vim /var/qmail2/supervise/qmail2-smtpd/run

<nowiki>#!/bin/sh</nowiki>

QMAILQUEUE="/var/qmail2/bin/qmail-tail"; export QMAILQUEUE

QUID=`id -u qmaild`

QGID=`id -g qmaild`

MAXD=`head -1 /var/qmail2/control/concurrencyincoming`

HOST=`head -1 /var/qmail2/control/me`

SOFT=`head -1 /var/qmail2/control/qmail-smtpd-softlimit`

CDBF="/etc/tcp.smtp.cdb"

<nowiki>if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then</nowiki>

echo QUID, QGID, MAXD, or HOST is unset in

echo /var/qmail/supervise/qmail-smtpd/run

exit 1

fi

exec /usr/local/bin/softlimit -m $SOFT \

/usr/local/bin/tcpserver -v \

-H \

-R \

-l $HOST \

-x $CDBF \

-c $MAXD \

-u $QUID \

-g $QGID \

0 \

qmail-second \

/var/qmail2/bin/qmail-smtpd \

/var/qmail2/bin/auth_smtp /usr/bin/true 2>&1

* chmod 755 /var/qmail2/supervise/qmail2-smtpd/run

'''Log daemon for Qmail2-smtpd '''

* vim /var/qmail2/supervise/qmail2-smtpd/log/run

<nowiki>#!/bin/sh</nowiki>

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail2/qmail2-smtpd 2>&1

* chmod 755 /var/qmail2/supervise/qmail2-smtpd/log/run

'''Link these file to /service '''

* ln -s /var/qmail2/supervise/qmail2-smtpd /service/
* ln -s /var/qmail2/supervise/qmail2-send /service/

'''Restart the Qmail via inttab process '''

<center>'''Testing of Qmail - Second instance'''</center>

* telnet to port 900 and send the mail .
* check for logs /var/log/qmail2/qmail2-send/current or /var/log/qmail2/qmail2-smtpd/current

= Disclaimer Related Implementation =
'''Install bglibs for qmail2'''

* cd /downloads/
* rpm –Uvh bglibs-1.022-1.i386.rpm ( get it from [http://untroubled.org/bglibs/ http://untroubled.org/bglibs/] )

or

* tar -xvfz bglibs-1.022-1.tar.gz
* cd bglibs-1.022-1
* make
* make install

'''Install altermime for qmail2'''

* tar xvzf altermime-0.3.6.tar.gz (get it from [http://www.pldaniels.com/altermime/ http://www.pldaniels.com/altermime/] )
* cd altermime-0.3.6
* make
* make install

'''Install qmail-qfilter for qmail2'''

* tar xvzf qmail-qfilter-2.1.tar.gz ([http://untroubled.org/qmail-qfilter/ http://untroubled.org/qmail-qfilter/])
* cd qmail-qfilter-2.1
* vi qmail-qfilter.c

( change qmail into qmail2 )

<nowiki>#ifndef QMAIL_QUEUE </nowiki>

<nowiki>#define QMAIL_QUEUE "/var/</nowiki>qmail2/bin/qmail-queue"

<nowiki>#endif </nowiki>

* make
* make install
* chmod 777 /usr/local/bin/qmail-qfilter
* chown root:qmail /usr/local/bin/qmail-qfilter

'''Disclaimer Settings'''

* vi /var/qmail2/bin/qmail-tail

<nowiki>#!/bin/sh</nowiki>

exec /usr/local/bin/qmail-qfilter /var/qmail2/bin/qmail-disclaimer

* chown root:qmail /var/qmail2/bin/qmail-tail
* chmod 777 /var/qmail2/bin/qmail-tail
* mkdir /var/qmail2/control/disclaimer/
* cd /var/qmail2/control/disclaimer
* vim groupvama.com.html

<nowiki><html></nowiki>

<nowiki><body></nowiki>

DISCLAIMER:

This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorised use or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

<nowiki></body></nowiki>

<nowiki></html></nowiki>

* vim gropvama.com.txt

This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized use or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

* chown root:qmail /var/qmail2/control/disclaimer/*
* chmod 777 /var/qmail2/control/disclaimer/*
* mkdir /var/tmp/qmail-qfilter
* chown root:qmail /var/tmp/qmail-qfilter
* chmod 777 /var/tmp/qmail-qfilter
* vi /var/qmail2/bin/qmail-disclaimer

<nowiki>#!/bin/sh</nowiki>

QMAILHOST=groupvama.com

INSPECT_DIR=/var/tmp/qmail-qfilter

<nowiki>if [ ! -f /var/qmail2/control/disclaimer/$QMAILHOST.txt ]</nowiki>

then

cat

exit 0

fi

EX_TEMPFAIL=31

EX_UNAVAILABLE=31

trap "rm -f /var/tmp/qmail-qfilter/in.$$" 0 1 2 3 15

cd $INSPECT_DIR || { echo Error: $INSPECT_DIR does not exist; exit $EX_TEMPFAIL; }

cat >$INSPECT_DIR/in.$$ || { echo Error: Cannot write to disk; exit $EX_TEMPFAIL; }

/usr/local/bin/altermime --input=$INSPECT_DIR/in.$$ \

--xheader="X-Disclaimer: $QMAILHOST" \

--disclaimer=/var/qmail2/control/disclaimer/$QMAILHOST.txt \

--disclaimer-html=/var/qmail2/control/disclaimer/$QMAILHOST.html || { echo Error: message rejected; exit $EX_UNAVAILABLE; }

cat $INSPECT_DIR/in.$$

rm in.$$

exit $?

* chown root:qmail /var/qmail2/bin/qmail-disclaimer
* chmod 777 /var/qmail2/bin/qmail-disclaimer

== Activation of Qmail2 ==
'''Changes on Qmail2-Send run file '''

* vi /service/qmail2-smtpd/run

( add following line at the top )

<nowiki>#!/bin/sh</nowiki>

QMAILQUEUE="/var/qmail2/bin/qmail-tail"; export QMAILQUEUE

Also Make sure the Qmail-smtpd is running on port 900 by

* vi /etc/services

<nowiki># Local services</nowiki>

second-qmail 900/tcp

'''Integrate Qmail with Qmail2 '''

vi /var/qmail/control/smtproutes

:127.0.0.1:900

'''Note: Then restart the qmail from /etc/inittab file'''

== Testing ==
* Telnet and send mail via Qmail-2 , you should get the disclaimer
* Test via offline Client like Evolution , Outlook etc . You should get the mail with

== Troubleshooting ==
* QQ error while sending mails

Check the smtp logs , if find error like

''/usr/local/bin/qmail-qfilter: error while loading shared libraries: libbg-sysdeps.so.1: cannot open shared object file: No such file or directory''

Then

you have to link libbg-sysdeps.so.1 to /usr/lib

* ln -s /usr/local/bglibs/lib/libbg-sysdeps.so.1 /usr/lib/

This should solve the issue

* 2. Some time the Qmail-1 is not able to deliver mails to Qmail-2 instance due to /var/tmp/qmail-qfilter directory is not there or vanishes. So a script to check and create the directory with cron is created for taking care of this issue.

The script is /usr/bin/check_qmail-qfilter_dir.sh

<nowiki>#!/bin/sh</nowiki>

DIRECTORY=/var/tmp/qmail-qfilter

<nowiki>if [ ! -d "$DIRECTORY" ]; then</nowiki>

mkdir -p $DIRECTORY;

chmod 777 $DIRECTORY;

chown -R root.qmail $Directory

fi

The cron entry is as follows

* crontab -e

<nowiki>*/5 * * * * /usr/bin/check_qmail-qfilter_dir.sh</nowiki>

<center>'''OPENLDAP MASTER SLAVE'''</center>

'''Openldap master (slapd.conf)'''

* Vim /etc/openldap/ldap.conf

BASE dc=groupvama,dc=com

URI ldap://127.0.0.1/

* Vim /etc/openldap/slapd.conf

<nowiki>#</nowiki>

<nowiki># See slapd.conf(5) for details on configuration options.</nowiki>

<nowiki># This file should NOT be world readable.</nowiki>

<nowiki>#</nowiki>

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/qmail.schema

include /etc/openldap/schema/dnszone.schema

<nowiki># Allow LDAPv2 client connections. </nowiki>This is NOT the default.

allow bind_v2

<nowiki># Do not enable referrals until AFTER you have a working directory</nowiki>

<nowiki># service AND an understanding of referrals.</nowiki>

<nowiki>#referral </nowiki>ldap://root.openldap.org

pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args

<nowiki># Load dynamic backend modules:</nowiki>

<nowiki># modulepath </nowiki>/usr/lib64/openldap

<nowiki># Modules available in openldap-servers-overlays RPM package</nowiki>

<nowiki># Module syncprov.la is now statically linked with slapd and there</nowiki>

<nowiki># is no need to load it here</nowiki>

<nowiki># moduleload accesslog.la</nowiki>

<nowiki># moduleload auditlog.la</nowiki>

<nowiki># moduleload denyop.la</nowiki>

<nowiki># moduleload dyngroup.la</nowiki>

<nowiki># moduleload dynlist.la</nowiki>

<nowiki># moduleload lastmod.la</nowiki>

<nowiki># moduleload pcache.la</nowiki>

<nowiki># moduleload ppolicy.la</nowiki>

<nowiki># moduleload refint.la</nowiki>

<nowiki># moduleload retcode.la</nowiki>

<nowiki># moduleload rwm.la</nowiki>

<nowiki># moduleload smbk5pwd.la</nowiki>

<nowiki># moduleload translucent.la</nowiki>

<nowiki># moduleload unique.la</nowiki>

<nowiki># moduleload valsort.la</nowiki>

<nowiki># modules available in openldap-servers-sql RPM package:</nowiki>

<nowiki># moduleload back_sql.la</nowiki>

<nowiki># The next three lines allow use of TLS for encrypting connections using a</nowiki>

<nowiki># dummy test certificate which you can generate by changing to</nowiki>

<nowiki># /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on</nowiki>

<nowiki># slapd.pem so that the ldap user or group can read it. </nowiki>Your client software

<nowiki># may balk at self-signed certificates, however.</nowiki>

<nowiki># TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt</nowiki>

<nowiki># TLSCertificateFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># Sample security restrictions</nowiki>

<nowiki># </nowiki>Require integrity protection (prevent hijacking)

<nowiki># </nowiki>Require 112-bit (3DES or better) encryption for updates

<nowiki># </nowiki>Require 63-bit encryption for simple bind

<nowiki># security ssf=1 update_ssf=112 simple_bind=64</nowiki>

<nowiki># Sample access control policy:</nowiki>

<nowiki># </nowiki>Root DSE: allow anyone to read it

<nowiki># </nowiki>Subschema (sub)entry DSE: allow anyone to read it

<nowiki># </nowiki>Other DSEs:

<nowiki># </nowiki>Allow self write access

<nowiki># </nowiki>Allow authenticated users read access

<nowiki># </nowiki>Allow anonymous users to authenticate

<nowiki># </nowiki>Directives needed to implement policy:

<nowiki># access to dn.base="" by * read</nowiki>

<nowiki># access to dn.base="cn=Subschema" by * read</nowiki>

<nowiki># access to *</nowiki>

<nowiki># </nowiki>by self write

<nowiki># </nowiki>by users read

<nowiki># </nowiki>by anonymous auth

<nowiki>#</nowiki>

<nowiki>#access to *</nowiki>

<nowiki># </nowiki>by dn.exact="cn=Manager,dc=groupvama,dc=com" read

<nowiki># </nowiki>by * none

<nowiki># if no access controls are present, the default policy</nowiki>

<nowiki># allows anyone and everyone to read anything but restricts</nowiki>

<nowiki># updates to rootdn. </nowiki>(e.g., "access to * by * read")

<nowiki># modules available in openldap-servers-sql RPM package:</nowiki>

<nowiki># moduleload back_sql.la</nowiki>

<nowiki># The next three lines allow use of TLS for encrypting connections using a</nowiki>

<nowiki># dummy test certificate which you can generate by changing to</nowiki>

<nowiki># /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on</nowiki>

<nowiki># slapd.pem so that the ldap user or group can read it. </nowiki>Your client software

<nowiki># may balk at self-signed certificates, however.</nowiki>

<nowiki># TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt</nowiki>

<nowiki># TLSCertificateFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># Sample security restrictions</nowiki>

<nowiki># </nowiki>Require integrity protection (prevent hijacking)

<nowiki># </nowiki>Require 112-bit (3DES or better) encryption for updates

<nowiki># </nowiki>Require 63-bit encryption for simple bind

<nowiki># security ssf=1 update_ssf=112 simple_bind=64</nowiki>

<nowiki># Sample access control policy:</nowiki>

<nowiki># </nowiki>Root DSE: allow anyone to read it

<nowiki># </nowiki>Subschema (sub)entry DSE: allow anyone to read it

<nowiki># </nowiki>Other DSEs:

<nowiki># </nowiki>Allow self write access

<nowiki># </nowiki>Allow authenticated users read access

<nowiki># </nowiki>Allow anonymous users to authenticate

<nowiki># </nowiki>Directives needed to implement policy:

<nowiki># access to dn.base="" by * read</nowiki>

<nowiki># access to dn.base="cn=Subschema" by * read</nowiki>

<nowiki># access to *</nowiki>

<nowiki># </nowiki>by self write

<nowiki># </nowiki>by users read

<nowiki># </nowiki>by anonymous auth

<nowiki>#</nowiki>

<nowiki>#access to *</nowiki>

<nowiki># </nowiki>by dn.exact="cn=Manager,dc=groupvama,dc=com" read

<nowiki># </nowiki>by * none

<nowiki># if no access controls are present, the default policy</nowiki>

<nowiki># allows anyone and everyone to read anything but restricts</nowiki>

<nowiki># updates to rootdn. </nowiki>(e.g., "access to * by * read")

<nowiki>#</nowiki>

<nowiki># rootdn can always read and write EVERYTHING!</nowiki>

<nowiki>#######################################################################</nowiki>

<nowiki># ldbm and/or bdb database definitions</nowiki>

<nowiki>#######################################################################</nowiki>

serverID 001

database bdb

suffix "dc=groupvama,dc=com"

rootdn "cn=Manager,dc=groupvama,dc=com"

<nowiki># Cleartext passwords, especially for the rootdn, should</nowiki>

<nowiki># be avoided. </nowiki>See slappasswd(8) and slapd.conf(5) for details.

<nowiki># Use of strong authentication encouraged.</nowiki>

rootpw MiraE#1920

<nowiki># rootpw </nowiki>{crypt}ijFYNcSNctBYg

<nowiki># The database directory MUST exist prior to running slapd AND</nowiki>

<nowiki># should only be accessible by the slapd and slap tools.</nowiki>

<nowiki># Mode 700 recommended.</nowiki>

directory /var/lib/ldap

<nowiki># Indices to maintain for this database</nowiki>

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub

<nowiki># Replicas of this database</nowiki>

<nowiki>#replogfile /var/lib/ldap/openldap-master-replog</nowiki>

<nowiki>#replica host=ldap-1.example.com:389 starttls=critical</nowiki>

<nowiki># </nowiki>bindmethod=sasl saslmech=GSSAPI

<nowiki># </nowiki>authcId=host/ldap-master.example.com@EXAMPLE.COM

overlay syncprov

syncprov-checkpoint 100 10

syncprov-sessionlog 100

replica uri=ldap://182.71.29.139:389

binddn="cn=Manager,dc=groupvama,dc=com"

bindmethod=simple credentials=MiraE#1920

'''Openldap slave (slapd.conf)'''

* '''Vim /etc/openldap/slapd.conf'''

<nowiki>#</nowiki>

<nowiki># See slapd.conf(5) for details on configuration options.</nowiki>

<nowiki># This file should NOT be world readable.</nowiki>

<nowiki>#</nowiki>

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/qmail.schema

<nowiki># Allow LDAPv2 client connections. </nowiki>This is NOT the default.

allow bind_v2

<nowiki># Do not enable referrals until AFTER you have a working directory</nowiki>

<nowiki># service AND an understanding of referrals.</nowiki>

<nowiki>#referral </nowiki>ldap://root.openldap.org

pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args

<nowiki># Load dynamic backend modules:</nowiki>

<nowiki># modulepath </nowiki>/usr/lib/openldap

<nowiki># Modules available in openldap-servers-overlays RPM package</nowiki>

<nowiki># Module syncprov.la is now statically linked with slapd and there</nowiki>

<nowiki># is no need to load it here</nowiki>

<nowiki># moduleload accesslog.la</nowiki>

<nowiki># moduleload auditlog.la</nowiki>

<nowiki># moduleload denyop.la</nowiki>

<nowiki># moduleload dyngroup.la</nowiki>

<nowiki># moduleload dynlist.la</nowiki>

<nowiki># moduleload lastmod.la</nowiki>

<nowiki># moduleload pcache.la</nowiki>

<nowiki># moduleload ppolicy.la</nowiki>

<nowiki># moduleload refint.la</nowiki>

<nowiki># moduleload retcode.la</nowiki>

<nowiki># moduleload rwm.la</nowiki>

<nowiki># moduleload smbk5pwd.la</nowiki>

<nowiki># moduleload translucent.la</nowiki>

<nowiki># moduleload unique.la</nowiki>

<nowiki># moduleload valsort.la</nowiki>

<nowiki># modules available in openldap-servers-sql RPM package:</nowiki>

<nowiki># moduleload back_sql.la</nowiki>

<nowiki># The next three lines allow use of TLS for encrypting connections using a</nowiki>

<nowiki># dummy test certificate which you can generate by changing to</nowiki>

<nowiki># /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on</nowiki>

<nowiki># slapd.pem so that the ldap user or group can read it. </nowiki>Your client software

<nowiki># may balk at self-signed certificates, however.</nowiki>

<nowiki># TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt</nowiki>

<nowiki># TLSCertificateFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># Sample security restrictions</nowiki>

<nowiki># </nowiki>Require integrity protection (prevent hijacking)

<nowiki># </nowiki>Require 112-bit (3DES or better) encryption for updates

<nowiki># </nowiki>Require 63-bit encryption for simple bind

<nowiki># security ssf=1 update_ssf=112 simple_bind=64</nowiki>

<nowiki># Sample access control policy:</nowiki>

<nowiki># </nowiki>Root DSE: allow anyone to read it

<nowiki># </nowiki>Subschema (sub)entry DSE: allow anyone to read it

<nowiki># </nowiki>Other DSEs:

<nowiki># </nowiki>Allow self write access

<nowiki># </nowiki>Allow authenticated users read access

<nowiki># </nowiki>Allow anonymous users to authenticate

<nowiki># </nowiki>Directives needed to implement policy:

<nowiki># access to dn.base="" by * read</nowiki>

<nowiki># access to dn.base="cn=Subschema" by * read</nowiki>

<nowiki># access to *</nowiki>

<nowiki># </nowiki>by self write

<nowiki># </nowiki>by users read

<nowiki># </nowiki>by anonymous auth

<nowiki>#</nowiki>

<nowiki># if no access controls are present, the default policy</nowiki>

<nowiki># allows anyone and everyone to read anything but restricts</nowiki>

<nowiki># updates to rootdn. </nowiki>(e.g., "access to * by * read")

<nowiki>#</nowiki>

<nowiki># rootdn can always read and write EVERYTHING!</nowiki>

<nowiki>#access to *</nowiki>

<nowiki># </nowiki>by dn.exact="cn=Manager,dc=groupvama,dc=com" read

<nowiki># </nowiki>by * none

<nowiki>#######################################################################</nowiki>

<nowiki># ldbm and/or bdb database definitions</nowiki>

<nowiki>#######################################################################</nowiki>

serverID 002

database bdb

<nowiki>#suffix </nowiki>"dc=my-domain,dc=com"

<nowiki>#rootdn </nowiki>"cn=Manager,dc=my-domain,dc=com"

suffix "dc=groupvama,dc=com"

rootdn "cn=Manager,dc=groupvama,dc=com"

<nowiki># Cleartext passwords, especially for the rootdn, should</nowiki>

<nowiki># be avoided. </nowiki>See slappasswd(8) and slapd.conf(5) for details.

<nowiki># Use of strong authentication encouraged.</nowiki>

<nowiki># rootpw </nowiki>secret

<nowiki># rootpw </nowiki>{crypt}ijFYNcSNctBYg

rootpw MiraE#1920

<nowiki># The database directory MUST exist prior to running slapd AND</nowiki>

<nowiki># should only be accessible by the slapd and slap tools.</nowiki>

<nowiki># Mode 700 recommended.</nowiki>

directory /var/lib/ldap

<nowiki># Indices to maintain for this database</nowiki>

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub

<nowiki># Replicas of this database</nowiki>

<nowiki>#replogfile /var/lib/ldap/openldap-master-replog</nowiki>

<nowiki>#replica host=ldap-1.example.com:389 starttls=critical</nowiki>

<nowiki># </nowiki>bindmethod=sasl saslmech=GSSAPI

<nowiki># </nowiki>authcId=host/ldap-master.example.com@EXAMPLE.COM

<nowiki>#syncrepl rid=001</nowiki>

<nowiki>#provider=ldap://182.71.29.139</nowiki>

<nowiki>#type=refreshAndPersist</nowiki>

<nowiki>#searchbase="dc=groupvama,dc=com"</nowiki>

<nowiki>#filter="(objectClass=*)"</nowiki>

<nowiki>#scope=sub</nowiki>

<nowiki>#attrs="*"</nowiki>

<nowiki>#bindmethod=simple</nowiki>

<nowiki>#binddn="cn=Manager,dc=groupvama,dc=com"</nowiki>

<nowiki>#credentials=MiraE#1920</nowiki>

syncrepl rid=001

provider=ldap://182.71.29.139

type=refreshAndPersist

retry="60 +"

searchbase="dc=groupvama,dc=com"

scope=sub

schemachecking=on

bindmethod=simple

binddn="cn=Manager,dc=groupvama,dc=com"

credentials=MiraE#1920

mirrormode on

Then restart ldap on both automatically master slave synchronize.

User:Ranjit

2013-08-19T11:18:51Z

Ranjit:

----
SERVER IS NOT GETTING START AND SHOWING THIS ERROR

EXT3-fs: unable to read superblock
mount: error mounting /dev/root on /sysroot as ext3: Invalid argument
Setting up other filesystems.
Setting up new root fs
setuproot: moving /dev failed: No such file or directory
no fstab.sys, mounting internal defaults
setuproot: error mounting /proc: No such file or directory
setuproot: error mounting /sys: No such file or directory
Switching to new root and running init.
unmounting old /dev
unmounting old /proc
unmounting old /sys
switchroot: mount failed: No such file or directory
Kernel panic - Not syncing: Attempted to kill init!

Note: actually this problem is coming when superblock of root partition are crrupted. therefore you are not able to mount your partition because file system of that partition is not working properly.

Sulation:-

Step-1. Go to rescure mode through CentOS DVD.

Note: If your Hard drive is not detecting/showing in rescure mode then boot from Ubuntu live Dvd for temporary use Ubuntu.

Step-2. Use following command to recover superblock.

#dumpe2fs /dev/sda2 | grep superblock

#fsck -b 32768 /dev/sda2
or #e2fsck -b 32768 /dev/sda2

Now reboot sysytem...

----

User:Ranjit

2013-08-19T11:15:19Z

Ranjit:

User:Ranjit

2013-08-19T10:57:10Z

Ranjit: Created page with "SERVER IS NOT GETTING START AND SHOWING THIS ERROR EXT3-fs: unable to read superblock mount: error mounting /dev/root on /sysroot as ext3: Invalid argument Setting up other ..."

SERVER IS NOT GETTING START AND SHOWING THIS ERROR

EXT3-fs: unable to read superblock
mount: error mounting /dev/root on /sysroot as ext3: Invalid argument
Setting up other filesystems.
Setting up new root fs
setuproot: moving /dev failed: No such file or directory
no fstab.sys, mounting internal defaults
setuproot: error mounting /proc: No such file or directory
setuproot: error mounting /sys: No such file or directory
Switching to new root and running init.
unmounting old /dev
unmounting old /proc
unmounting old /sys
switchroot: mount failed: No such file or directory
Kernel panic - Not syncing: Attempted to kill init!

Note: actually this problem is coming when superblock of root partition are crrupted. therefore you are not able to mount your partition because file system of that partition is not working properly.

Sulation:-

Step-1. Go to rescure mode through CentOS DVD.

Note: If your Hard drive is not detecting/showing in rescure mode then boot from Ubuntu live Dvd for temporary use Ubuntu.

Step-2. Use following command to recover superblock.

#dumpe2fs /dev/sda2 | grep superblock

#fsck -b 32768 /dev/sda2
or #e2fsck -b 32768 /dev/sda2

Now reboot sysytem...