IIEST final report
Auto-generated from the uploaded PDF IIEST_final_report.pdf. This is an extracted-text rendering for searchability; see the original PDF for exact formatting, diagrams, tables, and images.
Table Of Contents
Table of Contents
OS Version in Old Live server was – CentOS 6.5 ..................................................................................... 2
1.1 Zimbra Version – 8.6.0_GA_1153.FOSS ....................................................................................... 3
1.2 Total No of Servers – 1 ................................................................................................................. 3
1.3 Total No of Accounts – 3632 ........................................................................................................ 4
1.4 No of domains – 71 ..................................................................................................................... 4
1.5 SSL – Expires on Oct 29, 2023. By Sectigo Limited....................................................................... 5
1.6 Data – 2.3 TB ................................................................................................................................ 6
Installation of OS RHEL 8.7:..................................................................................................................... 7
Installation & Configuration of Zimbra ................................................................................................. 12
1.1 Prerequisites :- ........................................................................................................................... 12
1.2 DNS Configuration: .................................................................................................................... 12
1.3 Other Host Configurations ......................................................................................................... 15
Zimbra Installation ................................................................................................................................ 16
3.1 Log onto the Administration Console ........................................................................................ 29
Zimbra Migration .................................................................................................................................. 30
Installing DRBD on both the nodes : ..................................................................................................... 35
Configuration of Spam Filtering ............................................................................................................ 40
1.1 Outright Blocking With Postfix DNS Protocol Checks ................................................................ 40
1.2 Outright Blocking of Bad Sending Servers ................................................................................. 40
1.3 Outright Blocking of Certain Attachments ................................................................................. 40
1.4 Enforcing a match between FROM address and sasl username................................................ 42
1.5 Tuning SpamTag and SpamKill ................................................................................................... 43
1.6 Cbpolicy webui activated, and it’s authentication implemented. ............................................. 44
OS Version in Old Live server was – CentOS 6.5
1.1 Zimbra Version – 8.6.0_GA_1153.FOSS
1.2 Total No of Servers – 1
1.3 Total No of Accounts – 3632
1.4 No of domains – 71
1.5 SSL – Expires on Oct 29, 2023. By Sectigo
Limited.
1.6 Data – 2.3 TB
Installation of OS RHEL 8.7:
2.1. Download the RHEL 8.7 ISO image.
2.2. Make a bootable pen drive with the ISO image.
2.3. Insert the pen drive & boot the server.
2.4. Press F11 for Boot Menu
2.5. Select the USB drive and start Installation.
2.6. Partitioning done –
/opt – 6200G
/ - 420G
Swap – 64G
/boot – 1G
2.7. Select Timezone, language, set root and admin account passswords. Login to RedHat
account and attach subscription via the subscription manager. Begin installation.
2.8. Complete the installation and reboot.
Installation & Configuration of Zimbra
1.1 Prerequisites :-
• Install the following packages - Perl perl-core nmap libidn gmp libaio libstdc++ unzip sysstat
wget .
• # yum install perl perl-core nmap libidn gmp libaio libstdc++ unzip sysstat wget
1.2 DNS Configuration:
When you create a domain during the installation process, ZCS checks to see if you have an
MX record correctly configured. If it is not, an error is displayed suggesting that the domain name have
an MX record configured in DNS.
• Install dns (bind) packages by below command:
# yum install bind bind-chroot bind-utils
• Enable named service on system boot time by below command:
# systemctl enable named
• Make the entry of your IP in /etc/named.conf file in the listen-on port line. Also add the IP
address in the allow query line.
• Create zone file location configuration for domains.
• Create forward zone file -
[root@node1 ]# vi /var/named/node1.iiests.ac.in.hosts
1.3 Other Host Configurations
• Enter the Zimbra hostname and IP address in /etc/hosts file. Also enter the external ldap
details in the file.
• Disable postfix - # systemctl disable postfix
• Make the Selinux permanently disabled –
[root@node1 ~]# vi /etc/selinux/config
Zimbra Installation
• Change directory to /opt - # cd /opt
• Download Zimbra 8.8.15
# wget https://files.zimbra.com/downloads/8.8.15_GA/zcs-
8.8.15_GA_3953.RHEL8_64.20200629025823.tgz
• Unzip the file –
# tar -xvzf zcs-8.8.15_GA_3953.RHEL8_64.20200629025823.tgz
• Change directory to zcs-8.8.15
# cd zcs-8.8.15_GA_3953.RHEL8_64.20200629025823
• Execute the installation script –
# ./install.sh
Press 4 to set admin password
Installing Zimlets
Installation completed.
3.1 Log onto the Administration Console
Open any of your favorite web browser and access the zimbra web administration console with your
10.1.0.77 or hostname and supply the credentials.
https://mail.iiests.ac.in:7071
https://10.1.0.77:7071
Zimbra Migration
4.1 Make sure that the hostname, admin user and password, ldap password and mysql password are
set same as the old server.
4.2 Preparing the Old Server –
1. Create an LDAP dump directory. As root, type
a. mkdir /backup
b. chown zimbra:zimbra /backup
2. Backup the LDAP data, as zimbra, type
/opt/zimbra/libexec/zmslapcat /backup
3. Export MySQL data. Before you start, make sure that /backup is large enough to hold all the
data. Depending on the original database size, this can be very large. If you have large configuration,
you may want to run this command with nohup so that the session does not terminate. Type
/opt/zimbra/common/bin/mysqldump -f -S /opt/zimbra/data/tmp/mysql/mysql.sock \
-u zimbra --password=`zmlocalconfig -s -m nokey \
zimbra_mysql_password` --all-databases --single-transaction \
> /backup/mysql.sql
4.3 Preparing the New Server
1. LDAP data import on new server –
As Zimbra
Stop ldap – $ ldap stop
Cleanup the old database and move it to a new location
$ cd /opt/Zimbra/data/ldap
$ mv mdb mdb.old
Create the new directory structure –
$ mkdir -p mdb/db
Import the data –
$ /opt/Zimbra/libexec/zmslapadd /backup/ldap.bak
2. Mysql import –
$ mysql.server start [start mysql]
$ mysql -f zimbra < /backup/mysql.sql
$ mysql.server stop
3. Edit /opt/zimbra/conf/localconfig.xml to update the following password values to the values
from the localconfig.xml file on the old server:
Mysql passwords :
▪ zimbra_mysql_password
▪ mysql_root_password
LDAP password values:
◦ ldap_amavis_password
◦ ldap_nginx_password
◦ ldap_postfix_password
◦ ldap_replication_password
◦ ldap_root_password
◦ zimbra_ldap_password
4. Moving the email store and index:
Rsync the /opt/Zimbra/store/* and /opt/Zimbra/index/*
4.4 Stop Zimbra on old live server .
4.5 On New server
• Assign the IP to the new server. Add the external ldap, and public IPs in the /etc/hosts file.
• Change the IP in the named.conf and forward zone file.
• Sync both transport files and postmap it.
4.6 Zimbra is Live on New server.
Release 8.8.15_GA_3953.RHEL8_64_20200629025823 RHEL8_64 FOSS edition, Patch 8.8.15_P39.
All the Zimbra services are running
Emails sent in the year 2012 and received in 2013 successfully migrated to new server.
Zimbra logo successfully replaced by IIEST SHIBPUR Logo
Installing DRBD on both the nodes :
DRBD (Distributed Replicated Block Device) is a software-based, shared-nothing, replicated
storage solution mirroring the content of block devices (hard disks, partitions, logical volumes etc.)
between hosts.
DRBD mirrors data:
in real time: Replication occurs continuously while applications modify the data on the device.
transparently: Applications need not be aware that the data is stored on multiple hosts.
synchronously: With synchronous mirroring, applications are notified of write completions after
the writes have been carried out on all (connected) hosts.
Install DRBD 9.0 from ELREPO
To install ELREPO, first you should import the GPG key or else the GPG check will fail later.
# rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
Next install the ELPO repo
# rpm -Uvh https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
Once the elpo-release rpm is installed on both the nodes, use dnf to lookup drbd package
# dnf search drbd
============================================================== Name &
Summary Matched: drbd
===============================================================
kmod-drbd90.x86_64 : drbd90 kernel module(s)
collectd-drbd.x86_64 : DRBD plugin for collectd
drbd90-utils.x86_64 : Management utilities for DRBD
drbd90-utils-sysvinit.x86_64 : The SysV initscript to manage the DRBD.
drbdlinks.noarch : Program for managing links into a DRBD shared
partition
Install the DRBD 9 packages
# dnf install kmod-drbd90.x86_64 drbd90-utils.x86_64 -y
5 Configuring DRBD
• Configure a simple global_common.conf
# vi /etc/drbd.d/global_common.conf
global {
usage-count no;
}
common {
net {
protocol C;
}
}
• usage-count :-
The usage-count no line in the global section skips sending a notice to the DRBD team each
time a new version of the software is installed in your system.
• protocol C :-
The protocol C line tells the DRBD resource to use a fully synchronous replication.
This means that local write operations on the node that is functioning as primary are
considered completed only after both the local and remote disk writes have been confirmed.
Thus, if we run into the loss of a single node, that should not lead to any data loss under
normal circumstances, unless both nodes (or their storage subsystems) are irreversibly
destroyed at the same time.
Create DRBD resource :-
# vi /etc/drbd.d/drbd1.res
• By default DRBD uses port between 7788-7790, we have explicitly defined port number as
7789.
• Our DRBD device resource would be /dev/drbd1 i.e. the logical volumes from all the cluster
nodes would use /dev/drbd1 to perform Linux disk replication
• Next we must copy the DRBD resource file to all the cluster nodes
• When we installed DRBD earlier, a utility called drbdadm was installed as well,
drbdadm is intended to be used for the administration of DRBD resources.
• Create the meta-data –
# drbdadm create-md drbd1
The first step of Linux Disk Replication in starting and bringing a DRBD resource online is to
initialize its metadata
So our DRBD device /dev/drbd1 is ready.
• Repeat the same steps on both the nodes for DRBD configuration.
• Check DRBD Device status
• # drbdadm status drbd1 – It will show as secondary, we will have to force it to make it primary.
• Make the node1 as primary
# drbdadm primary --force drbd1
• # drbdadm status drbd1 – It will show node1 as primary, but inconsistent as we have not
connected and synced the node2 yet.
• Format to ext4 file system
# mkfs.ext4 /dev/drbd1
• Mount /dev/drbd1 on /opt inside which we have Zimbra installed and configured.
# mount /dev/drbd1 /opt
•
• # drbdadm connect all – to connect both the nodes.
It will start the syncing from primary to secondary node.
• # drbdsetup status --statistics --verbose drbd1 – this will show the detailed status and
percentage of data synced from primary to secondary node.
• After sync completion both the nodes are displayed as “UpToDate”
Configuration of Spam Filtering
1.1 Outright Blocking With Postfix DNS Protocol
Checks
zmprov mcf +zimbraMtaRestriction reject_non_fqdn_sender
zmprov mcf +zimbraMtaRestriction reject_unknown_sender_domain
zmprov mcf +zimbraMtaRestriction reject_unknown_reverse_client_hostname
The “reject_unknown_sender_domain” according to the Postfix documentation, performs some
specific checks to ensure the sender’s domain actually exists in public DNS. If the sender’s domain
doesn’t exist, the email is not accepted. Similarly, the “reject_non_fqdn_sender” check will reject
the email if the MAIL FROM isn’t a properly-formed email address.
1.2 Outright Blocking of Bad Sending Servers
Now we start using blocklists within Postfix, and their are two kinds: “RBLs” or left-hand-side
blocklists, and RHSBLs or right-hand-side blocklists. RBLs list IP addresses; RHSBLs list domains.
zmprov mcf +zimbraMtaRestriction "reject_rbl_client b.barracudacentral.org"
Here, we use a free block list from Barracuda.
1.3 Outright Blocking of Certain Attachments
By default, Zimbra does not block what could be dangerous email attachments, like Visual
Basic scripts, Windows Registry edits etc. So, we need to block those attachments
zmprov mcf +zimbraMtaBlockedExtension asd
zmprov mcf +zimbraMtaBlockedExtension bat
zmprov mcf +zimbraMtaBlockedExtension cab
zmprov mcf +zimbraMtaBlockedExtension chm
zmprov mcf +zimbraMtaBlockedExtension cmd
zmprov mcf +zimbraMtaBlockedExtension com
zmprov mcf +zimbraMtaBlockedExtension cpl
zmprov mcf +zimbraMtaBlockedExtension cpgz
zmprov mcf +zimbraMtaBlockedExtension dll
zmprov mcf +zimbraMtaBlockedExtension do
zmprov mcf +zimbraMtaBlockedExtension exe
zmprov mcf +zimbraMtaBlockedExtension hlp
zmprov mcf +zimbraMtaBlockedExtension hta
zmprov mcf +zimbraMtaBlockedExtension html
zmprov mcf +zimbraMtaBlockedExtension js
zmprov mcf +zimbraMtaBlockedExtension jse
zmprov mcf +zimbraMtaBlockedExtension lnk
zmprov mcf +zimbraMtaBlockedExtension ocx
zmprov mcf +zimbraMtaBlockedExtension pif
zmprov mcf +zimbraMtaBlockedExtension reg
zmprov mcf +zimbraMtaBlockedExtension scr
zmprov mcf +zimbraMtaBlockedExtension shb
zmprov mcf +zimbraMtaBlockedExtension shm
zmprov mcf +zimbraMtaBlockedExtension shs
zmprov mcf +zimbraMtaBlockedExtension shtml
zmprov mcf +zimbraMtaBlockedExtension vbe
zmprov mcf +zimbraMtaBlockedExtension vbs
zmprov mcf +zimbraMtaBlockedExtension vbx
zmprov mcf +zimbraMtaBlockedExtension vxd
zmprov mcf +zimbraMtaBlockedExtension wsf
zmprov mcf +zimbraMtaBlockedExtension wsh
zmprov mcf +zimbraMtaBlockedExtension xl
zmprov mcf zimbraMtaBlockedExtensionWarnAdmin TRUE
zmprov mcf zimbraMtaBlockedExtensionWarnRecipient TRUE
zmprov mcf zimbraVirusBlockEncryptedArchive FALSE
1.4 Enforcing a match between FROM address and
sasl username
Update zimbraMtaSmtpdRejectUnlistedRecipient & zimbraMtaSmtpdRejectUnlistedSender
zmprov mcf zimbraMtaSmtpdRejectUnlistedRecipient yes
zmprov mcf zimbraMtaSmtpdRejectUnlistedSender yes
zmmtactl restart
zmconfigdctl restart
Set the zimbraMtaSmtpdSenderLoginMaps portion
zmprov mcf zimbraMtaSmtpdSenderLoginMaps proxy:ldap:/opt/zimbra/conf/ldap-slm.cf
+zimbraMtaSmtpdSenderRestrictions reject_authenticated_sender_login_mismatch
Edit the file smtpd_sender_restrictions
You need to edit the file opt/zimbra/conf/zmconfigd/smtpd_sender_restrictions.cf and add
after the permit_mynetworks the line reject_sender_login_mismatch
vi /opt/zimbra/conf/zmconfigd/smtpd_sender_restrictions.cf
zmconfigd will update the postfix configuration automatically and apply the new rules. Now if
an account is hacked, and this is in place, they will not be able to send out emails with different
"from" addresses.
1.5 Tuning SpamTag and SpamKill
It is important to have updated AntiSpam Rules, updated rules will prevent the spam more
effectively hence make sure to enable the below setting if it is not enabled already.
$ zmlocalconfig -e antispam_enable_rule_updates=true
$ zmlocalconfig -e antispam_enable_restarts=true
Tune the SpamTag and SpamKill percentage.
zmprov mcf zimbraSpamKillPercent 75
zmprov mcf zimbraSpamTagPercent 25
1.6 Cbpolicy webui activated, and it’s authentication
implemented.