Editing IIEST final report

''Auto-generated from the uploaded PDF [[:File:IIEST_final_report.pdf|IIEST_final_report.pdf]]. This is an extracted-text rendering for searchability; see the original PDF for exact formatting, diagrams, tables, and images.''

<pre>
<nowiki>
Table Of Contents


Table of Contents
OS Version in Old Live server was – CentOS 6.5 ..................................................................................... 2

    1.1 Zimbra Version – 8.6.0_GA_1153.FOSS ....................................................................................... 3

    1.2 Total No of Servers – 1 ................................................................................................................. 3

    1.3 Total No of Accounts – 3632 ........................................................................................................ 4

    1.4 No of domains – 71 ..................................................................................................................... 4

    1.5 SSL – Expires on Oct 29, 2023. By Sectigo Limited....................................................................... 5

    1.6 Data – 2.3 TB ................................................................................................................................ 6

Installation of OS RHEL 8.7:..................................................................................................................... 7

Installation & Configuration of Zimbra ................................................................................................. 12

    1.1 Prerequisites :- ........................................................................................................................... 12

    1.2 DNS Configuration: .................................................................................................................... 12

    1.3 Other Host Configurations ......................................................................................................... 15

Zimbra Installation ................................................................................................................................ 16

    3.1 Log onto the Administration Console ........................................................................................ 29

Zimbra Migration .................................................................................................................................. 30

Installing DRBD on both the nodes : ..................................................................................................... 35

Configuration of Spam Filtering ............................................................................................................ 40

    1.1 Outright Blocking With Postfix DNS Protocol Checks ................................................................ 40

    1.2 Outright Blocking of Bad Sending Servers ................................................................................. 40

    1.3 Outright Blocking of Certain Attachments ................................................................................. 40

    1.4 Enforcing a match between FROM address and sasl username................................................ 42

    1.5 Tuning SpamTag and SpamKill ................................................................................................... 43

    1.6 Cbpolicy webui activated, and it’s authentication implemented. ............................................. 44

OS Version in Old Live server was – CentOS 6.5


  1.1   Zimbra Version – 8.6.0_GA_1153.FOSS


  1.2   Total No of Servers – 1

1.3   Total No of Accounts – 3632


1.4   No of domains – 71

1.5     SSL – Expires on Oct 29, 2023. By Sectigo
   Limited.

1.6   Data – 2.3 TB


Installation of OS RHEL 8.7:
2.1. Download the RHEL 8.7 ISO image.

2.2. Make a bootable pen drive with the ISO image.

2.3. Insert the pen drive & boot the server.

2.4. Press F11 for Boot Menu

2.5. Select the USB drive and start Installation.

2.6. Partitioning done –

/opt – 6200G

/ - 420G

Swap – 64G

/boot – 1G

2.7. Select Timezone, language, set root and admin account passswords. Login to RedHat
account and attach subscription via the subscription manager. Begin installation.

2.8. Complete the installation and reboot.

Installation & Configuration of Zimbra

    1.1         Prerequisites :-
    •   Install the following packages - Perl perl-core nmap libidn gmp libaio libstdc++ unzip sysstat
        wget .

    •   # yum install perl perl-core nmap libidn gmp libaio libstdc++ unzip sysstat wget

    1.2         DNS Configuration:
        When you create a domain during the installation process, ZCS checks to see if you have an
MX record correctly configured. If it is not, an error is displayed suggesting that the domain name have
an MX record configured in DNS.

    •   Install dns (bind) packages by below command:
          # yum install bind bind-chroot bind-utils

    •   Enable named service on system boot time by below command:
          # systemctl enable named

    •   Make the entry of your IP in /etc/named.conf file in the listen-on port line. Also add the IP
        address in the allow query line.

•   Create zone file location configuration for domains.

•   Create forward zone file -
    [root@node1 ]# vi /var/named/node1.iiests.ac.in.hosts

1.3         Other Host Configurations


•   Enter the Zimbra hostname and IP address in /etc/hosts file. Also enter the external ldap
    details in the file.


•   Disable postfix - # systemctl disable postfix

•   Make the Selinux permanently disabled –
    [root@node1 ~]# vi /etc/selinux/config

Zimbra Installation
  •   Change directory to /opt - # cd /opt
  •   Download Zimbra 8.8.15
      #                    wget             https://files.zimbra.com/downloads/8.8.15_GA/zcs-
      8.8.15_GA_3953.RHEL8_64.20200629025823.tgz
  •   Unzip the file –
      # tar -xvzf zcs-8.8.15_GA_3953.RHEL8_64.20200629025823.tgz

•   Change directory to zcs-8.8.15
    # cd zcs-8.8.15_GA_3953.RHEL8_64.20200629025823


•   Execute the installation script –
    # ./install.sh


Press 4 to set admin password


Installing Zimlets

Installation completed.


    3.1 Log onto the Administration Console
Open any of your favorite web browser and access the zimbra web administration console with your
10.1.0.77 or hostname and supply the credentials.

https://mail.iiests.ac.in:7071

https://10.1.0.77:7071

Zimbra Migration
4.1 Make sure that the hostname, admin user and password, ldap password and mysql password are
set same as the old server.
4.2 Preparing the Old Server –
    1. Create an LDAP dump directory. As root, type

        a. mkdir /backup
        b. chown zimbra:zimbra /backup

    2. Backup the LDAP data, as zimbra, type
         /opt/zimbra/libexec/zmslapcat /backup

   3. Export MySQL data. Before you start, make sure that /backup is large enough to hold all the
data. Depending on the original database size, this can be very large. If you have large configuration,
you may want to run this command with nohup so that the session does not terminate. Type

/opt/zimbra/common/bin/mysqldump -f -S /opt/zimbra/data/tmp/mysql/mysql.sock \

-u zimbra --password=`zmlocalconfig -s -m nokey \

zimbra_mysql_password` --all-databases --single-transaction \

> /backup/mysql.sql

4.3 Preparing the New Server

    1. LDAP data import on new server –

As Zimbra
  Stop ldap – $ ldap stop
Cleanup the old database and move it to a new location
$ cd /opt/Zimbra/data/ldap
$ mv mdb mdb.old

Create the new directory structure –
$ mkdir -p mdb/db

Import the data –
$ /opt/Zimbra/libexec/zmslapadd /backup/ldap.bak


    2. Mysql import –
       $ mysql.server start [start mysql]
       $ mysql -f zimbra < /backup/mysql.sql
       $ mysql.server stop

   3. Edit /opt/zimbra/conf/localconfig.xml to update the following password values to the values
      from the localconfig.xml file on the old server:
      Mysql passwords :
          ▪ zimbra_mysql_password
          ▪ mysql_root_password

  LDAP password values:

       ◦   ldap_amavis_password
       ◦   ldap_nginx_password
       ◦   ldap_postfix_password
       ◦   ldap_replication_password
       ◦   ldap_root_password
       ◦   zimbra_ldap_password

   4. Moving the email store and index:
      Rsync the /opt/Zimbra/store/* and /opt/Zimbra/index/*

4.4 Stop Zimbra on old live server .
4.5 On New server
       • Assign the IP to the new server. Add the external ldap, and public IPs in the /etc/hosts file.
       • Change the IP in the named.conf and forward zone file.
       • Sync both transport files and postmap it.
4.6 Zimbra is Live on New server.

Release 8.8.15_GA_3953.RHEL8_64_20200629025823 RHEL8_64 FOSS edition, Patch 8.8.15_P39.


All the Zimbra services are running

Emails sent in the year 2012 and received in 2013 successfully migrated to new server.

Zimbra logo successfully replaced by IIEST SHIBPUR Logo

Installing DRBD on both the nodes :
  DRBD (Distributed Replicated Block Device) is a software-based, shared-nothing, replicated
  storage solution mirroring the content of block devices (hard disks, partitions, logical volumes etc.)
  between hosts.

  DRBD mirrors data:

  in real time: Replication occurs continuously while applications modify the data on the device.
  transparently: Applications need not be aware that the data is stored on multiple hosts.
  synchronously: With synchronous mirroring, applications are notified of write completions after
  the writes have been carried out on all (connected) hosts.

  Install DRBD 9.0 from ELREPO
  To install ELREPO, first you should import the GPG key or else the GPG check will fail later.

  # rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org

  Next install the ELPO repo

  # rpm -Uvh https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm


  Once the elpo-release rpm is installed on both the nodes, use dnf to lookup drbd package

  # dnf search drbd
============================================================== Name &
Summary Matched: drbd
===============================================================


kmod-drbd90.x86_64 : drbd90 kernel module(s)


collectd-drbd.x86_64 : DRBD plugin for collectd


drbd90-utils.x86_64 : Management utilities for DRBD


drbd90-utils-sysvinit.x86_64 : The SysV initscript to manage the DRBD.


drbdlinks.noarch : Program for managing links into a DRBD shared
partition

    Install the DRBD 9 packages
    # dnf install kmod-drbd90.x86_64 drbd90-utils.x86_64 -y
5   Configuring DRBD

    •   Configure a simple global_common.conf

         # vi /etc/drbd.d/global_common.conf
global {
 usage-count no;
}
common {
 net {
  protocol C;
 }
}

    •   usage-count :-
        The usage-count no line in the global section skips sending a notice to the DRBD team each
        time a new version of the software is installed in your system.

    •   protocol C :-
        The protocol C line tells the DRBD resource to use a fully synchronous replication.
        This means that local write operations on the node that is functioning as primary are
        considered completed only after both the local and remote disk writes have been confirmed.
        Thus, if we run into the loss of a single node, that should not lead to any data loss under
        normal circumstances, unless both nodes (or their storage subsystems) are irreversibly
        destroyed at the same time.

Create DRBD resource :-

         # vi /etc/drbd.d/drbd1.res


   •   By default DRBD uses port between 7788-7790, we have explicitly defined port number as
       7789.
   •   Our DRBD device resource would be /dev/drbd1 i.e. the logical volumes from all the cluster
       nodes would use /dev/drbd1 to perform Linux disk replication
   •   Next we must copy the DRBD resource file to all the cluster nodes

•   When we installed DRBD earlier, a utility called drbdadm was installed as well,
    drbdadm is intended to be used for the administration of DRBD resources.

•   Create the meta-data –
    # drbdadm create-md drbd1


    The first step of Linux Disk Replication in starting and bringing a DRBD resource online is to
    initialize its metadata

    So our DRBD device /dev/drbd1 is ready.

•   Repeat the same steps on both the nodes for DRBD configuration.

•   Check DRBD Device status

•   # drbdadm status drbd1 – It will show as secondary, we will have to force it to make it primary.

•   Make the node1 as primary
    # drbdadm primary --force drbd1

•   # drbdadm status drbd1 – It will show node1 as primary, but inconsistent as we have not
    connected and synced the node2 yet.

•   Format to ext4 file system
    # mkfs.ext4 /dev/drbd1

•   Mount /dev/drbd1 on /opt inside which we have Zimbra installed and configured.
    # mount /dev/drbd1 /opt
•
•   # drbdadm connect all – to connect both the nodes.
    It will start the syncing from primary to secondary node.

•   # drbdsetup status --statistics --verbose drbd1 – this will show the detailed status and
    percentage of data synced from primary to secondary node.

•   After sync completion both the nodes are displayed as “UpToDate”

Configuration of Spam Filtering

  1.1    Outright Blocking With Postfix DNS Protocol
     Checks

  zmprov mcf +zimbraMtaRestriction reject_non_fqdn_sender
  zmprov mcf +zimbraMtaRestriction reject_unknown_sender_domain
  zmprov mcf +zimbraMtaRestriction reject_unknown_reverse_client_hostname

  The “reject_unknown_sender_domain” according to the Postfix documentation, performs some
  specific checks to ensure the sender’s domain actually exists in public DNS. If the sender’s domain
  doesn’t exist, the email is not accepted. Similarly, the “reject_non_fqdn_sender” check will reject
  the email if the MAIL FROM isn’t a properly-formed email address.


  1.2         Outright Blocking of Bad Sending Servers
  Now we start using blocklists within Postfix, and their are two kinds: “RBLs” or left-hand-side
  blocklists, and RHSBLs or right-hand-side blocklists. RBLs list IP addresses; RHSBLs list domains.

  zmprov mcf +zimbraMtaRestriction "reject_rbl_client b.barracudacentral.org"

  Here, we use a free block list from Barracuda.


  1.3         Outright Blocking of Certain Attachments
      By default, Zimbra does not block what could be dangerous email attachments, like Visual
      Basic scripts, Windows Registry edits etc. So, we need to block those attachments


      zmprov mcf +zimbraMtaBlockedExtension asd
      zmprov mcf +zimbraMtaBlockedExtension bat
      zmprov mcf +zimbraMtaBlockedExtension cab
      zmprov mcf +zimbraMtaBlockedExtension chm
      zmprov mcf +zimbraMtaBlockedExtension cmd
      zmprov mcf +zimbraMtaBlockedExtension com
      zmprov mcf +zimbraMtaBlockedExtension cpl
      zmprov mcf +zimbraMtaBlockedExtension cpgz

zmprov mcf +zimbraMtaBlockedExtension dll
zmprov mcf +zimbraMtaBlockedExtension do
zmprov mcf +zimbraMtaBlockedExtension exe
zmprov mcf +zimbraMtaBlockedExtension hlp
zmprov mcf +zimbraMtaBlockedExtension hta
zmprov mcf +zimbraMtaBlockedExtension html
zmprov mcf +zimbraMtaBlockedExtension js
zmprov mcf +zimbraMtaBlockedExtension jse
zmprov mcf +zimbraMtaBlockedExtension lnk
zmprov mcf +zimbraMtaBlockedExtension ocx
zmprov mcf +zimbraMtaBlockedExtension pif
zmprov mcf +zimbraMtaBlockedExtension reg
zmprov mcf +zimbraMtaBlockedExtension scr
zmprov mcf +zimbraMtaBlockedExtension shb
zmprov mcf +zimbraMtaBlockedExtension shm
zmprov mcf +zimbraMtaBlockedExtension shs
zmprov mcf +zimbraMtaBlockedExtension shtml
zmprov mcf +zimbraMtaBlockedExtension vbe
zmprov mcf +zimbraMtaBlockedExtension vbs
zmprov mcf +zimbraMtaBlockedExtension vbx
zmprov mcf +zimbraMtaBlockedExtension vxd
zmprov mcf +zimbraMtaBlockedExtension wsf
zmprov mcf +zimbraMtaBlockedExtension wsh
zmprov mcf +zimbraMtaBlockedExtension xl
zmprov mcf zimbraMtaBlockedExtensionWarnAdmin TRUE
zmprov mcf zimbraMtaBlockedExtensionWarnRecipient TRUE
zmprov mcf zimbraVirusBlockEncryptedArchive FALSE

1.4     Enforcing a match between FROM address and
   sasl username

  Update zimbraMtaSmtpdRejectUnlistedRecipient & zimbraMtaSmtpdRejectUnlistedSender


  zmprov mcf zimbraMtaSmtpdRejectUnlistedRecipient yes
  zmprov mcf zimbraMtaSmtpdRejectUnlistedSender yes
  zmmtactl restart
  zmconfigdctl restart


  Set the zimbraMtaSmtpdSenderLoginMaps portion


  zmprov mcf zimbraMtaSmtpdSenderLoginMaps proxy:ldap:/opt/zimbra/conf/ldap-slm.cf
  +zimbraMtaSmtpdSenderRestrictions reject_authenticated_sender_login_mismatch


  Edit the file smtpd_sender_restrictions
  You need to edit the file opt/zimbra/conf/zmconfigd/smtpd_sender_restrictions.cf and add
  after the permit_mynetworks the line reject_sender_login_mismatch

  vi /opt/zimbra/conf/zmconfigd/smtpd_sender_restrictions.cf

  zmconfigd will update the postfix configuration automatically and apply the new rules. Now if
  an account is hacked, and this is in place, they will not be able to send out emails with different
  "from" addresses.

1.5      Tuning SpamTag and SpamKill

  It is important to have updated AntiSpam Rules, updated rules will prevent the spam more
  effectively hence make sure to enable the below setting if it is not enabled already.
  $ zmlocalconfig -e antispam_enable_rule_updates=true
  $ zmlocalconfig -e antispam_enable_restarts=true


  Tune the SpamTag and SpamKill percentage.

  zmprov mcf zimbraSpamKillPercent 75

  zmprov mcf zimbraSpamTagPercent 25


1.6    Cbpolicy webui activated, and it’s authentication
   implemented.
</nowiki>
</pre>