Editing Qmail Server with Courier IMAP with Master/Slave LDAP for MiraExim

[[category:Mira Exim]]


'''Qmail Implementation with Courier IMAP,Master-Slave Openldap'''

'''MIRAEXIM LTD. NOIDA'''

'''BY- NAVDEEP MATHUR'''

='''IMPLEMENTING FIRST INSTANCE OF QMAIL'''=


'''Ensure rpmforge and epel repos are enabled.'''


* Switch off SELinux
* Flush Iptables rules

'''Create directory for downloading required packages '''


* mkdir /downloads
* cd /downloads

=='''DOWNLOAD AND EXTRACT PACKAGES'''==


'''Download all required packages for qmail-ldap installation '''


* wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz
* wget http://cr.yp.to/software/qmail-1.03.tar.gz
* wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz
* wget http://www.qmailrocks.org/downloads/patches/ucspi-tcp-0.88.errno.patch
* wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz
* wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/daemontools-0.76.errno.patch
* wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz
* wget http://lifewithqmail.org/inst_check
* wget https://sourceforge.net/projects/courier/files/maildrop/2.5.4/maildrop-2.5.4.tar.bz2/download --no-check-certificate
* wget http://prdownloads.sourceforge.net/qmail-scanner/qmail-scanner-2.08.tgz?download
* wget http://www.qmailrocks.org/downloads/scripts/finalize/qmailctl
* wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm

'''Extract all packages : '''


* tar -xvzf qmailrocks.tar.gz
* tar -xvzf squirrelmail-webmail-1.4.22.tar.gz
* tar -xvjf maildrop-2.5.4.tar.bz2
* tar -xvzf qmail-scanner-2.08.tgz 
* tar -xvzf qmailrocks/autorespond-2.0.5.tar.gz

=='''INSTALLATION OF PACKAGES AND CREATING USERS ,GROUPS'''==


'''Install all required packages before qmail-ldap installation '''


 yum install vim-enhanced httpd php* php-ldap perl gcc* gcc-c++ gcc44* openssl openssl-devel kernel-headers openssl-devel kernel-headers patch pcre* db4*
 openldap* glibc* zlib* glib* gdbm* php 


'''Create initial qmail '''


* mkdir /usr/src/qmail

'''Creating all needed users and groups '''


  groupadd nofiles
  useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias
  useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild
  useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill
  useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp
  groupadd qmail
  useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq
  useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr
  useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails
  groupadd vmail
  useradd -g vmail -s /bin/true vmail

'''Unpack qmail and apply the qmail-ldap patch '''

 cd /usr/src/qmail
 tar -xvzf /downloads/qmail-1.03.tar.gz
 gunzip /downloads/qmail-ldap-1.03-20060201.patch.gz
 cd qmail-1.03
 <nowiki>patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch</nowiki>

'''Make changes on "Makefile" to qmail work properly with ldap'''


Make these entries : 


 LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE
 <nowiki># ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS</nowiki>
 ZLIB=-lz
 <nowiki># to enable the auto-maildir-make feature</nowiki>
 MDIRMAKE=-DAUTOMAILDIRMAKE
 <nowiki># to enable the auto-homedir-make feature</nowiki>
 HDIRMAKE=-DAUTOHOMEDIRMAKE
 <nowiki># on most systems we need this to make auth_pop and auth_imap</nowiki>
 SHADOWLIBS=-lcrypt
 <nowiki># to enable the possibility to log and debug imap and pop</nowiki>
 DEBUG=-DDEBUG

Now Complie the Qmail 

 make man
 make setup check

==Configuration of Qmail related files ==

'''Creating qmail control files '''


 cd /var/qmail/control
 echo 100 > concurrencyincoming
 echo 255 > concurrencyremote
 echo ./Maildir/ > defaultdelivery
 echo /var/qmail/bin/dirmaker > dirmaker
 echo 0 > ldapcluster
 id -g vmail > ldapgid
 echo /home/vmail > ldapmessagestore
 echo qmailUser > ldapobjectclass
 echo secret > ldappassword
 echo 127.0.0.1 > ldapserver
 id -u vmail > ldapuid
 echo 80000000 > qmail-smtpd-softlimit
 echo 80000000 > qmail-pop3d-softlimit
 echo 3 > qmail-pop3d-loglevel
 echo 3 > qmail-start-loglevel
 echo groupvama.com > defaultdomain
 echo dc=groupvama,dc=com > ldapbasedn
 echo cn=Manager,dc=groupvama,dc=com > ldaplogin
 echo mail.groupvama.com > me
 echo groupvama.com >> rcpthosts
 echo miraexim.com >? rcpthosts
 echo vogueserv.com >> rcpthosts
 ln -s rcpthosts locals

'''Unpacking ucspi-tcpi and apply the error patch '''

 cd /usr/src/qmail
 tar -xvzf /downloads/ucspi-tcp-0.88.tar.gz
 cd ucspi-tcp-0.88
 <nowiki>patch < /downloads/ucspi-tcp-0.88.errno.patch</nowiki>
 make && make setup check

'''Unpacking daemontools and apply daemontools-error patch''' 


 mkdir -p /package
 chmod 1755 /package
 cd /package
 tar -xvzf /downloads/daemontools-0.76.tar.gz
 cd /package/admin/daemontools-0.76/src
 <nowiki>patch < /downloads/daemontools-0.76.errno.patch</nowiki>
 cd /package/admin/daemontools-0.76
 package/install

'''Creating the supervise script directories'''


 mkdir /var/qmail/supervise
 cd /var/qmail/supervise
 mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log
 chmod +t qmail-smtpd qmail-send qmail-pop3d

'''Creating qmail-smtpd run supervise '''


 '''vim qmail-smtpd/run'''
 <nowiki>#!/bin/sh</nowiki>
 QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE
 QUID=`id -u qmaild`
 QGID=`id -g qmaild`
 MAXD=`head -1 /var/qmail/control/concurrencyincoming`
 HOST=`head -1 /var/qmail/control/me`
 SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit`
 CDBF="/etc/tcp.smtp.cdb"
 <nowiki>if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then</nowiki>
 echo QUID, QGID, MAXD, or HOST is unset in
 echo /var/qmail/supervise/qmail-smtpd/run
 exit 1
 fi
 exec /usr/local/bin/softlimit -m $SOFT \
 /usr/local/bin/tcpserver -v \
 -H \
 -R \
 -l $HOST \
 -x $CDBF \
 -c $MAXD \
 -u $QUID \
 -g $QGID \
 0 \
 smtp \
 /var/qmail/bin/qmail-smtpd \
 /var/qmail/bin/auth_smtp /usr/bin/true 2>&1
 

'''Creating qmail-smtpd log run supervise script''' 


 '''vim qmail-smtpd/log/run'''
 <nowiki>#!/bin/sh</nowiki>
 export PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin
 exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1


'''Creating qmail rc supervise script'''


 '''vim /var/qmail/rc'''
 <nowiki>#!/bin/sh</nowiki>
 QLOG="`cat /var/qmail/control/qmail-start-loglevel`"
 DEFD="`cat /var/qmail/control/defaultdelivery`"
 exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"


'''Creating qmail-send run supervise script'''


 '''vim qmail-send/run'''
 <nowiki>#!/bin/sh</nowiki>
 exec /var/qmail/rc


'''Creating qmail-send log run supervise script '''


 '''vim qmail-send/log/run'''
 <nowiki>#!/bin/sh</nowiki>
 exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1


'''Creating qmail-pop3d run supervise script '''


 '''vim qmail-pop3d/run'''
 <nowiki>#!/bin/sh</nowiki>
 IP=`head -1 /var/qmail/control/me`
 LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel`
 SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit`
 exec \
 env LOGLEVEL=$LL \
 softlimit -m $SL \
 /usr/local/bin/tcpserver -v -R -H -l 0 0 pop3 \
 /var/qmail/bin/qmail-popup $IP \
 /var/qmail/bin/tcp-env \
 /var/qmail/bin/auth_pop \
 /var/qmail/bin/qmail-pop3d Maildir 2>&1


'''Creating qmail-pop3d log run supervise script''' 


 '''vim qmail-pop3d/log/run'''
 <nowiki>#!/bin/sh</nowiki>
 exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1


'''Creating auto directory maker script'''


 '''vim /var/qmail/bin/dirmaker'''
 <nowiki>#!/bin/sh</nowiki>
 echo '----------------------------------------------' >> /tmp/dirmaker
 date >> /tmp/dirmaker
 echo $1 >> /tmp/dirmaker
 id >> /tmp/dirmaker
 mkdir --parents -m 700 -p $1/Maildir
 mkdir --parents -m 700 -p $1/Maildir/tmp
 mkdir --parents -m 700 -p $1/Maildir/cur
 mkdir --parents -m 700 -p $1/Maildir/new
 chown -R vmail:vmail $1


'''Set permissions of all qmail supervise run scripts'''


 chmod 755 qmail-pop3d/run qmail-smtpd/run qmail-send/run
 chmod 755 qmail-pop3d/log/run qmail-smtpd/log/run qmail-send/log/run
 chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker

'''Create tcp.smtp file to appy tcprules'''


 '''vim /etc/tcp.smtp'''
 127.:allow,RELAYCLIENT="",MAXRCPTCOUNT="200"
 192.168.:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHPREPEND="Authenticated  user:",SANITYCHECK="",SMTPAUTH="",LOGLEVEL="3",AUTHREQUIRED="",MAXRCPTCOUNT="100"
 :allow,BLOCKRELAYPROBE="",RCPTCHECK="",SANITYCHECK="",RETURNMXCHECK="STRICT",RBL="",REJECTEXEC="",LOGLEVEL="3",TARPITCOUNT="10",TARPITDELAY="10",SMTPAUTH="",MAXRCPTCOUNT="25"


'''Creating qmail logging directories and set permissions'''


 mkdir /var/log/qmail
 cd /var/log/qmail
 mkdir qmail-send qmail-smtpd qmail-pop3d
 chown -R qmaill:root /var/log/qmail
 chmod -R 750 /var/log/qmail

'''Creating qmail alias users, links and set permissions'''


 cd /var/qmail
 cp -p /downloads/qmailctl /var/qmail/bin/.
 chmod 755 /var/qmail/bin/qmailctl
 ln -s /var/qmail/bin/qmailctl /usr/bin/
 qmailctl cdb

'''Creating links of supervise scripts'''


 mkdir -p /service
 cd /service/
 ln -s /var/qmail/supervise/qmail-* .

'''Creating aliases '''


 echo qmailadmin@groupvama.com > /var/qmail/alias/.qmail-root
 echo qmailadmin@ groupvama.com > /var/qmail/alias/.qmail-postmaster
 echo qmailadmin@ groupvama.com > /var/qmail/alias/.qmail-mailer-daemon
 ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous
 chmod 644 /var/qmail/alias/.qmail*

'''Stop sendmail and remove all related files'''


 /etc/init.d/sendmail stop
 chkconfig sendmail off
 mv /usr/lib/sendmail /usr/lib/sendmail.org
 mv /usr/sbin/sendmail /usr/sbin/sendmail.org
 ln -s /var/qmail/bin/sendmail /usr/lib/sendmail
 ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

='''COURIER IMAP INSTALLATION'''=

'''Compile courier-authlib and install'''

 cd /downloads/qmailrocks/
 tar jxvf courier-authlib-0.55.tar.bz2
 cd courier-authlib-0.55
 ./configure --prefix=/usr/local --exec-prefix=/usr/local --with-authldap --without-authmysql --disable-root-check --with-ssl –with-authchangepwdir=/usr/local/libexec/authlib --with-redhat
 make && make check
 make install-strip && make install-configure

'''Create IMAP certificate and make changes on configuration files '''


 '''vim /usr/local/etc/imapd.cnf''' 
 (Change postmaser@example.com an administrative email address) 
 emailAddress=qmailadmin@groupvama.com


 '''vim /usr/local/etc/imapd'''
 IMAPDSTART=YES


 '''vim /usr/local/etc/imapd-ssl'''
 IMAPDSSLSTART=YES
 TLS_CERTFILE=/var/qmail/control/clientcert.pem


 '''vim /usr/local/etc/authlib/authdaemonrc'''
 authmodulelist="authldap"
 authmodulelistorig="authldap"


 '''vim /usr/local/etc/authlib/authldaprc'''
 LDAP_SERVER 127.0.0.1
 LDAP_PORT 389
 LDAP_BASEDN dc=groupvama,dc=com
 LDAP_BINDDN cn=Manager,dc=groupvama,dc=com
 LDAP_BINDPW MiraE#1920
 LDAP_TIMEOUT 5
 LDAP_AUTHBIND 1
 LDAP_MAIL uid
 LDAP_GLOB_UID vmail
 LDAP_GLOB_GID vmail
 LDAP_HOMEDIR mailMessageStore
 LDAP_MAILROOT /home/vmail
 LDAP_MAILDIR mailbox
 LDAP_DEFAULTDELIVERY defaultDelivery
 LDAP_FULLNAME cn
 LDAP_CLEARPW clearPassword
 LDAP_CRYPTPW userPassword
 LDAP_DEREF never
 LDAP_TLS 0


'''Copy imap and imaps script in init.d directory'''


 cp /usr/local/libexec/imapd.rc /etc/rc.d/init.d/imap
 cp /usr/local/libexec/imapd-ssl.rc /etc/rc.d/init.d/imaps


'''Make imap and imaps services start on boot'''


 '''vim /etc/rc.local'''
 /usr/local/sbin/authdaemond start
 /etc/rc.d/init.d/imap start
 /etc/rc.d/init.d/imaps start


'''Restart authdaemon and imap services'''

 /usr/local/sbin/authdaemond stop
 /usr/local/sbin/authdaemond start
 /etc/rc.d/init.d/imap stop
 /etc/rc.d/init.d/imaps stop
 /etc/rc.d/init.d/imap start 
 /etc/rc.d/init.d/imaps start

=='''Install autoresponder and maildrop '''==


 cd /downloads/autorespond-2.0.5/
 make && make install
 cd /downloads/maildrop-2.5.4
 ./configure --prefix=/usr/local --exec-prefix=/usr/local --enable-maildrop-uid=root
 make && make install-strip && make install-man

'''Install all required packages for Qmail-Scanner '''


 yum perl-suidperl perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS perl-Time-HiRes* perl-HTML-Tagset perl-HTML-Parser perl-Pod-Usage* perl-Parse-Syslog perl-Statistics-Distributions spamassassin clamav clamd

'''Add user "qscand" for scanning '''


 useradd -c "Qmail-Scanner Account" -s /bin/false -m qscand

'''Change user clamav to qscand '''


* vim /etc/logrotate.d/clamav<nowiki>[Change clamav to qscand]</nowiki>

/var/log/clamav/clamd.log {

missingok

notifempty

create 644 qscand qscand

postrotate

killall -HUP clamd 2>/dev/null || :

endscript

}


* vim /etc/logrotate.d/freshclam<nowiki>[Change clamav to qscand]</nowiki>

/var/log/clamav/freshclam.log {

missingok

notifempty

create 644 qscand qscand

}

* vim /etc/clamd.conf

User qscand


* vim /etc/freshclam.conf

DatabaseOwner qscand


* chown qscand.qscand /var/log/clamav/ -R
* chown -R qscand.qscand /var/run/clamav/
* /etc/init.d/clamd restart
* /etc/init.d/spamassassin restart

'''Install Qmail-Scanner '''


* cd /downloads/qmail-scanner-2.08
* ./configure --admin admin --domain groupvama.com
* mkdir -p /var/spool/qscan
* mkdir -p /var/spool/qscan/quarantine/viruses/tmp /var/spool/qscan/quarantine/viruses/cur /var/spool/qscan/quarantine/viruses/new
* mkdir -p /var/spool/qscan/quarantine/spam/tmp /var/spool/qscan/quarantine/spam/cur /var/spool/qscan/quarantine/spam/new
* mkdir -p /var/spool/qscan/quarantine/policy/tmp /var/spool/qscan/quarantine/policy/cur /var/spool/qscan/quarantine/policy/new
* mkdir -p /var/spool/qscan/working/tmp /var/spool/qscan/working/cur /var/spool/qscan/working/new
* mkdir -p /var/spool/qscan/archive/tmp /var/spool/qscan/archive/cur /var/spool/qscan/archive/new
* cp /downloads/qmail-scanner-2.08/quarantine-events.txt /var/spool/qscan/
* chown -R qscand:qscand /var/spool/qscan/
* cp -pv /downloads/qmail-scanner-2.08/qmail-scanner-queue.pl /var/qmail/bin/
* chown qscand.qscand /var/qmail/bin/qmail-scanner-queue.pl
* chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl
* /var/qmail/bin/qmail-scanner-queue.pl -z
* /var/qmail/bin/qmail-scanner-queue.pl -g
* cp -v /downloads/qmail-scanner-2.08/contrib/logrotate.qmail-scanner /etc/logrotate.d/qmail-scanner
* /etc/init.d/syslog restart

'''Integrate Qmail-scanner with qmail queue'''

* vim /var/qmail/supervise/qmail-smtpd/run

QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE


<center>'''IMPLEMENTING SECOND INSTANCE OF QMAIL WITH DISCLAIMER AND COPY OF ALL OUTGOING MESSAGES'''</center>


<center>'''CONCEPT'''</center>


Disclaimer on Qmail is Added to the Second Instance so that only Out going mails to different domains are uploaded with Common Signature / Disclaimer. Here this is used for multiple domains. Also second instance use to copy of all outgoing messages at log@groupvama.com.


<center>'''IMPLEMENTAION PROCESS'''</center>

* Implement Qmail-2 , i.e Second Qmail Instance 
* Define Qmail-send and Qmail-smtpd daemons 
* Define 2nd Qmail smtp port ( say 900) 
* Install Qmail-qfilter , altermime and bglibs to satisfy the requirement. 
* Define Multiple domain's text and HTML disclaimer 
* Integrate Qmail's both the instances 

<center>'''INSTALLATION OF QMAIL2'''</center>

'''Creating directories for installing qmail2'''

* mkdir -p /var/qmail2 
* mkdir /usr/src/qmail2 
* cd /usr/src/qmail2 

'''Unpack qmail in /usr/src/qmail2 and apply qmail-ldap patch(this patch contain qmail queue and qmail error patch)'''


* tar xvzf /downloads/qmailrocks/qmail-1.03.tar.gz ( Assuming that you have downloaded Qmailrocks earlier ) 
* cd qmail-1.03 
* <nowiki>patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch</nowiki>
* echo 255 > /usr/src/qmail2/qmail-1.03/conf-spwan 
* echo 211 > /usr/src/qmail2/qmail-1.03/conf-split 

'''Make changes on "Makefile" to qmail work properly with ldap'''


Make these entries : 


LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE

ZLIB=-lz

SHADOWLIBS=-lcrypt

DEBUG=-DDEBUG


* vim conf-qmail

( replace qmail with qmail2 ) 


'''Caution:''' This is very critical Step as, not doing do will cause the main Qmail instance will get over written . 

'''Keep a copy of all outgoing mail messages '''


* vim extra.h

QUEUE_EXTRA "Tlog\0" 

QUEUE_EXTRALEN 5


* make man
* make setup check

'''Qmail2 Control Files'''


* cd /var/qmail2/control/

* echo 100 > concurrencyincoming
* echo 255 > concurrencyremote
* echo ./Maildir/ > defaultdelivery
* echo /var/qmail/bin/dirmaker > dirmaker
* echo 0 > ldapcluster
* id -g vmail > ldapgid
* echo /home/vmail > ldapmessagestore
* echo qmailUser > ldapobjectclass
* echo secret > ldappassword
* echo 127.0.0.1 > ldapserver
* id -u vmail > ldapuid
* echo 80000000 > qmail-smtpd-softlimit
* echo 80000000 > qmail-pop3d-softlimit
* echo 3 > qmail-pop3d-loglevel
* echo 3 > qmail-start-loglevel
* echo groupvama.com > defaultdomain
* echo dc=groupvama,dc=com > ldapbasedn
* echo cn=Manager,dc=groupvama,dc=com > ldaplogin
* echo mail.groupvama.com > me

'''Qmail2 Daemons '''

Now create qmail2-smtpd and qmail2-send daemons 

* Create /var/qmail2/rc 

<nowiki>#!/bin/sh</nowiki>

QLOG="`cat /var/qmail2/control/qmail-start-loglevel`"

DEFD="`cat /var/qmail2/control/defaultdelivery`"

exec env - PATH="/var/qmail2/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

* chmod 755 /var/qmail2/rc 

'''Create supervise directories for Qmail2-send and Qmail2-smtpd and log directories '''

* mkdir -p /var/qmail2/supervise/qmail2-smtpd/log
* mkdir -p /var/qmail2/supervise/qmail2-send/log
* mkdir -p /var/log/qmail2/qmail2-smtpd/
* mkdir -p /var/log/qmail2/qmail2-send/
* chown -R qmaill.nofiles /var/log/qmail2/

'''Daemon for Qmail2-send '''

* vim /var/qmail2/supervise/qmail2-send/run 

<nowiki>#!/bin/sh</nowiki>

exec /var/qmail2/rc


* chmod 755 /var/qmail2/supervise/qmail2-send/run

'''Log daemon for Qmail2-send '''

* vim/var/qmail2/supervise/qmail2-send/log/run 

<nowiki>#!/bin/sh</nowiki>

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail2/qmail2-send 2>&1

'''Daemon for Qmail2-smtpd '''

* vim /var/qmail2/supervise/qmail2-smtpd/run 

<nowiki>#!/bin/sh</nowiki>

QMAILQUEUE="/var/qmail2/bin/qmail-tail"; export QMAILQUEUE

QUID=`id -u qmaild`

QGID=`id -g qmaild`

MAXD=`head -1 /var/qmail2/control/concurrencyincoming`

HOST=`head -1 /var/qmail2/control/me`

SOFT=`head -1 /var/qmail2/control/qmail-smtpd-softlimit`

CDBF="/etc/tcp.smtp.cdb"


<nowiki>if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then</nowiki>

echo QUID, QGID, MAXD, or HOST is unset in

echo /var/qmail/supervise/qmail-smtpd/run

exit 1

fi


exec /usr/local/bin/softlimit -m $SOFT \

/usr/local/bin/tcpserver -v \

-H \

-R \

-l $HOST \

-x $CDBF \

-c $MAXD \

-u $QUID \

-g $QGID \

0 \

qmail-second \

/var/qmail2/bin/qmail-smtpd \

/var/qmail2/bin/auth_smtp /usr/bin/true 2>&1


* chmod 755 /var/qmail2/supervise/qmail2-smtpd/run

'''Log daemon for Qmail2-smtpd '''

* vim /var/qmail2/supervise/qmail2-smtpd/log/run 

<nowiki>#!/bin/sh</nowiki>

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail2/qmail2-smtpd 2>&1

* chmod 755 /var/qmail2/supervise/qmail2-smtpd/log/run

'''Link these file to /service '''

* ln -s /var/qmail2/supervise/qmail2-smtpd /service/
* ln -s /var/qmail2/supervise/qmail2-send /service/

'''Restart the Qmail via inttab process '''

<center>'''Testing of Qmail - Second instance'''</center>

* telnet to port 900 and send the mail . 
* check for logs /var/log/qmail2/qmail2-send/current or /var/log/qmail2/qmail2-smtpd/current 

= Disclaimer Related Implementation =
'''Install bglibs for qmail2'''

* cd /downloads/ 
* rpm –Uvh bglibs-1.022-1.i386.rpm ( get it from [http://untroubled.org/bglibs/ http://untroubled.org/bglibs/] ) 

or 

* tar -xvfz bglibs-1.022-1.tar.gz 
* cd bglibs-1.022-1
* make
* make install

'''Install altermime for qmail2'''

* tar xvzf altermime-0.3.6.tar.gz (get it from [http://www.pldaniels.com/altermime/ http://www.pldaniels.com/altermime/] ) 
* cd altermime-0.3.6
* make
* make install

'''Install qmail-qfilter for qmail2'''

* tar xvzf qmail-qfilter-2.1.tar.gz ([http://untroubled.org/qmail-qfilter/ http://untroubled.org/qmail-qfilter/]) 
* cd qmail-qfilter-2.1 
* vi qmail-qfilter.c 

( change qmail into qmail2 ) 

<nowiki>#ifndef QMAIL_QUEUE </nowiki>

<nowiki>#define QMAIL_QUEUE "/var/</nowiki>qmail2/bin/qmail-queue" 

<nowiki>#endif </nowiki>

* make 
* make install 
* chmod 777 /usr/local/bin/qmail-qfilter 
* chown root:qmail /usr/local/bin/qmail-qfilter 

'''Disclaimer Settings'''


* vi /var/qmail2/bin/qmail-tail 

<nowiki>#!/bin/sh</nowiki>

exec /usr/local/bin/qmail-qfilter /var/qmail2/bin/qmail-disclaimer

* chown root:qmail /var/qmail2/bin/qmail-tail 
* chmod 777 /var/qmail2/bin/qmail-tail 
* mkdir /var/qmail2/control/disclaimer/ 
* cd /var/qmail2/control/disclaimer 
* vim groupvama.com.html 

<nowiki><html></nowiki>


<nowiki><body></nowiki>


DISCLAIMER:

This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorised use or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.


<nowiki></body></nowiki>


<nowiki></html></nowiki>

* vim gropvama.com.txt 

This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized use or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

* chown root:qmail /var/qmail2/control/disclaimer/* 
* chmod 777 /var/qmail2/control/disclaimer/* 
* mkdir /var/tmp/qmail-qfilter 
* chown root:qmail /var/tmp/qmail-qfilter 
* chmod 777 /var/tmp/qmail-qfilter 
* vi /var/qmail2/bin/qmail-disclaimer 

<nowiki>#!/bin/sh</nowiki>

QMAILHOST=groupvama.com

INSPECT_DIR=/var/tmp/qmail-qfilter

<nowiki>if [ ! -f /var/qmail2/control/disclaimer/$QMAILHOST.txt ]</nowiki>

then

cat

exit 0

fi

EX_TEMPFAIL=31

EX_UNAVAILABLE=31

trap "rm -f /var/tmp/qmail-qfilter/in.$$" 0 1 2 3 15

cd $INSPECT_DIR || { echo Error: $INSPECT_DIR does not exist; exit $EX_TEMPFAIL; }

cat >$INSPECT_DIR/in.$$ || { echo Error: Cannot write to disk; exit $EX_TEMPFAIL; }

/usr/local/bin/altermime --input=$INSPECT_DIR/in.$$ \

--xheader="X-Disclaimer: $QMAILHOST" \

--disclaimer=/var/qmail2/control/disclaimer/$QMAILHOST.txt \

--disclaimer-html=/var/qmail2/control/disclaimer/$QMAILHOST.html || { echo Error: message rejected; exit $EX_UNAVAILABLE; }

cat $INSPECT_DIR/in.$$

rm in.$$

exit $?

* chown root:qmail /var/qmail2/bin/qmail-disclaimer 
* chmod 777 /var/qmail2/bin/qmail-disclaimer 

== Activation of Qmail2 ==
'''Changes on Qmail2-Send run file '''

* vi /service/qmail2-smtpd/run

( add following line at the top ) 

<nowiki>#!/bin/sh</nowiki>

QMAILQUEUE="/var/qmail2/bin/qmail-tail"; export QMAILQUEUE

Also Make sure the Qmail-smtpd is running on port 900 by 

* vi /etc/services 

<nowiki># Local services</nowiki>

second-qmail 900/tcp

'''Integrate Qmail with Qmail2 '''

vi /var/qmail/control/smtproutes 

:127.0.0.1:900

'''Note: Then restart the qmail from /etc/inittab file'''

== Testing ==
* Telnet and send mail via Qmail-2 , you should get the disclaimer 
* Test via offline Client like Evolution , Outlook etc . You should get the mail with 

== Troubleshooting ==
* QQ error while sending mails 

Check the smtp logs , if find error like 

''/usr/local/bin/qmail-qfilter: error while loading shared libraries: libbg-sysdeps.so.1: cannot open shared object file: No such file or directory'' 

Then 

you have to link libbg-sysdeps.so.1 to /usr/lib 

* ln -s /usr/local/bglibs/lib/libbg-sysdeps.so.1 /usr/lib/

This should solve the issue 

* 2. Some time the Qmail-1 is not able to deliver mails to Qmail-2 instance due to /var/tmp/qmail-qfilter directory is not there or vanishes. So a script to check and create the directory with cron is created for taking care of this issue. 

The script is /usr/bin/check_qmail-qfilter_dir.sh 

<nowiki>#!/bin/sh</nowiki>

DIRECTORY=/var/tmp/qmail-qfilter

<nowiki>if [&nbsp;! -d "$DIRECTORY" ]; then</nowiki>

mkdir -p $DIRECTORY;

chmod 777 $DIRECTORY;

chown -R root.qmail $Directory

fi

The cron entry is as follows 

* crontab -e

<nowiki>*/5 * * * * /usr/bin/check_qmail-qfilter_dir.sh</nowiki>


<center>'''OPENLDAP MASTER SLAVE'''</center>


'''Openldap master (slapd.conf)'''


* Vim /etc/openldap/ldap.conf

BASE dc=groupvama,dc=com

URI ldap://127.0.0.1/


* Vim /etc/openldap/slapd.conf

<nowiki>#</nowiki>

<nowiki># See slapd.conf(5) for details on configuration options.</nowiki>

<nowiki># This file should NOT be world readable.</nowiki>

<nowiki>#</nowiki>

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/qmail.schema

include /etc/openldap/schema/dnszone.schema


<nowiki># Allow LDAPv2 client connections. </nowiki>This is NOT the default.

allow bind_v2


<nowiki># Do not enable referrals until AFTER you have a working directory</nowiki>

<nowiki># service AND an understanding of referrals.</nowiki>

<nowiki>#referral </nowiki>ldap://root.openldap.org


pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args


<nowiki># Load dynamic backend modules:</nowiki>

<nowiki># modulepath </nowiki>/usr/lib64/openldap


<nowiki># Modules available in openldap-servers-overlays RPM package</nowiki>

<nowiki># Module syncprov.la is now statically linked with slapd and there</nowiki>

<nowiki># is no need to load it here</nowiki>

<nowiki># moduleload accesslog.la</nowiki>

<nowiki># moduleload auditlog.la</nowiki>

<nowiki># moduleload denyop.la</nowiki>

<nowiki># moduleload dyngroup.la</nowiki>

<nowiki># moduleload dynlist.la</nowiki>

<nowiki># moduleload lastmod.la</nowiki>

<nowiki># moduleload pcache.la</nowiki>

<nowiki># moduleload ppolicy.la</nowiki>

<nowiki># moduleload refint.la</nowiki>

<nowiki># moduleload retcode.la</nowiki>

<nowiki># moduleload rwm.la</nowiki>

<nowiki># moduleload smbk5pwd.la</nowiki>

<nowiki># moduleload translucent.la</nowiki>

<nowiki># moduleload unique.la</nowiki>

<nowiki># moduleload valsort.la</nowiki>

<nowiki># modules available in openldap-servers-sql RPM package:</nowiki>

<nowiki># moduleload back_sql.la</nowiki>


<nowiki># The next three lines allow use of TLS for encrypting connections using a</nowiki>

<nowiki># dummy test certificate which you can generate by changing to</nowiki>

<nowiki># /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on</nowiki>

<nowiki># slapd.pem so that the ldap user or group can read it. </nowiki>Your client software

<nowiki># may balk at self-signed certificates, however.</nowiki>

<nowiki># TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt</nowiki>

<nowiki># TLSCertificateFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem</nowiki>


<nowiki># Sample security restrictions</nowiki>

<nowiki># </nowiki>Require integrity protection (prevent hijacking)

<nowiki># </nowiki>Require 112-bit (3DES or better) encryption for updates

<nowiki># </nowiki>Require 63-bit encryption for simple bind

<nowiki># security ssf=1 update_ssf=112 simple_bind=64</nowiki>


<nowiki># Sample access control policy:</nowiki>

<nowiki># </nowiki>Root DSE: allow anyone to read it

<nowiki># </nowiki>Subschema (sub)entry DSE: allow anyone to read it

<nowiki># </nowiki>Other DSEs:

<nowiki># </nowiki>Allow self write access

<nowiki># </nowiki>Allow authenticated users read access

<nowiki># </nowiki>Allow anonymous users to authenticate

<nowiki># </nowiki>Directives needed to implement policy:

<nowiki># access to dn.base="" by * read</nowiki>

<nowiki># access to dn.base="cn=Subschema" by * read</nowiki>

<nowiki># access to *</nowiki>

<nowiki># </nowiki>by self write

<nowiki># </nowiki>by users read

<nowiki># </nowiki>by anonymous auth

<nowiki>#</nowiki>


<nowiki>#access to *</nowiki>

<nowiki># </nowiki>by dn.exact="cn=Manager,dc=groupvama,dc=com" read

<nowiki># </nowiki>by * none

<nowiki># if no access controls are present, the default policy</nowiki>

<nowiki># allows anyone and everyone to read anything but restricts</nowiki>

<nowiki># updates to rootdn. </nowiki>(e.g., "access to * by * read")

<nowiki># modules available in openldap-servers-sql RPM package:</nowiki>

<nowiki># moduleload back_sql.la</nowiki>


<nowiki># The next three lines allow use of TLS for encrypting connections using a</nowiki>

<nowiki># dummy test certificate which you can generate by changing to</nowiki>

<nowiki># /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on</nowiki>

<nowiki># slapd.pem so that the ldap user or group can read it. </nowiki>Your client software

<nowiki># may balk at self-signed certificates, however.</nowiki>

<nowiki># TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt</nowiki>

<nowiki># TLSCertificateFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem</nowiki>


<nowiki># Sample security restrictions</nowiki>

<nowiki># </nowiki>Require integrity protection (prevent hijacking)

<nowiki># </nowiki>Require 112-bit (3DES or better) encryption for updates

<nowiki># </nowiki>Require 63-bit encryption for simple bind

<nowiki># security ssf=1 update_ssf=112 simple_bind=64</nowiki>


<nowiki># Sample access control policy:</nowiki>

<nowiki># </nowiki>Root DSE: allow anyone to read it

<nowiki># </nowiki>Subschema (sub)entry DSE: allow anyone to read it

<nowiki># </nowiki>Other DSEs:

<nowiki># </nowiki>Allow self write access

<nowiki># </nowiki>Allow authenticated users read access

<nowiki># </nowiki>Allow anonymous users to authenticate

<nowiki># </nowiki>Directives needed to implement policy:

<nowiki># access to dn.base="" by * read</nowiki>

<nowiki># access to dn.base="cn=Subschema" by * read</nowiki>

<nowiki># access to *</nowiki>

<nowiki># </nowiki>by self write

<nowiki># </nowiki>by users read

<nowiki># </nowiki>by anonymous auth

<nowiki>#</nowiki>


<nowiki>#access to *</nowiki>

<nowiki># </nowiki>by dn.exact="cn=Manager,dc=groupvama,dc=com" read

<nowiki># </nowiki>by * none

<nowiki># if no access controls are present, the default policy</nowiki>

<nowiki># allows anyone and everyone to read anything but restricts</nowiki>

<nowiki># updates to rootdn. </nowiki>(e.g., "access to * by * read")

<nowiki>#</nowiki>

<nowiki># rootdn can always read and write EVERYTHING!</nowiki>

<nowiki>#######################################################################</nowiki>

<nowiki># ldbm and/or bdb database definitions</nowiki>

<nowiki>#######################################################################</nowiki>

serverID 001


database bdb

suffix "dc=groupvama,dc=com"

rootdn "cn=Manager,dc=groupvama,dc=com"

<nowiki># Cleartext passwords, especially for the rootdn, should</nowiki>

<nowiki># be avoided. </nowiki>See slappasswd(8) and slapd.conf(5) for details.

<nowiki># Use of strong authentication encouraged.</nowiki>

rootpw MiraE#1920

<nowiki># rootpw </nowiki>{crypt}ijFYNcSNctBYg


<nowiki># The database directory MUST exist prior to running slapd AND</nowiki>

<nowiki># should only be accessible by the slapd and slap tools.</nowiki>

<nowiki># Mode 700 recommended.</nowiki>

directory /var/lib/ldap


<nowiki># Indices to maintain for this database</nowiki>

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub


<nowiki># Replicas of this database</nowiki>

<nowiki>#replogfile /var/lib/ldap/openldap-master-replog</nowiki>

<nowiki>#replica host=ldap-1.example.com:389 starttls=critical</nowiki>

<nowiki># </nowiki>bindmethod=sasl saslmech=GSSAPI

<nowiki># </nowiki>authcId=host/ldap-master.example.com@EXAMPLE.COM


overlay syncprov

syncprov-checkpoint 100 10

syncprov-sessionlog 100


replica uri=ldap://182.71.29.139:389

binddn="cn=Manager,dc=groupvama,dc=com"

bindmethod=simple credentials=MiraE#1920


'''Openldap slave (slapd.conf)'''

* '''Vim /etc/openldap/slapd.conf'''

<nowiki>#</nowiki>

<nowiki># See slapd.conf(5) for details on configuration options.</nowiki>

<nowiki># This file should NOT be world readable.</nowiki>

<nowiki>#</nowiki>

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/qmail.schema


<nowiki># Allow LDAPv2 client connections. </nowiki>This is NOT the default.

allow bind_v2


<nowiki># Do not enable referrals until AFTER you have a working directory</nowiki>

<nowiki># service AND an understanding of referrals.</nowiki>

<nowiki>#referral </nowiki>ldap://root.openldap.org


pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args


<nowiki># Load dynamic backend modules:</nowiki>

<nowiki># modulepath </nowiki>/usr/lib/openldap


<nowiki># Modules available in openldap-servers-overlays RPM package</nowiki>

<nowiki># Module syncprov.la is now statically linked with slapd and there</nowiki>

<nowiki># is no need to load it here</nowiki>

<nowiki># moduleload accesslog.la</nowiki>

<nowiki># moduleload auditlog.la</nowiki>

<nowiki># moduleload denyop.la</nowiki>

<nowiki># moduleload dyngroup.la</nowiki>

<nowiki># moduleload dynlist.la</nowiki>

<nowiki># moduleload lastmod.la</nowiki>

<nowiki># moduleload pcache.la</nowiki>

<nowiki># moduleload ppolicy.la</nowiki>

<nowiki># moduleload refint.la</nowiki>

<nowiki># moduleload retcode.la</nowiki>

<nowiki># moduleload rwm.la</nowiki>

<nowiki># moduleload smbk5pwd.la</nowiki>

<nowiki># moduleload translucent.la</nowiki>

<nowiki># moduleload unique.la</nowiki>

<nowiki># moduleload valsort.la</nowiki>


<nowiki># modules available in openldap-servers-sql RPM package:</nowiki>

<nowiki># moduleload back_sql.la</nowiki>


<nowiki># The next three lines allow use of TLS for encrypting connections using a</nowiki>

<nowiki># dummy test certificate which you can generate by changing to</nowiki>

<nowiki># /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on</nowiki>

<nowiki># slapd.pem so that the ldap user or group can read it. </nowiki>Your client software

<nowiki># may balk at self-signed certificates, however.</nowiki>

<nowiki># TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt</nowiki>

<nowiki># TLSCertificateFile /etc/pki/tls/certs/slapd.pem</nowiki>

<nowiki># TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem</nowiki>


<nowiki># Sample security restrictions</nowiki>

<nowiki># </nowiki>Require integrity protection (prevent hijacking)

<nowiki># </nowiki>Require 112-bit (3DES or better) encryption for updates

<nowiki># </nowiki>Require 63-bit encryption for simple bind

<nowiki># security ssf=1 update_ssf=112 simple_bind=64</nowiki>


<nowiki># Sample access control policy:</nowiki>

<nowiki># </nowiki>Root DSE: allow anyone to read it

<nowiki># </nowiki>Subschema (sub)entry DSE: allow anyone to read it

<nowiki># </nowiki>Other DSEs:

<nowiki># </nowiki>Allow self write access

<nowiki># </nowiki>Allow authenticated users read access

<nowiki># </nowiki>Allow anonymous users to authenticate

<nowiki># </nowiki>Directives needed to implement policy:

<nowiki># access to dn.base="" by * read</nowiki>

<nowiki># access to dn.base="cn=Subschema" by * read</nowiki>

<nowiki># access to *</nowiki>

<nowiki># </nowiki>by self write

<nowiki># </nowiki>by users read

<nowiki># </nowiki>by anonymous auth

<nowiki>#</nowiki>

<nowiki># if no access controls are present, the default policy</nowiki>

<nowiki># allows anyone and everyone to read anything but restricts</nowiki>

<nowiki># updates to rootdn. </nowiki>(e.g., "access to * by * read")

<nowiki>#</nowiki>

<nowiki># rootdn can always read and write EVERYTHING!</nowiki>

<nowiki>#access to *</nowiki>

<nowiki># </nowiki>by dn.exact="cn=Manager,dc=groupvama,dc=com" read

<nowiki># </nowiki>by * none

<nowiki>#######################################################################</nowiki>

<nowiki># ldbm and/or bdb database definitions</nowiki>

<nowiki>#######################################################################</nowiki>

serverID 002


database bdb

<nowiki>#suffix </nowiki>"dc=my-domain,dc=com"

<nowiki>#rootdn </nowiki>"cn=Manager,dc=my-domain,dc=com"

suffix "dc=groupvama,dc=com"

rootdn "cn=Manager,dc=groupvama,dc=com"

<nowiki># Cleartext passwords, especially for the rootdn, should</nowiki>

<nowiki># be avoided. </nowiki>See slappasswd(8) and slapd.conf(5) for details.

<nowiki># Use of strong authentication encouraged.</nowiki>

<nowiki># rootpw </nowiki>secret

<nowiki># rootpw </nowiki>{crypt}ijFYNcSNctBYg

rootpw MiraE#1920


<nowiki># The database directory MUST exist prior to running slapd AND</nowiki>

<nowiki># should only be accessible by the slapd and slap tools.</nowiki>

<nowiki># Mode 700 recommended.</nowiki>

directory /var/lib/ldap


<nowiki># Indices to maintain for this database</nowiki>

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub


<nowiki># Replicas of this database</nowiki>

<nowiki>#replogfile /var/lib/ldap/openldap-master-replog</nowiki>

<nowiki>#replica host=ldap-1.example.com:389 starttls=critical</nowiki>

<nowiki># </nowiki>bindmethod=sasl saslmech=GSSAPI

<nowiki># </nowiki>authcId=host/ldap-master.example.com@EXAMPLE.COM


<nowiki>#syncrepl rid=001</nowiki>

<nowiki>#provider=ldap://182.71.29.139</nowiki>

<nowiki>#type=refreshAndPersist</nowiki>

<nowiki>#searchbase="dc=groupvama,dc=com"</nowiki>

<nowiki>#filter="(objectClass=*)"</nowiki>

<nowiki>#scope=sub</nowiki>

<nowiki>#attrs="*"</nowiki>

<nowiki>#bindmethod=simple</nowiki>

<nowiki>#binddn="cn=Manager,dc=groupvama,dc=com"</nowiki>

<nowiki>#credentials=MiraE#1920</nowiki>


syncrepl rid=001

provider=ldap://182.71.29.139

type=refreshAndPersist

retry="60 +"

searchbase="dc=groupvama,dc=com"

scope=sub

schemachecking=on

bindmethod=simple

binddn="cn=Manager,dc=groupvama,dc=com"

credentials=MiraE#1920


mirrormode on


Then restart ldap on both automatically master slave synchronize.