Qmail installation1: Difference between revisions

Latest revision as of 02:55, 28 November 2012

[[Qmail + LDAP Configuration ]]

Qmail Downloads

Check for gcc

wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz

wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

rpm -Uhv rpmforge-release-0.3.6-1.el5.rf.i386.rpm

yum install openldap* yum install zlib* yum install glib yum install gcc-c++ yum install gdbm*

1. yum install openssl-devel

2.Qmail Downloads

First create a new directory where you will store your qmail package.

mkdir /downloads

cd /downloads

Download the qmail package (or tarball).

wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz

Download qmail-ldap patch.

wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

Unpack the downloaded qmail package.

tar -zxvf qmailrocks.tar.gz

3.Creating initial qmail directories.

mkdir -p /var/qmail

mkdir /usr/src/qmail

4.Creating all needed users and groups:

groupadd nofiles

useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias

useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild

useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill

useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp

groupadd qmail

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails

groupadd vmail

useradd -g vmail -s /bin/true vmail

5.Unpacking qmail, ucspi-tcp and daemontools

cd /usr/src/qmail

tar zxvf /downloads/qmailrocks/qmail-1.03.tar.gz

tar zxvf /downloads/qmailrocks/ucspi-tcp-0.88.tar.gz

mkdir -p /package

chmod 1755 /package

cd /package

tar zxvf /downloads/qmailrocks/daemontools-0.76.tar.gz

6.Creating & setting qmail logging directories.

mkdir /var/log/qmail

cd /var/log/qmail

mkdir qmail-send qmail-smtpd qmail-pop3d

chown -R qmaill:root /var/log/qmail

chmod -R 750 /var/log/qmail

7.Setting up the supervise script directories.

mkdir /var/qmail/supervise

cd /var/qmail/supervise

mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log

chmod +t qmail-smtpd qmail-send qmail-pop3d

8.Setting conf-split and conf-spawn.

echo 211 > /usr/src/qmail/qmail-1.03/conf-split

echo 255 > /usr/src/qmail/qmail-1.03/conf-spawn

9.Applying qmail-ldap patch.

cd /usr/src/qmail/qmail-1.03/

gzip -d qmail-ldap-1.03-20060201.patch.gz

patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch

10.Make following changes to the Makefile and then save & close this file.

vi Makefile

LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DSMTPEXECCHECK -DALTQUEUE

ZLIB=-lz

MDIRMAKE=-DAUTOMAILDIRMAKE

HDIRMAKE=-DAUTOHOMEDIRMAKE

SHADOWLIBS=-lcrypt

DEBUG=-DDEBUG

Save & Close this file.

11.Building qmail.

make setup check

Please enter the hostname in place of <hostname> like mailserver.krishnagroup.co.in ./config-fast <hostname>

12.Build ucspi-tcp:

cd /usr/src/qmail/ucspi-tcp-0.88/

patch < /downloads/qmailrocks/patches/ucspi-tcp-0.88.errno.patch

make && make setup check

13.Build daemontools:

cd /package/admin/daemontools-0.76/src

patch < /downloads/qmailrocks/patches/daemontools-0.76.errno.patch

cd ..

package/install

If you take a look at the running processes on your server at this point, you should see the daemon "svscanboot" running.

14.LDAP controls files.

cd /var/qmail/control

echo 100 > concurrencyincoming

echo 255 > concurrencyremote

echo ./Maildir/ > defaultdelivery

Please enter the domain name in place of <domain-name> like krishnagroup.co.in

echo <domain-name> > defaultdomain

echo /var/qmail/bin/dirmaker > dirmaker

Please enter the base dn in place of <base-dn> like dc=krishnagroup,dc=co,dc=in

echo <base-dn> > ldapbasedn

echo 0 > ldapcluster

id -g vmail > ldapgid

Please enter root dn in place of <root-dn> for LDAP login like cn=manager,dc=krishnagroup,dc=co,dc=in

echo <root-dn> > ldaplogin

echo /home/vmail > ldapmessagestore

echo qmailUser > ldapobjectclass

Please enter the root dn password in place of <rootdn-pass>

echo <rootdn-pass> > ldappassword

echo 127.0.0.1 > ldapserver

id -u vmail > ldapuid

Please enter the hostname in place of <hostname> like mailserver.krishnagroup.co.in

echo <hostname> > me

echo 127.:allow,NOPBS="" :deny > qmail-pop3d.rules

echo 80000000 > qmail-smtpd-softlimit

echo 80000000 > qmail-pop3d-softlimit

echo 3 > qmail-start-loglevel

Please enter the domain name in place of <domain-name> for which you want to receive mails like krishnagroup.co.in

echo <domain-name> > rcpthosts

Please enter the hostname

in place of <hostname> like krishnagroup.co.in

echo <hostname> > locals

Please enter the domain name in place of <domain-name> for which you want to receive mails like krishnagroup.co.in

echo <domain-name> >> locals

cd /var/qmail

Make changes to dirmaker file and then save & close it:

vi bin/dirmaker

!/bin/sh

echo '----------------------------------------------' >> /tmp/dirmaker date >> /tmp/dirmaker echo $1 >> /tmp/dirmaker id >> /tmp/dirmaker

mkdir --parents -m 700 -p $1/Maildir mkdir --parents -m 700 -p $1/Maildir/tmp mkdir --parents -m 700 -p $1/Maildir/cur mkdir --parents -m 700 -p $1/Maildir/new chown -R vmail:vmail $1

Save & Close this file.

Make changes to dirmaker file and then save & close it.

vi rc

!/bin/sh

QLOG="`cat /var/qmail/control/qmail-start-loglevel`" DEFD="`cat /var/qmail/control/defaultdelivery`" exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

Save & Close this file.

chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker

15.Qmail Run Files

cd supervise

vi qmail-smtpd/run

!/bin/bash

QUID=`id -u qmaild` QGID=`id -g qmaild` MAXD=`head -1 /var/qmail/control/concurrencyincoming` HOST=`head -1 /var/qmail/control/me` SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit` CDBF="/etc/tcp.smtp.cdb"

if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then

   echo QUID, QGID, MAXD, or HOST is unset in
   echo /var/qmail/supervise/qmail-smtpd/run
   exit 1

fi

exec /usr/local/bin/softlimit -m 40000000 \

               /usr/local/bin/tcpserver                -v                      \
                                                       -H              \
                                                       -R              \
                                                       -l $HOST                \
                                                       -x $CDBF        \
                                                       -c $MAXD      \
                                                       -u $QUID        \
                                                       -g $QGID        \
                                                       0                       \
                                               smtp                    \
                             /var/qmail/bin/qmail-smtpd krishnagroup.co.in     \
            /var/qmail/bin/auth_smtp /usr/bin/true 2>&1

Save & Close this file.

vi qmail-smtpd/log/run

!/bin/sh

PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin export PATH exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1

Save & Close this file.

vi qmail-send/run

!/bin/sh

exec /var/qmail/rc

Save & Close this file.

vi qmail-send/log/run

!/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1

Save & Close this file.

vi qmail-pop3d/run

!/bin/sh

IP=`head -1 /var/qmail/control/me` LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel` SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit` exec \

       env LOGLEVEL=$LL                                                \
       softlimit -m $SL                                                        \
       /usr/local/bin/tcpserver -v -R -H -l 0 0  pop3                  \
       /var/qmail/bin/qmail-popup $IP                                  \
       /var/qmail/bin/tcp-env                                                  \
       /var/qmail/bin/auth_pop                                                 \
       /var/qmail/bin/qmail-pop3d Maildir 2>&1

Save & Close this file.

vi qmail-pop3d/log/run

!/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1

Save & Close this file.

vi /etc/tcp.smtp

127.:allow,RELAYCLIENT=""

allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHREQUIRED="",AUTHPREPEND="Authenticateduser:",SANITYCHECK="",REJECTEXEC="",LOGLEVEL="3",SMTPAUTH=""

Save & Close this file.

chmod -R +x /var/qmail/supervise/*

mkdir /service

ln -s /var/qmail/supervise/qmail-send /var/qmail/supervise/qmail-smtpd /var/qmail/supervise/qmail-pop3d /service

cd /var/qmail

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-root

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-postmaster

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-mailer-daemon

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-anonymous

chmod 644 /var/qmail/alias/.qmail*

rsync -avur /downloads/qmailrocks/scripts/finalize/qmailctl bin/.

ln -s /var/qmail/bin/qmailctl /usr/bin

ln -s /var/qmail/bin/qmailctl /etc/init.d/qmailctl

qmailctl cdb

16.Qmail - Other configuration:

/etc/init.d/sendmail stop

chkconfig sendmail off

mv /usr/lib/sendmail /usr/lib/sendmail.org

mv /usr/sbin/sendmail /usr/sbin/sendmail.org

ln -s /var/qmail/bin/sendmail /usr/lib/sendmail

ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

17.OPENLDAP Integration with QMAIL-LDAP:

cd /etc/openldap

cp /usr/src/qmail/qmail-1.03/qmail.schema schema/.

vi slapd.conf

See slapd.conf(5) for details on configuration options.
This file should NOT be world readable.
#include         /etc/openldap/schema/core.schema
#include         /etc/openldap/schema/cosine.schema
#include         /etc/openldap/schema/inetorgperson.schema
#include         /etc/openldap/schema/nis.schema
#include         /etc/openldap/schema/qmail.schema
#Allow LDAPv2 client connections.  This is NOT the default.
  allow bind_v2
#Do not enable referrals until AFTER you have a working directory
#service AND an understanding of referrals.
#referral       ldap://root.openldap.org
pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args
#Load dynamic backend modules:
#modulepath    /usr/lib/openldap
#modules available in openldap-servers-overlays RPM package:
#moduleload accesslog.la
#moduleload auditlog.la
#moduleload denyop.la
#moduleload dyngroup.la
#moduleload dynlist.la
#moduleload lastmod.la
#moduleload pcache.la
#moduleload ppolicy.la
#moduleload refint.la
#moduleload retcode.la
#moduleload rwm.la
#moduleload smbk5pwd.la
#moduleload syncprov.la
#moduleload translucent.la
#moduleload unique.la
#moduleload valsort.la
 loglevel        4
#modules available in openldap-servers-sql RPM package:
#moduleload back_sql.la
#The next three lines allow use of TLS for encrypting connections using a
#dummy test certificate which you can generate by changing to
#/etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on
#slapd.pem so that the ldap user or group can read it.  Your client software
#may balk at self-signed certificates, however.
#TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
#TLSCertificateFile /etc/pki/tls/certs/slapd.pem
#TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem
#Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
#Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING! 
-------------------------------------------------------------------
# ldbm and/or bdb database definitions
---------------------------------------------------------------------
database        bdb
#suffix         "dc=my-domain,dc=com"
suffix          "dc=krishnagroup,dc=co,dc=in"
#rootdn         "cn=Manager,dc=my-domain,dc=com"
rootdn          "cn=manager,dc=krishnagroup,dc=co,dc=in"
#Cleartext passwords, especially for the rootdn, should
#be avoided.  See slappasswd(8) and slapd.conf(5) for details.
#Use of strong authentication encouraged.
#rootpw                secret
rootpw          root1234
# rootpw                {crypt}ijFYNcSNctBYg
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
#Mode 700 recommended.
directory       /var/lib/ldap
# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
#     bindmethod=sasl saslmech=GSSAPI
#     authcId=host/ldap-master.example.com@EXAMPLE.COM
Save & Close this file.

vi ldap.conf

HOST 127.0.0.1 BASE dc=krishnagroup,dc=co,dc=in

Save & Close this file.

/etc/init.d/ldap start

18.Creation of LDAP Database and LDIF FILES:

cd /downloads

mkdir ldif_files

cd ldif_files

LDIF file for creating base.

vi base.ldif

#krishnagroup.co.in
dn: dc=krishnagroup,dc=co,dc=in
objectClass: top
objectClass: domain
dc: krishnagroup

Save & Close this file.

LDIF file for creating organizational unit.

vi ou.ldif

#krishnagroup.co.in
dn: ou=krishnagroup.co.in,dc=krishnagroup,dc=co,dc=in
objectClass: top
objectClass: organizationalUnit
ou: krishnagroup.co.in
description: krishnagroup.co.in

Save & Close this file.

LDIF file for creating Admin User.

vi admin.ldif

# admin, krishnagroup.co.in
dn: uid=admin,ou=krishnagroup.co.in,dc=krishnagroup,dc=co,dc=in
objectClass: top
objectClass: inetOrgPerson
objectClass: qmailUser
cn: Admin
sn: Admin
mail: admin@krishnagroup.co.in
accountStatus: active
userPassword: {SSHA}ZzYPfGvVLpRMTRG89fRIVi2HH1SO73cM
mailMessageStore: krishnagroup.co.in/admin
uid: admin

Save & Close this file.

LDIF file for Users.

vi tetra_test.ldif

# tetra_test@krishnagroup.co.in, krishnagroup.co.in, krishnagroup.co.in
dn: uid=tetra_test@krishnagroup.co.in,ou=krishnagroup.co.in,dc=krishnagroup,dc=co,dc=in
givenName: Tetra Test
sn: Tetra Test
uid: tetra_test@krishnagroup.co.in
mailMessageStore: krishnagroup.co.in/tetra_test
mail: tetra_test@krishnagroup.co.in
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: qmailUser
cn: IT Helpdesk Corp
userPassword:: e01ENX1YMDNNTzFxblpkWWRneWZldUlMUG1RPT0=
Save & Close this file.

19.Command to create user / database.:

ldapadd -acvx -D "cn=manager,dc=krishnagroup,dc=co,dc=in" -w root1234 -f base.ldif

20.Courier IMAP Integration:

Compilation and its parameters

cd /downloads/qmailrocks/

tar -jxvf courier-authlib-0.55.tar.bz2

cd courier-authlib-0.55

./configure --prefix=/usr/local --exec-prefix=/usr/local --with-authldap --without-authmysql --disable-root-check --with-ssl --with-authchangepwdir=/usr/local/libexec/authlib --with-redhat

make && make check

make install-strip && make install-configure

vi /etc/rc.local (Add the following line.)

/usr/local/sbin/authdaemond start
Save & Close this file.

cd /downloads/qmailrocks/

tar -jxvf courier-imap-4.0.2.tar.bz2

useradd bsmith

chown -R bsmith:wheel courier-imap-4.0.2

cd /downloads/qmailrocks/courier-imap-4.0.2

su bsmith

./configure --prefix=/usr/local --exec-prefix=/usr/local --without-authvchkpw --with-authldap --without-authmysql --disable-root-check --with-ssl --with-authchangepwdir=/usr/local/libexec/authlib --with-redhat

make && make check

exit

make install-strip && make install-configure

/usr/local/sbin/mkimapdcert

vi /usr/local/etc/imapd.cnf (Change postmaster@example.com by an administrative email address )

…………………………
…………………………
emailAddress=admin@krishnagroup.co.in
…………………………
Save & Close this file.

Configuration changes.

vi /usr/local/etc/imapd

IMAPDSTART=YES
Save & Close this file.

vi /usr/local/etc/imapd-ssl

IMAPDSSLSTART=YES
TLS_CERTFILE=/usr/local/share/imapd.pem
Save & Close this file.

vi /usr/local/etc/authlib/authdaemonrc

authmodulelist="authldap"
authmodulelistorig="authldap"
Save & Close this file.

vi /usr/local/etc/authlib/authldaprc

LDAP_SERVER             localhost
LDAP_PORT               389
LDAP_PROTOCOL_VERSION   3
LDAP_BASEDN             dc=krishnagroup, dc=co, dc=in
LDAP_BINDDN             cn=manager, dc=krishnagroup, dc=co, dc=in
LDAP_BINDPW             root1234
LDAP_TIMEOUT            5
LDAP_AUTHBIND	       1
LDAP_MAIL               uid
LDAP_GLOB_UID           vmail
LDAP_GLOB_GID           vmail
LDAP_HOMEDIR            mailMessageStore
LDAP_MAILROOT        /home/vmail
LDAP_MAILDIR            mailbox
LDAP_DEFAULTDELIVERY    defaultDelivery
LDAP_FULLNAME           cn
LDAP_CLEARPW            clearPassword
LDAP_CRYPTPW            userPassword
#LDAP_CRYPTPW           sambaLMPassword
LDAP_DEREF              never
LDAP_TLS                0
Save & Close this file.

cp /usr/local/libexec/imapd.rc /etc/rc.d/init.d/imap

cp /usr/local/libexec/imapd-ssl.rc /etc/rc.d/init.d/imaps

vi /etc/rc.local ( Add following line )

/etc/rc.d/init.d/imap  start
/etc/rc.d/init.d/imaps start 
Save & Close this file.

/usr/local/sbin/authdaemond stop

/usr/local/sbin/authdaemond start

/etc/rc.d/init.d/imap stop

/etc/rc.d/init.d/imaps stop

/etc/rc.d/init.d/imap start

/etc/rc.d/init.d/imaps start

phpldapadmin

yum install httpd* php* -y

cd /downloads wget http://downloads.sourceforge.net/project/phpldapadmin/phpldapadmin-php5/1.2.0.5/phpldapadmin-1.2.0.5.tgz?use_mirror=nchc

tar zxvf phpldapadmin-1.2.0.5.tgz

mv phpldapadmin-1.2.0.5 /var/www/html/phpldapadmin

cd /var/www/html/phpldapadmin

mv config/config.php.example config/config.php

vi /etc/php.ini

memory_limit = 32M
Save and exit

cat /usr/local/etc/authlib/authldaprc|grep -v ^#|grep -v ^$|less