Qmail-Ldap installation2 + dovecot: Difference between revisions

Latest revision as of 04:07, 27 November 2012

Qmail-LDAP installation on RedHat and CentOS v5.x.x[edit]

Ensure rpmforge and epel repos are enabled.

Switch off SELinux.

Flush Iptables rules

Create directory for downloading required packages:

mkdir /downloads
cd /downloads

Download all required packages for qmail-ldap installation:

wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz

wget http://cr.yp.to/software/qmail-1.03.tar.gz

wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz 

wget http://www.qmailrocks.org/downloads/patches/ucspi-tcp-0.88.errno.patch

wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz

wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/daemontools-0.76.errno.patch

wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

wget http://lifewithqmail.org/inst_check

wget http://sourceforge.net/projects/courier/files/maildrop/2.5.4/maildrop-2.5.4.tar.bz2/download --no-check-certificate

wget http://prdownloads.sourceforge.net/qmail-scanner/qmail-scanner-2.08.tgz?download

wget http://www.qmailrocks.org/downloads/scripts/finalize/qmailctl

wget http://sourceforge.net/projects/phpldapadmin/files/latest/download

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm

Extract packages:

tar -xvzf qmailrocks.tar.gz

tar -xvzf phpldapadmin-1.2.2.tgz

tar -xvzf squirrelmail-webmail-1.4.22.tar.gz

tar -xvjf maildrop-2.5.4.tar.bz2

tar -xvzf qmail-scanner-2.08.tgz

tar -xvzf qmailrocks/autorespond-2.0.5.tar.gz

Install all required packages before qmail-ldap installation:

yum install vim-enhanced httpd php* php-ldap perl gcc* gcc-c++ gcc44* openssl openssl-devel kernel-headers openssl-devel 
kernel-headers patch pcre* db4* openldap* glibc* zlib* glib* gdbm* php

Create initial qmail directories:

mkdir -p /var/qmail
mkdir /usr/src/qmail

Creating all needed users and groups:

groupadd nofiles

useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp

groupadd qmail

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails

groupadd vmail

useradd -g vmail -s /bin/true vmail

Unpack qmail and apply the qmail-ldap patch:

cd /usr/src/qmail
tar -xvzf /downloads/qmail-1.03.tar.gz
gunzip /downloads/qmail-ldap-1.03-20060201.patch.gz
cd qmail-1.03
patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch

Make changes on "Makefile" to qmail work properly with ldap:

LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS-DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE -DBIGBROTHER
# ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS
ZLIB=-lz
# to enable the auto-maildir-make feature
MDIRMAKE=-DAUTOMAILDIRMAKE
# to enable the auto-homedir-make feature
HDIRMAKE=-DAUTOHOMEDIRMAKE
# on most systems we need this to make auth_pop and auth_imap
SHADOWLIBS=-lcrypt
# to enable the possibility to log and debug imap and pop
DEBUG=-DDEBUG

After that, setup qmail

make man

make setup check

Creating qmail control files:

cd /var/qmail/control
echo 100 > concurrencyincoming
echo 255 > concurrencyremote
echo ./Maildir/ > defaultdelivery
echo 10000 > defaultquotacount
echo 10000000 > defaultquotasize
echo /var/qmail/bin/dirmaker > dirmaker
echo 0 > ldapcluster
id -g vmail > ldapgid
echo /home/vmail > ldapmessagestore
echo qmailUser > ldapobjectclass
echo secret > ldappassword
echo 127.0.0.1 > ldapserver
id -u vmail > ldapuid
echo 80000000 > qmail-smtpd-softlimit
echo 80000000 > qmail-pop3d-softlimit
echo 3 > qmail-pop3d-loglevel
echo 3 > qmail-start-loglevel
echo MYDOMAIN.com > defaultdomain
echo dc=MYDOMAIN,dc=com > ldapbasedn
echo cn=manager,dc=MYDOMAIN,dc=com > ldaplogin
echo mail.MYDOMAIN.com > me
echo MYDOMAIN.com > rcpthosts
ln -s rcpthosts locals

Unpacking ucspi-tcpi and apply the error patch:

cd /usr/src/qmail
tar -xvzf /downloads/ucspi-tcp-0.88.tar.gz
cd ucspi-tcp-0.88
patch < /downloads/ucspi-tcp-0.88.errno.patch

make && make setup check

Unpacking daemontools and apply daemontools-error patch:

mkdir -p /package
chmod 1755 /package
cd /package
tar -xvzf /downloads/daemontools-0.76.tar.gz
cd /package/admin/daemontools-0.76/src
patch < /downloads/daemontools-0.76.errno.patch
cd /package/admin/daemontools-0.76
package/install

Optional

# /command/svscanboot & #

# chmod 755 /etc/rc.local #

Creating the supervise script directories:

mkdir /var/qmail/supervise
cd /var/qmail/supervise
mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log
chmod +t qmail-smtpd qmail-send qmail-pop3d

Creating qmail-smtpd run supervise script:

vim qmail-smtpd/run

#!/bin/sh
QUID=`id -u qmaild`
QGID=`id -g qmaild`
MAXD=`head -1 /var/qmail/control/concurrencyincoming`
HOST=`head -1 /var/qmail/control/me`
SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit`
CDBF="/etc/tcp.smtp.cdb"
if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then
   echo QUID, QGID, MAXD, or HOST is unset in
   echo /var/qmail/supervise/qmail-smtpd/run
   exit 1
fi
exec            /usr/local/bin/softlimit                -m $SOFT        \
               /usr/local/bin/tcpserver                -v              \
                                                       -H              \
                                                       -R              \
                                                       -l $HOST        \
                                                       -x $CDBF        \
                                                       -c $MAXD        \
                                                       -u $QUID        \
                                                       -g $QGID        \
                                                       0               \
                                               smtp                    \
                             /var/qmail/bin/qmail-smtpd                \
            /var/qmail/bin/auth_smtp /usr/bin/true 2>&1

Creating qmail-smtpd log run supervise script:

vim qmail-smtpd/log/run

#!/bin/sh
export PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1

Creating qmail rc supervise script:

vim /var/qmail/rc

#!/bin/sh
QLOG="`cat /var/qmail/control/qmail-start-loglevel`"
DEFD="`cat /var/qmail/control/defaultdelivery`"
exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

Creating qmail-send run supervise script:

vim qmail-send/run

#!/bin/sh
exec /var/qmail/rc

Creating qmail-send log run supervise script:

vim qmail-send/log/run

#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1

Creating qmail-pop3d run supervise script:

vim qmail-pop3d/run

#!/bin/sh
IP=`head -1 /var/qmail/control/me`
LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel`
SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit`
exec  \
       env LOGLEVEL=$LL \
       softlimit -m $SL  \
       /usr/local/bin/tcpserver -v -R -H -l 0 0  pop3 \
       /var/qmail/bin/qmail-popup $IP \
       /var/qmail/bin/tcp-env \
       /var/qmail/bin/auth_pop  \
       /var/qmail/bin/qmail-pop3d Maildir 2>&1

Creating qmail-pop3d log run supervise script:

vim qmail-pop3d/log/run

#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1

Creating auto directory maker script:

vim /var/qmail/bin/dirmaker

#!/bin/sh
echo '----------------------------------------------' >> /tmp/dirmaker
date >> /tmp/dirmaker
echo $1 >> /tmp/dirmaker
id >> /tmp/dirmaker
mkdir --parents -m 700 -p $1/Maildir
mkdir --parents -m 700 -p $1/Maildir/tmp
mkdir --parents -m 700 -p $1/Maildir/cur
mkdir --parents -m 700 -p $1/Maildir/new
chown -R vmail:vmail $1

Set permissions of all qmail supervise run scripts:

chmod 755 qmail-pop3d/run qmail-smtpd/run qmail-send/run
chmod 755 qmail-pop3d/log/run qmail-smtpd/log/run qmail-send/log/run
chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker

Create tcp.smtp file to appy tcprules:

vim /etc/tcp.smtp

127.:allow,RELAYCLIENT="",MAXRCPTCOUNT="200"
192.168.:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHPREPEND="Authenticated
user:",SANITYCHECK="",SMTPAUTH="",LOGLEVEL="3",AUTHREQUIRED="",MAXRCPTCOUNT="100"
:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SANITYCHECK="",RETURNMXCHECK="STRICT",RBL="",REJECTEXEC="",LOGLEVEL="3",TARPITCOUNT="10",TARPITDELAY="10",SMTPAUTH="",MAXRCPTCOUNT="25"

Creating qmail logging directories and set permissions:

mkdir /var/log/qmail
cd /var/log/qmail
mkdir qmail-send qmail-smtpd qmail-pop3d
chown -R qmaill:root /var/log/qmail
chmod -R 750 /var/log/qmail

Creating qmail alias users, links and set permissions:

cd /var/qmail
cp -p /downloads/qmailctl /var/qmail/bin/.
chmod 755 /var/qmail/bin/qmailctl
ln -s /var/qmail/bin/qmailctl /usr/bin/
qmailctl cdb
mkdir -p /service
cd /service/
ln -s /var/qmail/supervise/qmail-* .
echo admin@prime-pci.com > /var/qmail/alias/.qmail-root
echo admin@prime-pci.com > /var/qmail/alias/.qmail-postmaster
echo admin@prime-pci.com > /var/qmail/alias/.qmail-mailer-daemon
ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous
chmod 644 /var/qmail/alias/.qmail*

Stop sendmail and remove all related files:

/etc/init.d/sendmail stop

chkconfig sendmail off

mv /usr/lib/sendmail /usr/lib/sendmail.org

mv /usr/sbin/sendmail /usr/sbin/sendmail.org

ln -s /var/qmail/bin/sendmail /usr/lib/sendmail

ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

Configure OpenLDAP:

cd /etc/openldap
cp /usr/src/qmail/qmail-1.03/qmail.schema schema/.
cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

vim /etc/openldap/slapd.conf

include         /etc/openldap/schema/qmail.schema
database        bdb
suffix          "dc=prime-pci,dc=com"
rootdn          "cn=Manager,dc=prime-pci,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw                secret
# rootpw                {crypt}ijFYNcSNctBYg
rootpw          secret

vim /etc/openldap/ldap.conf

HOST 127.0.0.1
BASE dc=prime-pci,dc=com

/etc/init.d/ldap restart

Create Domain.ldif file for Base and OU:

mkdir -p /downloads/ldap_ldif
cd /downloads/ldap_ldif

vim domain.ldif

# base dn
dn: dc=prime-pci,dc=com
objectClass: dcObject
objectClass: organization
o: prime-pci
dc: prime-pci
# ou, prime-pci.com
dn: ou=prime-pci.com,dc=prime-pci,dc=com
objectClass: top
objectClass: organizationalUnit
ou: prime-pci.com

vim admin.ldif [password=postmaster]

# admin, prime-pci.com
dn: uid=admin,ou=prime-pci.com,dc=prime-pci,dc=com
objectClass: top
objectClass: inetOrgPerson
objectClass: qmailUser
cn: admin admin
sn: admin admin
mail: admin@prime-pci.com
accountStatus: active
mailMessageStore: prime-pci.com/admin
uid: admin
mailHost: node1.prime-pci.com
deliveryMode: noforward
userPassword:: e0NSWVBUfU9XY3dPTS9IekVBT2s=

Add domain and admin user's data on LDAP

ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f domain.ldif
ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f admin.ldif

Dovecot installation

cd /root/downloads/shashankQmail

tar xvzf dovecot-2.0.14.tar.gz

cd dovecot-2.0.14

./configure --without-shadow --without-pam  --without-bsdauth \
--without-gssapi --without-sia --without-vpopmail \
 --without-sql --without-pgsql --without-mysql --without-sqlite \
--with-ssl=openssl --with-libwrap --with-ldap --without-shadow --prefix=/usr

make && make install

useradd -d /nonexistent -s /bin/false -c 'Dovecot user' dovecot

mkdir -p /etc/ssl/private/

mkdir -p /etc/ssl/certs/

cp -pv /usr/share/doc/dovecot/example-config/dovecot.conf
/usr/etc/dovecot/dovecot.conf

cp -pv /usr/share/doc/dovecot/example-config/dovecot-ldap.conf.ext
/usr/etc/dovecot/dovecot-ldap.conf

ln -s /usr/etc/dovecot/dovecot-ldap.conf
/usr/etc/dovecot/dovecot-ldap-userdb.conf

Update slapd.conf by placing this line 'by:

dn="uid=dovecot,ou=mail,dc=example2,dc=com" read' below 'access to attrs=userPassword'.

Eg:

access to * by dn="uid=admin,ou=mail,dc=example2,dc=com" write
              by * read
access to attrs=userPassword
              by dn="uid=dovecot,ou=mail,dc=example2,dc=com" read
              by dn="uid=admin,ou=mail,dc=example2,dc=com" write
              by anonymous auth

Example dovecot-ldap.conf file (You can copy+paste it):

hosts = localhost
dn =  uid=dovecot,ou=mail,dc=example2,dc=com
dnpass = asdf1234
auth_bind = no
ldap_version = 3
base = dc=example2,dc=com
scope = subtree
#user_attrs = mailMessageStore=home
user_attrs = mailMessageStore=home=/home/vmail/%$
#user_attrs = mail=home:/home/vmail/%d/%n
#user_attrs = mail=maildir:/home/vmail/%d/%n/Maildir
user_filter = (&(objectClass=qmailUser)(uid=%u))
pass_attrs = uid=user,userPassword=password
pass_filter =
(&(objectClass=qmailUser)(uid=%u)(!(accountStatus=disabled))(!(accountStatus=noaccess)))
default_pass_scheme = SSHA

Example dovecot.conf file (You can copy+paste it):

auth_verbose = yes
disable_plaintext_auth = no
debug_log_path = /var/log/dovecot-debug.log
default_login_user = dovecot
first_valid_uid = 89
info_log_path = /var/log/dovecot-info.log
last_valid_uid = 2000
log_path = /var/log/dovecot
login_greeting = Shashank's custom qmail!
mail_gid = vmail
mail_location = maildir:~/Maildir
mail_uid = vmail
namespace {
 inbox = yes
 location = maildir:~/Maildir
 prefix = INBOX.
 separator = .
}
passdb {
 args = /usr/etc/dovecot/dovecot-ldap.conf
 driver = ldap
}
protocols = imap
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
 args = /usr/etc/dovecot/dovecot-ldap-userdb.conf
 driver = ldap
}
verbose_proctitle = yes
verbose_ssl = yes
protocol lda {
 postmaster_address = admin@example2.com
}

Now simply type 'dovecot' at the terminal to start.

'dovecot stop' stops it.
'dovecot -n' checks config file.

Install autoresponder and maildrop:

cd /downloads/autorespond-2.0.5/
make && make install
cd /downloads/maildrop-2.5.4
./configure --prefix=/usr/local --exec-prefix=/usr/local --enable-maildrop-uid=root
make && make install-strip && make install-man

Reload tcp.smtp rules

Unpack Phpldapadmin and configure to access from Web:

mv /downloads/phpldapadmin-1.2.2 /var/www/html/phpldapadmin
cd /var/www/html/phpldapadmin
mkdir templates/creation.old templates/modification.old
mv templates/creation/* templates/creation.old/
mv templates/modification/* templates/modification.old/

Increase PHP memory limit:

vim /etc/php.ini

memory_limit = 128M

Unpack Squirrelmail and configure to Web access:

mv /downloads/squirrelmail-webmail-1.4.22 /var/www/html/webmail
cd /var/www/html/webmail
mkdir attachements
chown -R apache:apache attachements
chown -R apache:apache data
cd config
./conf.pl

Install all required packages for Qmail-Scanner:

yum perl-suidperl perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS
perl-Time-HiRes* perl-HTML-Tagset perl-HTML-Parser perl-Pod-Usage*
perl-Parse-Syslog perl-Statistics-Distributions spamassassin clamav clamd

Add user "qscand" for scanning:

useradd -c "Qmail-Scanner Account" -s /bin/false -m qscand

Change user clamav to qscand:

vim /etc/logrotate.d/clamav [Change clamav to qscand]

/var/log/clamav/clamd.log {
    missingok
    notifempty
    create 644 qscand qscand
    postrotate
        killall -HUP clamd 2>/dev/null || :
    endscript
}

vim /etc/logrotate.d/freshclam [Change clamav to qscand]

/var/log/clamav/freshclam.log {
    missingok
    notifempty
    create 644 qscand qscand
}

vim /etc/clamd.conf

User qscand

vim /etc/freshclam.conf

DatabaseOwner qscand

chown qscand.qscand /var/log/clamav/ -R
chown -R qscand.qscand /var/run/clamav/
/etc/init.d/clamd restart
/etc/init.d/spamassassin restart

Install Qmail-Scanner:

cd /downloads/qmail-scanner-2.08
./configure --admin admin --domain prime-pci.com
mkdir -p /var/spool/qscan
mkdir -p /var/spool/qscan/quarantine/viruses/tmp
/var/spool/qscan/quarantine/viruses/cur
/var/spool/qscan/quarantine/viruses/new
mkdir -p /var/spool/qscan/quarantine/spam/tmp
/var/spool/qscan/quarantine/spam/cur /var/spool/qscan/quarantine/spam/new
mkdir -p /var/spool/qscan/quarantine/policy/tmp
/var/spool/qscan/quarantine/policy/cur
/var/spool/qscan/quarantine/policy/new
mkdir -p /var/spool/qscan/working/tmp /var/spool/qscan/working/cur
/var/spool/qscan/working/new
mkdir -p /var/spool/qscan/archive/tmp /var/spool/qscan/archive/cur
/var/spool/qscan/archive/new
cp /downloads/qmail-scanner-2.08/quarantine-events.txt /var/spool/qscan/
chown -R qscand:qscand /var/spool/qscan/
cp -pv /downloads/qmail-scanner-2.08/qmail-scanner-queue.pl /var/qmail/bin/
chown qscand.qscand /var/qmail/bin/qmail-scanner-queue.pl
chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl
/var/qmail/bin/qmail-scanner-queue.pl -z 
/var/qmail/bin/qmail-scanner-queue.pl -g
cp -v /downloads/qmail-scanner-2.08/contrib/logrotate.qmail-scanner
/etc/logrotate.d/qmail-scanner
/etc/init.d/syslog restart

Integrate Qmail-scanner with qmail queue:

vim /var/qmail/supervise/qmail-smtpd/run

QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE

Check Qmail-scanner Installation:

su - tetra
/var/qmail/bin/qmail-scanner-queue.pl -g
/root/downloads/qmail-scanner-2.08/contrib/test_installation.sh -doit
###[ This step generate 2 spam mails and send to the admin e-mail account]###

LDAP address book settings on Thunderbird:

Name: LDAP Address Book
Hostname: node1.prime-pci.com
Base DN: ou=prime-pci.com,dc=prime-pci,dc=com
Port Number: 389