GSTN - Zimbra Collaboration suit

Zimbra Collaboration Network Edition

ZimbraCollaboration Suite

Introduction

Zimbra Collaboration delivers your Mailbox, Contacts, Calendar, Tasks, Files and much more on any device: Smart Phone, Tablet or iPad and Desktop or Laptop Computer running Windows, Linux or OS X. Zimbra is an enterprise-class email, calendar and collaboration solution built for the cloud, both public and private. With a redesigned browser-based interface, Zimbra offers the most innovative messaging experience available today, connecting end users to the information and activity in their personal clouds.

Architecture

The mail flow Architecture at GSTN. Would be as per the following diagram.

Server Sizing / Considerations

ServerName	OS	Role	vRAM	vCPU	HDD OS [GB]	HDDData [GB]	VLANID	IP Address	VIP	Subnet	Gateway
GD9107	RHEL	Zimbra MTA/Proxy #1	16	4	200		201	172.18.201.11	172.18.201.13	255.255.255.192	172.18.201.1
GD9108	RHEL	Zimbra MTA/Proxy#2	16	4	200		201	172.18.201.12	255.255.255.192	172.18.201.1
GD9109	RHEL	Zimbra LDAP/Mailbox#1	16	8	200	1024	101	172.18.101.18	172.18.101.20	255.255.255.0	172.18.101.1
GD9110	RHEL	Zimbra LDAP/Mailbox#2	16	8	200	101	172.18.101.19	255.255.255.0	172.18.101.1
GD9111	RHEL	Zimbra Archival Server	8	4	100	1024	101	172.18.101.21		255.255.255.0	172.18.101.1

IPv6 Details

ServerName	IP Address	Gateway	VIP
GD9107	2404:a800:1000:d:a000::b/69	2404:a800:1000:d:a000::1	2404:a800:1000:d:a000::d/69
GD9108	2404:a800:1000:d:a000::c/69	2404:a800:1000:d:a000::1
GD9109	2404:a800:1000:d:7800::12/69	2404:a800:1000:d:7800::1	2404:a800:1000:d:7800::14/69
GD9110	2404:a800:1000:d:7800::13/69	2404:a800:1000:d:7800::1
GD9111	2404:a800:1000:d:7800::15/69	2404:a800:1000:d:7800::1	NA

GD9107 IpV4 and IpV6 details:

GD9108 IpV4 and IpV6 details:

GD9109 IpV4 and IpV6 details:

GD9110 IpV4 and IpV6 details:

GD9111 IpV4 and IpV6 details:

Template:Anchor Trend IMSVA integration with Zimbra Architecture

Trend's IMSVA Solution placed at gateway level as Anti-virus and Anti Spam solution on High Availability. This AV/AS Gateway Engine Seamlessly integrates with Zimbra Collaborative Suite. The MX is pointed to this Trend's IMSVA Engine. All the Incoming mails from the Internet are scanned and then forwarded to Zimbra MTA/ Proxy Server. As IMSVA is integrated with AD , the check for authentic users are done at Gateway level itself and invalid mails are rejected at SMTP level of IMSVA. Once the incoming mail passes all scanning and declared as genuine mail, it forwarded to Zimbra MTA. In turn Zimbra MTA pushes the mails to Mail box Server after 2^nd level of scanning . The Users are connected to the Mailbox are authenticated against AD . All outgoing mails are again scanned at Zimbra Level via Zimbra's Integrated AV/ AS Engine ( Clam-AV and Spamassassin ) and pushed to IMSVA for further Scanning. Passing all the checks by IMSVA , the outgoing mails id delivered to the final destination via Internet.

Sizing Considerations and design.

Considering the deployment of 100 users scalable to 200, the environment can be split up as follows:

Assumptions* No of Users: 100

• Mail Box Quota / User: As per given user quota list.
• Average Utilization: 60%
• Outgoing Mail / User: 20
• Incoming Mail / User: 20
• Average Mail Size: 50 KB
• Average Attachment Size: 1024 KB

Front End Components:* 2 * Zimbra MTA / Proxy VM with 4 virtual cores and 16 GB of RAM

• 2 * Zimbra Mailbox VM with 8 virtual cores and 16 GB of RAM

Actual Allocation of Disk / LUN as per the Sizing in Zimbra

Mailbox Server Storage	Usable	Mapped Disks	Remark
Required Primary Space (TB)	0.2	1024 (RAID 1)	User Mailbox
Required Backup Space (TB)*	0.4	400 (Raid5) SANBackup LUN	Zimbra Native Backup , 1 Full Backup and 6 Incremental Backups
Required Archive Space(TB)**	0.4	1024 (Raid5)	Archive Mailbox retention policy 90 days on Live Environment

* Includes one full backups and one week of incremental. Assumes nightly incremental are 10% as big as full.

** Archived data on Disk is calculated for 180 Days

Full Backup of Archive Email will be done through backup for 30 days and will be retained for 7 years.

Daily incremental and weekly Full Backup of mailbox folder will happen to maintain a retention of 28 days.

Template:Anchor Zimbra Components and its distribution at GSTN site

Zimbra Core - Includes the libraries, utilities, monitoring tools, and basic configuration files. zmconfigd is part of zimbra-core and is automatically enabled and runs on all systems.

Zimbra Store -(mailbox server) -The Zimbra store includes the components for the mailbox server, including Jetty, which is the servlet container the Zimbra software runs within. The Zimbra mailbox server includes the following components:* Data store. The data store is a MariaDB© database.

• Message store. The message store is where all email messages and file attachments reside.
• Index store. Index and search technology is provided through Lucene. Index files are maintained for each mailbox.
• Web application services. The Jetty web application server runs web applications (webapps) on any store server. It provides one or more web application services.

Zimbra LDAP -Zimbra Collaboration uses the OpenLDAP ® software, an open source LDAP directory server. User authentication,theZimbra Global Address List, and configuration attributes are services provided through OpenLDAP. Note that the Zimbra GAL and authentication services can be provided by an external LDAP Directory such as Active Directory.

Zimbra MTA - Postfix is the open source mail transfer agent (MTA) that receives email via SMTP and routes each message to the appropriate Zimbra mailbox server using Local Mail Transfer Protocol (LMTP). The Zimbra MTA also includes the anti-virus and anti- Spam components.

Zimbra Proxy -Zimbra Collaboration 8.6 Zimbra Proxy is a high-performance reverse proxy service for passing IMAP[S]/POP[S]/HTTP[S] client requests to other internal ZCS services. This package is normally installed on the MTA server(s) or on its own independent server(s). When the zimbra-proxy package is installed, the proxy feature is enabled by default. Installing the Zimbra Proxy is highly recommended, and required if using a separate web application server.

ZimbraMemcached-Memcached is automatically selected when the zimbra-proxy is installed. At least one server must run zimbra-memcached when the proxy is in use. You can use a single memcached server with one or more Zimbra proxies. zimbra-memcached is required if using a separate web application server.

Zimbra SNMP - The Zimbra SNMP package will be installed. zimbra-SNMP for monitoring, this package will be installed on every Zimbra server.

Zimbra Logger - The Zimbra Logger package will be used and is installed on mailbox server. The Zimbra Logger installs tools for syslog aggregation and reporting. If you do not install Logger, the server statistics section of the administration console will not display. The Logger package must be installed at the same time as the mailbox server.

Zimbra Spell - The Zimbra Spell package is installed. Aspell is the open source spell checker used on the Zimbra Web Client. When Zimbra-Spell is installed, the Zimbra-Apache package is also installed. Zimbra Apache TheZimbra Apache package is installed automatically when Zimbra Spell or ZimbraConvertd is installed.

ZimbraConvertd -Zimbra-convertd package is installed on the zimbra-store server. Only one Zimbra-convertd package needs to be present in the Zimbra Collaboration environment. The default is to install one zimbra-convertd on each zimbra-store server. When Zimbra-Convertd is installed, the Zimbra-Apache package is also installed.

Zimbra Archiving - The Zimbra Archiving and Discovery feature is used and feature for ZCS Network Edition. Archiving and Discovery offers the ability to store and search all messages that were delivered to or sent by ZCS. This package includes the cross mailbox search function which can be used for both live and archive mailbox searches. Note: Using Archiving and Discovery can trigger additional mailbox license usage.

For GSTN we would be using Zimbra Archiving for Audit and legal purpose.

Specific Design for GSTN as below

Components	Mailbox Servers	MTA Server	Archive server
Zimbra- core	YES	YES	YES
Zimbra-Store	YES	NO	YES
Zimbra LDAP	YES	NO	NO
Zimbra MTA	NO	YES	NO
Zimbra Proxy	NO	YES	NO
ZimbraMemcached	NO	YES	NO
Zimbra SNMP	YES	YES	YES
Zimbra Logger	YES	NO	NO
Zimbra Spell	YES	NO	NO
ZimbraConvertd	YES	NO	NO
Zimbra Apache	YES	NO	YES
Zimbra Archiving	NO	NO	YES

Component status from GD9107:

Component status from GD9108:

Component status from mailbox server:

Component status from GD9111:

GSTN Client Access

GTSN Mail Users will be sitting in Client access or User zone to access the mail services . They can use following access methods* Off-line Client access – Microsoft Outlook will be preferred Mail client . Zimbra has Outlook connector for accessing the Zimbra all features including MAPI access , Calendar ,Tasks , GAL , Shared Calender and Folders etc . Microsoft Outlook with ZCO ( Zimbra Connector for outlook ) will use full fledge MAPI protocol . MAPI synchronization to outlook 2003/2007/2010 with full delegate, off-line access and support for S/MIME. Other clients like Thunderbird , Microsoft mail , outlook express , Eudora will use IMAP , POP3 and SMTP over SSL/TLS for mail access and for calendar access will use CALDAV protocols

• Exchange Web Services - If your users are using an Enterprise Email Client like Microsoft Outlook in Mac OS X, Zimbra provides Exchange Web Services, which allows your users connect to their Mailbox in their favorite Operating System
• Zimbra WEB UI - Rich browser-based interface with application features such as drag and drop, tagging and conversation views
  • Ability to send and receive authenticated and encrypted email messages
  • Comprehensive search-based in-box; ability to search within attachments; saved search folders
  • Innovative calendar wizard that finds the optimal time and place for large meetings within seconds
  • Effective sharing and collaboration with peers, including in-boxes, contacts, calendars and tasks
  • Robust enterprise calendars with shared free and busy times; inter-operable with MS Exchange
  • Innovative “hub” of communications that integrates third-party services as mashups or application tabs

• Mobile devices - Zimbra provides the latest version of Exchange Active Sync (EAS), which allows your users to sync their entire Mailbox, Calendar, Contacts and Tasks to their Mobile Devices such as i Phones, i Pads, Androids, etc. This option also allows connections to Microsoft Outlook using EAS.Ability to set mobile security policies including device wipe, Pins and device-management features on user accounts.

Supported Versions of Microsoft Operating System

ZCO supports Microsoft Operating Systems: Windows 2010 ,Windows® 8, Windows 7, Vista and Windows XP with required updates.

Important: Windows XP is deprecated. The 8.x series of Zimbra Collaboration is the last release to support Microsoft Outlook 2003 and Microsoft Windows XP.

Supported Versions of Microsoft Outlook

ZCO supports the following versions of Microsoft Outlook:

Outlook 2013: 32-bit and 64-bit editions of Microsoft Office are supported.

Outlook 2010: 32-bit and 64-bit editions of Microsoft Office are supported.

Note:

“Click to run” versions of Outlook 2010 are not supported.

Outlook 2007: Client computers must have Microsoft Office Outlook 2007

SP2 or later installed.

Outlook 2003: Client computers must have Microsoft Office Outlook 2003

SP3 or later installed.

Important: : Outlook 2003 is deprecated: The 8.x series of Zimbra Collaboration is the last release to support Microsoft Outlook 2003 and Microsoft Windows XP.

Template:Anchor Zimbra Archiving and discovery

Zimbra Archiving and Discovery is an optional feature that enables you to archive messages that were delivered to or sent by Zimbra Collaboration and to search across mailboxes. When archiving is enabled for an account, a copy of all email from or to that account is forked at the MTA, and a copy of the message is delivered to a predefined archive mailbox. The archiving process is transparent to account users.

Zimbra Collaboration allows you to configure certain features for different accounts using the Class-of-Service (COS). The Archiving & Discovery Feature can be configured per Account or per Class-of-Service to automatically Archive all information to/from that account(s) for Legal and audit purposes. In the same Configuration window, you can select an account Template Name, so all the Archiving accounts will have an unique and custom name, easy to Manage and Discover when necessary.

Zimbra Collaboration Admin Console makes this task easy by providing all the necessary tools for managing Archiving accounts. Using the Template Name option and the different Icon per Archiving Accounts, the IT Department can list and manage all the Archiving Accounts.

The Zimbra Archiving & Discovery Feature allows the IT Department to search across mailboxes using the special Feature called Search Mailbox. The IT Department can select multiple Advanced Search parameters and save the results of the Search in a dedicated Mailbox ready for the Legal & Audit purposes. The Advanced Search contains more than 8 different filters to add to the search chain to obtain the content the Audit requires.

Template:Anchor Template:Anchor Zimbra Archiving architecture and design

When a message is sent or received by a user, the message is always routed through the Postfix MTA. The Postfix MTA allows integrating software that can perform actions on messages that are in flight. When archiving is enabled for the sender or the recipient of messages, Zimbra Archiving integrates with an MTA hook and the Amavisd-New utility to fork a copy of the message. The “does recipient or sender have archiving enabled” check is performed on the SMTP standard envelope and not on the From or To/Cc headers. Since checks are performed on the envelope, B cc copies and messages sent to distribution lists are captured.

It is also possible to delegate any user for archiving access even for searching an single or multiple archival mailboxes.

Template:Anchor Zimbra Dumpster

With Dumpster the users (and more importantly, admins) can recover deleted files (Emails, Contacts, Calendar or appointments, Tasks, Files, etc.) from a period of time. This feature is really useful to recover specific files deleted by mistake, and makes the life of the System Administrator, and also of the users, much easier.

30 Days retention period for deleted files is suggested for GSTN . In this case , GSTN users can recover items, it will show files for the last 30 days, and items older than 30 days will be auto purged.

AD IntegrationTemplate:Anchor

Zimbra permits the use of external LDAP servers (Active Directory) per domain for end user authentication. Zimbra user accounts are mapped to LDAP accounts on an external host using an LDAP query filter.

As GSTN has Central LDAP Directory on Linux AD environment, All the accounts created for Mail access will use the same user-name and credentials as defined on Central AD. Even the GAL will also be populating from Linux AD.

Template:Anchor High Availability Architecture

Zimbra MTA and Zimbra Mailbox Servers are the Servers which will use RHEL HA components. IP address, Zimbra Service and Volume mount points will highly available.

On Zimbra MTA Servers , the Service IP ( Cluster IP ) and Zimbra MTA/ Proxy services will take care of High availability . The 2 numbers of MTA servers will be part of this cluster setup which will work on Active / Passive mode. In case of host failure the RHEV cluster will ensure that VM running on the failed host is restarted on the other available host . In-case any of the Services of Zimbra failure or OS related issue on the Zimbra MTA Server VM , present Zimbra MTA VM is fenced and all the services gets transfered to the current passive Zimbra MTA VM . The Passive VM is declared Active and will serve the all the designated zimbra services.

The two number of Mailbox servers will be also be in active / passive cluster via RHEL HA . In case of failure, inside of the VM like zimbra service failure , OS corruption , Planed Updated etc , the Services , Cluster IP and Mounted Volume will be moved to the passive Zimbra Mailbox server .

No HA for Zimbra Archival Server. Full Backup of Archive Email will be done through backup for 30 days and will be retained for 7 years.

The fail-over mechanism will be automated, but fail back will be suggested manual.

Suggested Zimbra details

Host Name	Server Role	OS	OS Space [Raid-5]	Raid5 LUN [Data]	Data Space [Raid-10]	RAM	vCPU	IP Address	VIP
GD9107	Zimbra MTA/Proxy(#1)	RHEL	200			16	4	172.18.201.11	172.18.201.13
GD9108	Zimbra MTA/Proxy(#2)	RHEL	200			16	4	172.18.201.12
GD9109	Zimbra LDAP/Mailbox (#1)	RHEL	200		1024	16	8	172.18.101.18	172.18.101.20
GD9110	Zimbra LDAP/Mailbox (#2)	RHEL	200		16	8	172.18.101.19
GD9111	Zimbra Archival Server	RHEL	100	1024		8	4	172.18.101.21	No HA for Archival Server

Template:Anchor Distribution List

Distribution Lists can be created by Zimbra domain administrators to handle a bevy of needs such as email forwarding, team lists, customers lists and more via Web administration panel of Zimbra

A distribution list is a group of email addresses contained in a list with a common email address. When users send to a distribution list, they are sending the message to everyone whose address is included in the list. The address line displays the distribution list address; the individual recipient addresses cannot be viewed. Only administrators can create, change, or delete distribution lists.

The maximum number of members in a distribution list is 1000 recipients. The 1000 recipients include addresses in distribution lists that are nested within a distribution list. Senders do not receive an error when they send a message to a distribution list with more than 1000 members, but the message is not sent to more than 1000 recipients.

When a Zimbra user’s email address is added to a distribution list, the user’s account Member Of tab is updated with the list name. When a distribution list is deleted or the removed, the distribution list is automatically removed from the Member Of tab.

The Hide in GAL check box can be enabled to create distribution lists that do not display in the Global Address List (GAL). You can use this feature to limit the exposure of the distribution list to only those that know the address.

Using Distribution Lists for Group Sharing

Instead of creating individual share requests, distribution lists can be created to share items with a group. Users notify the administrator that they have shared an item with the distribution list and the administrator publishes the shared item to the list. This is done in the Shares tab. When a new shared item is published, existing members of the list are automatically notified of the new share.

Everyone in the DL has the same share privileges that the grantee defines for the shared item.

When new members are added to the group distribution list, they are automatically granted the same shared privileges as other members of the group. You can set up the Share tab so that new members are automatically notified about items that are shared with them through the list.

Sender Restriction to Distribution lists. The Zimbramilter allows for the regulation of distribution list senders on a Global or server level. When the milter server is enabled, only users who have been granted explicit sending permissions will be allowed.

Zimbra DL are dynamic in nature which remove the users automatically from DL when user's account is closed or removed .

Template:Anchor Resource (e.g. Meeting Room) Bookings

A resource is a location or equipment that can be scheduled for a meeting. Each meeting room location and other non-location specific resources such as AV equipment is set up as a resource account. The Resources section in the administration console shows all resources that are configured for ZCS.

User accounts with the Calendar feature can select these resources for their meetings. The resource accounts automatically accept or reject invitations based on availability. Administrators do not need to monitor these mailboxes on a regular basis. The contents of the resource mailboxes are purged according to the mail purge policies.

A Resource Wizard on the administration console guides you through the resource configuration. You can configure the account with the following details about the resource:* Type of resource, either location or equipment

• Scheduling policy
• Forwarding address to receive a copy of the invite
• Description of the resource
• Contact information. This can be a person to contact if there are issues.

Location information, including room name, specific building location including building and address, and room capacity. When you create a resource account, a directory account is created in the LDAP server.

To schedule a resource, users invite the equipment resource and/or location to a meeting. When they select the resource, they can view the description of the resource, contact information and free/busy status for the resource, if these are set up.

When the meeting invite is sent, an email is sent to the resource account, and, based on the scheduling policy, if the resource is free the meeting is automatically entered in the resource’s calendar and the resource is shown as Busy.

Template:Anchor Corporate Directory/ GAL

A company directory is a company-wide listing of users, usually within the organization itself, that is available to all users of the email system. Sometimes called “white pages” or global address list (GAL), Zimbra uses the company directory to look up user addresses from within the company. For each domain used in Zimbra, you can choose from the following GAL search options:* Use an external LDAP server for the GAL

• Use the Zimbra implementation in OpenLDAP
• Include both external LDAP server and OpenLDAP in GAL searches

At GSTN LDAP/Active Directory (SAMBA4) will be integrated and serve at GAL .

Template:Anchor ZimbraMobile and Active sync

Zimbra offers four options for accessing Zimbra accounts using mobile devices.

Zimbra Mobile Web Client. The first option, the Zimbra Mobile Web Client, is the most versatile option since it can be accessed on almost any mobile device and requires no license or additional software. Using the Zimbra Mobile Web Client, users can access their mail, contacts, calendar, and briefcase.

Zimbra Mobile Touch Client. A Network Edition Feature. The secure, HTML5 mobile web application provides a device-specific user experience for Android and iOS devices. The Zimbra touch client can be tailored through open APIs and fully white labeled. It delivers anytime, anywhere mailbox access, through a unique Zimbra experience, that keeps people connected to their data.

Zimbra Mobile for Smart Phones. A Network Edition Feature. The third option, Zimbra Mobile for Smart Phones, offers users two-way, over-the-air (OTA) synchronization and access to mail, contacts, calendar, and briefcase. It works natively with iPhone, Android devices, Windows Mobile and Symbian S60/S80 smart phones. The ActiveSync protocol is used to configure and sync the Zimbra mailbox server with the native client that is used on a user’s device.

Zimbra Connector for BlackBerry. The third option, Zimbra Connector for BlackBerry, is only for BlackBerry mobile devices. This option offers users two-way, OTA synchronization and access to mail, contacts, calendar, and briefcase. This option requires a paid Zimbra Collaboration Suite license plus you must have a BlackBerry Enterprise Server (BES).

Template:Anchor ZimbraMailbox Structure with journaling

Journaling in Zimbra Solution

Journaling in Zimbra is used for Database integrity . As mailbox data and indexes goes in the Mariadb (Mysql) database, the database integrity is achieved via redo logs. Redo Logs are 1G by default . The Redo logs are also achieved after 1 GB of space utilization. This is depicted in the shown Mailbox architecture of Zimbra.

Zimbra Archiving and Discovery will use a kind of Journaling mechanism where copies of messages are stored in Zimbra archive mailbox as depicted on Zimbra Archiving process flow. Zimbra Archive is retained for 90 days for all users on the archive server and Backup should ensure the availability for 7 Years .

Backup policy on Mailbox via HP Datastore Backup Solution * Daily increment from Monday to Saturday

• Full Backup on Sunday

Backup policy on Archive Mailbox via HP Datastore Backup Solution* Full Monthly Backup ( 30days )

File:ZIMBRACOL21.wmf\

Template:Anchor Backup and Restore

Zimbra Collaboration (Zimbra Collaboration) includes a configurable backup manager that resides on every zimbra Collaboration server and performs both backup and restore functions.

The backup manager can be used to restore a single user, rather than having to restore the entire system in the event that one user’s mailbox becomes corrupted. It is also possible to restore full server via backup manager.

Backup and restore procedures can be run directly from the administration console. In the Navigation pane, Monitoring>Backup lists each of the servers.

Restoring Data

Three types of restore procedures can be run:* The zmrestore command is used to restore the mailboxes while the Zimbra Collaboration mailbox server is running.

• The zmrestoreoffline is used to restore the mail server when the mail server is down. This command is run for disaster recovery.
• The zmrestoreldap is used to restore the content of the LDAP directory server.

The restore process allows all accounts or individual accounts to be specified.

GSTN will have 2 following methods of Backup .* Zimbra Native Backup

• Backup via HP Data protector backup solution

Zimbra Native Backup: Will be used to backup User’s Mailboxes and Will be Stored on 400GB Disk projected from RHEVCluster_Data_R5_TP_SANBAckup LUN.

Every Sunday will run Full Backup and Monday to Saturday Incremental With the retention of one week only.