Jump to content

Qmail installation1: Difference between revisions

From TetraWiki
← Older editNewer edit →
Raunaq (talk | contribs)
127 edits
No edit summary
Raunaq (talk | contribs)
127 edits
No edit summary
Line 483: Line 483:




16.Qmail - Other configuration
16.Qmail - Other configuration:




Line 500: Line 500:




17.OPENLDAP Integration with QMAIL-LDAP
17.OPENLDAP Integration with QMAIL-LDAP:
 
 


cd /etc/openldap
cd /etc/openldap


cp /usr/src/qmail/qmail-1.03/qmail.schema schema/.
cp /usr/src/qmail/qmail-1.03/qmail.schema schema/.




vi slapd.conf
vi slapd.conf
----------------------------------------
----------------------------------------
  See slapd.conf(5) for details on configuration options.
  See slapd.conf(5) for details on configuration options.
  This file should NOT be world readable.
  This file should NOT be world readable.


include        /etc/openldap/schema/core.schema
#include        /etc/openldap/schema/core.schema
include        /etc/openldap/schema/cosine.schema
#include        /etc/openldap/schema/cosine.schema
include        /etc/openldap/schema/inetorgperson.schema
#include        /etc/openldap/schema/inetorgperson.schema
include        /etc/openldap/schema/nis.schema
#include        /etc/openldap/schema/nis.schema
include        /etc/openldap/schema/qmail.schema
#include        /etc/openldap/schema/qmail.schema


# Allow LDAPv2 client connections.  This is NOT the default.
# Allow LDAPv2 client connections.  This is NOT the default.

Revision as of 09:32, 24 July 2012

[[Qmail + LDAP Configuration ]]


Qmail Downloads

Check for gcc


wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz

wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm


rpm -Uhv rpmforge-release-0.3.6-1.el5.rf.i386.rpm

yum install openldap* yum install zlib* yum install glib yum install gcc-c++ yum install gdbm*


1. yum install openssl-devel


2.Qmail Downloads

First create a new directory where you will store your qmail package.

mkdir /downloads

cd /downloads

Download the qmail package (or tarball).

wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz

Download qmail-ldap patch.

wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

Unpack the downloaded qmail package.

tar -zxvf qmailrocks.tar.gz


3.Creating initial qmail directories.

mkdir -p /var/qmail

mkdir /usr/src/qmail


4.Creating all needed users and groups:


groupadd nofiles

useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias

useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild

useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill

useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp


groupadd qmail

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails


groupadd vmail

useradd -g vmail -s /bin/true vmail


5.Unpacking qmail, ucspi-tcp and daemontools


cd /usr/src/qmail

tar zxvf /downloads/qmailrocks/qmail-1.03.tar.gz

tar zxvf /downloads/qmailrocks/ucspi-tcp-0.88.tar.gz

mkdir -p /package

chmod 1755 /package

cd /package

tar zxvf /downloads/qmailrocks/daemontools-0.76.tar.gz


6.Creating & setting qmail logging directories.


mkdir /var/log/qmail

cd /var/log/qmail

mkdir qmail-send qmail-smtpd qmail-pop3d

chown -R qmaill:root /var/log/qmail

chmod -R 750 /var/log/qmail


7.Setting up the supervise script directories.


mkdir /var/qmail/supervise

cd /var/qmail/supervise

mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log

chmod +t qmail-smtpd qmail-send qmail-pop3d


8.Setting conf-split and conf-spawn.

echo 211 > /usr/src/qmail/qmail-1.03/conf-split

echo 255 > /usr/src/qmail/qmail-1.03/conf-spawn


9.Applying qmail-ldap patch.


cd /usr/src/qmail/qmail-1.03/

gzip -d qmail-ldap-1.03-20060201.patch.gz

patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch


10.Make following changes to the Makefile and then save & close this file.


vi Makefile

LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DSMTPEXECCHECK -DALTQUEUE

ZLIB=-lz

MDIRMAKE=-DAUTOMAILDIRMAKE

HDIRMAKE=-DAUTOHOMEDIRMAKE

SHADOWLIBS=-lcrypt

DEBUG=-DDEBUG

Save & Close this file.


11.Building qmail.

make setup check

Please enter the hostname in place of <hostname> like mailserver.krishnagroup.co.in ./config-fast <hostname>


12.Build ucspi-tcp:


cd /usr/src/qmail/ucspi-tcp-0.88/

patch < /downloads/qmailrocks/patches/ucspi-tcp-0.88.errno.patch

make && make setup check


13.Build daemontools:


cd /package/admin/daemontools-0.76/src

patch < /downloads/qmailrocks/patches/daemontools-0.76.errno.patch

cd ..

package/install

If you take a look at the running processes on your server at this point, you should see the daemon "svscanboot" running.


14.LDAP controls files.


cd /var/qmail/control

echo 100 > concurrencyincoming

echo 255 > concurrencyremote

echo ./Maildir/ > defaultdelivery


Please enter the domain name in place of <domain-name> like krishnagroup.co.in


echo <domain-name> > defaultdomain

echo /var/qmail/bin/dirmaker > dirmaker


Please enter the base dn in place of <base-dn> like dc=krishnagroup,dc=co,dc=in


echo <base-dn> > ldapbasedn

echo 0 > ldapcluster

id -g vmail > ldapgid


Please enter root dn in place of <root-dn> for LDAP login like cn=manager,dc=krishnagroup,dc=co,dc=in


echo <root-dn> > ldaplogin

echo /home/vmail > ldapmessagestore

echo qmailUser > ldapobjectclass


Please enter the root dn password in place of <rootdn-pass>


echo <rootdn-pass> > ldappassword

echo 127.0.0.1 > ldapserver

id -u vmail > ldapuid


Please enter the hostname in place of <hostname> like mailserver.krishnagroup.co.in


echo <hostname> > me

echo 127.:allow,NOPBS="" :deny > qmail-pop3d.rules

echo 80000000 > qmail-smtpd-softlimit

echo 80000000 > qmail-pop3d-softlimit

echo 3 > qmail-start-loglevel


Please enter the domain name in place of <domain-name> for which you want to receive mails like krishnagroup.co.in


echo <domain-name> > rcpthosts


Please enter the hostname 

in place of <hostname> like krishnagroup.co.in


echo <hostname> > locals


Please enter the domain name in place of <domain-name> for which you want to receive mails like krishnagroup.co.in


echo <domain-name> >> locals

cd /var/qmail



Make changes to dirmaker file and then save & close it:


vi bin/dirmaker

  1. !/bin/sh

echo '----------------------------------------------' >> /tmp/dirmaker date >> /tmp/dirmaker echo $1 >> /tmp/dirmaker id >> /tmp/dirmaker

mkdir --parents -m 700 -p $1/Maildir mkdir --parents -m 700 -p $1/Maildir/tmp mkdir --parents -m 700 -p $1/Maildir/cur mkdir --parents -m 700 -p $1/Maildir/new chown -R vmail:vmail $1

Save & Close this file.


Make changes to dirmaker file and then save & close it.

vi rc

  1. !/bin/sh

QLOG="`cat /var/qmail/control/qmail-start-loglevel`" DEFD="`cat /var/qmail/control/defaultdelivery`" exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

Save & Close this file.


chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker


15.Qmail Run Files

cd supervise

vi qmail-smtpd/run

  1. !/bin/bash

QUID=`id -u qmaild` QGID=`id -g qmaild` MAXD=`head -1 /var/qmail/control/concurrencyincoming` HOST=`head -1 /var/qmail/control/me` SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit` CDBF="/etc/tcp.smtp.cdb"

if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then 

   echo QUID, QGID, MAXD, or HOST is unset in
   echo /var/qmail/supervise/qmail-smtpd/run
   exit 1

fi

exec /usr/local/bin/softlimit -m 40000000 \ 

               /usr/local/bin/tcpserver                -v                      \
                                                       -H              \
                                                       -R              \
                                                       -l $HOST                \
                                                       -x $CDBF        \
                                                       -c $MAXD      \
                                                       -u $QUID        \
                                                       -g $QGID        \
                                                       0                       \
                                               smtp                    \
                             /var/qmail/bin/qmail-smtpd krishnagroup.co.in     \
            /var/qmail/bin/auth_smtp /usr/bin/true 2>&1

Save & Close this file.


vi qmail-smtpd/log/run

  1. !/bin/sh

PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin export PATH exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1

Save & Close this file.


vi qmail-send/run

  1. !/bin/sh

exec /var/qmail/rc

Save & Close this file.


vi qmail-send/log/run

  1. !/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1

Save & Close this file.


vi qmail-pop3d/run

  1. !/bin/sh

IP=`head -1 /var/qmail/control/me` LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel` SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit` exec \ 

       env LOGLEVEL=$LL                                                \
       softlimit -m $SL                                                        \
       /usr/local/bin/tcpserver -v -R -H -l 0 0  pop3                  \
       /var/qmail/bin/qmail-popup $IP                                  \
       /var/qmail/bin/tcp-env                                                  \
       /var/qmail/bin/auth_pop                                                 \
       /var/qmail/bin/qmail-pop3d Maildir 2>&1

Save & Close this file.


vi qmail-pop3d/log/run

  1. !/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1

Save & Close this file.


vi /etc/tcp.smtp

127.:allow,RELAYCLIENT=""

allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHREQUIRED="",AUTHPREPEND="Authenticateduser:",SANITYCHECK="",REJECTEXEC="",LOGLEVEL="3",SMTPAUTH=""

Save & Close this file.


chmod -R +x /var/qmail/supervise/*

mkdir /service

ln -s /var/qmail/supervise/qmail-send /var/qmail/supervise/qmail-smtpd /var/qmail/supervise/qmail-pop3d /service

cd /var/qmail

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-root

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-postmaster

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-mailer-daemon

echo admin@krishnagroup.co.in > /var/qmail/alias/.qmail-anonymous

chmod 644 /var/qmail/alias/.qmail*

rsync -avur /downloads/qmailrocks/scripts/finalize/qmailctl bin/.

ln -s /var/qmail/bin/qmailctl /usr/bin

ln -s /var/qmail/bin/qmailctl /etc/init.d/qmailctl

qmailctl cdb


16.Qmail - Other configuration:


/etc/init.d/sendmail stop

chkconfig sendmail off

mv /usr/lib/sendmail /usr/lib/sendmail.org

mv /usr/sbin/sendmail /usr/sbin/sendmail.org

ln -s /var/qmail/bin/sendmail /usr/lib/sendmail

ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail


17.OPENLDAP Integration with QMAIL-LDAP:


cd /etc/openldap

cp /usr/src/qmail/qmail-1.03/qmail.schema schema/.


vi slapd.conf 

See slapd.conf(5) for details on configuration options.
This file should NOT be world readable.

#include         /etc/openldap/schema/core.schema
#include         /etc/openldap/schema/cosine.schema
#include         /etc/openldap/schema/inetorgperson.schema
#include         /etc/openldap/schema/nis.schema
#include         /etc/openldap/schema/qmail.schema
  1. Allow LDAPv2 client connections. This is NOT the default.

allow bind_v2

  1. Do not enable referrals until AFTER you have a working directory
  2. service AND an understanding of referrals.
  3. referral ldap://root.openldap.org

pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args

  1. Load dynamic backend modules:
  2. modulepath /usr/lib/openldap
  1. modules available in openldap-servers-overlays RPM package:
  2. moduleload accesslog.la
  3. moduleload auditlog.la
  4. moduleload denyop.la
  5. moduleload dyngroup.la
  6. moduleload dynlist.la
  7. moduleload lastmod.la
  8. moduleload pcache.la
  9. moduleload ppolicy.la
  10. moduleload refint.la
  11. moduleload retcode.la
  12. moduleload rwm.la
  13. moduleload smbk5pwd.la
  14. moduleload syncprov.la
  15. moduleload translucent.la
  16. moduleload unique.la
  17. moduleload valsort.la

loglevel 4


  1. modules available in openldap-servers-sql RPM package:
  2. moduleload back_sql.la
  1. The next three lines allow use of TLS for encrypting connections using a
  2. dummy test certificate which you can generate by changing to
  3. /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on
  4. slapd.pem so that the ldap user or group can read it. Your client software
  5. may balk at self-signed certificates, however.
  6. TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
  7. TLSCertificateFile /etc/pki/tls/certs/slapd.pem
  8. TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem
  1. Sample security restrictions
  2. Require integrity protection (prevent hijacking)
  3. Require 112-bit (3DES or better) encryption for updates
  4. Require 63-bit encryption for simple bind
  5. security ssf=1 update_ssf=112 simple_bind=64
  1. Sample access control policy:
  2. Root DSE: allow anyone to read it
  3. Subschema (sub)entry DSE: allow anyone to read it
  4. Other DSEs:
  5. Allow self write access
  6. Allow authenticated users read access
  7. Allow anonymous users to authenticate
  8. Directives needed to implement policy:
  9. access to dn.base="" by * read
  10. access to dn.base="cn=Subschema" by * read
  11. access to *
  12. by self write
  13. by users read
  14. by anonymous auth
  16. if no access controls are present, the default policy
  17. allows anyone and everyone to read anything but restricts
  18. updates to rootdn. (e.g., "access to * by * read")
  20. rootdn can always read and write EVERYTHING!
  1. ldbm and/or bdb database definitions

database bdb

  1. suffix "dc=my-domain,dc=com"

suffix "dc=krishnagroup,dc=co,dc=in"

  1. rootdn "cn=Manager,dc=my-domain,dc=com"

rootdn "cn=manager,dc=krishnagroup,dc=co,dc=in"

  1. Cleartext passwords, especially for the rootdn, should
  2. be avoided. See slappasswd(8) and slapd.conf(5) for details.
  3. Use of strong authentication encouraged.
  4. rootpw secret

rootpw root1234

  1. rootpw {crypt}ijFYNcSNctBYg
  1. The database directory MUST exist prior to running slapd AND
  2. should only be accessible by the slapd and slap tools.
  3. Mode 700 recommended.

directory /var/lib/ldap

  1. Indices to maintain for this database

index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub

  1. Replicas of this database
  2. replogfile /var/lib/ldap/openldap-master-replog
  3. replica host=ldap-1.example.com:389 starttls=critical
  4. bindmethod=sasl saslmech=GSSAPI
  5. authcId=host/ldap-master.example.com@EXAMPLE.COM

Save & Close this file.

vi ldap.conf

HOST 127.0.0.1 BASE dc=krishnagroup,dc=co,dc=in

Save & Close this file.

/etc/init.d/ldap start

18.Creation of LDAP Database and LDIF FILES

cd /downloads

mkdir ldif_files

cd ldif_files

LDIF file for creating base.

vi base.ldif

  1. krishnagroup.co.in

dn: dc=krishnagroup,dc=co,dc=in objectClass: top objectClass: domain dc: krishnagroup

Save & Close this file.

LDIF file for creating organizational unit.

vi ou.ldif

  1. krishnagroup.co.in

dn: ou=krishnagroup.co.in,dc=krishnagroup,dc=co,dc=in objectClass: top objectClass: organizationalUnit ou: krishnagroup.co.in description: krishnagroup.co.in

Save & Close this file.

LDIF file for creating Admin User.

vi admin.ldif

  1. admin, krishnagroup.co.in

dn: uid=admin,ou=krishnagroup.co.in,dc=krishnagroup,dc=co,dc=in objectClass: top objectClass: inetOrgPerson objectClass: qmailUser cn: Admin sn: Admin mail: admin@krishnagroup.co.in accountStatus: active userPassword: {SSHA}ZzYPfGvVLpRMTRG89fRIVi2HH1SO73cM mailMessageStore: krishnagroup.co.in/admin uid: admin

Save & Close this file.


LDIF file for Users.

vi tetra_test.ldif

  1. tetra_test@krishnagroup.co.in, krishnagroup.co.in, krishnagroup.co.in

dn: uid=tetra_test@krishnagroup.co.in,ou=krishnagroup.co.in,dc=krishnagroup,dc=co,dc=in givenName: Tetra Test sn: Tetra Test uid: tetra_test@krishnagroup.co.in mailMessageStore: krishnagroup.co.in/tetra_test mail: tetra_test@krishnagroup.co.in objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: qmailUser cn: IT Helpdesk Corp userPassword:: e01ENX1YMDNNTzFxblpkWWRneWZldUlMUG1RPT0=

Save & Close this file.


19.Command to create user / database.

ldapadd -acvx -D "cn=manager,dc=krishnagroup,dc=co,dc=in" -w root1234 -f base.ldif


20.Courier IMAP Integration.

Compilation and its parameters

cd /downloads/qmailrocks/

tar -jxvf courier-authlib-0.55.tar.bz2

cd courier-authlib-0.55

./configure --prefix=/usr/local --exec-prefix=/usr/local --with-authldap --without-authmysql --disable-root-check --with-ssl --with-authchangepwdir=/usr/local/libexec/authlib --with-redhat

make && make check

make install-strip && make install-configure


vi /etc/rc.local (Add the following line.)

/usr/local/sbin/authdaemond start

Save & Close this file.


cd /downloads/qmailrocks/

tar -jxvf courier-imap-4.0.2.tar.bz2

useradd bsmith


chown -R bsmith:wheel courier-imap-4.0.2

cd /downloads/qmailrocks/courier-imap-4.0.2

su bsmith

./configure --prefix=/usr/local --exec-prefix=/usr/local --without-authvchkpw --with-authldap --without-authmysql --disable-root-check --with-ssl --with-authchangepwdir=/usr/local/libexec/authlib --with-redhat

make && make check

exit

make install-strip && make install-configure

/usr/local/sbin/mkimapdcert


vi /usr/local/etc/imapd.cnf (Change postmaster@example.com by an administrative email address )

………………………… ………………………… emailAddress=admin@krishnagroup.co.in …………………………

Save & Close this file.


Configuration changes.

vi /usr/local/etc/imapd

IMAPDSTART=YES

Save & Close this file.


vi /usr/local/etc/imapd-ssl

IMAPDSSLSTART=YES TLS_CERTFILE=/usr/local/share/imapd.pem

Save & Close this file.


vi /usr/local/etc/authlib/authdaemonrc

authmodulelist="authldap" authmodulelistorig="authldap"

Save & Close this file.


vi /usr/local/etc/authlib/authldaprc

LDAP_SERVER localhost LDAP_PORT 389 LDAP_PROTOCOL_VERSION 3 LDAP_BASEDN dc=krishnagroup, dc=co, dc=in LDAP_BINDDN cn=manager, dc=krishnagroup, dc=co, dc=in LDAP_BINDPW root1234 LDAP_TIMEOUT 5 LDAP_AUTHBIND 1 LDAP_MAIL uid LDAP_GLOB_UID vmail LDAP_GLOB_GID vmail LDAP_HOMEDIR mailMessageStore LDAP_MAILROOT /home/vmail LDAP_MAILDIR            mailbox LDAP_DEFAULTDELIVERY defaultDelivery LDAP_FULLNAME cn LDAP_CLEARPW clearPassword LDAP_CRYPTPW userPassword

  1. LDAP_CRYPTPW sambaLMPassword

LDAP_DEREF never LDAP_TLS 0

Save & Close this file.


cp /usr/local/libexec/imapd.rc /etc/rc.d/init.d/imap

cp /usr/local/libexec/imapd-ssl.rc /etc/rc.d/init.d/imaps


vi /etc/rc.local ( Add following line )

/etc/rc.d/init.d/imap start /etc/rc.d/init.d/imaps start

Save & Close this file.


/usr/local/sbin/authdaemond stop

/usr/local/sbin/authdaemond start

/etc/rc.d/init.d/imap stop

/etc/rc.d/init.d/imaps stop

/etc/rc.d/init.d/imap start

/etc/rc.d/init.d/imaps start

phpldapadmin yum install httpd* php* -y

cd /downloads wget http://downloads.sourceforge.net/project/phpldapadmin/phpldapadmin-php5/1.2.0.5/phpldapadmin-1.2.0.5.tgz?use_mirror=nchc

tar zxvf phpldapadmin-1.2.0.5.tgz 

mv  phpldapadmin-1.2.0.5 /var/www/html/phpldapadmin

cd /var/www/html/phpldapadmin mv config/config.php.example config/config.php

vi /etc/php.ini memory_limit = 32M


cat /usr/local/etc/authlib/authldaprc|grep -v ^#|grep -v ^$|less

Retrieved from "https://wiki.tetrain.com/index.php?title=Qmail_installation1&oldid=18"