Qmail-Ldap installation2 + dovecot: Difference between revisions

yum install vim-enhanced httpd php* php-ldap perl gcc* gcc-c++ gcc44*openssl openssl-devel kernel-headers openssl-devel kernel-headers patch pcre* db4* openldap* glibc* zlib* glib* gdbm* php

Create initial qmail directories

mkdir -p /var/qmail

mkdir /usr/src/qmail

Creating all needed users and groups:

groupadd nofiles

useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp

groupadd qmail

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails

groupadd vmail

useradd -g vmail -s /bin/true vmail

Unpack qmail and apply the qmail-ldap patch

cd /usr/src/qmail

tar -xvzf /downloads/qmail-1.03.tar.gz

gunzip /downloads/qmail-ldap-1.03-20060201.patch.gz

cd qmail-1.03

patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch

Make changes on "Makefile" to qmail work properly with ldap

LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE -DBIGBROTHER

ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS

ZLIB=-lz

to enable the auto-maildir-make feature

MDIRMAKE=-DAUTOMAILDIRMAKE

to enable the auto-homedir-make feature

HDIRMAKE=-DAUTOHOMEDIRMAKE

on most systems we need this to make auth_pop and auth_imap

SHADOWLIBS=-lcrypt

to enable the possibility to log and debug imap and pop

DEBUG=-DDEBUG

make man make setup check

1. 1. 1. 1. Creating qmail control files ########################

cd /var/qmail/control echo 100 > concurrencyincoming echo 255 > concurrencyremote echo ./Maildir/ > defaultdelivery echo 10000 > defaultquotacount echo 10000000 > defaultquotasize echo /var/qmail/bin/dirmaker > dirmaker echo 0 > ldapcluster id -g vmail > ldapgid echo /home/vmail > ldapmessagestore echo qmailUser > ldapobjectclass echo secret > ldappassword echo 127.0.0.1 > ldapserver id -u vmail > ldapuid echo 80000000 > qmail-smtpd-softlimit echo 80000000 > qmail-pop3d-softlimit echo 3 > qmail-pop3d-loglevel echo 3 > qmail-start-loglevel echo MYDOMAIN.com > defaultdomain echo dc=MYDOMAIN,dc=com > ldapbasedn echo cn=manager,dc=MYDOMAIN,dc=com > ldaplogin echo mail.MYDOMAIN.com > me echo MYDOMAIN.com > rcpthosts ln -s rcpthosts locals

1. 1. 1. 1. Unpacking ucspi-tcpi and apply the error patch ###############

cd /usr/src/qmail tar -xvzf /downloads/ucspi-tcp-0.88.tar.gz cd ucspi-tcp-0.88 patch < /downloads/ucspi-tcp-0.88.errno.patch make && make setup check

1. 1. 1. 1. Unpacking daemontools and apply daemontools-error patch #########

mkdir -p /package chmod 1755 /package cd /package tar -xvzf /downloads/daemontools-0.76.tar.gz cd /package/admin/daemontools-0.76/src patch < /downloads/daemontools-0.76.errno.patch cd /package/admin/daemontools-0.76 package/install ######### Optional ########## # /command/svscanboot & # # chmod 755 /etc/rc.local # #############################

1. 1. 1. 1. Creating the supervise script directories ################

mkdir /var/qmail/supervise cd /var/qmail/supervise mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log chmod +t qmail-smtpd qmail-send qmail-pop3d

1. 1. 1. 1. Creating qmail-smtpd run supervise script ##################

vim qmail-smtpd/run

!/bin/sh

QUID=`id -u qmaild` QGID=`id -g qmaild` MAXD=`head -1 /var/qmail/control/concurrencyincoming` HOST=`head -1 /var/qmail/control/me` SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit` CDBF="/etc/tcp.smtp.cdb"

if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then

   echo QUID, QGID, MAXD, or HOST is unset in
   echo /var/qmail/supervise/qmail-smtpd/run
   exit 1

fi

exec /usr/local/bin/softlimit -m $SOFT \

               /usr/local/bin/tcpserver                -v              \
                                                       -H              \
                                                       -R              \
                                                       -l $HOST        \
                                                       -x $CDBF        \
                                                       -c $MAXD        \
                                                       -u $QUID        \
                                                       -g $QGID        \
                                                       0               \
                                               smtp                    \
                             /var/qmail/bin/qmail-smtpd                \
            /var/qmail/bin/auth_smtp /usr/bin/true 2>&1

1. 1. 1. 1. Creating qmail-smtpd log run supervise script ###############

vim qmail-smtpd/log/run

!/bin/sh

export PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1

1. 1. 1. 1. Creating qmail rc supervise script ####################

vim /var/qmail/rc

!/bin/sh

QLOG="`cat /var/qmail/control/qmail-start-loglevel`" DEFD="`cat /var/qmail/control/defaultdelivery`" exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

1. 1. 1. 1. Creating qmail-send run supervise script #################

vim qmail-send/run

!/bin/sh

exec /var/qmail/rc

1. 1. 1. 1. Creating qmail-send log run supervise script ###############

vim qmail-send/log/run

!/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1

1. 1. 1. 1. Creating qmail-pop3d run supervise script ###############

vim qmail-pop3d/run

!/bin/sh

IP=`head -1 /var/qmail/control/me` LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel` SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit` exec

    \
       env LOGLEVEL=$LL                                                  
    \
       softlimit -m $SL                                                  
    \
       /usr/local/bin/tcpserver -v -R -H -l 0 0  pop3                    
    \
       /var/qmail/bin/qmail-popup $IP                                    
    \
       /var/qmail/bin/tcp-env                                            
    \
       /var/qmail/bin/auth_pop                                           
    \
       /var/qmail/bin/qmail-pop3d Maildir 2>&1

1. 1. 1. 1. Creating qmail-pop3d log run supervise script ##############

vim qmail-pop3d/log/run

!/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1

1. 1. 1. 1. Creating auto directory maker script ##################

vim /var/qmail/bin/dirmaker

!/bin/sh

echo '----------------------------------------------' >> /tmp/dirmaker date >> /tmp/dirmaker echo $1 >> /tmp/dirmaker id >> /tmp/dirmaker mkdir --parents -m 700 -p $1/Maildir mkdir --parents -m 700 -p $1/Maildir/tmp mkdir --parents -m 700 -p $1/Maildir/cur mkdir --parents -m 700 -p $1/Maildir/new chown -R vmail:vmail $1

1. 1. 1. 1. Set permissions of all qmail supervise run scripts ###########

chmod 755 qmail-pop3d/run qmail-smtpd/run qmail-send/run chmod 755 qmail-pop3d/log/run qmail-smtpd/log/run qmail-send/log/run chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker

1. 1. 1. 1. Create tcp.smtp file to appy tcprules #################

vim /etc/tcp.smtp

127.:allow,RELAYCLIENT="",MAXRCPTCOUNT="200" 192.168.:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHPREPEND="Authenticated user:",SANITYCHECK="",SMTPAUTH="",LOGLEVEL="3",AUTHREQUIRED="",MAXRCPTCOUNT="100"

allow,BLOCKRELAYPROBE="",RCPTCHECK="",SANITYCHECK="",RETURNMXCHECK="STRICT",RBL="",REJECTEXEC="",LOGLEVEL="3",TARPITCOUNT="10",TARPITDELAY="10",SMTPAUTH="",MAXRCPTCOUNT="25"

1. 1. 1. 1. Creating qmail logging directories and set permissions ########

mkdir /var/log/qmail cd /var/log/qmail mkdir qmail-send qmail-smtpd qmail-pop3d chown -R qmaill:root /var/log/qmail chmod -R 750 /var/log/qmail

1. 1. 1. 1. Creating qmail alias users, links and set permissions #########

cd /var/qmail cp -p /downloads/qmailctl /var/qmail/bin/. chmod 755 /var/qmail/bin/qmailctl ln -s /var/qmail/bin/qmailctl /usr/bin/ qmailctl cdb

mkdir -p /service cd /service/ ln -s /var/qmail/supervise/qmail-* .

echo admin@prime-pci.com > /var/qmail/alias/.qmail-root echo admin@prime-pci.com > /var/qmail/alias/.qmail-postmaster echo admin@prime-pci.com > /var/qmail/alias/.qmail-mailer-daemon ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous chmod 644 /var/qmail/alias/.qmail*

1. 1. 1. 1. Stop sendmail and remove all related files ##############

/etc/init.d/sendmail stop chkconfig sendmail off mv /usr/lib/sendmail /usr/lib/sendmail.org mv /usr/sbin/sendmail /usr/sbin/sendmail.org ln -s /var/qmail/bin/sendmail /usr/lib/sendmail ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

1. 1. 1. 1. Configure OpenLDAP ###########################

cd /etc/openldap cp /usr/src/qmail/qmail-1.03/qmail.schema schema/. cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

vim /etc/openldap/slapd.conf

include /etc/openldap/schema/qmail.schema

database bdb suffix "dc=prime-pci,dc=com" rootdn "cn=Manager,dc=prime-pci,dc=com"

Cleartext passwords, especially for the rootdn, should
be avoided. See slappasswd(8) and slapd.conf(5) for details.
Use of strong authentication encouraged.
rootpw secret
rootpw {crypt}ijFYNcSNctBYg

rootpw secret

vim /etc/openldap/ldap.conf

HOST 127.0.0.1 BASE dc=prime-pci,dc=com

/etc/init.d/ldap restart

1. 1. 1. 1. Create Domain.ldif file for Base and OU ##################

mkdir -p /downloads/ldap_ldif cd /downloads/ldap_ldif

vim domain.ldif

base dn

dn: dc=prime-pci,dc=com objectClass: dcObject objectClass: organization o: prime-pci dc: prime-pci

ou, prime-pci.com

dn: ou=prime-pci.com,dc=prime-pci,dc=com objectClass: top objectClass: organizationalUnit ou: prime-pci.com

vim admin.ldif [password=postmaster]

admin, prime-pci.com

dn: uid=admin,ou=prime-pci.com,dc=prime-pci,dc=com objectClass: top objectClass: inetOrgPerson objectClass: qmailUser cn: admin admin sn: admin admin mail: admin@prime-pci.com accountStatus: active mailMessageStore: prime-pci.com/admin uid: admin mailHost: node1.prime-pci.com deliveryMode: noforward userPassword:: e0NSWVBUfU9XY3dPTS9IekVBT2s=

1. 1. 1. 1. Add domain and admin user's data on LDAP ##################

ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f domain.ldif ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f admin.ldif

———————————————————— Dovecot installation ————————————————————

cd /root/downloads/shashankQmail

tar xvzf dovecot-2.0.14.tar.gz

cd dovecot-2.0.14

./configure --without-shadow --without-pam --without-bsdauth --without-gssapi --without-sia --without-vpopmail \

 --without-sql --without-pgsql --without-mysql --without-sqlite \

--with-ssl=openssl --with-libwrap --with-ldap --without-shadow --prefix=/usr

make && make install

useradd -d /nonexistent -s /bin/false -c 'Dovecot user' dovecot

mkdir -p /etc/ssl/private/ mkdir -p /etc/ssl/certs/

1. 1. 1. ln -s /var/qmail/control/servercert.pem /etc/ssl/certs/dovecot.pem
    2. ln -s /var/qmail/control/servercert.pem /etc/ssl/private/dovecot.pem

cp -pv /usr/share/doc/dovecot/example-config/dovecot.conf /usr/etc/dovecot/dovecot.conf cp -pv /usr/share/doc/dovecot/example-config/dovecot-ldap.conf.ext /usr/etc/dovecot/dovecot-ldap.conf

ln -s /usr/etc/dovecot/dovecot-ldap.conf /usr/etc/dovecot/dovecot-ldap-userdb.conf

Update slapd.conf by placing this line 'by dn="uid=dovecot,ou=mail,dc=example2,dc=com" read' below 'access to attrs=userPassword'. Eg: access to * by dn="uid=admin,ou=mail,dc=example2,dc=com" write

              by * read

access to attrs=userPassword

              by dn="uid=dovecot,ou=mail,dc=example2,dc=com" read
              by dn="uid=admin,ou=mail,dc=example2,dc=com" write
              by anonymous auth

Example dovecot-ldap.conf file (You can copy+paste it):

===============================================

hosts = localhost dn = uid=dovecot,ou=mail,dc=example2,dc=com dnpass = asdf1234 auth_bind = no ldap_version = 3 base = dc=example2,dc=com scope = subtree user_attrs = mailMessageStore=home user_filter = (&(objectClass=qmailUser)(uid=%u)) pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=qmailUser)(uid=%u)(!(accountStatus=disabled))(!(accountStatus=noaccess))) default_pass_scheme = SSHA

===============================================

Example dovecot.conf file (You can copy+paste it):

===============================================

auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log default_login_user = dovecot first_valid_uid = 89 info_log_path = /var/log/dovecot-info.log last_valid_uid = 2000 log_path = /var/log/dovecot login_greeting = Shashank's custom qmail! mail_gid = vmail mail_location = maildir:~/Maildir mail_uid = vmail namespace {

inbox = yes
location = maildir:~/Maildir
prefix = INBOX.
separator = .

} passdb {

args = /usr/etc/dovecot/dovecot-ldap.conf
driver = ldap

} protocols = imap ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb {

args = /usr/etc/dovecot/dovecot-ldap-userdb.conf
driver = ldap

} verbose_proctitle = yes verbose_ssl = yes protocol lda {

postmaster_address = admin@example2.com

}

===============================================

Now simply type 'dovecot' at the terminal to start. 'dovecot stop' stops it. 'dovecot -n' checks config file.

1. 1. 1. 1. Install autoresponder and maildrop #####################

cd /downloads/autorespond-2.0.5/ make && make install

cd /downloads/maildrop-2.5.4 ./configure --prefix=/usr/local --exec-prefix=/usr/local --enable-maildrop-uid=root make && make install-strip && make install-man

1. 1. 1. 1. Reload tcp.smtp rules ############################

qmailctl cdb

OR

tcprules /etc/tcp.smtp.cdb /etc/tcp.smtp.tmp < /etc/tcp.smtp

1. 1. 1. 1. Unpack Phpldapadmin and configure to access from Web ###########

mv /downloads/phpldapadmin-1.2.2 /var/www/html/phpldapadmin cd /var/www/html/phpldapadmin mkdir templates/creation.old templates/modification.old mv templates/creation/* templates/creation.old/ mv templates/modification/* templates/modification.old/

1. 1. 1. 1. Increase PHP memory limit ########################

vim /etc/php.ini

memory_limit = 128M

1. 1. 1. 1. Unpack Squirrelmail and configure to Web access ##############

mv /downloads/squirrelmail-webmail-1.4.22 /var/www/html/webmail cd /var/www/html/webmail mkdir attachements chown -R apache:apache attachements chown -R apache:apache data cd config ./conf.pl

1. 1. 1. 1. Install all required packages for Qmail-Scanner ###############

yum perl-suidperl perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS perl-Time-HiRes* perl-HTML-Tagset perl-HTML-Parser perl-Pod-Usage* perl-Parse-Syslog perl-Statistics-Distributions spamassassin clamav clamd

1. 1. 1. 1. Add user "qscand" for scanning #####################

useradd -c "Qmail-Scanner Account" -s /bin/false -m qscand

1. 1. 1. 1. Change user clamav to qscand #######################

vim /etc/logrotate.d/clamav [Change clamav to qscand]

/var/log/clamav/clamd.log {

   missingok
   notifempty
   create 644 qscand qscand
   postrotate
       killall -HUP clamd 2>/dev/null || :
   endscript

}

vim /etc/logrotate.d/freshclam [Change clamav to qscand]

/var/log/clamav/freshclam.log {

   missingok
   notifempty
   create 644 qscand qscand

}

vim /etc/clamd.conf

User qscand

vim /etc/freshclam.conf

DatabaseOwner qscand

chown qscand.qscand /var/log/clamav/ -R chown -R qscand.qscand /var/run/clamav/ /etc/init.d/clamd restart /etc/init.d/spamassassin restart

1. 1. 1. 1. Install Qmail-Scanner ###########################

cd /downloads/qmail-scanner-2.08 ./configure --admin admin --domain prime-pci.com mkdir -p /var/spool/qscan mkdir -p /var/spool/qscan/quarantine/viruses/tmp /var/spool/qscan/quarantine/viruses/cur /var/spool/qscan/quarantine/viruses/new mkdir -p /var/spool/qscan/quarantine/spam/tmp /var/spool/qscan/quarantine/spam/cur /var/spool/qscan/quarantine/spam/new mkdir -p /var/spool/qscan/quarantine/policy/tmp /var/spool/qscan/quarantine/policy/cur /var/spool/qscan/quarantine/policy/new mkdir -p /var/spool/qscan/working/tmp /var/spool/qscan/working/cur /var/spool/qscan/working/new mkdir -p /var/spool/qscan/archive/tmp /var/spool/qscan/archive/cur /var/spool/qscan/archive/new cp /downloads/qmail-scanner-2.08/quarantine-events.txt /var/spool/qscan/ chown -R qscand:qscand /var/spool/qscan/ cp -pv /downloads/qmail-scanner-2.08/qmail-scanner-queue.pl /var/qmail/bin/ chown qscand.qscand /var/qmail/bin/qmail-scanner-queue.pl chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl /var/qmail/bin/qmail-scanner-queue.pl -z /var/qmail/bin/qmail-scanner-queue.pl -g cp -v /downloads/qmail-scanner-2.08/contrib/logrotate.qmail-scanner /etc/logrotate.d/qmail-scanner /etc/init.d/syslog restart

1. 1. 1. 1. Integrate Qmail-scanner with qmail queue ################

vim /var/qmail/supervise/qmail-smtpd/run

QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE

1. 1. 1. 1. Check Qmail-scanner Installation ####################

su - tetra /var/qmail/bin/qmail-scanner-queue.pl -g /root/downloads/qmail-scanner-2.08/contrib/test_installation.sh -doit

1. [ This step generate 2 spam mails and send to the admin e-mail account]##

1. 1. 1. 1. LDAP address book settings on Thunderbird #################

Name: LDAP Address Book Hostname: node1.prime-pci.com Base DN: ou=prime-pci.com,dc=prime-pci,dc=com Port Number: 389