Jump to content

Qmail-Ldap installation2 + dovecot

From TetraWiki
Revision as of 06:23, 25 July 2012 by Raunaq (talk | contribs)

Qmail-LDAP installation on RedHat and CentOS v5.x.x


Ensure rpmforge and epel repos are enabled.

Switch off SELinux.

Flush Iptables rules


Create directory for downloading required packages

mkdir /downloads

cd /downloads


Download all required packages for qmail-ldap installation:

wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz

wget http://cr.yp.to/software/qmail-1.03.tar.gz

wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz

wget http://www.qmailrocks.org/downloads/patches/ucspi-tcp-0.88.errno.patch

wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz

wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/daemontools-0.76.errno.patch

wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

wget http://lifewithqmail.org/inst_check

wget https://sourceforge.net/projects/courier/files/maildrop/2.5.4/maildrop-2.5.4.tar.bz2/download


--no-check-certificate


wget http://prdownloads.sourceforge.net/qmail-scanner/qmail-scanner-2.08.tgz?download

wget http://www.qmailrocks.org/downloads/scripts/finalize/qmailctl

wget http://sourceforge.net/projects/phpldapadmin/files/latest/download

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm

tar -xvzf qmailrocks.tar.gz

tar -xvzf phpldapadmin-1.2.2.tgz

tar -xvzf squirrelmail-webmail-1.4.22.tar.gz

tar -xvjf maildrop-2.5.4.tar.bz2

tar -xvzf qmail-scanner-2.08.tgz

tar -xvzf qmailrocks/autorespond-2.0.5.tar.gz


Install all required packages before qmail-ldap installation: 

yum install vim-enhanced httpd php* php-ldap perl gcc* gcc-c++ gcc44*openssl openssl-devel kernel-headers openssl-devel kernel-headers patch pcre* db4* openldap* glibc* zlib* glib* gdbm* php


Create initial qmail directories

mkdir -p /var/qmail

mkdir /usr/src/qmail


Creating all needed users and groups:


groupadd nofiles 

useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp

groupadd qmail 

useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails

groupadd vmail 

useradd -g vmail -s /bin/true vmail



Unpack qmail and apply the qmail-ldap patch

cd /usr/src/qmail

tar -xvzf /downloads/qmail-1.03.tar.gz

gunzip /downloads/qmail-ldap-1.03-20060201.patch.gz

cd qmail-1.03

patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch


Make changes on "Makefile" to qmail work properly with ldap: 


LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS-DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE -DBIGBROTHER
# ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS
ZLIB=-lz
# to enable the auto-maildir-make feature
MDIRMAKE=-DAUTOMAILDIRMAKE
# to enable the auto-homedir-make feature
HDIRMAKE=-DAUTOHOMEDIRMAKE
# on most systems we need this to make auth_pop and auth_imap
SHADOWLIBS=-lcrypt
# to enable the possibility to log and debug imap and pop
DEBUG=-DDEBUG


make man

make setup check


Creating qmail control files 

cd /var/qmail/control
echo 100 > concurrencyincoming
echo 255 > concurrencyremote
echo ./Maildir/ > defaultdelivery
echo 10000 > defaultquotacount
echo 10000000 > defaultquotasize
echo /var/qmail/bin/dirmaker > dirmaker
echo 0 > ldapcluster
id -g vmail > ldapgid
echo /home/vmail > ldapmessagestore
echo qmailUser > ldapobjectclass
echo secret > ldappassword
echo 127.0.0.1 > ldapserver
id -u vmail > ldapuid
echo 80000000 > qmail-smtpd-softlimit
echo 80000000 > qmail-pop3d-softlimit
echo 3 > qmail-pop3d-loglevel
echo 3 > qmail-start-loglevel
echo MYDOMAIN.com > defaultdomain
echo dc=MYDOMAIN,dc=com > ldapbasedn
echo cn=manager,dc=MYDOMAIN,dc=com > ldaplogin
echo mail.MYDOMAIN.com > me
echo MYDOMAIN.com > rcpthosts
ln -s rcpthosts locals



Unpacking ucspi-tcpi and apply the error patch:


cd /usr/src/qmail

tar -xvzf /downloads/ucspi-tcp-0.88.tar.gz

cd ucspi-tcp-0.88

patch < /downloads/ucspi-tcp-0.88.errno.patch

make && make setup check



Unpacking daemontools and apply daemontools-error patch:

mkdir -p /package

chmod 1755 /package

cd /package

tar -xvzf /downloads/daemontools-0.76.tar.gz

cd /package/admin/daemontools-0.76/src

patch < /downloads/daemontools-0.76.errno.patch

cd /package/admin/daemontools-0.76

package/install


Optional

# /command/svscanboot & #

# chmod 755 /etc/rc.local #


Creating the supervise script directories: 

mkdir /var/qmail/supervise
cd /var/qmail/supervise
mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log
chmod +t qmail-smtpd qmail-send qmail-pop3d


Creating qmail-smtpd run supervise script:


vim qmail-smtpd/run 

#!/bin/sh
QUID=`id -u qmaild`
QGID=`id -g qmaild`
MAXD=`head -1 /var/qmail/control/concurrencyincoming`
HOST=`head -1 /var/qmail/control/me`
SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit`
CDBF="/etc/tcp.smtp.cdb"
if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then
   echo QUID, QGID, MAXD, or HOST is unset in
   echo /var/qmail/supervise/qmail-smtpd/run
   exit 1
fi
exec            /usr/local/bin/softlimit                -m $SOFT        \
               /usr/local/bin/tcpserver                -v              \
                                                       -H              \
                                                       -R              \
                                                       -l $HOST        \
                                                       -x $CDBF        \
                                                       -c $MAXD        \
                                                       -u $QUID        \
                                                       -g $QGID        \
                                                       0               \
                                               smtp                    \
                             /var/qmail/bin/qmail-smtpd                \
            /var/qmail/bin/auth_smtp /usr/bin/true 2>&1



Creating qmail-smtpd log run supervise script:


vim qmail-smtpd/log/run 

#!/bin/sh
export PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000
n20 /var/log/qmail/qmail-smtpd 2>&1



Creating qmail rc supervise script:


vim /var/qmail/rc 

#!/bin/sh
QLOG="`cat /var/qmail/control/qmail-start-loglevel`"
DEFD="`cat /var/qmail/control/defaultdelivery`"
exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"



Creating qmail-send run supervise script:


vim qmail-send/run 

#!/bin/sh
exec /var/qmail/rc


Creating qmail-send log run supervise script:


vim qmail-send/log/run 

#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000
n20 /var/log/qmail/qmail-send 2>&1


Creating qmail-pop3d run supervise script:


vim qmail-pop3d/run 

#!/bin/sh
IP=`head -1 /var/qmail/control/me`
LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel`
SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit`
exec                                                                      
    \
       env LOGLEVEL=$LL                                                  
    \
       softlimit -m $SL                                                  
    \
       /usr/local/bin/tcpserver -v -R -H -l 0 0  pop3                    
    \
       /var/qmail/bin/qmail-popup $IP                                    
    \
       /var/qmail/bin/tcp-env                                            
    \
       /var/qmail/bin/auth_pop                                           
    \
       /var/qmail/bin/qmail-pop3d Maildir 2>&1


Creating qmail-pop3d log run supervise script:

vim qmail-pop3d/log/run 

#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000
n20 /var/log/qmail/qmail-pop3d 2>&1


Creating auto directory maker script:


vim /var/qmail/bin/dirmaker 

#!/bin/sh
echo '----------------------------------------------' >> /tmp/dirmaker
date >> /tmp/dirmaker
echo $1 >> /tmp/dirmaker
id >> /tmp/dirmaker
mkdir --parents -m 700 -p $1/Maildir
mkdir --parents -m 700 -p $1/Maildir/tmp
mkdir --parents -m 700 -p $1/Maildir/cur
mkdir --parents -m 700 -p $1/Maildir/new
chown -R vmail:vmail $1


Set permissions of all qmail supervise run scripts:

chmod 755 qmail-pop3d/run qmail-smtpd/run qmail-send/run

chmod 755 qmail-pop3d/log/run qmail-smtpd/log/run qmail-send/log/run

chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker


Create tcp.smtp file to appy tcprules:


vim /etc/tcp.smtp 

127.:allow,RELAYCLIENT="",MAXRCPTCOUNT="200"
192.168.:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHPREPEND="Authenticated
user:",SANITYCHECK="",SMTPAUTH="",LOGLEVEL="3",AUTHREQUIRED="",MAXRCPTCOUNT="100"
:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SANITYCHECK="",RETURNMXCHECK="STRICT",RBL="",REJECTEXEC="",LOGLEVEL="3",TARPITCOUNT="10",TARPITDELAY="10",SMTPAUTH="",MAXRCPTCOUNT="25"


Creating qmail logging directories and set permissions:

mkdir /var/log/qmail

cd /var/log/qmail

mkdir qmail-send qmail-smtpd qmail-pop3d

chown -R qmaill:root /var/log/qmail

chmod -R 750 /var/log/qmail


Creating qmail alias users, links and set permissions:

cd /var/qmail

cp -p /downloads/qmailctl /var/qmail/bin/.

chmod 755 /var/qmail/bin/qmailctl

ln -s /var/qmail/bin/qmailctl /usr/bin/

qmailctl cdb

mkdir -p /service

cd /service/

ln -s /var/qmail/supervise/qmail-* .

echo admin@prime-pci.com > /var/qmail/alias/.qmail-root

echo admin@prime-pci.com > /var/qmail/alias/.qmail-postmaster

echo admin@prime-pci.com > /var/qmail/alias/.qmail-mailer-daemon

ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous

chmod 644 /var/qmail/alias/.qmail*


Stop sendmail and remove all related files:

/etc/init.d/sendmail stop

chkconfig sendmail off

mv /usr/lib/sendmail /usr/lib/sendmail.org

mv /usr/sbin/sendmail /usr/sbin/sendmail.org

ln -s /var/qmail/bin/sendmail /usr/lib/sendmail

ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail


Configure OpenLDAP:

cd /etc/openldap

cp /usr/src/qmail/qmail-1.03/qmail.schema schema/.

cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG


vim /etc/openldap/slapd.conf 

include         /etc/openldap/schema/qmail.schema
database        bdb
suffix          "dc=prime-pci,dc=com"
rootdn          "cn=Manager,dc=prime-pci,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw                secret
# rootpw                {crypt}ijFYNcSNctBYg
rootpw          secret


vim /etc/openldap/ldap.conf 

HOST 127.0.0.1
BASE dc=prime-pci,dc=com


/etc/init.d/ldap restart


Create Domain.ldif file for Base and OU

mkdir -p /downloads/ldap_ldif

cd /downloads/ldap_ldif


vim domain.ldif 

# base dn
dn: dc=prime-pci,dc=com
objectClass: dcObject
objectClass: organization
o: prime-pci
dc: prime-pci
# ou, prime-pci.com
dn: ou=prime-pci.com,dc=prime-pci,dc=com
objectClass: top
objectClass: organizationalUnit
ou: prime-pci.com


vim admin.ldif [password=postmaster] 

# admin, prime-pci.com
dn: uid=admin,ou=prime-pci.com,dc=prime-pci,dc=com
objectClass: top
objectClass: inetOrgPerson
objectClass: qmailUser
cn: admin admin
sn: admin admin
mail: admin@prime-pci.com
accountStatus: active
mailMessageStore: prime-pci.com/admin
uid: admin
mailHost: node1.prime-pci.com
deliveryMode: noforward
userPassword:: e0NSWVBUfU9XY3dPTS9IekVBT2s=


Add domain and admin user's data on LDAP 

ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f domain.ldif
ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f admin.ldif


Dovecot installation


cd /root/downloads/shashankQmail

tar xvzf dovecot-2.0.14.tar.gz

cd dovecot-2.0.14


./configure --without-shadow --without-pam --without-bsdauth --without-gssapi --without-sia --without-vpopmail \ 

 --without-sql --without-pgsql --without-mysql --without-sqlite \

--with-ssl=openssl --with-libwrap --with-ldap --without-shadow --prefix=/usr

make && make install

useradd -d /nonexistent -s /bin/false -c 'Dovecot user' dovecot

mkdir -p /etc/ssl/private/

mkdir -p /etc/ssl/certs/

        1. ln -s /var/qmail/control/servercert.pem /etc/ssl/certs/dovecot.pem
        2. ln -s /var/qmail/control/servercert.pem /etc/ssl/private/dovecot.pem


cp -pv /usr/share/doc/dovecot/example-config/dovecot.conf /usr/etc/dovecot/dovecot.conf cp -pv /usr/share/doc/dovecot/example-config/dovecot-ldap.conf.ext /usr/etc/dovecot/dovecot-ldap.conf

ln -s /usr/etc/dovecot/dovecot-ldap.conf /usr/etc/dovecot/dovecot-ldap-userdb.conf


Update slapd.conf by placing this line 'by dn="uid=dovecot,ou=mail,dc=example2,dc=com" read' below 'access to attrs=userPassword'. Eg: access to * by dn="uid=admin,ou=mail,dc=example2,dc=com" write 

              by * read

access to attrs=userPassword 

              by dn="uid=dovecot,ou=mail,dc=example2,dc=com" read
              by dn="uid=admin,ou=mail,dc=example2,dc=com" write
              by anonymous auth


Example dovecot-ldap.conf file (You can copy+paste it):

===============================================

hosts = localhost dn = uid=dovecot,ou=mail,dc=example2,dc=com dnpass = asdf1234 auth_bind = no ldap_version = 3 base = dc=example2,dc=com scope = subtree user_attrs = mailMessageStore=home user_filter = (&(objectClass=qmailUser)(uid=%u)) pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=qmailUser)(uid=%u)(!(accountStatus=disabled))(!(accountStatus=noaccess))) default_pass_scheme = SSHA

===============================================

Example dovecot.conf file (You can copy+paste it):

===============================================

auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log default_login_user = dovecot first_valid_uid = 89 info_log_path = /var/log/dovecot-info.log last_valid_uid = 2000 log_path = /var/log/dovecot login_greeting = Shashank's custom qmail! mail_gid = vmail mail_location = maildir:~/Maildir mail_uid = vmail namespace { 

inbox = yes
location = maildir:~/Maildir
prefix = INBOX.
separator = .

} passdb { 

args = /usr/etc/dovecot/dovecot-ldap.conf
driver = ldap

} protocols = imap ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { 

args = /usr/etc/dovecot/dovecot-ldap-userdb.conf
driver = ldap

} verbose_proctitle = yes verbose_ssl = yes protocol lda { 

postmaster_address = admin@example2.com

}

===============================================

Now simply type 'dovecot' at the terminal to start. 'dovecot stop' stops it. 'dovecot -n' checks config file.




                                    2. Install autoresponder and maildrop #####################

cd /downloads/autorespond-2.0.5/ make && make install

cd /downloads/maildrop-2.5.4 ./configure --prefix=/usr/local --exec-prefix=/usr/local --enable-maildrop-uid=root make && make install-strip && make install-man


                                                1. Reload tcp.smtp rules ############################

qmailctl cdb 

  OR

tcprules /etc/tcp.smtp.cdb /etc/tcp.smtp.tmp < /etc/tcp.smtp


                    2. Unpack Phpldapadmin and configure to access from Web ###########

mv /downloads/phpldapadmin-1.2.2 /var/www/html/phpldapadmin cd /var/www/html/phpldapadmin mkdir templates/creation.old templates/modification.old mv templates/creation/* templates/creation.old/ mv templates/modification/* templates/modification.old/

                                                1. Increase PHP memory limit ########################

vim /etc/php.ini

memory_limit = 128M


                        2. Unpack Squirrelmail and configure to Web access ##############

mv /downloads/squirrelmail-webmail-1.4.22 /var/www/html/webmail cd /var/www/html/webmail mkdir attachements chown -R apache:apache attachements chown -R apache:apache data cd config ./conf.pl


                      2. Install all required packages for Qmail-Scanner ###############

yum perl-suidperl perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS perl-Time-HiRes* perl-HTML-Tagset perl-HTML-Parser perl-Pod-Usage* perl-Parse-Syslog perl-Statistics-Distributions spamassassin clamav clamd

                                            1. Add user "qscand" for scanning #####################

useradd -c "Qmail-Scanner Account" -s /bin/false -m qscand

                                            1. Change user clamav to qscand #######################

vim /etc/logrotate.d/clamav [Change clamav to qscand]

/var/log/clamav/clamd.log { 

   missingok
   notifempty
   create 644 qscand qscand
   postrotate
       killall -HUP clamd 2>/dev/null || :
   endscript

}

vim /etc/logrotate.d/freshclam [Change clamav to qscand]

/var/log/clamav/freshclam.log { 

   missingok
   notifempty
   create 644 qscand qscand

}

vim /etc/clamd.conf

User qscand

vim /etc/freshclam.conf

DatabaseOwner qscand

chown qscand.qscand /var/log/clamav/ -R chown -R qscand.qscand /var/run/clamav/ /etc/init.d/clamd restart /etc/init.d/spamassassin restart


                                                2. Install Qmail-Scanner ###########################

cd /downloads/qmail-scanner-2.08 ./configure --admin admin --domain prime-pci.com mkdir -p /var/spool/qscan mkdir -p /var/spool/qscan/quarantine/viruses/tmp /var/spool/qscan/quarantine/viruses/cur /var/spool/qscan/quarantine/viruses/new mkdir -p /var/spool/qscan/quarantine/spam/tmp /var/spool/qscan/quarantine/spam/cur /var/spool/qscan/quarantine/spam/new mkdir -p /var/spool/qscan/quarantine/policy/tmp /var/spool/qscan/quarantine/policy/cur /var/spool/qscan/quarantine/policy/new mkdir -p /var/spool/qscan/working/tmp /var/spool/qscan/working/cur /var/spool/qscan/working/new mkdir -p /var/spool/qscan/archive/tmp /var/spool/qscan/archive/cur /var/spool/qscan/archive/new cp /downloads/qmail-scanner-2.08/quarantine-events.txt /var/spool/qscan/ chown -R qscand:qscand /var/spool/qscan/ cp -pv /downloads/qmail-scanner-2.08/qmail-scanner-queue.pl /var/qmail/bin/ chown qscand.qscand /var/qmail/bin/qmail-scanner-queue.pl chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl /var/qmail/bin/qmail-scanner-queue.pl -z /var/qmail/bin/qmail-scanner-queue.pl -g cp -v /downloads/qmail-scanner-2.08/contrib/logrotate.qmail-scanner /etc/logrotate.d/qmail-scanner /etc/init.d/syslog restart


                                  1. Integrate Qmail-scanner with qmail queue ################

vim /var/qmail/supervise/qmail-smtpd/run

QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE


                                        1. Check Qmail-scanner Installation ####################

su - tetra /var/qmail/bin/qmail-scanner-queue.pl -g /root/downloads/qmail-scanner-2.08/contrib/test_installation.sh -doit

    1. [ This step generate 2 spam mails and send to the admin e-mail account]##


                              1. LDAP address book settings on Thunderbird #################

Name: LDAP Address Book Hostname: node1.prime-pci.com Base DN: ou=prime-pci.com,dc=prime-pci,dc=com Port Number: 389

Retrieved from "https://wiki.tetrain.com/index.php?title=Qmail-Ldap_installation2_%2B_dovecot&oldid=31"