Jump to content

Qmail Server with Courier IMAP with Master/Slave LDAP for MiraExim

From TetraWiki
Revision as of 04:41, 29 October 2013 by Ranjit (talk | contribs) (→Coiguration of Qmail related files)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)


Qmail Implementation with Courier IMAP,Master-Slave Openldap

MIRAEXIM LTD. NOIDA

BY- NAVDEEP MATHUR

IMPLEMENTING FIRST INSTANCE OF QMAIL[edit]

Ensure rpmforge and epel repos are enabled.


  • Switch off SELinux
  • Flush Iptables rules

Create directory for downloading required packages


  • mkdir /downloads
  • cd /downloads

DOWNLOAD AND EXTRACT PACKAGES[edit]

Download all required packages for qmail-ldap installation


Extract all packages :


  • tar -xvzf qmailrocks.tar.gz
  • tar -xvzf squirrelmail-webmail-1.4.22.tar.gz
  • tar -xvjf maildrop-2.5.4.tar.bz2
  • tar -xvzf qmail-scanner-2.08.tgz
  • tar -xvzf qmailrocks/autorespond-2.0.5.tar.gz

INSTALLATION OF PACKAGES AND CREATING USERS ,GROUPS[edit]

Install all required packages before qmail-ldap installation 


yum install vim-enhanced httpd php* php-ldap perl gcc* gcc-c++ gcc44* openssl openssl-devel kernel-headers openssl-devel kernel-headers patch pcre* db4*
openldap* glibc* zlib* glib* gdbm* php


Create initial qmail


  • mkdir /usr/src/qmail

Creating all needed users and groups 


 groupadd nofiles
 useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias
 useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild
 useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill
 useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp
 groupadd qmail
 useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq
 useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr
 useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails
 groupadd vmail
 useradd -g vmail -s /bin/true vmail

Unpack qmail and apply the qmail-ldap patch 

cd /usr/src/qmail
tar -xvzf /downloads/qmail-1.03.tar.gz
gunzip /downloads/qmail-ldap-1.03-20060201.patch.gz
cd qmail-1.03
patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch

Make changes on "Makefile" to qmail work properly with ldap


Make these entries : 


LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE
# ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS
ZLIB=-lz
# to enable the auto-maildir-make feature
MDIRMAKE=-DAUTOMAILDIRMAKE
# to enable the auto-homedir-make feature
HDIRMAKE=-DAUTOHOMEDIRMAKE
# on most systems we need this to make auth_pop and auth_imap
SHADOWLIBS=-lcrypt
# to enable the possibility to log and debug imap and pop
DEBUG=-DDEBUG

Now Complie the Qmail 

make man
make setup check

Configuration of Qmail related files[edit]

Creating qmail control files 


cd /var/qmail/control
echo 100 > concurrencyincoming
echo 255 > concurrencyremote
echo ./Maildir/ > defaultdelivery
echo /var/qmail/bin/dirmaker > dirmaker
echo 0 > ldapcluster
id -g vmail > ldapgid
echo /home/vmail > ldapmessagestore
echo qmailUser > ldapobjectclass
echo secret > ldappassword
echo 127.0.0.1 > ldapserver
id -u vmail > ldapuid
echo 80000000 > qmail-smtpd-softlimit
echo 80000000 > qmail-pop3d-softlimit
echo 3 > qmail-pop3d-loglevel
echo 3 > qmail-start-loglevel
echo groupvama.com > defaultdomain
echo dc=groupvama,dc=com > ldapbasedn
echo cn=Manager,dc=groupvama,dc=com > ldaplogin
echo mail.groupvama.com > me
echo groupvama.com >> rcpthosts
echo miraexim.com >? rcpthosts
echo vogueserv.com >> rcpthosts
ln -s rcpthosts locals

Unpacking ucspi-tcpi and apply the error patch 

cd /usr/src/qmail
tar -xvzf /downloads/ucspi-tcp-0.88.tar.gz
cd ucspi-tcp-0.88
patch < /downloads/ucspi-tcp-0.88.errno.patch
make && make setup check

Unpacking daemontools and apply daemontools-error patch 


mkdir -p /package
chmod 1755 /package
cd /package
tar -xvzf /downloads/daemontools-0.76.tar.gz
cd /package/admin/daemontools-0.76/src
patch < /downloads/daemontools-0.76.errno.patch
cd /package/admin/daemontools-0.76
package/install

Creating the supervise script directories 


mkdir /var/qmail/supervise
cd /var/qmail/supervise
mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log
chmod +t qmail-smtpd qmail-send qmail-pop3d

Creating qmail-smtpd run supervise 


vim qmail-smtpd/run
#!/bin/sh
QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE
QUID=`id -u qmaild`
QGID=`id -g qmaild`
MAXD=`head -1 /var/qmail/control/concurrencyincoming`
HOST=`head -1 /var/qmail/control/me`
SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit`
CDBF="/etc/tcp.smtp.cdb"
if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then
echo QUID, QGID, MAXD, or HOST is unset in
echo /var/qmail/supervise/qmail-smtpd/run
exit 1
fi
exec /usr/local/bin/softlimit -m $SOFT \
/usr/local/bin/tcpserver -v \
-H \
-R \
-l $HOST \
-x $CDBF \
-c $MAXD \
-u $QUID \
-g $QGID \
0 \
smtp \
/var/qmail/bin/qmail-smtpd \
/var/qmail/bin/auth_smtp /usr/bin/true 2>&1

Creating qmail-smtpd log run supervise script 


vim qmail-smtpd/log/run
#!/bin/sh
export PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1


Creating qmail rc supervise script 


vim /var/qmail/rc
#!/bin/sh
QLOG="`cat /var/qmail/control/qmail-start-loglevel`"
DEFD="`cat /var/qmail/control/defaultdelivery`"
exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"


Creating qmail-send run supervise script 


vim qmail-send/run
#!/bin/sh
exec /var/qmail/rc


Creating qmail-send log run supervise script 


vim qmail-send/log/run
#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1


Creating qmail-pop3d run supervise script 


vim qmail-pop3d/run
#!/bin/sh
IP=`head -1 /var/qmail/control/me`
LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel`
SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit`
exec \
env LOGLEVEL=$LL \
softlimit -m $SL \
/usr/local/bin/tcpserver -v -R -H -l 0 0 pop3 \
/var/qmail/bin/qmail-popup $IP \
/var/qmail/bin/tcp-env \
/var/qmail/bin/auth_pop \
/var/qmail/bin/qmail-pop3d Maildir 2>&1


Creating qmail-pop3d log run supervise script 


vim qmail-pop3d/log/run
#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1


Creating auto directory maker script 


vim /var/qmail/bin/dirmaker
#!/bin/sh
echo '----------------------------------------------' >> /tmp/dirmaker
date >> /tmp/dirmaker
echo $1 >> /tmp/dirmaker
id >> /tmp/dirmaker
mkdir --parents -m 700 -p $1/Maildir
mkdir --parents -m 700 -p $1/Maildir/tmp
mkdir --parents -m 700 -p $1/Maildir/cur
mkdir --parents -m 700 -p $1/Maildir/new
chown -R vmail:vmail $1


Set permissions of all qmail supervise run scripts 


chmod 755 qmail-pop3d/run qmail-smtpd/run qmail-send/run
chmod 755 qmail-pop3d/log/run qmail-smtpd/log/run qmail-send/log/run
chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker

Create tcp.smtp file to appy tcprules 


vim /etc/tcp.smtp
127.:allow,RELAYCLIENT="",MAXRCPTCOUNT="200"
192.168.:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHPREPEND="Authenticated  user:",SANITYCHECK="",SMTPAUTH="",LOGLEVEL="3",AUTHREQUIRED="",MAXRCPTCOUNT="100"
:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SANITYCHECK="",RETURNMXCHECK="STRICT",RBL="",REJECTEXEC="",LOGLEVEL="3",TARPITCOUNT="10",TARPITDELAY="10",SMTPAUTH="",MAXRCPTCOUNT="25"


Creating qmail logging directories and set permissions 


mkdir /var/log/qmail
cd /var/log/qmail
mkdir qmail-send qmail-smtpd qmail-pop3d
chown -R qmaill:root /var/log/qmail
chmod -R 750 /var/log/qmail

Creating qmail alias users, links and set permissions 


cd /var/qmail
cp -p /downloads/qmailctl /var/qmail/bin/.
chmod 755 /var/qmail/bin/qmailctl
ln -s /var/qmail/bin/qmailctl /usr/bin/
qmailctl cdb

Creating links of supervise scripts 


mkdir -p /service
cd /service/
ln -s /var/qmail/supervise/qmail-* .

Creating aliases 


echo qmailadmin@groupvama.com > /var/qmail/alias/.qmail-root
echo qmailadmin@ groupvama.com > /var/qmail/alias/.qmail-postmaster
echo qmailadmin@ groupvama.com > /var/qmail/alias/.qmail-mailer-daemon
ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous
chmod 644 /var/qmail/alias/.qmail*

Stop sendmail and remove all related files 


/etc/init.d/sendmail stop
chkconfig sendmail off
mv /usr/lib/sendmail /usr/lib/sendmail.org
mv /usr/sbin/sendmail /usr/sbin/sendmail.org
ln -s /var/qmail/bin/sendmail /usr/lib/sendmail
ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

COURIER IMAP INSTALLATION[edit]

Compile courier-authlib and install 

cd /downloads/qmailrocks/
tar jxvf courier-authlib-0.55.tar.bz2
cd courier-authlib-0.55
./configure --prefix=/usr/local --exec-prefix=/usr/local --with-authldap --without-authmysql --disable-root-check --with-ssl –with-authchangepwdir=/usr/local/libexec/authlib --with-redhat
make && make check
make install-strip && make install-configure

Create IMAP certificate and make changes on configuration files 


vim /usr/local/etc/imapd.cnf 
(Change postmaser@example.com an administrative email address) 
emailAddress=qmailadmin@groupvama.com



vim /usr/local/etc/imapd
IMAPDSTART=YES



vim /usr/local/etc/imapd-ssl
IMAPDSSLSTART=YES
TLS_CERTFILE=/var/qmail/control/clientcert.pem



vim /usr/local/etc/authlib/authdaemonrc
authmodulelist="authldap"
authmodulelistorig="authldap"



vim /usr/local/etc/authlib/authldaprc
LDAP_SERVER 127.0.0.1
LDAP_PORT 389
LDAP_BASEDN dc=groupvama,dc=com
LDAP_BINDDN cn=Manager,dc=groupvama,dc=com
LDAP_BINDPW MiraE#1920
LDAP_TIMEOUT 5
LDAP_AUTHBIND 1
LDAP_MAIL uid
LDAP_GLOB_UID vmail
LDAP_GLOB_GID vmail
LDAP_HOMEDIR mailMessageStore
LDAP_MAILROOT /home/vmail
LDAP_MAILDIR mailbox
LDAP_DEFAULTDELIVERY defaultDelivery
LDAP_FULLNAME cn
LDAP_CLEARPW clearPassword
LDAP_CRYPTPW userPassword
LDAP_DEREF never
LDAP_TLS 0


Copy imap and imaps script in init.d directory 


cp /usr/local/libexec/imapd.rc /etc/rc.d/init.d/imap
cp /usr/local/libexec/imapd-ssl.rc /etc/rc.d/init.d/imaps


Make imap and imaps services start on boot 


vim /etc/rc.local
/usr/local/sbin/authdaemond start
/etc/rc.d/init.d/imap start
/etc/rc.d/init.d/imaps start


Restart authdaemon and imap services 

/usr/local/sbin/authdaemond stop
/usr/local/sbin/authdaemond start
/etc/rc.d/init.d/imap stop
/etc/rc.d/init.d/imaps stop
/etc/rc.d/init.d/imap start 
/etc/rc.d/init.d/imaps start

Install autoresponder and maildrop [edit]

cd /downloads/autorespond-2.0.5/
make && make install
cd /downloads/maildrop-2.5.4
./configure --prefix=/usr/local --exec-prefix=/usr/local --enable-maildrop-uid=root
make && make install-strip && make install-man

Install all required packages for Qmail-Scanner 


yum perl-suidperl perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS perl-Time-HiRes* perl-HTML-Tagset perl-HTML-Parser perl-Pod-Usage* perl-Parse-Syslog perl-Statistics-Distributions spamassassin clamav clamd

Add user "qscand" for scanning 


useradd -c "Qmail-Scanner Account" -s /bin/false -m qscand

Change user clamav to qscand


  • vim /etc/logrotate.d/clamav[Change clamav to qscand]

/var/log/clamav/clamd.log {

missingok

notifempty

create 644 qscand qscand

postrotate

killall -HUP clamd 2>/dev/null || :

endscript

}


  • vim /etc/logrotate.d/freshclam[Change clamav to qscand]

/var/log/clamav/freshclam.log {

missingok

notifempty

create 644 qscand qscand

}

  • vim /etc/clamd.conf

User qscand


  • vim /etc/freshclam.conf

DatabaseOwner qscand


  • chown qscand.qscand /var/log/clamav/ -R
  • chown -R qscand.qscand /var/run/clamav/
  • /etc/init.d/clamd restart
  • /etc/init.d/spamassassin restart

Install Qmail-Scanner


  • cd /downloads/qmail-scanner-2.08
  • ./configure --admin admin --domain groupvama.com
  • mkdir -p /var/spool/qscan
  • mkdir -p /var/spool/qscan/quarantine/viruses/tmp /var/spool/qscan/quarantine/viruses/cur /var/spool/qscan/quarantine/viruses/new
  • mkdir -p /var/spool/qscan/quarantine/spam/tmp /var/spool/qscan/quarantine/spam/cur /var/spool/qscan/quarantine/spam/new
  • mkdir -p /var/spool/qscan/quarantine/policy/tmp /var/spool/qscan/quarantine/policy/cur /var/spool/qscan/quarantine/policy/new
  • mkdir -p /var/spool/qscan/working/tmp /var/spool/qscan/working/cur /var/spool/qscan/working/new
  • mkdir -p /var/spool/qscan/archive/tmp /var/spool/qscan/archive/cur /var/spool/qscan/archive/new
  • cp /downloads/qmail-scanner-2.08/quarantine-events.txt /var/spool/qscan/
  • chown -R qscand:qscand /var/spool/qscan/
  • cp -pv /downloads/qmail-scanner-2.08/qmail-scanner-queue.pl /var/qmail/bin/
  • chown qscand.qscand /var/qmail/bin/qmail-scanner-queue.pl
  • chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl
  • /var/qmail/bin/qmail-scanner-queue.pl -z
  • /var/qmail/bin/qmail-scanner-queue.pl -g
  • cp -v /downloads/qmail-scanner-2.08/contrib/logrotate.qmail-scanner /etc/logrotate.d/qmail-scanner
  • /etc/init.d/syslog restart

Integrate Qmail-scanner with qmail queue

  • vim /var/qmail/supervise/qmail-smtpd/run

QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE


IMPLEMENTING SECOND INSTANCE OF QMAIL WITH DISCLAIMER AND COPY OF ALL OUTGOING MESSAGES


CONCEPT


Disclaimer on Qmail is Added to the Second Instance so that only Out going mails to different domains are uploaded with Common Signature / Disclaimer. Here this is used for multiple domains. Also second instance use to copy of all outgoing messages at log@groupvama.com.


IMPLEMENTAION PROCESS
  • Implement Qmail-2 , i.e Second Qmail Instance
  • Define Qmail-send and Qmail-smtpd daemons
  • Define 2nd Qmail smtp port ( say 900)
  • Install Qmail-qfilter , altermime and bglibs to satisfy the requirement.
  • Define Multiple domain's text and HTML disclaimer
  • Integrate Qmail's both the instances
INSTALLATION OF QMAIL2

Creating directories for installing qmail2

  • mkdir -p /var/qmail2
  • mkdir /usr/src/qmail2
  • cd /usr/src/qmail2

Unpack qmail in /usr/src/qmail2 and apply qmail-ldap patch(this patch contain qmail queue and qmail error patch)


  • tar xvzf /downloads/qmailrocks/qmail-1.03.tar.gz ( Assuming that you have downloaded Qmailrocks earlier )
  • cd qmail-1.03
  • patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch
  • echo 255 > /usr/src/qmail2/qmail-1.03/conf-spwan
  • echo 211 > /usr/src/qmail2/qmail-1.03/conf-split

Make changes on "Makefile" to qmail work properly with ldap


Make these entries :


LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE

ZLIB=-lz

SHADOWLIBS=-lcrypt

DEBUG=-DDEBUG


  • vim conf-qmail

( replace qmail with qmail2 )


Caution: This is very critical Step as, not doing do will cause the main Qmail instance will get over written .

Keep a copy of all outgoing mail messages


  • vim extra.h

QUEUE_EXTRA "Tlog\0"

QUEUE_EXTRALEN 5


  • make man
  • make setup check

Qmail2 Control Files


  • cd /var/qmail2/control/
  • echo 100 > concurrencyincoming
  • echo 255 > concurrencyremote
  • echo ./Maildir/ > defaultdelivery
  • echo /var/qmail/bin/dirmaker > dirmaker
  • echo 0 > ldapcluster
  • id -g vmail > ldapgid
  • echo /home/vmail > ldapmessagestore
  • echo qmailUser > ldapobjectclass
  • echo secret > ldappassword
  • echo 127.0.0.1 > ldapserver
  • id -u vmail > ldapuid
  • echo 80000000 > qmail-smtpd-softlimit
  • echo 80000000 > qmail-pop3d-softlimit
  • echo 3 > qmail-pop3d-loglevel
  • echo 3 > qmail-start-loglevel
  • echo groupvama.com > defaultdomain
  • echo dc=groupvama,dc=com > ldapbasedn
  • echo cn=Manager,dc=groupvama,dc=com > ldaplogin
  • echo mail.groupvama.com > me

Qmail2 Daemons

Now create qmail2-smtpd and qmail2-send daemons

  • Create /var/qmail2/rc

#!/bin/sh

QLOG="`cat /var/qmail2/control/qmail-start-loglevel`"

DEFD="`cat /var/qmail2/control/defaultdelivery`"

exec env - PATH="/var/qmail2/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"

  • chmod 755 /var/qmail2/rc

Create supervise directories for Qmail2-send and Qmail2-smtpd and log directories

  • mkdir -p /var/qmail2/supervise/qmail2-smtpd/log
  • mkdir -p /var/qmail2/supervise/qmail2-send/log
  • mkdir -p /var/log/qmail2/qmail2-smtpd/
  • mkdir -p /var/log/qmail2/qmail2-send/
  • chown -R qmaill.nofiles /var/log/qmail2/

Daemon for Qmail2-send

  • vim /var/qmail2/supervise/qmail2-send/run

#!/bin/sh

exec /var/qmail2/rc


  • chmod 755 /var/qmail2/supervise/qmail2-send/run

Log daemon for Qmail2-send

  • vim/var/qmail2/supervise/qmail2-send/log/run

#!/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail2/qmail2-send 2>&1

Daemon for Qmail2-smtpd

  • vim /var/qmail2/supervise/qmail2-smtpd/run

#!/bin/sh

QMAILQUEUE="/var/qmail2/bin/qmail-tail"; export QMAILQUEUE

QUID=`id -u qmaild`

QGID=`id -g qmaild`

MAXD=`head -1 /var/qmail2/control/concurrencyincoming`

HOST=`head -1 /var/qmail2/control/me`

SOFT=`head -1 /var/qmail2/control/qmail-smtpd-softlimit`

CDBF="/etc/tcp.smtp.cdb"


if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then

echo QUID, QGID, MAXD, or HOST is unset in

echo /var/qmail/supervise/qmail-smtpd/run

exit 1

fi


exec /usr/local/bin/softlimit -m $SOFT \

/usr/local/bin/tcpserver -v \

-H \

-R \

-l $HOST \

-x $CDBF \

-c $MAXD \

-u $QUID \

-g $QGID \

0 \

qmail-second \

/var/qmail2/bin/qmail-smtpd \

/var/qmail2/bin/auth_smtp /usr/bin/true 2>&1


  • chmod 755 /var/qmail2/supervise/qmail2-smtpd/run

Log daemon for Qmail2-smtpd

  • vim /var/qmail2/supervise/qmail2-smtpd/log/run

#!/bin/sh

exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail2/qmail2-smtpd 2>&1

  • chmod 755 /var/qmail2/supervise/qmail2-smtpd/log/run

Link these file to /service

  • ln -s /var/qmail2/supervise/qmail2-smtpd /service/
  • ln -s /var/qmail2/supervise/qmail2-send /service/

Restart the Qmail via inttab process

Testing of Qmail - Second instance
  • telnet to port 900 and send the mail .
  • check for logs /var/log/qmail2/qmail2-send/current or /var/log/qmail2/qmail2-smtpd/current

Disclaimer Related Implementation[edit]

Install bglibs for qmail2

or

  • tar -xvfz bglibs-1.022-1.tar.gz
  • cd bglibs-1.022-1
  • make
  • make install

Install altermime for qmail2

Install qmail-qfilter for qmail2

( change qmail into qmail2 )

#ifndef QMAIL_QUEUE

#define QMAIL_QUEUE "/var/qmail2/bin/qmail-queue"

#endif

  • make
  • make install
  • chmod 777 /usr/local/bin/qmail-qfilter
  • chown root:qmail /usr/local/bin/qmail-qfilter

Disclaimer Settings


  • vi /var/qmail2/bin/qmail-tail

#!/bin/sh

exec /usr/local/bin/qmail-qfilter /var/qmail2/bin/qmail-disclaimer

  • chown root:qmail /var/qmail2/bin/qmail-tail
  • chmod 777 /var/qmail2/bin/qmail-tail
  • mkdir /var/qmail2/control/disclaimer/
  • cd /var/qmail2/control/disclaimer
  • vim groupvama.com.html

<html>


<body>


DISCLAIMER:

This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorised use or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.


</body>


</html>

  • vim gropvama.com.txt

This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized use or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

  • chown root:qmail /var/qmail2/control/disclaimer/*
  • chmod 777 /var/qmail2/control/disclaimer/*
  • mkdir /var/tmp/qmail-qfilter
  • chown root:qmail /var/tmp/qmail-qfilter
  • chmod 777 /var/tmp/qmail-qfilter
  • vi /var/qmail2/bin/qmail-disclaimer

#!/bin/sh

QMAILHOST=groupvama.com

INSPECT_DIR=/var/tmp/qmail-qfilter

if [ ! -f /var/qmail2/control/disclaimer/$QMAILHOST.txt ]

then

cat

exit 0

fi

EX_TEMPFAIL=31

EX_UNAVAILABLE=31

trap "rm -f /var/tmp/qmail-qfilter/in.$$" 0 1 2 3 15

cd $INSPECT_DIR || { echo Error: $INSPECT_DIR does not exist; exit $EX_TEMPFAIL; }

cat >$INSPECT_DIR/in.$$ || { echo Error: Cannot write to disk; exit $EX_TEMPFAIL; }

/usr/local/bin/altermime --input=$INSPECT_DIR/in.$$ \

--xheader="X-Disclaimer: $QMAILHOST" \

--disclaimer=/var/qmail2/control/disclaimer/$QMAILHOST.txt \

--disclaimer-html=/var/qmail2/control/disclaimer/$QMAILHOST.html || { echo Error: message rejected; exit $EX_UNAVAILABLE; }

cat $INSPECT_DIR/in.$$

rm in.$$

exit $?

  • chown root:qmail /var/qmail2/bin/qmail-disclaimer
  • chmod 777 /var/qmail2/bin/qmail-disclaimer

Activation of Qmail2[edit]

Changes on Qmail2-Send run file

  • vi /service/qmail2-smtpd/run

( add following line at the top )

#!/bin/sh

QMAILQUEUE="/var/qmail2/bin/qmail-tail"; export QMAILQUEUE

Also Make sure the Qmail-smtpd is running on port 900 by

  • vi /etc/services

# Local services

second-qmail 900/tcp

Integrate Qmail with Qmail2

vi /var/qmail/control/smtproutes

127.0.0.1:900

Note: Then restart the qmail from /etc/inittab file

Testing[edit]

  • Telnet and send mail via Qmail-2 , you should get the disclaimer
  • Test via offline Client like Evolution , Outlook etc . You should get the mail with

Troubleshooting[edit]

  • QQ error while sending mails

Check the smtp logs , if find error like

/usr/local/bin/qmail-qfilter: error while loading shared libraries: libbg-sysdeps.so.1: cannot open shared object file: No such file or directory

Then

you have to link libbg-sysdeps.so.1 to /usr/lib

  • ln -s /usr/local/bglibs/lib/libbg-sysdeps.so.1 /usr/lib/

This should solve the issue

  • 2. Some time the Qmail-1 is not able to deliver mails to Qmail-2 instance due to /var/tmp/qmail-qfilter directory is not there or vanishes. So a script to check and create the directory with cron is created for taking care of this issue.

The script is /usr/bin/check_qmail-qfilter_dir.sh

#!/bin/sh

DIRECTORY=/var/tmp/qmail-qfilter

if [ ! -d "$DIRECTORY" ]; then

mkdir -p $DIRECTORY;

chmod 777 $DIRECTORY;

chown -R root.qmail $Directory

fi

The cron entry is as follows

  • crontab -e

*/5 * * * * /usr/bin/check_qmail-qfilter_dir.sh


OPENLDAP MASTER SLAVE


Openldap master (slapd.conf)


  • Vim /etc/openldap/ldap.conf

BASE dc=groupvama,dc=com

URI ldap://127.0.0.1/


  • Vim /etc/openldap/slapd.conf

#

# See slapd.conf(5) for details on configuration options.

# This file should NOT be world readable.

#

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/qmail.schema

include /etc/openldap/schema/dnszone.schema


# Allow LDAPv2 client connections. This is NOT the default.

allow bind_v2


# Do not enable referrals until AFTER you have a working directory

# service AND an understanding of referrals.

#referral ldap://root.openldap.org


pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args


# Load dynamic backend modules:

# modulepath /usr/lib64/openldap


# Modules available in openldap-servers-overlays RPM package

# Module syncprov.la is now statically linked with slapd and there

# is no need to load it here

# moduleload accesslog.la

# moduleload auditlog.la

# moduleload denyop.la

# moduleload dyngroup.la

# moduleload dynlist.la

# moduleload lastmod.la

# moduleload pcache.la

# moduleload ppolicy.la

# moduleload refint.la

# moduleload retcode.la

# moduleload rwm.la

# moduleload smbk5pwd.la

# moduleload translucent.la

# moduleload unique.la

# moduleload valsort.la

# modules available in openldap-servers-sql RPM package:

# moduleload back_sql.la


# The next three lines allow use of TLS for encrypting connections using a

# dummy test certificate which you can generate by changing to

# /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on

# slapd.pem so that the ldap user or group can read it. Your client software

# may balk at self-signed certificates, however.

# TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

# TLSCertificateFile /etc/pki/tls/certs/slapd.pem

# TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem


# Sample security restrictions

# Require integrity protection (prevent hijacking)

# Require 112-bit (3DES or better) encryption for updates

# Require 63-bit encryption for simple bind

# security ssf=1 update_ssf=112 simple_bind=64


# Sample access control policy:

# Root DSE: allow anyone to read it

# Subschema (sub)entry DSE: allow anyone to read it

# Other DSEs:

# Allow self write access

# Allow authenticated users read access

# Allow anonymous users to authenticate

# Directives needed to implement policy:

# access to dn.base="" by * read

# access to dn.base="cn=Subschema" by * read

# access to *

# by self write

# by users read

# by anonymous auth

#


#access to *

# by dn.exact="cn=Manager,dc=groupvama,dc=com" read

# by * none

# if no access controls are present, the default policy

# allows anyone and everyone to read anything but restricts

# updates to rootdn. (e.g., "access to * by * read")

# modules available in openldap-servers-sql RPM package:

# moduleload back_sql.la


# The next three lines allow use of TLS for encrypting connections using a

# dummy test certificate which you can generate by changing to

# /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on

# slapd.pem so that the ldap user or group can read it. Your client software

# may balk at self-signed certificates, however.

# TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

# TLSCertificateFile /etc/pki/tls/certs/slapd.pem

# TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem


# Sample security restrictions

# Require integrity protection (prevent hijacking)

# Require 112-bit (3DES or better) encryption for updates

# Require 63-bit encryption for simple bind

# security ssf=1 update_ssf=112 simple_bind=64


# Sample access control policy:

# Root DSE: allow anyone to read it

# Subschema (sub)entry DSE: allow anyone to read it

# Other DSEs:

# Allow self write access

# Allow authenticated users read access

# Allow anonymous users to authenticate

# Directives needed to implement policy:

# access to dn.base="" by * read

# access to dn.base="cn=Subschema" by * read

# access to *

# by self write

# by users read

# by anonymous auth

#


#access to *

# by dn.exact="cn=Manager,dc=groupvama,dc=com" read

# by * none

# if no access controls are present, the default policy

# allows anyone and everyone to read anything but restricts

# updates to rootdn. (e.g., "access to * by * read")

#

# rootdn can always read and write EVERYTHING!

#######################################################################

# ldbm and/or bdb database definitions

#######################################################################

serverID 001


database bdb

suffix "dc=groupvama,dc=com"

rootdn "cn=Manager,dc=groupvama,dc=com"

# Cleartext passwords, especially for the rootdn, should

# be avoided. See slappasswd(8) and slapd.conf(5) for details.

# Use of strong authentication encouraged.

rootpw MiraE#1920

# rootpw {crypt}ijFYNcSNctBYg


# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended.

directory /var/lib/ldap


# Indices to maintain for this database

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub


# Replicas of this database

#replogfile /var/lib/ldap/openldap-master-replog

#replica host=ldap-1.example.com:389 starttls=critical

# bindmethod=sasl saslmech=GSSAPI

# authcId=host/ldap-master.example.com@EXAMPLE.COM


overlay syncprov

syncprov-checkpoint 100 10

syncprov-sessionlog 100


replica uri=ldap://182.71.29.139:389

binddn="cn=Manager,dc=groupvama,dc=com"

bindmethod=simple credentials=MiraE#1920


Openldap slave (slapd.conf)

  • Vim /etc/openldap/slapd.conf

#

# See slapd.conf(5) for details on configuration options.

# This file should NOT be world readable.

#

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/qmail.schema


# Allow LDAPv2 client connections. This is NOT the default.

allow bind_v2


# Do not enable referrals until AFTER you have a working directory

# service AND an understanding of referrals.

#referral ldap://root.openldap.org


pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args


# Load dynamic backend modules:

# modulepath /usr/lib/openldap


# Modules available in openldap-servers-overlays RPM package

# Module syncprov.la is now statically linked with slapd and there

# is no need to load it here

# moduleload accesslog.la

# moduleload auditlog.la

# moduleload denyop.la

# moduleload dyngroup.la

# moduleload dynlist.la

# moduleload lastmod.la

# moduleload pcache.la

# moduleload ppolicy.la

# moduleload refint.la

# moduleload retcode.la

# moduleload rwm.la

# moduleload smbk5pwd.la

# moduleload translucent.la

# moduleload unique.la

# moduleload valsort.la


# modules available in openldap-servers-sql RPM package:

# moduleload back_sql.la


# The next three lines allow use of TLS for encrypting connections using a

# dummy test certificate which you can generate by changing to

# /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on

# slapd.pem so that the ldap user or group can read it. Your client software

# may balk at self-signed certificates, however.

# TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

# TLSCertificateFile /etc/pki/tls/certs/slapd.pem

# TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem


# Sample security restrictions

# Require integrity protection (prevent hijacking)

# Require 112-bit (3DES or better) encryption for updates

# Require 63-bit encryption for simple bind

# security ssf=1 update_ssf=112 simple_bind=64


# Sample access control policy:

# Root DSE: allow anyone to read it

# Subschema (sub)entry DSE: allow anyone to read it

# Other DSEs:

# Allow self write access

# Allow authenticated users read access

# Allow anonymous users to authenticate

# Directives needed to implement policy:

# access to dn.base="" by * read

# access to dn.base="cn=Subschema" by * read

# access to *

# by self write

# by users read

# by anonymous auth

#

# if no access controls are present, the default policy

# allows anyone and everyone to read anything but restricts

# updates to rootdn. (e.g., "access to * by * read")

#

# rootdn can always read and write EVERYTHING!

#access to *

# by dn.exact="cn=Manager,dc=groupvama,dc=com" read

# by * none

#######################################################################

# ldbm and/or bdb database definitions

#######################################################################

serverID 002


database bdb

#suffix "dc=my-domain,dc=com"

#rootdn "cn=Manager,dc=my-domain,dc=com"

suffix "dc=groupvama,dc=com"

rootdn "cn=Manager,dc=groupvama,dc=com"

# Cleartext passwords, especially for the rootdn, should

# be avoided. See slappasswd(8) and slapd.conf(5) for details.

# Use of strong authentication encouraged.

# rootpw secret

# rootpw {crypt}ijFYNcSNctBYg

rootpw MiraE#1920


# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended.

directory /var/lib/ldap


# Indices to maintain for this database

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub


# Replicas of this database

#replogfile /var/lib/ldap/openldap-master-replog

#replica host=ldap-1.example.com:389 starttls=critical

# bindmethod=sasl saslmech=GSSAPI

# authcId=host/ldap-master.example.com@EXAMPLE.COM


#syncrepl rid=001

#provider=ldap://182.71.29.139

#type=refreshAndPersist

#searchbase="dc=groupvama,dc=com"

#filter="(objectClass=*)"

#scope=sub

#attrs="*"

#bindmethod=simple

#binddn="cn=Manager,dc=groupvama,dc=com"

#credentials=MiraE#1920


syncrepl rid=001

provider=ldap://182.71.29.139

type=refreshAndPersist

retry="60 +"

searchbase="dc=groupvama,dc=com"

scope=sub

schemachecking=on

bindmethod=simple

binddn="cn=Manager,dc=groupvama,dc=com"

credentials=MiraE#1920


mirrormode on


Then restart ldap on both automatically master slave synchronize.

Retrieved from "https://wiki.tetrain.com/index.php?title=Qmail_Server_with_Courier_IMAP_with_Master/Slave_LDAP_for_MiraExim&oldid=1475"