Jump to content

Indorama Mail Server Arch

From TetraWiki
Revision as of 11:36, 29 July 2015 by Amit (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Migration Plan Indorama
hostname – mail.indorama-ind.com
192.128.91.12 (220.227.213.92) – root - Z@123


1: Server Readiness ( 14th July - 15th July )

  • Hardware Availability
  • Os Installation (Centos update 6 with DVD )
  • DNS Configuration
  • Zimbra Installation
  • Spam Tuning and RBL listing

2: Sever Configuration ( 15th July – 16th July )

  • User Creation and local mail testing (Required List of all users and there passwords If available )
  • Migration Of User mails if available
  • Implementation of COS
  • Mail testing with respect to COS
  • Distribution List Implementation (Implementation of restrictions if required )
  • Backup Script Implementation (Testing and scheduled accordingly )
  • Firewall Implementation (Restrictive to Tetra office and local Environment only )
  • MX testing.

3: Documentation ( 17th July – 18th July )

  • Implementation Document of zimbra
  • User Creation Script
  • Mail Migration Script
  • COS implementation Script
  • DL Implementation and restriction, script and process
  • Any additional customization.

4: Project Sign off ( 20th July )

  • Final Mail Confirmation related the project Sign off.

Server Readiness

  • H/W
  • OS installation Completed
  • Network Setup
  • RHN Register
  • DNS Configuration

#Package Installation

# yum install bind*


# vim /etc/named.conf

options {


listen-on port 53 { 127.0.0.1; 192.128.91.12; };


# listen-on-v6 port 53 { ::1; };


directory "/var/named";


dump-file "/var/named/data/cache_dump.db";


statistics-file "/var/named/data/named_stats.txt";


memstatistics-file "/var/named/data/named_mem_stats.txt";


allow-query { localhost; };


recursion yes;


dnssec-enable yes;


dnssec-validation yes;


dnssec-lookaside auto;


/* Path to ISC DLV key */


bindkeys-file "/etc/named.iscdlv.key";


managed-keys-directory "/var/named/dynamic";


};


logging {


channel default_debug {


file "data/named.run";


severity dynamic;


};


};


zone "." IN {


type hint;


file "named.ca";


};


zone"indorama-ind.com" IN {


type master;


file "fwd.indorama-ind.com";


allow-update { none; };


};


include "/etc/named.rfc1912.zones";


include "/etc/named.root.key";


# cat /var/named/fwd.indorama-ind.com


$TTL 86400


@ IN SOA root.indorama-ind.com. root.indorama-ind.com. (


2011071001 ;Serial


3600 ;Refresh


1800 ;Retry


604800 ;Expire


86400 ;Minimum TTL


)


@IN NS indorama-ind.com.


@IN A 192.128.91.12


mailIN A 192.128.91.12

mailsrv IN A 192.128.91.12


indorama-ind.com.INMX 0mail.indorama-ind.com.


# /etc/init.d/named restart

# chkconfig named on


Installation of Zimbra


# yum install nc

# /etc/init.d/postfix stop

# chkconfig postfix off


[root@ZMAIL zcs-8.6.0_GA_1153.RHEL6_64.20141215151155]# ./install.sh


Operations logged to /tmp/install.log.31992


Checking for existing installation...


zimbra-ldap...NOT FOUND


zimbra-logger...NOT FOUND


zimbra-mta...NOT FOUND


zimbra-dnscache...NOT FOUND


zimbra-snmp...NOT FOUND


zimbra-store...NOT FOUND


zimbra-apache...NOT FOUND


zimbra-spell...NOT FOUND


zimbra-convertd...NOT FOUND


zimbra-memcached...NOT FOUND


zimbra-proxy...NOT FOUND


zimbra-archiving...NOT FOUND


zimbra-core...NOT FOUND


PLEASE READ THIS AGREEMENT CAREFULLY BEFORE USING THE SOFTWARE.


ZIMBRA, INC. ("ZIMBRA") WILL ONLY LICENSE THIS SOFTWARE TO YOU IF YOU


FIRST ACCEPT THE TERMS OF THIS AGREEMENT. BY DOWNLOADING OR INSTALLING


THE SOFTWARE, OR USING THE PRODUCT, YOU ARE CONSENTING TO BE BOUND BY


THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS


AGREEMENT, THEN DO NOT DOWNLOAD, INSTALL OR USE THE PRODUCT.


License Terms for the Zimbra Collaboration Suite:


http://www.zimbra.com/license/zimbra-public-eula-2-5.html


Do you agree with the terms of the software license agreement? [N] y


Checking for prerequisites...


FOUND: NPTL


FOUND: nc-1.84-22


FOUND: sudo-1.8.6p3-7


FOUND: libidn-1.18-2


FOUND: gmp-4.3.1-7


FOUND: libaio-0.3.107-10


FOUND: libstdc++-4.4.7-3


FOUND: unzip-6.0-1


Checking for suggested prerequisites...


FOUND: perl-5.10.1


FOUND: sysstat


FOUND: sqlite


Prerequisite check complete.


Checking for installable packages


Found zimbra-core


Found zimbra-ldap


Found zimbra-logger


Found zimbra-mta


Found zimbra-dnscache


Found zimbra-snmp


Found zimbra-store


Found zimbra-apache


Found zimbra-spell


Found zimbra-memcached


Found zimbra-proxy


Select the packages to install


Install zimbra-ldap [Y] y


Install zimbra-logger [Y]


Install zimbra-mta [Y]


Install zimbra-dnscache [Y] n


Install zimbra-snmp [Y]


Install zimbra-store [Y]


Install zimbra-apache [Y]


Install zimbra-spell [Y]


Install zimbra-memcached [Y] n


Install zimbra-proxy [Y] n


Checking required space for zimbra-core


Checking space for zimbra-store


Checking required packages for zimbra-store


zimbra-store package check complete.


Installing:


zimbra-core


zimbra-ldap


zimbra-logger


zimbra-mta


zimbra-snmp


zimbra-store


zimbra-apache


zimbra-spell


The system will be modified. Continue? [N] y


Removing /opt/zimbra


Removing zimbra crontab entry...done.


Cleaning up zimbra init scripts...done.


Cleaning up /etc/ld.so.conf...done.


Cleaning up /etc/prelink.conf...done.


Cleaning up /etc/security/limits.conf...done.


Finished removing Zimbra Collaboration Server.


Installing packages


zimbra-core......zimbra-core-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


zimbra-ldap......zimbra-ldap-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


zimbra-logger......zimbra-logger-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


zimbra-mta......zimbra-mta-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


zimbra-snmp......zimbra-snmp-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


zimbra-store......zimbra-store-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


zimbra-apache......zimbra-apache-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


zimbra-spell......zimbra-spell-8.6.0_GA_1153.RHEL6_64-20141215151155.x86_64.rpm...done


Operations logged to /tmp/zmsetup07142015-180638.log


Installing LDAP configuration database...done.


Setting defaults...MX: mail.indorama-ind.com (192.128.91.12)


Interface: 192.128.91.12


Interface: 127.0.0.1


Interface: ::1


192.128.91.12


done.


Checking for port conflicts


Port conflict detected: 25 (zimbra-mta)


Port conflict detected: 25 (zimbra-mta)


Port conflicts detected! - Press Enter/Return key to continue


Main menu


1) Common Configuration:


2) zimbra-ldap: Enabled


3) zimbra-logger: Enabled


4) zimbra-mta: Enabled


5) zimbra-snmp: Enabled


6) zimbra-store: Enabled


+Create Admin User: yes


+Admin user to create: admin@indorama-ind.com


******* +Admin Password UNSET


+Anti-virus quarantine user: virus-quarantine.t3uymrfau2@indorama-ind.com


+Enable automated spam training: yes


+Spam training user: spam.pqpq83jmzj@indorama-ind.com


+Non-spam(Ham) training user: ham.posvxg1ap@indorama-ind.com


+SMTP host: indorama-ind.com


+Web server HTTP port: 80


+Web server HTTPS port: 443


+Web server mode: https


+IMAP server port: 143


+IMAP server SSL port: 993


+POP server port: 110


+POP server SSL port: 995


+Use spell check server: yes


+Spell server URL: http://indorama-ind.com:7780/aspell.php


+Configure for use with mail proxy: FALSE


+Configure for use with web proxy: FALSE


+Enable version update checks: TRUE


+Enable version update notifications: TRUE


+Version update notification email: admin@indorama-ind.com


+Version update source email: admin@indorama-ind.com


+Install mailstore (service webapp): yes


+Install UI (zimbra,zimbraAdmin webapps): yes


7) zimbra-spell: Enabled


8) Default Class of Service Configuration:


s) Save config to file


x) Expand menu


q) Quit


Address unconfigured (**) items (? - help) 6


Store configuration


1) Status: Enabled


2) Create Admin User: yes


3) Admin user to create: admin@indorama-ind.com


** 4) Admin Password UNSET


5) Anti-virus quarantine user: virus-quarantine.t3uymrfau2@indorama-ind.com


6) Enable automated spam training: yes


7) Spam training user: spam.pqpq83jmzj@indorama-ind.com


8) Non-spam(Ham) training user: ham.posvxg1ap@indorama-ind.com


9) SMTP host: indorama-ind.com


10) Web server HTTP port: 80


11) Web server HTTPS port: 443


12) Web server mode: https


13) IMAP server port: 143


14) IMAP server SSL port: 993


15) POP server port: 110


16) POP server SSL port: 995


17) Use spell check server: yes


18) Spell server URL: http://indorama-ind.com:7780/aspell.php


19) Configure for use with mail proxy: FALSE


20) Configure for use with web proxy: FALSE


21) Enable version update checks: TRUE


22) Enable version update notifications: TRUE


23) Version update notification email: admin@indorama-ind.com


24) Version update source email: admin@indorama-ind.com


25) Install mailstore (service webapp): yes


26) Install UI (zimbra,zimbraAdmin webapps): yes


Select, or 'r' for previous menu [r] 4


Password for admin@indorama-ind.com (min 6 characters): [RHp9zerPi] tetra4indorama


Store configuration


1) Status: Enabled


2) Create Admin User: yes


3) Admin user to create: admin@indorama-ind.com


4) Admin Password set


5) Anti-virus quarantine user: virus-quarantine.t3uymrfau2@indorama-ind.com


6) Enable automated spam training: yes


7) Spam training user: spam.pqpq83jmzj@indorama-ind.com


8) Non-spam(Ham) training user: ham.posvxg1ap@indorama-ind.com


9) SMTP host: indorama-ind.com


10) Web server HTTP port: 80


11) Web server HTTPS port: 443


12) Web server mode: https


13) IMAP server port: 143


14) IMAP server SSL port: 993


15) POP server port: 110


16) POP server SSL port: 995


17) Use spell check server: yes


18) Spell server URL: http://indorama-ind.com:7780/aspell.php


19) Configure for use with mail proxy: FALSE


20) Configure for use with web proxy: FALSE


21) Enable version update checks: TRUE


22) Enable version update notifications: TRUE


23) Version update notification email: admin@indorama-ind.com


24) Version update source email: admin@indorama-ind.com


25) Install mailstore (service webapp): yes


26) Install UI (zimbra,zimbraAdmin webapps): yes


Select, or 'r' for previous menu [r]


Main menu


1) Common Configuration:


2) zimbra-ldap: Enabled


3) zimbra-logger: Enabled


4) zimbra-mta: Enabled


5) zimbra-snmp: Enabled


6) zimbra-store: Enabled


7) zimbra-spell: Enabled


8) Default Class of Service Configuration:


s) Save config to file


x) Expand menu


q) Quit


*** CONFIGURATION COMPLETE - press 'a' to apply


Select from menu, or press 'a' to apply config (? - help) a


Save configuration data to a file? [Yes]


Save config in file: [/opt/zimbra/config.6991]


Saving config in /opt/zimbra/config.6991...done.


The system will be modified - continue? [No] yes


Operations logged to /tmp/zmsetup07142015-180638.log


Setting local config values...done.


Initializing core config...Setting up CA...done.


Deploying CA to /opt/zimbra/conf/ca ...done.


Creating SSL zimbra-store certificate...done.


Creating new zimbra-ldap SSL certificate...done.


Creating new zimbra-mta SSL certificate...done.


Installing mailboxd SSL certificates...done.


Installing MTA SSL certificates...done.


Installing LDAP SSL certificate...done.


Initializing ldap...done.


Setting replication password...done.


Setting Postfix password...done.


Setting amavis password...done.


Setting nginx password...done.


Setting BES searcher password...done.


Creating server entry for indorama-ind.com...done.


Setting Zimbra IP Mode...done.


Saving CA in ldap ...done.


Saving SSL Certificate in ldap ...done.


Setting spell check URL...done.


Setting service ports on indorama-ind.com...done.


Setting zimbraFeatureTasksEnabled=TRUE...done.


Setting zimbraFeatureBriefcasesEnabled=TRUE...done.


Setting TimeZone Preference...done.


Initializing mta config...done.


Setting services on indorama-ind.com...done.


Adding indorama-ind.com to zimbraMailHostPool in default COS...done.


Creating domain indorama-ind.com...done.


Setting default domain name...done.


Creating domain indorama-ind.com...already exists.


Creating admin account admin@indorama-ind.com...done.


Creating root alias...done.


Creating postmaster alias...done.


Creating user spam.pqpq83jmzj@indorama-ind.com...done.


Creating user ham.posvxg1ap@indorama-ind.com...done.


Creating user virus-quarantine.t3uymrfau2@indorama-ind.com...done.


Setting spam training and Anti-virus quarantine accounts...done.


Initializing store sql database...done.


Setting zimbraSmtpHostname for indorama-ind.com...done.


Configuring SNMP...done.


Setting up syslog.conf...done.


Starting servers...done.


Installing common zimlets...


com_zimbra_date...done.


com_zimbra_url...done.


com_zimbra_tooltip...done.


com_zimbra_webex...done.


com_zimbra_clientuploader...done.


com_zimbra_proxy_config...done.


com_zimbra_mailarchive...done.


com_zimbra_srchhighlighter...done.


com_zimbra_ymemoticons...done.


com_zimbra_bulkprovision...done.


com_zimbra_adminversioncheck...done.


com_zimbra_email...done.


com_zimbra_phone...done.


com_zimbra_viewmail...done.


com_zimbra_cert_manager...done.


com_zimbra_attachmail...done.


com_zimbra_attachcontacts...done.


Finished installing common zimlets.


Restarting mailboxd...done.


Creating galsync account for default domain...done.


You have the option of notifying Zimbra of your installation.


This helps us to track the uptake of the Zimbra Collaboration Server.


The only information that will be transmitted is:


The VERSION of zcs installed (8.6.0_GA_1153_RHEL6_64)


The ADMIN EMAIL ADDRESS created (admin@indorama-ind.com)


Notify Zimbra of your installation? [Yes] no


Notification skipped


Setting up zimbra crontab...done.


Moving /tmp/zmsetup07142015-180638.log to /opt/zimbra/log


Configuration complete - press return to exit


Spam tuning For Zimbra

1: RBL

zen.spamhaus.org

psbl.surriel.com

b.barracudacentral.org

bl.spamcop.net

dnsbl.sorbs.net


Spamassassin

Rajor2[edit]

Compile[edit]

As root: Get razor-agents-sdk from razor.sourceforge.net, untar it and

perl Makefile.PL

make

make install

Get also razor-agents from razor.sourceforge.net, untar it and

perl Makefile.PL

make

make install

Configuring Razor

Create .razor folder in /opt/zimbra/amavisd and give zimbra user permissions

mkdir /opt/zimbra/amavisd/.razor; chown -Rf zimbra:zimbra /opt/zimbra/amavisd/.razor

As zimbra user, create your razor account:

razor-admin -home=/opt/zimbra/amavisd/.razor -create

razor-admin -home=/opt/zimbra/amavisd/.razor -discover

razor-admin -home=/opt/zimbra/amavisd/.razor -register

Installing Pyzor[edit]

As root, install python support.

yum install python

Get pyzor package from pyzor.sourceforge.net, untar it and:

python setup.py build

python setup.py install

Configuring Pyzor

Create .pyzor folder into zimbra-amavisd home and set perms

mkdir /opt/zimbra/amavisd/.pyzor; chown zimbra:zimbra /opt/zimbra/amavisd/.pyzor

Open your firewall ports for pyzor (UDP/24441 outgoing)

And ready to go, as zimbra user, with:

pyzor --homedir /opt/zimbra/amavisd/.pyzor discover


$ zmlocalconfig antispam_enable_rule_updates

antispam_enable_rule_updates = false

$ zmlocalconfig antispam_enable_restarts

antispam_enable_restarts = false

$ zmlocalconfig -e antispam_enable_rule_updates=true

$ zmlocalconfig -e antispam_enable_restarts=true

# vim /opt/zimbra/conf/sa/sauser.cf

pyzor_timeout 10

use_razor2 1

use_pyzor 1

score URIBL_BLACK 3.250

score RAZOR2_CHECK 3.250

score PYZOR_CHECK 3.250

score BAYES_99 4.000

score BAYES_60 2.250

score BAYES_50 1.500

score BAYES_00 -0.500

score RP_MATCHES_RCVD -0.000

ref: https://wiki.zimbra.com/wiki/SpamAssassin_Customizations http://wiki.zimbra.com/wiki/Improving_Anti-spam_system


User Creation

All its done by script with the list of users file

File is like belo and it stores in dir /opt/zimbra/custom-scripts with the name user.txt

ca atul.saxena@indorama-ind.com 100S3708U79156KK


ca ashok.yadav@indorama-ind.com 591Z4982R19662VH


ca harnyag.bhardwaj@indorama-ind.com 304Y6186S76418WD


ca brijb.shukla@indorama-ind.com 725K5008O70827JF


to create all users hit below command login as zimbra user

# su – zimbra

$ zmprov < user.txt

Note: We want user must change there password after first login for that make new file with the entry like below and the hit the below command (file is in same directory with name passmustchg.txt

ma atul.saxena@indorama-ind.com zimbraPasswordMustChange TRUE


ma ashok.yadav@indorama-ind.com zimbraPasswordMustChange TRUE

$ zmprov < passmustchg.txt


Setup the password policy

Password policy is based on COS (Class of Service ) as all the created users were in default COS we can update the policy, screenshot is below for the same.

1: login to admin account ( https://192.128.91.12:7071 ) user admin and the password

Will have below screen

[[Image:]]

Click on configure will have below screen


[[Image:]]

Click on default will have below

[[Image:]]Now Click on Advance will have below:

[[Image:]]


Modify the policy as per the requirement, hero “0” represents the unlimited count.

15th July 15

Customization

Restricting users to send mails to certain domains[edit]

$ vim /opt/zimbra/conf/zmconfigd/smtpd_recipient_restrictions.cf

check_sender_access lmdb:/opt/zimbra/postfix/conf/restricted_senders

Note: This line should be added after the reject_non_fqdn_recipient lineNote: ZCS 8.5 and later use lmdb databases, not hash databases

$ vim /opt/zimbra/conf/zmconfigd.cf

Find the section labeled SECTION mta and enter the following two lines directly below

POSTCONF smtpd_restriction_classes local_only

POSTCONF local_only FILE postfix_check_recipient_access.cf

$ touch /opt/zimbra/conf/postfix_check_recipient_access.cf


$ vim /opt/zimbra/conf/postfix_check_recipient_access.cf

check_recipient_access lmdb:/opt/zimbra/postfix/conf/local_domains, reject

$ touch /opt/zimbra/postfix/conf/restricted_senders # list all the users we want to restrict

vim /opt/zimbra/postfix/conf/restricted_senders

tetra_test@indorama-ind.com local_only

$ touch /opt/zimbra/postfix/conf/local_domains # list all the domains where "restricted users" allowed to sent mails.

vim /opt/zimbra/postfix/conf/local_domains

indorama-ind.com OK

tetrain.com OK

$ postmap /opt/zimbra/postfix/conf/restricted_senders

$ postmap /opt/zimbra/postfix/conf/local_domains

$ zmmtactl stop

$ zmmtactl start

Important Note if you need to undo this configuration[edit]

Remove the two lines that were added to the zmmta.cf file. Make sure the Postfix setting smtpd_restriction_classes has nothing set.

postconf -e smtpd_restriction_classes=' '

zmmtactl reload

reference: https://wiki.zimbra.com/wiki/Restrict_users_to_certain_domain


Restricting users to send mail on DL

$ zmprov modifyConfig zimbraMilterServerEnabled TRUE

$ zmmilterctl start

$ zmmilterctl status

Assigning Rights to Distribution[edit]

$ zmprov grr dl forexdailyreport.del@indorama-ind.com usr tetra_test@indorama-ind.com sendToDistList

$ zmmtactl reload

Removing Rights to Users for any Distribution List[edit]

Modifying and revoking grants

If you want to remove or modify permissions, you'll need to use 'zmprov rvr' instead of 'zmprov grr'.

Example of removing sendToDistList permissions for a user:

$ zmprov rvr dl distributionlist@domain.com usr user@domain.com sendToDistList

$ zmmtactl reload


All User Mail Box quota Defined 209715200 (200 MB )

$ zmprov ma atul.saxena@indorama-ind.com zimbraMailQuota 209715200


$ zmprov ma ashok.yadav@indorama-ind.com zimbraMailQuota 209715200

.

[[Image:]].

Mobile User Configuration

1: Go to Add account on your mobile device.


[[Image:]]2: Click on Email.


3: Click On other (pop3/imap)

[[Image:]]


[[Image:]]


4: Enter The Account Information

[[Image:]]


[[Image:]]


5: Select POP

[[Image:]]


[[Image:]] 6: Provide the Information As shown

7: Provide the Smtp information as shown


Congratulation !!! Account Configured

Smtp Realy

Smtp Address: smtp.qlc.co.in

user: irsl-smtpt@indorama-ind.com

pass: Indo@1234

$ zmprov ms indorama-ind.com zimbraMtaRelayHost smtp.qlc.co.in

$ zmprov ms indorama-ind.com zimbraMtaSmtpSaslAuthEnable yes

$ vim /opt/zimbra/conf/relay_password # have the above user detail entry

$ postmap /opt/zimbra/conf/relay_password

$ zmprov ms indorama-ind.com zimbraMtaSmtpSaslPasswordMaps lmdb:/opt/zimbra/conf/relay_password

$ postfix reload

To activate the license

$ zmlicense -i /tmp/ZCSLicense.xml

$ zmlicense -A /tmp/vdghu65abcv02j0akdtmpkn773-activation.xml

$ zmlicense -p # this will show the lisence status

Retrieved from "https://wiki.tetrain.com/index.php?title=Indorama_Mail_Server_Arch&oldid=2022"