Qmail-Ldap installation2 + dovecot
Qmail-LDAP installation on RedHat and CentOS v5.x.x
Ensure rpmforge and epel repos are enabled.
Switch off SELinux.
Flush Iptables rules
Create directory for downloading required packages:
mkdir /downloads cd /downloads
Download all required packages for qmail-ldap installation:
wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz wget http://cr.yp.to/software/qmail-1.03.tar.gz wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz wget http://www.qmailrocks.org/downloads/patches/ucspi-tcp-0.88.errno.patch wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/daemontools-0.76.errno.patch wget http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz wget http://lifewithqmail.org/inst_check wget https://sourceforge.net/projects/courier/files/maildrop/2.5.4/maildrop-2.5.4.tar.bz2/download --no-check-certificate
wget http://prdownloads.sourceforge.net/qmail-scanner/qmail-scanner-2.08.tgz?download wget http://www.qmailrocks.org/downloads/scripts/finalize/qmailctl
wget http://sourceforge.net/projects/phpldapadmin/files/latest/download wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm
Extract packages:
tar -xvzf qmailrocks.tar.gz tar -xvzf phpldapadmin-1.2.2.tgz tar -xvzf squirrelmail-webmail-1.4.22.tar.gz tar -xvjf maildrop-2.5.4.tar.bz2 tar -xvzf qmail-scanner-2.08.tgz tar -xvzf qmailrocks/autorespond-2.0.5.tar.gz
Install all required packages before qmail-ldap installation:
yum install vim-enhanced httpd php* php-ldap perl gcc* gcc-c++ gcc44*openssl openssl-devel kernel-headers openssl-devel kernel-headers patch pcre* db4* openldap* glibc* zlib* glib* gdbm* php
Create initial qmail directories:
mkdir -p /var/qmail mkdir /usr/src/qmail
Creating all needed users and groups:
groupadd nofiles
useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p'*' alias useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaild useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmaill useradd -g nofiles -d /var/qmail -s /sbin/nologin -p'*' qmailp
groupadd qmail
useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailq useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmailr useradd -g qmail -d /var/qmail -s /sbin/nologin -p'*' qmails
groupadd vmail
useradd -g vmail -s /bin/true vmail
Unpack qmail and apply the qmail-ldap patch:
cd /usr/src/qmail tar -xvzf /downloads/qmail-1.03.tar.gz gunzip /downloads/qmail-ldap-1.03-20060201.patch.gz cd qmail-1.03 patch -p1 < /downloads/qmail-ldap-1.03-20060201.patch
Make changes on "Makefile" to qmail work properly with ldap:
LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS-DQMQP_COMPRESS -DSMTPEXECCHECK -DALTQUEUE -DBIGBROTHER # ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS ZLIB=-lz # to enable the auto-maildir-make feature MDIRMAKE=-DAUTOMAILDIRMAKE # to enable the auto-homedir-make feature HDIRMAKE=-DAUTOHOMEDIRMAKE # on most systems we need this to make auth_pop and auth_imap SHADOWLIBS=-lcrypt # to enable the possibility to log and debug imap and pop DEBUG=-DDEBUG
After that, setup qmail
make man make setup check
Creating qmail control files:
cd /var/qmail/control echo 100 > concurrencyincoming echo 255 > concurrencyremote echo ./Maildir/ > defaultdelivery echo 10000 > defaultquotacount echo 10000000 > defaultquotasize echo /var/qmail/bin/dirmaker > dirmaker echo 0 > ldapcluster id -g vmail > ldapgid echo /home/vmail > ldapmessagestore echo qmailUser > ldapobjectclass echo secret > ldappassword echo 127.0.0.1 > ldapserver id -u vmail > ldapuid echo 80000000 > qmail-smtpd-softlimit echo 80000000 > qmail-pop3d-softlimit echo 3 > qmail-pop3d-loglevel echo 3 > qmail-start-loglevel echo MYDOMAIN.com > defaultdomain echo dc=MYDOMAIN,dc=com > ldapbasedn echo cn=manager,dc=MYDOMAIN,dc=com > ldaplogin echo mail.MYDOMAIN.com > me echo MYDOMAIN.com > rcpthosts ln -s rcpthosts locals
Unpacking ucspi-tcpi and apply the error patch:
cd /usr/src/qmail tar -xvzf /downloads/ucspi-tcp-0.88.tar.gz cd ucspi-tcp-0.88 patch < /downloads/ucspi-tcp-0.88.errno.patch
make && make setup check
Unpacking daemontools and apply daemontools-error patch:
mkdir -p /package chmod 1755 /package cd /package tar -xvzf /downloads/daemontools-0.76.tar.gz cd /package/admin/daemontools-0.76/src patch < /downloads/daemontools-0.76.errno.patch cd /package/admin/daemontools-0.76 package/install
Optional
# /command/svscanboot & #
# chmod 755 /etc/rc.local #
Creating the supervise script directories:
mkdir /var/qmail/supervise cd /var/qmail/supervise mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log chmod +t qmail-smtpd qmail-send qmail-pop3d
Creating qmail-smtpd run supervise script:
vim qmail-smtpd/run
#!/bin/sh
QUID=`id -u qmaild`
QGID=`id -g qmaild`
MAXD=`head -1 /var/qmail/control/concurrencyincoming`
HOST=`head -1 /var/qmail/control/me`
SOFT=`head -1 /var/qmail/control/qmail-smtpd-softlimit`
CDBF="/etc/tcp.smtp.cdb"
if [ -z "$QUID" -o -z "$QGID" -o -z "$MAXD" -o -z "$HOST" ]; then
echo QUID, QGID, MAXD, or HOST is unset in
echo /var/qmail/supervise/qmail-smtpd/run
exit 1
fi
exec /usr/local/bin/softlimit -m $SOFT \
/usr/local/bin/tcpserver -v \
-H \
-R \
-l $HOST \
-x $CDBF \
-c $MAXD \
-u $QUID \
-g $QGID \
0 \
smtp \
/var/qmail/bin/qmail-smtpd \
/var/qmail/bin/auth_smtp /usr/bin/true 2>&1
Creating qmail-smtpd log run supervise script:
vim qmail-smtpd/log/run
#!/bin/sh export PATH=/var/qmail/bin:/usr/local/bin:/usr/bin:/bin exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-smtpd 2>&1
Creating qmail rc supervise script:
vim /var/qmail/rc
#!/bin/sh QLOG="`cat /var/qmail/control/qmail-start-loglevel`" DEFD="`cat /var/qmail/control/defaultdelivery`" exec env - PATH="/var/qmail/bin:$PATH" LOGLEVEL="$QLOG" qmail-start "$DEFD"
Creating qmail-send run supervise script:
vim qmail-send/run
#!/bin/sh exec /var/qmail/rc
Creating qmail-send log run supervise script:
vim qmail-send/log/run
#!/bin/sh exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-send 2>&1
Creating qmail-pop3d run supervise script:
vim qmail-pop3d/run
#!/bin/sh
IP=`head -1 /var/qmail/control/me`
LL=`head -1 /var/qmail/control/qmail-pop3d-loglevel`
SL=`head -1 /var/qmail/control/qmail-pop3d-softlimit`
exec
\
env LOGLEVEL=$LL
\
softlimit -m $SL
\
/usr/local/bin/tcpserver -v -R -H -l 0 0 pop3
\
/var/qmail/bin/qmail-popup $IP
\
/var/qmail/bin/tcp-env
\
/var/qmail/bin/auth_pop
\
/var/qmail/bin/qmail-pop3d Maildir 2>&1
Creating qmail-pop3d log run supervise script:
vim qmail-pop3d/log/run
#!/bin/sh exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n20 /var/log/qmail/qmail-pop3d 2>&1
Creating auto directory maker script:
vim /var/qmail/bin/dirmaker
#!/bin/sh echo '----------------------------------------------' >> /tmp/dirmaker date >> /tmp/dirmaker echo $1 >> /tmp/dirmaker id >> /tmp/dirmaker mkdir --parents -m 700 -p $1/Maildir mkdir --parents -m 700 -p $1/Maildir/tmp mkdir --parents -m 700 -p $1/Maildir/cur mkdir --parents -m 700 -p $1/Maildir/new chown -R vmail:vmail $1
Set permissions of all qmail supervise run scripts:
chmod 755 qmail-pop3d/run qmail-smtpd/run qmail-send/run chmod 755 qmail-pop3d/log/run qmail-smtpd/log/run qmail-send/log/run chmod 755 /var/qmail/rc /var/qmail/bin/dirmaker
Create tcp.smtp file to appy tcprules:
vim /etc/tcp.smtp
127.:allow,RELAYCLIENT="",MAXRCPTCOUNT="200" 192.168.:allow,BLOCKRELAYPROBE="",RCPTCHECK="",SENDERCHECK="",AUTHPREPEND="Authenticated user:",SANITYCHECK="",SMTPAUTH="",LOGLEVEL="3",AUTHREQUIRED="",MAXRCPTCOUNT="100" :allow,BLOCKRELAYPROBE="",RCPTCHECK="",SANITYCHECK="",RETURNMXCHECK="STRICT",RBL="",REJECTEXEC="",LOGLEVEL="3",TARPITCOUNT="10",TARPITDELAY="10",SMTPAUTH="",MAXRCPTCOUNT="25"
Creating qmail logging directories and set permissions:
mkdir /var/log/qmail cd /var/log/qmail mkdir qmail-send qmail-smtpd qmail-pop3d chown -R qmaill:root /var/log/qmail chmod -R 750 /var/log/qmail
Creating qmail alias users, links and set permissions:
cd /var/qmail cp -p /downloads/qmailctl /var/qmail/bin/. chmod 755 /var/qmail/bin/qmailctl ln -s /var/qmail/bin/qmailctl /usr/bin/ qmailctl cdb mkdir -p /service cd /service/ ln -s /var/qmail/supervise/qmail-* . echo admin@prime-pci.com > /var/qmail/alias/.qmail-root echo admin@prime-pci.com > /var/qmail/alias/.qmail-postmaster echo admin@prime-pci.com > /var/qmail/alias/.qmail-mailer-daemon ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous chmod 644 /var/qmail/alias/.qmail*
Stop sendmail and remove all related files:
/etc/init.d/sendmail stop
chkconfig sendmail off
mv /usr/lib/sendmail /usr/lib/sendmail.org
mv /usr/sbin/sendmail /usr/sbin/sendmail.org
ln -s /var/qmail/bin/sendmail /usr/lib/sendmail
ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail
Configure OpenLDAP:
cd /etc/openldap cp /usr/src/qmail/qmail-1.03/qmail.schema schema/. cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
vim /etc/openldap/slapd.conf
include /etc/openldap/schema/qmail.schema
database bdb
suffix "dc=prime-pci,dc=com"
rootdn "cn=Manager,dc=prime-pci,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw secret
# rootpw {crypt}ijFYNcSNctBYg
rootpw secret
vim /etc/openldap/ldap.conf
HOST 127.0.0.1 BASE dc=prime-pci,dc=com
/etc/init.d/ldap restart
Create Domain.ldif file for Base and OU:
mkdir -p /downloads/ldap_ldif cd /downloads/ldap_ldif
vim domain.ldif
# base dn dn: dc=prime-pci,dc=com objectClass: dcObject objectClass: organization o: prime-pci dc: prime-pci # ou, prime-pci.com dn: ou=prime-pci.com,dc=prime-pci,dc=com objectClass: top objectClass: organizationalUnit ou: prime-pci.com
vim admin.ldif [password=postmaster]
# admin, prime-pci.com dn: uid=admin,ou=prime-pci.com,dc=prime-pci,dc=com objectClass: top objectClass: inetOrgPerson objectClass: qmailUser cn: admin admin sn: admin admin mail: admin@prime-pci.com accountStatus: active mailMessageStore: prime-pci.com/admin uid: admin mailHost: node1.prime-pci.com deliveryMode: noforward userPassword:: e0NSWVBUfU9XY3dPTS9IekVBT2s=
Add domain and admin user's data on LDAP
ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f domain.ldif ldapadd -x -D "cn=manager,dc=prime-pci,dc=com" -w secret -f admin.ldif
Dovecot installation
cd /root/downloads/shashankQmail
tar xvzf dovecot-2.0.14.tar.gz
cd dovecot-2.0.14
./configure --without-shadow --without-pam --without-bsdauth --without-gssapi --without-sia --without-vpopmail \ --without-sql --without-pgsql --without-mysql --without-sqlite \ --with-ssl=openssl --with-libwrap --with-ldap --without-shadow --prefix=/usr
make && make install
useradd -d /nonexistent -s /bin/false -c 'Dovecot user' dovecot
mkdir -p /etc/ssl/private/
mkdir -p /etc/ssl/certs/
cp -pv /usr/share/doc/dovecot/example-config/dovecot.conf /usr/etc/dovecot/dovecot.conf
cp -pv /usr/share/doc/dovecot/example-config/dovecot-ldap.conf.ext /usr/etc/dovecot/dovecot-ldap.conf
ln -s /usr/etc/dovecot/dovecot-ldap.conf /usr/etc/dovecot/dovecot-ldap-userdb.conf
Update slapd.conf by placing this line 'by:
dn="uid=dovecot,ou=mail,dc=example2,dc=com" read' below 'access to attrs=userPassword'.
Eg:
access to * by dn="uid=admin,ou=mail,dc=example2,dc=com" write
by * read
access to attrs=userPassword
by dn="uid=dovecot,ou=mail,dc=example2,dc=com" read
by dn="uid=admin,ou=mail,dc=example2,dc=com" write
by anonymous auth
Example dovecot-ldap.conf file (You can copy+paste it):
hosts = localhost dn = uid=dovecot,ou=mail,dc=example2,dc=com dnpass = asdf1234 auth_bind = no ldap_version = 3 base = dc=example2,dc=com scope = subtree user_attrs = mailMessageStore=home user_filter = (&(objectClass=qmailUser)(uid=%u)) pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=qmailUser)(uid=%u)(!(accountStatus=disabled))(!(accountStatus=noaccess))) default_pass_scheme = SSHA
Example dovecot.conf file (You can copy+paste it):
auth_verbose = yes
debug_log_path = /var/log/dovecot-debug.log
default_login_user = dovecot
first_valid_uid = 89
info_log_path = /var/log/dovecot-info.log
last_valid_uid = 2000
log_path = /var/log/dovecot
login_greeting = Shashank's custom qmail!
mail_gid = vmail
mail_location = maildir:~/Maildir
mail_uid = vmail
namespace {
inbox = yes
location = maildir:~/Maildir
prefix = INBOX.
separator = .
}
passdb {
args = /usr/etc/dovecot/dovecot-ldap.conf
driver = ldap
}
protocols = imap
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
args = /usr/etc/dovecot/dovecot-ldap-userdb.conf
driver = ldap
}
verbose_proctitle = yes
verbose_ssl = yes
protocol lda {
postmaster_address = admin@example2.com
}
Now simply type 'dovecot' at the terminal to start.
'dovecot stop' stops it. 'dovecot -n' checks config file.
Install autoresponder and maildrop:
cd /downloads/autorespond-2.0.5/ make && make install cd /downloads/maildrop-2.5.4 ./configure --prefix=/usr/local --exec-prefix=/usr/local --enable-maildrop-uid=root make && make install-strip && make install-man
Reload tcp.smtp rules
Unpack Phpldapadmin and configure to access from Web:
mv /downloads/phpldapadmin-1.2.2 /var/www/html/phpldapadmin cd /var/www/html/phpldapadmin mkdir templates/creation.old templates/modification.old mv templates/creation/* templates/creation.old/ mv templates/modification/* templates/modification.old/
Increase PHP memory limit:
vim /etc/php.ini
memory_limit = 128M
Unpack Squirrelmail and configure to Web access:
mv /downloads/squirrelmail-webmail-1.4.22 /var/www/html/webmail cd /var/www/html/webmail mkdir attachements chown -R apache:apache attachements chown -R apache:apache data cd config ./conf.pl
Install all required packages for Qmail-Scanner:
yum perl-suidperl perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS perl-Time-HiRes* perl-HTML-Tagset perl-HTML-Parser perl-Pod-Usage* perl-Parse-Syslog perl-Statistics-Distributions spamassassin clamav clamd
Add user "qscand" for scanning:
useradd -c "Qmail-Scanner Account" -s /bin/false -m qscand
Change user clamav to qscand:
vim /etc/logrotate.d/clamav [Change clamav to qscand]
/var/log/clamav/clamd.log {
missingok
notifempty
create 644 qscand qscand
postrotate
killall -HUP clamd 2>/dev/null || :
endscript
}
vim /etc/logrotate.d/freshclam [Change clamav to qscand]
/var/log/clamav/freshclam.log {
missingok
notifempty
create 644 qscand qscand
}
vim /etc/clamd.conf
User qscand
vim /etc/freshclam.conf
DatabaseOwner qscand
chown qscand.qscand /var/log/clamav/ -R chown -R qscand.qscand /var/run/clamav/ /etc/init.d/clamd restart /etc/init.d/spamassassin restart
Install Qmail-Scanner:
cd /downloads/qmail-scanner-2.08 ./configure --admin admin --domain prime-pci.com mkdir -p /var/spool/qscan mkdir -p /var/spool/qscan/quarantine/viruses/tmp /var/spool/qscan/quarantine/viruses/cur /var/spool/qscan/quarantine/viruses/new mkdir -p /var/spool/qscan/quarantine/spam/tmp /var/spool/qscan/quarantine/spam/cur /var/spool/qscan/quarantine/spam/new mkdir -p /var/spool/qscan/quarantine/policy/tmp /var/spool/qscan/quarantine/policy/cur /var/spool/qscan/quarantine/policy/new mkdir -p /var/spool/qscan/working/tmp /var/spool/qscan/working/cur /var/spool/qscan/working/new mkdir -p /var/spool/qscan/archive/tmp /var/spool/qscan/archive/cur /var/spool/qscan/archive/new cp /downloads/qmail-scanner-2.08/quarantine-events.txt /var/spool/qscan/ chown -R qscand:qscand /var/spool/qscan/ cp -pv /downloads/qmail-scanner-2.08/qmail-scanner-queue.pl /var/qmail/bin/ chown qscand.qscand /var/qmail/bin/qmail-scanner-queue.pl chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl /var/qmail/bin/qmail-scanner-queue.pl -z /var/qmail/bin/qmail-scanner-queue.pl -g cp -v /downloads/qmail-scanner-2.08/contrib/logrotate.qmail-scanner /etc/logrotate.d/qmail-scanner /etc/init.d/syslog restart
Integrate Qmail-scanner with qmail queue:
vim /var/qmail/supervise/qmail-smtpd/run
QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE
Check Qmail-scanner Installation:
su - tetra /var/qmail/bin/qmail-scanner-queue.pl -g /root/downloads/qmail-scanner-2.08/contrib/test_installation.sh -doit ###[ This step generate 2 spam mails and send to the admin e-mail account]###
LDAP address book settings on Thunderbird:
Name: LDAP Address Book Hostname: node1.prime-pci.com Base DN: ou=prime-pci.com,dc=prime-pci,dc=com Port Number: 389