ispman/docs/contrib amavisdnew-with-ispman-howto.html,NONE,1.1 ispman-debian-howto.html,NONE,1.1 perdition-ispman.html,NONE,1.1
Joerg Delker <[email protected]>
| Newsgroups | gmane.comp.isp.ispman.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /cvsroot/ispman/ispman/docs/contrib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv27051 Added Files: amavisdnew-with-ispman-howto.html ispman-debian-howto.html perdition-ispman.html Log Message: added some contrib docs --- NEW FILE: amavisdnew-with-ispman-howto.html --- <html><head><title>amavisd-new with ISPMan Howto</title> <h1>amavisd-new with ISPMan Howto</A> Adapted from README.postfix for ISPMAN .97 on Debian 3.0/Stable by [email protected] Author of README.postfix: Mark Martinec <[email protected]> <p> Using Amavisd on an ISPMan mail server installation --- <p> 1. If you're using Debian Stable 3.0, amavisd isn't in the stable branch. You can work around this in either of these ways: (I used option A, probably out of habit). if you're using some other distribution get amavisd-new installed either from source or some packages for your distro. <p> A) Visit <a href="http://packages.debian.org">http://packages.debian.org</a> and download the needed packages and dependencies <BR> Put all the deb files on the server <BR> LIST OF FILES: <a href="http://packages.debian.org/testing/mail/amavisd-new.html">http://packages.debian.org/testing/mail/amavisd-new.html</a> <BR> 'dpkg -i' install them, if you get stuck 'dpkg -r' the package and try again. <p> B) Edit /etc/apt/sources.list and add a testing source (this will update libc6 and a bunch of stuff) "apt-get update;apt-get install amavisd-new spamassassin clamav-daemon" when done, remove the testing source. <p> I installed spam assassin using dh-make-perl to grab it from CPAN, you're on your own here: apt-get install dh-make-perl dh-make-perl --build --install --cpan Mail::Spamassassin <p> NOTE: DEBUGGING amavisd # su - amavisd (Debian creates this automagically) $ /usr/local/sbin/amavisd debug <BR> LIST OF DEB PACKAGES file libmime-perl libconvert-tnef-perl libconvert-uulib-perl libcompress-zlib-perl libarchive-tar-perl libarchive-zip-perl libmailtools-perl libunix-syslog-perl libnet-perl libnet-server-perl libmime-base64-perl spamassassin clamav clamav-daemon lha arj unrar zoo nomarch cpio lzop </pre> <p> 2) After installation edit amavisd.conf like so: <p> Change these lines <pre> #Use this line if you are doing this for all ISPMan domains read_hash(\%local_domains, '/etc/postfix/local_domains'); #If you want people to know they got sent a virus, uncomment this #NOT A GOOD IDEA DURING A MICROSOFT VIRUS STORM #$warnvirusrecip = 1; #Make sure these addresses work for your site #or just comment them out $virus_admin = "virusalert\@$mydomain"; $spam_admin = "spamalert\@$mydomain"; $virus_quarantine_to = 'virus-quarantine'; $spam_quarantine_to = 'spam-quarantine'; #Add virus/spam lovers here + quarantine, abuse and trouble ticket addresses $virus_lovers{lc("postmaster\@$mydomain")} = 1; $virus_lovers{lc('[email protected]')} = 1; $virus_lovers{lc('[email protected]')} = 1; $virus_lovers{lc('some.user@')} = 1; # this recipient, regardless of domain $virus_lovers{lc('[email protected]')} = 0; # never, even if domain matches $virus_lovers{lc('example.com')} = 1; # this domain, but not its subdomains $virus_lovers{lc('.example.com')}= 1; # this domain, including its subdomains #or: # @virus_lovers_acl = qw( [email protected] !lab.xxx.com .xxx.com yyy.org ); $bypass_virus_checks{lc('[email protected]')} = 1; @bypass_virus_checks_acl = qw( some.ddd !butnot.example.com .example.com ); @virus_lovers_acl = qw( [email protected] ); $virus_lovers_re = new_RE( qr'(helpdesk|postmaster)@example\.com$'i ); $spam_lovers{lc("postmaster\@$mydomain")} = 1; $spam_lovers{lc('[email protected]')} = 1; $spam_lovers{lc('[email protected]')} = 1; @spam_lovers_acl = qw( !.example.com ); $spam_lovers_re = new_RE( qr'^[email protected]\.com$'i ); </pre> Customize Text in /var/amavis/ with proper notification info (like abuse@ spam@ virus@ addresses) <p> <p> 3) Verify amavisd is listening on a local SMTP port 10024 (default): <pre> --> $ telnet 127.0.0.1 10024 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 [127.0.0.1] ESMTP amavisd-new service ready --> quit 221 Bye Connection closed by foreign host. </pre> <p> <p> 4) Configure spam assassin <pre > Edit /etc/defaults/spamassassin and set ENABLED=1 hup spamassassin (it listens on port 783) </pre> <p> 5) Configure clamav <pre > Nothing to do for Debian, but make sure it is running and schedule virus definition updates </pre> <p> 6) With a text editor add to the Postfix master.cf file the following two entries, e.g. near the end of the file: <pre > (YOU COULD USE LMTP FOR THIS, IF YOUR POSTFIX IS NEW ENOUGH) </pre> <pre> smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=1200 -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - n - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes </pre> Of all the options specified above in the second entry, the one that is essential is the '-o content_filter=' . <p> Check the other (normal) smtp and smtpd postfix services in this file and use the same setting here for the chroot 'y/n'. <p> 7) Do a 'postfix reload', check the log file for any complaints, and verify if it is listening on port 10025. <pre> --> $ telnet 127.0.0.1 10025 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 yourhost.example.com ESMTP Postfix --> quit 221 Bye Connection closed by foreign host. </pre> <p> 8) If you want, simulate a mail sent to amavisd and see if it gets delivered via Postfix to its recipient. Try first with a simple and clean message, then with an EICAR test virus pattern which should be recognized by all virus scanners (unless you have them disabled or not installed): <pre> --> $ telnet 127.0.0.1 10024 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 [127.0.0.1] ESMTP amavisd-new service ready --> MAIL FROM:<[email protected]> 250 2.1.0 Sender [email protected] OK --> RCPT TO:<postmaster> 250 2.1.5 Recipient postmaster OK --> DATA 354 End data with <CR><LF>.<CR><LF> --> Subject: test1 --> --> test1 --> . *** 250 2.6.0 Ok, id=31859-01, from MTA: 250 Ok: queued as 90B7F16F --> MAIL FROM:<[email protected]> 250 2.1.0 Sender [email protected] OK --> RCPT TO:<postmaster> 250 2.1.5 Recipient postmaster OK --> DATA 354 End data with <CR><LF>.<CR><LF> --> Subject: test2 - virus test pattern --> --> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* --> . </pre> <p> you should get one of the following replies, depending on your $final_virus_destiny and *virus_lovers* settings in amavisd.conf: <ul > <ul > <ul > <li> 550 5.7.1 Message content rejected, id=16968-01 - VIRUS: EICAR-AV-Test <li> 250 2.5.0 Ok, but 1 BOUNCE <li> 250 2.7.1 Ok, discarded, id=16984-01 - VIRUS: EICAR-AV-Test <li> 250 2.6.0 Ok, id=17041-01, from MTA: 250 Ok: queued as 3F1841A5F5 </ul> </ul> </ul> <p> --> QUIT 221 2.0.0 [127.0.0.1] (amavisd) closing transmission channel Connection closed by foreign host. <p> You may need/want to use different sender and recipient addresses. The test pattern must be entered exactly, starting at the beginning of the line (without indentation). <p> Depending on the settings in amavisd.conf, the sender ([email protected]) and the virus administrator should have been sent a (non-)delivery status notification, the second message quarantined, and the first message must have been successfully delivered to the recipient. See the log that is scrolling on the terminal (as setup at step 1) and check for possible problems. <p> 9) Tell Postfix to start forwarding all mail it receives to amavisd-new for content inspection. <p> <pre > Add this line to /etc/postfix/main.cf content_filter = smtp-amavis:[127.0.0.1]:10024 </pre> <p> <p> 10) Do a 'postfix reload' and watch the logs - both the Postfix logs, and the amavisd log file (on the screen or wherever you have it directed). <p> If you get in trouble, you only need to undo the step 9 and reload postfix. New mail will no longer be tagged with content filter routing. <p> NOTE: the messages that have been received while 'content_filter' was set, will still try to get delivered to your old setting of content_filter, and will wait in the queue until successful or deleted - or until you do: postsuper -r ALL; postfix reload <BR> <BR> <BR> <H3>Mail Flow Overview With Amavisd</H3> Here's an overview of how the mail flow is once amavis is installed: <pre> Postfix (25) -> Amavisd (10024) -> Postfix#2 (10025) -> Cyrus | ^ \ / | Spam Assassin (783) </pre> 1) Mail comes to port 25 (postfix) 2) Postfix sends the mail to amavisd (port 10024) 3) Amavis spam checks and virus checks it (uses Spam Assassin port 783) 4) Amavis tags the message if spam is detected, and passes it BACK to postfix (port 10025) 5) Postfix delivers the mail to Cyrus 6) Cyrus delivers the mail according to sieve rules. </body></html> --- NEW FILE: perdition-ispman.html --- <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=iso-8859-1"> <TITLE></TITLE> <META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.0 (Linux)"> <META NAME="CREATED" CONTENT="20040114;9270900"> <META NAME="CHANGED" CONTENT="20040114;12502300"> <STYLE> <!-- @page { size: 8.5in 11in; margin-left: 1.25in; margin-right: 1.25in; margin-top: 1in; margin-bottom: 1in } P { margin-bottom: 0.08in } H3 { margin-bottom: 0.08in } H3.western { font-family: "Arial", sans-serif } H3.cjk { font-family: "Mincho" } --> </STYLE> </HEAD> <BODY LANG="en-US" DIR="LTR"> <P ALIGN=CENTER STYLE="margin-top: 0.17in; page-break-after: avoid"><FONT FACE="Arial, sans-serif"><FONT SIZE=5><B>Using Perdition With ISPMan</B></FONT></FONT></P> <P ALIGN=CENTER STYLE="margin-bottom: 0in"><B>Updated: January 14, 2004</B></P> <P ALIGN=CENTER STYLE="margin-bottom: 0in"><B>by Tony Wasson (wasson at azxws.com)</B></P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in">As an ISPMan administrator, you'll use Perdition to let users login with user-9IKiO1iGCm/[email protected] or user_domain_com. You can also use it to append a domain name onto a username. You can also use Perdition as a “traffic directory” during email migration, however that is outside the scope of this document. </P> <H3 CLASS="western">Setting Up Perdition</H3> <P STYLE="margin-bottom: 0in">1) If running ISPMan 1.0 or higher, skip this step.. </P> <P STYLE="margin-bottom: 0in">Older releases did not support the 2 UIDs (userids) for all users by default. You need to run "ispman.fixUsers" to create both UIDs. You need to make sure all new users have 2 UIDs also, so you can either make “ispman.fixUsers” a cron job . On 0.9.7 you can patch ISPMan to do this for all new users by changing users.ldif.template like so:</P> <P STYLE="margin-top: 0.08in"><FONT SIZE=2><I>After the 1st UID line, add this:</I></FONT></P> <P STYLE="margin-top: 0.08in"><FONT SIZE=2><I>uid: join '@', ($r->param("userid"), $r->param("ispmanDomain"))</I></FONT></P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in">2) Make sure you have access to your LDAP server(s)</P> <P STYLE="margin-bottom: 0in">You may have to edit tcpwrappers (/etc/hosts.allow), iptables/ipchains or other firewall rules depending on your security setup. </P> <OL START=2> <P STYLE="margin-bottom: 0in"></P> </OL> <PRE>ldapsearch -xvu -h 127.0.0.1 -LLL -b "o=ispman" ispmanVar=* </PRE><P STYLE="margin-bottom: 0in"> 3) Verify the LDAP server is reachable, something like this works well</P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in">4) Install perdition</P> <P STYLE="margin-bottom: 0in">You can use packages for your distribution, or compile from source available from: http://www.vergenet.net/linux/perdition/download/</P> <OL START=2> <P STYLE="margin-bottom: 0in"></P> </OL> <PRE>#apt-get install perdition perdition-ldap</PRE><P STYLE="margin-bottom: 0in"> <BR> </P> <P STYLE="margin-bottom: 0in">5) Configure Perdition</P> <OL START=3> <P STYLE="margin-bottom: 0in">Keep in mind that your map_libary file may be in a different location.When you “go live” you should have multiple LDAP servers. As long as they are all on standard ports, set these up on the map_library_opt line. </P> </OL> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in"><B>A basic /etc/perdition/perdition.conf looks like so:</B></P> <PRE> <SPAN STYLE="background: #b3b3b3">map_library /usr/lib/libperditiondb_ldap.so.0</SPAN> <SPAN STYLE="background: #b3b3b3">map_library_opt "ldap://127.0.0.1/o=ispman?mailroutingaddress?sub?(uid=%25s)"</SPAN> <SPAN STYLE="background: #b3b3b3">server_ok_line</SPAN> <SPAN STYLE="background: #b3b3b3">username_from_database</SPAN> </PRE><P STYLE="margin-bottom: 0in"> <B>A single domain setup config file will probably look more like </B> </P> <PRE> <SPAN STYLE="background: #b3b3b3">map_library /usr/lib/libperditiondb_ldap.so.0</SPAN> <SPAN STYLE="background: #b3b3b3"># The following map_library_opt line needs to be on a single line</SPAN> <SPAN STYLE="background: #b3b3b3"># Customize the @azxws.com to match your domain.</SPAN> <SPAN STYLE="background: #b3b3b3">map_library_opt “ldap://127.0.0.1//o=ispman?mailroutingaddress?sub?(uid=%[email protected])"</SPAN> <SPAN STYLE="background: #b3b3b3">server_ok_line</SPAN> <SPAN STYLE="background: #b3b3b3">username_from_database</SPAN></PRE><P STYLE="margin-bottom: 0in"> <BR> </P> <P STYLE="margin-bottom: 0in"><B>A multi-LDAP server config file will probably look more like :</B></P> <PRE> <SPAN STYLE="background: #b3b3b3">map_library /usr/lib/libperditiondb_ldap.so.0</SPAN> <SPAN STYLE="background: #b3b3b3"># The following map_library_opt line needs to be on a single line</SPAN> <SPAN STYLE="background: #b3b3b3">map_library_opt “ldap://127.0.0.1 192.168.2.10 192.168.3.10 \</SPAN> <SPAN STYLE="background: #b3b3b3">/o=ispman?mailroutingaddress?sub?(uid=%25s)"</SPAN> <SPAN STYLE="background: #b3b3b3">server_ok_line</SPAN> <SPAN STYLE="background: #b3b3b3">username_from_database</SPAN> </PRE><P STYLE="margin-bottom: 0in"> 6) Make sure Perdition starts on bootup and start it manually now</P> <PRE>/etc/init.d/perdition start</PRE><P STYLE="margin-bottom: 0in"> <BR> </P> <P STYLE="margin-bottom: 0in">7) Verify the account and password are correct by logging in directly</P> <P STYLE="margin-bottom: 0in">against the mail server. I usually do something like this on the mail server:</P> <P STYLE="margin-bottom: 0in"><BR> </P> <PRE> telnet localhost 110 USER user_domain_com PASS thepassword </PRE><P STYLE="margin-bottom: 0in"> Then I repeat these steps using my new Perdition proxy. If it fails, check the logs (perdition uses syslog). You may also use a system debugger (like strace) and a network sniffer to verify LDAP is functioning. I have also had good success setting an outgoing_server in perdition.conf as a debugging measure</P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in">Once you have underscore names working, use the user-9IKiO1iGCm/[email protected] name through Perdition. Voila! It works...</P> <OL START=4> <P STYLE="margin-bottom: 0in"></P> </OL> <P STYLE="margin-bottom: 0in">On a side note, you'll most likely want to setup postfix to do SMTP authentication. It's pretty easy to get PLAIN and LOGIN working. If you want other mechanisms, you'll need to work harder. Remember, since there are two UIDs, either user-9IKiO1iGCm/[email protected] and user_domain_com works.</P> <P STYLE="margin-bottom: 0in"><BR> </P> <H3 CLASS="western">FAQ:</H3> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in"><B>Q: I got this error: perdition[10905]: dlopen of "/usr/lib/libperditiondb_ldap.so.0" failed, what should I check?</B></P> <P STYLE="margin-bottom: 0in">A: This is usually a configuration problem. First verify that your map_library_opt line is correct and has no word wrap. Next check your config file like so:</P> <PRE>grep -v '^#' /etc/perdition/perdition.conf</PRE><P STYLE="margin-bottom: 0in"> <BR> </P> <P STYLE="margin-bottom: 0in"><BR> </P> <PRE></PRE><H3 CLASS="western"> <B>Single Server Perdition Tric</B>k</H3> <P STYLE="margin-bottom: 0in; border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">If you have a small installation and want this on the same machine as Cyrus 2.1, you can set it up like so perdition listens on the outside IP and Cyrus listens on localhost. Note that you will need to make sure any webmail programs point to the external IP address so that users can login with their email address as their username.</SPAN></FONT></P> <P STYLE="margin-bottom: 0in; border: none; padding: 0in"><BR> </P> <P STYLE="margin-bottom: 0in; border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">In /etc/cyrus.conf edit these two lines and restart cyrus:</SPAN></FONT></P> <PRE STYLE="border: none; padding: 0in"> <FONT COLOR="#000000"><SPAN STYLE="background: transparent">imap cmd="imapd -U 30" listen="localhost:imap" prefork=0 maxchild=100</SPAN></FONT> <FONT COLOR="#000000"><SPAN STYLE="background: transparent">pop3 cmd="pop3d -U 30" listen="localhost:pop3" prefork=0 maxchild=50</SPAN></FONT> </PRE><P STYLE="margin-bottom: 0in; border: none; padding: 0in"> <FONT COLOR="#000000"><SPAN STYLE="background: transparent">In /etc/perdition/perdition.conf add these lines and restart perdition:</SPAN></FONT></P> <PRE STYLE="border: none; padding: 0in"> <FONT COLOR="#000000"><SPAN STYLE="background: transparent">bind_address XXX.XXX.XXX.XXX <--- Must be outside IP</SPAN></FONT> <FONT COLOR="#000000"><SPAN STYLE="background: transparent">outgoing_server 127.0.0.1</SPAN></FONT> </PRE><P STYLE="margin-bottom: 0in; border: none; padding: 0in"> <FONT COLOR="#000000"><SPAN STYLE="background: transparent">Ensure that your hostname resolves to 127.0.0.1. </SPAN></FONT> </P> <P STYLE="margin-bottom: 0in; border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">This prevents Perdition from connecting back to itself in a loop.</SPAN></FONT></P> <P STYLE="margin-bottom: 0in; border: none; padding: 0in"><BR> </P> <PRE STYLE="border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">NOTE: I've also seen people setup cyrus to listen on alternate pop and imap ports. This can work too, the choice is up to you.</SPAN></FONT> </PRE><H3 CLASS="western"> For More Information:</H3> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in">1) Read the Perdition man pages.</P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in">2) Visit the Perdition website</P> <P STYLE="margin-bottom: 0in"><A HREF="http://www.vergenet.net/linux/perdition/">http://www.vergenet.net/linux/perdition/</A></P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in">3) Read Configuring Perdition Proxy Software to Use an Existing LDAP Server</P> <P STYLE="margin-bottom: 0in"><A HREF="http://www.vergenet.net/linux/perdition/docs/perdition_ldap.pdf">http://www.vergenet.net/linux/perdition/docs/perdition_ldap.pdf</A></P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in"><BR> </P> <P STYLE="margin-bottom: 0in"><BR> </P> </BODY> </HTML> --- NEW FILE: ispman-debian-howto.html --- <HTML> <TITLE> Running ISPMAN on Debian 3.0 Full Install Guide </TITLE> <BODY> Running ISPMAN on Debian 3.0 Full Install Guide <PRE> Overview of the process: A) Configure and install ISPMAN, populate LDAP for a first time install B) Log into the ISPMAN web interface, then finish configuring ISPMAN C) Setup ISPMAN agents with a /etc/init.d/ispman-agent startup script D) Configure each application to work with the ISPMAN agent or the LDAP information Preinstallation checklist: apt-get install libdigest-md5-perl cvs slapd Directory initialization method: auto Directory suffix style: custom Enter your suffix: o=ispman Passwd: xxxxxx <-- needs to match LDAP password during compile Replicate to another LDAP server: No ISPMAN Primary Server Setup Notes: 1. creat a user called ispman 2. "chown ispman /opt" and "cd /opt" 3. login as ispman and download the latest ispman-someversion.tar.gz to /opt 4. tar zxf ispman-someversion.tar.gz 5. cd ispman-someversion 6. cvs -z3 update -dP 7. ./configure Accepted all defaults except: Domain is azxws.com LDAP directory is /etc/ldap set ldap password set cyrus password 8. "make ispman" FIRST TIME INSTALL ONLY (EMPTY LDAP TREE) NOTE: This will WIPE out an existing ispman installation. A. AS ROOT: cp /opt/ispman-someversion/tmp/conf/slapd.conf /etc/ldap/slapd.conf B. AS ROOT: cp /opt/ispman-someversion/tmp/conf/schema/* /etc/ldap/schema/ C. /etc/init.d/slapd restart D. make ldif_install 9. make install_ispman_common 10. make install_ispman_web 11. Setup ispman web access: A. AS ROOT: apt-get install apache apache-ssl B. Modify /etc/apache-ssl/httpd.conf with Include /etc/ispman/apache.conf C. Create the file /etc/ispman/apache.conf like so: /----- /etc/ispman/apache.conf --- Alias /ispman /opt/ispman/htdocs <Directory /opt/ispman/htdocs> Options ExecCGI AddHandler cgi-script .cgi DirectoryIndex index.html index.cgi AllowOverride None </Directory> \------ end apache.conf -------- D. /etc/init.d/apache-ssl restart You should now be able to access ISPMAN at https://ip.add.re.ss/ispman/ If unable to access the website, check /var/log/apache_ssl/error_log and fix it.. ----ISPMAN Web Configuration -- Login using the name ispman with the LDAP password entered above. Click Configuration, make sure to setup hosts and host groups. ISPMAN - Apache Configuration Apache stop command - /etc/init.d/apache stop Webalizer command - /usr/bin/webalizer Apache vhost file - /etc/apache/vhosts.conf (Must add "Include /etc/apache/vhosts.conf" to apache's httpd.conf) Apache start command - /etc/init.d/apache start Apache graceful reload command - /etc/init.d/apache reload Default vhost IP -- * (Allows it to work on any machine) Apache reload command - /etc/init.d/apache reload ISPMAN - Mail Configuration IMAP server - cyrus Server Maps command - /usr/sbin/postmap SMTP reload command - /etc/init.d/postfix reload Map files directory - /etc/postfix Mailbox Prefix - user. DNS Config: Named Start Command - /etc/init.d/bind start Primary DNS (name) - ns1.domain.com ISPMan's DNS data directory - ispman/ Primary Mail Server (name) - mail.domain.com Named data directory - /var/named Secondary Mail Server (IP) - xxx.xxx.xxx DNS Backend - bind8 Secondary DNS (IP) - xxx.xxx.xxx.xxx Reverse Zone directory - rev/ Header file for named.conf - /opt/ispman/templates/named.conf.header Named Reload Command - /etc/init.d/bind reload Footer file for named.conf - /opt/ispman/templates/named.conf.footer Named Stop Command - /etc/init.d/bind stop Secondary Zone directory - sec/ Named Config File - /etc/named.ispman.conf Primary DNS (IP) - xxx.xxx.xxx.xxx Secondary Mail Server (name) - mail2.domain.com Secondary DNS (name) - ns2.domain.com Primary Mail Server (IP) - xxx.xxx.xxx.xxx Catch all CNAME - none Primary Zone directory - pri/ Hostmaster's email address - hostmaster.domain.com Named User - root Set up additional users if desired. --ISPMAN-AGENT--- 1) apt-get install daemontools-installer, when asked DO make the /service directory 2) mkdir /etc/ispman 3) edit /etc/ispman/run like so: /---- /etc/ispman/run ---- #!/bin/sh exec Starting ispman agent exec /opt/ispman/bin/ispman-agent nodetach \----- end file ----- 4) ln -s /etc/ispman /service/ 5) ln -s /opt/ispman/var/ /var/log/ispman/ 6) edit /etc/init.d/ispman-agent like so: /--------/etc/init.d/ispman-agent---- #!/bin/sh # * svc -h /service/yourdaemon: sends HUP # * svc -t /service/yourdaemon: sends TERM, and automatically restarts the # daemon after it dies # * svc -d /service/yourdaemon: sends TERM, and leaves the service down # * svc -u /service/yourdaemon: brings the service back up # * svc -o /service/yourdaemon: runs the service once daemon="/service/ispman" process="ispman" name="ispman-agent" case "$1" in start) echo -n "Starting $name:" svc -u $daemon echo " started" ps aux | grep $process ;; stop) echo -n "Stopping $name:" svc -d /service/ispman echo " stopped" ps aux | grep $process ;; restart|force-reload) echo -n "Restarting $name:" svc -t $daemon echo " restarted" ;; reload) echo -n "Reloading $name:" svc -h $daemon echo " reloaded" ;; status) echo -"Getting Status... Jobs in queue: " /opt/ispman/bin/ispman.processes -h $HOSTNAME ;; *) echo 'Usage: /etc/init.d/ispman {start|stop|restart|force-reload|reload| status}' exit 1 esac exit 0 \--------/etc/init.d/ispman-agent---- NOTE: I had to edit /opt/ispman/bin/ispman.processes and tell it the ispman/lib path. 7) chmod +x /etc/init.d/ispman-agent 8) /etc/init.d/ispman-agent start tail the logs in /var/log/ispman/ to see whats happening. The biggest problem with agents not completing tasks is that the hostname does not match. Checking the syslog will show what hostname the agent looks for. 9) update-rc.d defaults ispman-agent 99 NOTE: Do above steps sans web configuration stuff for each machine participating in the net. It should also be possible to just copy /opt/ispman sans the htdocs dir to each server. --LDAP setup --- YOU MUST HAVE A NEWLINE AFTER YOUR ENTRIES OR THIS WON'T WORK. This secures LDAP from foreign queries. Feel free to add LDAP ACL and iptable rules too. You need to setup your own replication servers. 1) Edit /etc/hosts.allow adding: slapd: XXX.XXX.XXX.XXX 127.0.0.1 : ALLOW 2) Edit /etc/hosts.deny adding: slapd: ALL : DENY NOTE: test using ldapsearch locally and from a remote machine not in the allowed file. 3) Test it like so (requires ldap-utils package) ldapsearch -xvu -LLL -b "o=ispman" ispmanVar=* --PAM_LDAP setup --- This basically allows any daemon using PAM for authentication to use LDAP. Some programs like Cyrus don't authenticate directly from LDAP without patches. This lets them 'ask' PAM for authentication. PAM then acts as an 'LDAP proxy' finding out authentication information and and returns the answer in an understandable way. 1) make sure libpam-ldap is installed (apt-get install libpam-ldap) make configuration readable/writeable by owner only: Yes Make local root Database admin: No Database requires logging in: No Local crypt to use when changing passwords: crypt 2) Edit /etc/pam_ldap.conf like so: host 127.0.0.1 <--- will differ if the LDAP server is elsewhere. base o=ispman ldap_version 3 pam_password crypt --CYRUS/IMAP/POP3D--- This includes setup guides for Cyrus 1.5 which is in the stable branch and Cyrus2.1 which is official, but is backported. Cyrus 1.5 is easier to setup, but lacks SSL support and sieve mail sorting. The /var/spool/cyrus directory layout of 2.xx is designed for large installations. Authentication depends on different daemons, but thanks to pam support, they both work easily with an ISPMAN LDAP site. CYRUS 2.1 instructions 1) Add these line to /etc/apt/sources.list #Cyrus21 Backports deb http://people.debian.org/~hmh/woody/ hmh/cyrus/ 2) apt-get update 3) apt-get install cyrus21-pop3d cyrus21-common cyrus21-imapd cyrus21-admin cyrus21-admin cyrus21-clients cyrus21-doc gawk libcyrus-imap-perl21 libsasl2 libsnmp-base libsnmp4.2 sasl2-bin libsasl2-modules libsasl2 and sasl2-bin 4) Edit the following lines in /etc/imapd.conf like so: admins: cyrus popminpoll: 0 allowplaintext: yes sasl_minimum_layer: 0 sasl_mech_list: plain login sasl_pwcheck_method: saslauthd lmtp_downcase_rcpt: yes tls_ca_file: /etc/ssl/cyrus.pem tls_cert_file: /etc/ssl/cyrus.pem tls_key_file: /etc/ssl/cyrus.pem 5) Edit /etc/cyrus.conf and allow lmtp localhost, imaps, and pop3s 6) Create SSL key and pem file for cyrus A. openssl req -new -nodes -out req.pem -keyout key.pem B. openssl rsa -in key.pem -out new.key.pem C. openssl x509 -in req.pem -out ca-cert -req \ -signkey new.key.pem -days 999 D. mv new.key.pem /etc/ssl/cyrus.pem E. cat ca-cert >> /etc/ssl/cyrus.pem F. chown cyrus.mail /etc/ssl/cyrus.pem G. chmod 600 /etc/ssl/cyrus.pem 7) Edit /etc/pam.d/imap AND /etc/pam.d/pop like so: auth sufficient pam_ldap.so account sufficient pam_ldap.so 8) Add cyrus to the sasl group (adduser cyrus sasl) 9) Now, configure saslauthd to use PAM mode and startup: Modify /etc/default/saslauthd so that it reads: start=yes MECHANISMS="pam" NOTE: I've seen configs where saslauthd goes straight to LDAP. The example I followed didn't work, so I stuck with pam. YMMV. 10) Restart saslauthd and cyrus /etc/init.d/cyrus21 restart /etc/init.d/saslauthd restart 11) Test the setup by doing this: #cyradm --user cyrus localhost localhost password: <--- compile time cyrus password localhost> lm <-- lm shows installed mailboxes If you don't get a hostname> prompt, check the syslog for errors. Verify LDAP is running. THEN the ultimate: Create a domain and verify connectivity! telnet localhost 110 USER someuser_domain_com PASS password LIST (you should see all mail waiting.) CYRUS 1.5 SETUP 1) edit /etc/imapd.conf, change the two lines listed like so: popminpoll:0 admins: cyrus 2) adduser --system cyrus (may already exist) 3) passwd cyrus (to whatever you set it up as in ./configure) 4) update-alternatives --config pwcheck choose 2 /usr/sbin/pwcheck_pam NOTE: Unless you stop pwcheck before this step, restarting it will leave you with the old pwcheck_standard running. I do a killall pwcheck after this step for good measure. 5) edit /etc/pam.d/cyrus so it says: auth sufficient /lib/security/pam_ldap.so account sufficient /lib/security/pam_ldap.so 6) test it! sample test for cyrus 1.5: #cyradm -u cyrus localhost localhost password: <--- compile time cyrus password localhost> lm <-- lm shows installed mailboxes If you get anything but a hostname> prompt, check the syslog and auth.log for errors. Verify that pwcheck_pam is really running. Permission problems in /var/lib/cyrus or /var/spool/cyrus can 'block' a cyradm session. If you are still stuck, try strace'ing a pwcheck agent and see what it spits out. --BIND 8 SETUP-- 1) apt-get install bind 2) Add this line to /etc/named/named.conf: include "/etc/named.ispman.conf"; NOTE: The ; at the end is critical, if it is dropped, you'll see a syslog error like: /etc/bind/named.conf:67: parse error near <end of file> 3) Then as root: ln -s /etc/bind/ /var/named ISPMAN likes to put stuff in /var/named/ispman/ so we make a symlink 4) Reload bind (/etc/init.d/bind reload) and check the logs, it should be happy. --APACHE NOTES-- 1) apt-get install squirrelmail apache apache-ssl 2) Edit /etc/apache/httpd.conf adding these lines: (change IPs and Server Name) UseCanonicalName Off NameVirtualHost * Include /etc/apache/vhosts.conf < --- this is where the agent adds stuff Include /etc/ispman/apache.conf < --- this should still be in there NOTE: With UseCanonicalName Off the server name comes from the contents of the Host: header in the request. 2) if /etc/apache/vhosts.conf does not exist then (touch /etc/apache/vhosts.conf) 3) /etc/init.d/apache restart Check apache's logs, he should be happy. NOTE: ISPMAN uses an intermediate file in /etc/apache/vhosts.conf.hash file. I've had to edit this file manually when a domain just wouldn't die. --POSTFIX--- NOTE: postfix-snap packages are postfix 2.0 and some config options have changed, this setup is for plain postfix 1) apt-get install postfix-ldap postfix-tls libsasl-modules-plain 2) Edit /etc/pam.d/smtpd like so: auth sufficient pam_ldap.so account sufficient pam_ldap.so 2) mkdir /etc/postfix/sasl and then create /etc/postfix/sasl/smtpd.conf like so: pwcheck_method: pam 3) Edit /etc/postfix/master.cf Make sure smtpd is NOT chrooted -- This lets it do SMTP Auth. WARNING: SMTP Auth is an addon to postfix, it does decrease the overall security. 4) Create TLS cert and key in /etc/postfix A. #openssl req -new -x509 -nodes -out cert.pem B. chown root.postfix *.pem C. chmod 640 *.pem 4) edit /etc/postfix/main.cf like so: mailbox_transport=cyrus mydomain = domain.com myhostname = host.domain.com program_directory = /usr/lib/postfix alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases # NOTE: myorigin MUST match the maildrop hostname in ISPMAN. myorigin = /etc/mailname relayhost = mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all mydestination = $mydomain, $myhostname, localhost.$mydomain, /etc/postfix/destination, hash:/etc/postfix/destination_domains relay_domains = $mydomain, $myhostname, localhost.$mydomain, /etc/postfix/destination, hash:/etc/postfix/relay_domains #canonical_maps = hash:/etc/postfix/canonical virtual_maps = ldap:ldapvirtual default_transport = smtp ldapvirtual_server_host = localhost ldapvirtual_server_port = 389 ldapvirtual_bind_dn = o=ispman ldapvirtual_bind = no ldapvirtual_timeout = ldapvirtual_search_base = o=ispman ldapvirtual_query_filter = (|(mailLocalAddress=%s)(mailAlias=%s)) ldapvirtual_result_attribute = mailRoutingAddress,mailForwardingAddress ldapvirtual_lookup_wildcards = no #relocated_maps = hash:/etc/postfix/relocated #smtpd_sender_restrictions = hash:/etc/postfix/access $transport_maps = hash:/etc/postfix/transport smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) local_destination_concurrency_limit = 2 default_destination_concurrency_limit = 10 debug_peer_level = 2 debugger_command = PATH=/usr/bin:/usr/X11R6/bin # SMTP Auth Stuff see http://killyridols.net/postfixtlssmtpauth.shtml smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname smtpd_recipient_restrictions = permit_sasl_authenticated, check_relay_domains #For STARTTLS SMTP smtpd_tls_cert_file = /etc/postfix/cert.pem smtpd_tls_key_file = /etc/postfix/privkey.pem smtpd_use_tls = yes tls_random_source = dev:/dev/urandom tls_daemon_random_source = dev:/dev/urand 5) Test it! telnet localhost 25 If postfix drops the connect, read syslog. Most of my install problems are with SMTP auth settings, try commenting that out and restarting if postfix components are dying. Also ensure that your pam files are correct and that smtpd is not in a chroot environment. LMTP can speed up stuff, but I didn't do this step, yet.... 6) Setup LMTP deliveries (if using cyrus 2.1) # addgroup lmtp # adduser postfix lmtp Fix the socket directory permissions: # dpkg-statoverride --force --update --add \ cyrus lmtp 750 /var/run/cyrus/socket Restart Postfix and Cyrus IMAPd # /etc/init.d/postfix restart # /etc/init.d/cyrus21 restart --PUREFTPD -- Proftpd doesn't support the ISPMAN LDAP space quotas or denied users so we run pure-ftpd-ldap. 1) install purftpd-ldap package, setup to run from inetd A. edit /etc/apt/sources.list adding: deb ftp://ftp.debian.org/debian testing main contrib non-free B. apt-get update C. apt-get install pure-ftpd-ldap libc6 libpam0g libc6-dev locales 2) Edit /etc/pure-ftpd/db/ldap.conf like so: LDAPServer localhost LDAPPort 389 LDAPBaseDN o=ispman LDAPFilter (&(objectClass=posixAccount)(uid=\L) 3) Edit /etc/inetd.conf like so: ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/pure-ftpd -l ldap:/etc/pure- ftpd/db/ldap.conf 4) Create a test domain as per our documentation, make sure to add an FTP user to use below. Be sure to Commit the Session. 5) Restart inetd and test: /etc/init.d/inetd restart ftp localhost USER www.domain.com PASS password NOTE: Logs to syslog, verify that it is checking LDAP NOTE: Search for users like so: ldapsearch -xv -LLL -b "o=ispman" '(&(objectClass=posixAccount)(uid=joe))' </PRE> </HTML> ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com