ispman/docs/contrib amavisdnew-with-ispman-howto.html,NONE,1.1 ispman-debian-howto.html,NONE,1.1 perdition-ispman.html,NONE,1.1

Joerg Delker <[email protected]>
Newsgroups gmane.comp.isp.ispman.cvs
Message-ID <[email protected]>
Update of /cvsroot/ispman/ispman/docs/contrib
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv27051

Added Files:
	amavisdnew-with-ispman-howto.html ispman-debian-howto.html 
	perdition-ispman.html 
Log Message:
added some contrib docs


--- NEW FILE: amavisdnew-with-ispman-howto.html ---
<html><head><title>amavisd-new with ISPMan Howto</title>
<h1>amavisd-new with ISPMan Howto</A>

Adapted from README.postfix for ISPMAN .97 on Debian 3.0/Stable by [email protected]
Author of README.postfix: Mark Martinec &lt;[email protected]&gt;
<p>
Using Amavisd on an ISPMan mail server installation
---
<p>
1. If you're using Debian Stable 3.0, amavisd isn't in the stable branch.
You can work around this in either of these ways: (I used option A, probably
out of habit). if you're using some other distribution get amavisd-new
installed either from source or some packages for your distro. 
<p>
A) Visit <a
href="http://packages.debian.org">http://packages.debian.org</a> and
download the needed packages and dependencies
<BR>     Put all the deb files on the server  
<BR>     LIST OF FILES: <a
href="http://packages.debian.org/testing/mail/amavisd-new.html">http://packages.debian.org/testing/mail/amavisd-new.html</a>
<BR>    'dpkg -i' install them, if you get stuck 'dpkg -r' the package and try
again.


<p>

  B) Edit /etc/apt/sources.list and add a testing source (this will update
libc6 and a bunch of stuff)
    "apt-get update;apt-get install amavisd-new spamassassin clamav-daemon"
     when done, remove the testing source.

<p>
I installed spam assassin using dh-make-perl to grab it from CPAN, you're on
your own here:

  apt-get install dh-make-perl
  dh-make-perl --build --install --cpan Mail::Spamassassin

<p>
NOTE: DEBUGGING amavisd

  # su - amavisd (Debian creates this automagically)
  $ /usr/local/sbin/amavisd debug
<BR>


LIST OF DEB PACKAGES
file libmime-perl libconvert-tnef-perl libconvert-uulib-perl 
libcompress-zlib-perl libarchive-tar-perl libarchive-zip-perl 
libmailtools-perl libunix-syslog-perl libnet-perl 
libnet-server-perl libmime-base64-perl spamassassin clamav 
clamav-daemon lha arj unrar zoo nomarch cpio lzop
</pre>
<p>
2) After installation edit amavisd.conf like so:
<p>
Change these lines
<pre>
#Use this line if you are doing this for all ISPMan domains
read_hash(\%local_domains, '/etc/postfix/local_domains'); 

#If you want people to know they got sent a virus, uncomment this
#NOT A GOOD IDEA DURING A MICROSOFT VIRUS STORM
#$warnvirusrecip = 1;   

#Make sure these addresses work for your site
#or just comment them out
$virus_admin = "virusalert\@$mydomain";
$spam_admin = "spamalert\@$mydomain";
$virus_quarantine_to  = 'virus-quarantine';
$spam_quarantine_to = 'spam-quarantine';

#Add virus/spam lovers here + quarantine, abuse and trouble ticket addresses
 $virus_lovers{lc("postmaster\@$mydomain")} = 1;
 $virus_lovers{lc('[email protected]')} = 1;
 $virus_lovers{lc('[email protected]')} = 1;
 $virus_lovers{lc('some.user@')} = 1;  # this recipient, regardless of
domain
 $virus_lovers{lc('[email protected]')} = 0; # never, even if domain matches  
 $virus_lovers{lc('example.com')} = 1; # this domain, but not its subdomains 
 $virus_lovers{lc('.example.com')}= 1; # this domain, including its
subdomains
#or:
# @virus_lovers_acl = qw( [email protected] !lab.xxx.com .xxx.com yyy.org );

 $bypass_virus_checks{lc('[email protected]')} = 1;
 @bypass_virus_checks_acl = qw( some.ddd !butnot.example.com .example.com );

 @virus_lovers_acl = qw( [email protected] );
 $virus_lovers_re = new_RE( qr'(helpdesk|postmaster)@example\.com$'i );
 $spam_lovers{lc("postmaster\@$mydomain")} = 1;
 $spam_lovers{lc('[email protected]')} = 1;
 $spam_lovers{lc('[email protected]')} = 1;
 @spam_lovers_acl = qw( !.example.com );   
 $spam_lovers_re = new_RE( qr'^[email protected]\.com$'i );

</pre>
Customize Text in /var/amavis/ with proper notification info (like abuse@
spam@ virus@ addresses)
<p>
<p>
3) Verify amavisd is listening on a local SMTP port 10024 (default):
<pre>
--&gt; $ telnet 127.0.0.1 10024
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

220 [127.0.0.1] ESMTP amavisd-new service ready

--&gt; quit

221 Bye
Connection closed by foreign host.

</pre>
<p>
<p>
4) Configure spam assassin
<pre >
  Edit /etc/defaults/spamassassin and set ENABLED=1
  hup spamassassin (it listens on port 783)
</pre>
<p>
5) Configure clamav
<pre >
  Nothing to do for Debian, but make sure it is running and schedule virus
definition updates
</pre>
<p>
6) With a text editor add to the Postfix master.cf file
the following two entries, e.g. near the end of the file:
<pre >

 (YOU COULD USE LMTP FOR THIS, IF YOUR POSTFIX IS NEW ENOUGH)
</pre>
<pre>
smtp-amavis  unix   -    -    n   -    2 smtp
 -o smtp_data_done_timeout=1200
 -o disable_dns_lookups=yes

127.0.0.1:10025  inet  n - n - - smtpd
 -o content_filter=
 -o local_recipient_maps=
 -o relay_recipient_maps=
 -o smtpd_restriction_classes=
 -o smtpd_client_restrictions=
 -o smtpd_helo_restrictions=
 -o smtpd_sender_restrictions=
 -o smtpd_recipient_restrictions=permit_mynetworks,reject
 -o mynetworks=127.0.0.0/8
 -o strict_rfc821_envelopes=yes
</pre>
Of all the options specified above in the second entry, the one
that is essential is the '-o content_filter=' .
<p>
Check the other (normal) smtp and smtpd postfix services in this file
and use the same setting here for the chroot 'y/n'. 
<p>
7) Do a 'postfix reload', check the log file for any complaints,
and verify if it is listening on port 10025. 
<pre>
--&gt; $ telnet 127.0.0.1 10025
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 yourhost.example.com ESMTP Postfix
--&gt; quit
221 Bye
Connection closed by foreign host.

</pre>
<p>
8) If you want, simulate a mail sent to amavisd and see if it gets delivered
via Postfix to its recipient. Try first with a simple and clean message,
then with an EICAR test virus pattern which should be recognized by all
virus scanners (unless you have them disabled or not installed):
<pre>
--&gt; $ telnet 127.0.0.1 10024
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 [127.0.0.1] ESMTP amavisd-new service ready
--&gt; MAIL FROM:&lt;[email protected]&gt;
250 2.1.0 Sender [email protected] OK
--&gt; RCPT TO:&lt;postmaster&gt;
250 2.1.5 Recipient postmaster OK
--&gt; DATA
354 End data with &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;

--&gt; Subject: test1
--&gt;
--&gt; test1
--&gt; .

*** 250 2.6.0 Ok, id=31859-01, from MTA: 250 Ok: queued as 90B7F16F

--&gt; MAIL FROM:&lt;[email protected]&gt;
250 2.1.0 Sender [email protected] OK
--&gt; RCPT TO:&lt;postmaster&gt;

250 2.1.5 Recipient postmaster OK
--&gt; DATA
354 End data with &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;
--&gt; Subject: test2 - virus test pattern
--&gt;
--&gt; X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
--&gt; .


</pre>
<p>
you should get one of the following replies, depending on your
$final_virus_destiny and *virus_lovers* settings in amavisd.conf:
<ul >
<ul >
<ul >
<li> 550 5.7.1 Message content rejected, id=16968-01 - VIRUS: EICAR-AV-Test
<li> 250 2.5.0 Ok, but 1 BOUNCE
<li> 250 2.7.1 Ok, discarded, id=16984-01 - VIRUS: EICAR-AV-Test
<li> 250 2.6.0 Ok, id=17041-01, from MTA: 250 Ok: queued as 3F1841A5F5
</ul>
</ul>
</ul>

<p>
--&gt; QUIT
221 2.0.0 [127.0.0.1] (amavisd) closing transmission channel
Connection closed by foreign host.
<p>
You may need/want to use different sender and recipient addresses.
The test pattern must be entered exactly, starting at the beginning
of the line (without indentation).
<p>
Depending on the settings in amavisd.conf, the sender ([email protected])
and the virus administrator should have been sent a (non-)delivery status
notification, the second message quarantined, and the first message must
have
been successfully delivered to the recipient. See the log that is scrolling
on the terminal (as setup at step 1) and check for possible problems.
<p>
9) Tell Postfix to start forwarding all mail it receives to amavisd-new for
content inspection.
<p>
<pre >
   Add this line to /etc/postfix/main.cf
   content_filter = smtp-amavis:[127.0.0.1]:10024
</pre>
<p>
<p>

10) Do a 'postfix reload' and watch the logs - both the Postfix logs,
and the amavisd log file (on the screen or wherever you have it directed).
<p>
If you get in trouble, you only need to undo the step 9 and reload postfix.
New mail will no longer be tagged with content filter routing.
<p>
NOTE: the messages that have been received while 'content_filter' was set,
will still try to get delivered to your old setting of content_filter,
and will wait in the queue until successful or deleted - or until you do:
postsuper -r ALL; postfix reload
<BR>
<BR>
<BR>
<H3>Mail Flow Overview With Amavisd</H3>
Here's an overview of how the mail flow is once amavis is installed:
<pre>
Postfix (25) -> Amavisd (10024) -> Postfix#2 (10025) -> Cyrus
                  |     ^
                 \ /    |
               Spam Assassin (783) 
</pre>

1) Mail comes to port 25 (postfix) 

2) Postfix sends the mail to amavisd (port 10024)

3) Amavis spam checks and virus checks it (uses Spam Assassin port 783)

4) Amavis tags the message if spam is detected, and passes it BACK to
postfix (port 10025)

5) Postfix delivers the mail to Cyrus

6) Cyrus delivers the mail according to sieve rules.



</body></html>

--- NEW FILE: perdition-ispman.html ---
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
	<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=iso-8859-1">
	<TITLE></TITLE>
	<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.0  (Linux)">
	<META NAME="CREATED" CONTENT="20040114;9270900">
	<META NAME="CHANGED" CONTENT="20040114;12502300">
	<STYLE>
	<!--
		@page { size: 8.5in 11in; margin-left: 1.25in; margin-right: 1.25in; margin-top: 1in; margin-bottom: 1in }
		P { margin-bottom: 0.08in }
		H3 { margin-bottom: 0.08in }
		H3.western { font-family: "Arial", sans-serif }
		H3.cjk { font-family: "Mincho" }
	-->
	</STYLE>
</HEAD>
<BODY LANG="en-US" DIR="LTR">
<P ALIGN=CENTER STYLE="margin-top: 0.17in; page-break-after: avoid"><FONT FACE="Arial, sans-serif"><FONT SIZE=5><B>Using
Perdition With ISPMan</B></FONT></FONT></P>
<P ALIGN=CENTER STYLE="margin-bottom: 0in"><B>Updated: January 14,
2004</B></P>
<P ALIGN=CENTER STYLE="margin-bottom: 0in"><B>by Tony Wasson (wasson
at azxws.com)</B></P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in">As an ISPMan administrator, you'll use
Perdition to let users login with user-9IKiO1iGCm/[email protected] or user_domain_com.
You can also use it to append a domain name onto a username. You can
also use Perdition as a &ldquo;traffic directory&rdquo; during email
migration, however that is outside the scope of this document. 
</P>
<H3 CLASS="western">Setting Up Perdition</H3>
<P STYLE="margin-bottom: 0in">1) If running ISPMan 1.0 or higher,
skip this step.. 
</P>
<P STYLE="margin-bottom: 0in">Older releases did not support the 2
UIDs (userids) for all users by default. You need to run
&quot;ispman.fixUsers&quot; to create both UIDs. You need to make
sure all new users have 2 UIDs also, so you can either make
&ldquo;ispman.fixUsers&rdquo; a cron job . On 0.9.7 you can patch
ISPMan to do this for all new users by changing users.ldif.template
like so:</P>
<P STYLE="margin-top: 0.08in"><FONT SIZE=2><I>After the 1st UID line,
add this:</I></FONT></P>
<P STYLE="margin-top: 0.08in"><FONT SIZE=2><I>uid:  join '@',
($r-&gt;param(&quot;userid&quot;), $r-&gt;param(&quot;ispmanDomain&quot;))</I></FONT></P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in">2) Make sure you have access to your
LDAP server(s)</P>
<P STYLE="margin-bottom: 0in">You may have to edit tcpwrappers
(/etc/hosts.allow), iptables/ipchains or other firewall rules
depending on your security setup. 
</P>
<OL START=2>
	<P STYLE="margin-bottom: 0in"></P>
</OL>
<PRE>ldapsearch -xvu -h 127.0.0.1 -LLL -b &quot;o=ispman&quot; ispmanVar=*
</PRE><P STYLE="margin-bottom: 0in">
3) Verify the LDAP server is reachable, something like this works
well</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in">4) Install perdition</P>
<P STYLE="margin-bottom: 0in">You can use packages for your
distribution, or compile from source available from:
http://www.vergenet.net/linux/perdition/download/</P>
<OL START=2>
	<P STYLE="margin-bottom: 0in"></P>
</OL>
<PRE>#apt-get install perdition perdition-ldap</PRE><P STYLE="margin-bottom: 0in">
<BR>
</P>
<P STYLE="margin-bottom: 0in">5) Configure Perdition</P>
<OL START=3>
	<P STYLE="margin-bottom: 0in">Keep in mind that your map_libary file
	may be in a different location.When you &ldquo;go live&rdquo; you
	should have multiple LDAP servers. As long as they are all on
	standard ports, set these up on the map_library_opt line. 
	</P>
</OL>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in"><B>A basic
/etc/perdition/perdition.conf looks like so:</B></P>
<PRE>
<SPAN STYLE="background: #b3b3b3">map_library /usr/lib/libperditiondb_ldap.so.0</SPAN>
<SPAN STYLE="background: #b3b3b3">map_library_opt &quot;ldap://127.0.0.1/o=ispman?mailroutingaddress?sub?(uid=%25s)&quot;</SPAN>
<SPAN STYLE="background: #b3b3b3">server_ok_line</SPAN>
<SPAN STYLE="background: #b3b3b3">username_from_database</SPAN>
</PRE><P STYLE="margin-bottom: 0in">
<B>A single domain setup config file will probably look more like </B>
</P>
<PRE>
<SPAN STYLE="background: #b3b3b3">map_library /usr/lib/libperditiondb_ldap.so.0</SPAN>
<SPAN STYLE="background: #b3b3b3"># The following map_library_opt line needs to be on a single line</SPAN>
<SPAN STYLE="background: #b3b3b3"># Customize the @azxws.com to match your domain.</SPAN>
<SPAN STYLE="background: #b3b3b3">map_library_opt &ldquo;ldap://127.0.0.1//o=ispman?mailroutingaddress?sub?(uid=%[email protected])&quot;</SPAN>
<SPAN STYLE="background: #b3b3b3">server_ok_line</SPAN>
<SPAN STYLE="background: #b3b3b3">username_from_database</SPAN></PRE><P STYLE="margin-bottom: 0in">
<BR>
</P>
<P STYLE="margin-bottom: 0in"><B>A multi-LDAP server config file will
probably look more like :</B></P>
<PRE>
<SPAN STYLE="background: #b3b3b3">map_library /usr/lib/libperditiondb_ldap.so.0</SPAN>
<SPAN STYLE="background: #b3b3b3"># The following map_library_opt line needs to be on a single line</SPAN>
<SPAN STYLE="background: #b3b3b3">map_library_opt &ldquo;ldap://127.0.0.1 192.168.2.10 192.168.3.10 \</SPAN>
<SPAN STYLE="background: #b3b3b3">/o=ispman?mailroutingaddress?sub?(uid=%25s)&quot;</SPAN>
<SPAN STYLE="background: #b3b3b3">server_ok_line</SPAN>
<SPAN STYLE="background: #b3b3b3">username_from_database</SPAN>
</PRE><P STYLE="margin-bottom: 0in">
6) Make sure Perdition starts on bootup and start it manually now</P>
<PRE>/etc/init.d/perdition start</PRE><P STYLE="margin-bottom: 0in">
<BR>
</P>
<P STYLE="margin-bottom: 0in">7) Verify the account and password are
correct by logging in directly</P>
<P STYLE="margin-bottom: 0in">against the mail server. I usually do
something like this on the mail server:</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<PRE>  telnet localhost 110
  USER user_domain_com
  PASS thepassword
</PRE><P STYLE="margin-bottom: 0in">
Then I  repeat these steps using my new Perdition proxy. If it fails,
check the logs (perdition uses syslog). You may also use a system
debugger (like strace) and a network sniffer to verify LDAP is
functioning. I have also had good success setting an outgoing_server
in perdition.conf as a debugging measure</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in">Once you have underscore names working,
use the user-9IKiO1iGCm/[email protected] name through Perdition. Voila! It works...</P>
<OL START=4>
	<P STYLE="margin-bottom: 0in"></P>
</OL>
<P STYLE="margin-bottom: 0in">On a side note, you'll most likely want
to setup postfix to do SMTP authentication. It's pretty easy to get 
PLAIN and LOGIN  working. If you want other mechanisms, you'll need
to work harder. Remember, since there are two UIDs, either
user-9IKiO1iGCm/[email protected] and user_domain_com works.</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<H3 CLASS="western">FAQ:</H3>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in"><B>Q: I got this error:
perdition[10905]: dlopen of &quot;/usr/lib/libperditiondb_ldap.so.0&quot;
failed, what should I check?</B></P>
<P STYLE="margin-bottom: 0in">A: This is usually a configuration
problem. First verify that your map_library_opt line is correct and
has no word wrap. Next check your config file like so:</P>
<PRE>grep -v '^#' /etc/perdition/perdition.conf</PRE><P STYLE="margin-bottom: 0in">
<BR>
</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<PRE></PRE><H3 CLASS="western">
<B>Single Server Perdition Tric</B>k</H3>
<P STYLE="margin-bottom: 0in; border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">If
you have a small installation and want this on the same machine as
Cyrus 2.1, you can set it up like so perdition listens on the outside
IP and Cyrus listens on localhost. Note that you will need to make
sure any webmail programs point to the external IP address so that
users can login with their email address as their username.</SPAN></FONT></P>
<P STYLE="margin-bottom: 0in; border: none; padding: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in; border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">In
/etc/cyrus.conf edit these two lines and restart cyrus:</SPAN></FONT></P>
<PRE STYLE="border: none; padding: 0in">
<FONT COLOR="#000000"><SPAN STYLE="background: transparent">imap   cmd=&quot;imapd -U 30&quot; listen=&quot;localhost:imap&quot; prefork=0 maxchild=100</SPAN></FONT>
<FONT COLOR="#000000"><SPAN STYLE="background: transparent">pop3   cmd=&quot;pop3d -U 30&quot; listen=&quot;localhost:pop3&quot; prefork=0 maxchild=50</SPAN></FONT>
</PRE><P STYLE="margin-bottom: 0in; border: none; padding: 0in">
<FONT COLOR="#000000"><SPAN STYLE="background: transparent">In
/etc/perdition/perdition.conf add these lines and restart perdition:</SPAN></FONT></P>
<PRE STYLE="border: none; padding: 0in">
<FONT COLOR="#000000"><SPAN STYLE="background: transparent">bind_address XXX.XXX.XXX.XXX  &lt;--- Must be outside IP</SPAN></FONT>
<FONT COLOR="#000000"><SPAN STYLE="background: transparent">outgoing_server 127.0.0.1</SPAN></FONT>
</PRE><P STYLE="margin-bottom: 0in; border: none; padding: 0in">
<FONT COLOR="#000000"><SPAN STYLE="background: transparent">Ensure
that your hostname resolves to 127.0.0.1. </SPAN></FONT>
</P>
<P STYLE="margin-bottom: 0in; border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">This
prevents Perdition from connecting back to itself in a loop.</SPAN></FONT></P>
<P STYLE="margin-bottom: 0in; border: none; padding: 0in"><BR>
</P>
<PRE STYLE="border: none; padding: 0in"><FONT COLOR="#000000"><SPAN STYLE="background: transparent">NOTE: I've also seen people setup cyrus to listen on alternate pop and imap ports. This can work too, the choice is up to you.</SPAN></FONT>
</PRE><H3 CLASS="western">
For More Information:</H3>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in">1) Read the Perdition man pages.</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in">2) Visit the Perdition website</P>
<P STYLE="margin-bottom: 0in"><A HREF="http://www.vergenet.net/linux/perdition/">http://www.vergenet.net/linux/perdition/</A></P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in">3) Read Configuring Perdition Proxy
Software to Use an Existing LDAP Server</P>
<P STYLE="margin-bottom: 0in"><A HREF="http://www.vergenet.net/linux/perdition/docs/perdition_ldap.pdf">http://www.vergenet.net/linux/perdition/docs/perdition_ldap.pdf</A></P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
<P STYLE="margin-bottom: 0in"><BR>
</P>
</BODY>
</HTML>
--- NEW FILE: ispman-debian-howto.html ---
<HTML>
<TITLE>
Running ISPMAN on Debian 3.0 Full Install Guide
</TITLE>
<BODY>
Running ISPMAN on Debian 3.0 Full Install Guide
<PRE>
Overview of the process:
A) Configure and install ISPMAN, populate LDAP for a first time install B)
Log into the ISPMAN web interface, then finish configuring ISPMAN C) Setup
ISPMAN agents with a /etc/init.d/ispman-agent startup script D) Configure
each application to work with the ISPMAN agent or the LDAP information

Preinstallation checklist:

apt-get install libdigest-md5-perl cvs slapd
 Directory initialization method: auto
 Directory suffix style: custom 
 Enter your suffix:  o=ispman
 Passwd: xxxxxx   <-- needs to match LDAP password during compile
 Replicate to another LDAP server: No

ISPMAN Primary Server Setup Notes:

1. creat a user called ispman
2. "chown ispman /opt" and "cd /opt"
3. login as ispman and download the latest ispman-someversion.tar.gz to /opt
4. tar zxf ispman-someversion.tar.gz 
5. cd ispman-someversion
6. cvs -z3 update -dP    
7. ./configure
  Accepted all defaults except:
   Domain is azxws.com
   LDAP directory is /etc/ldap
   set ldap password
   set cyrus password

8. "make ispman"
FIRST TIME INSTALL ONLY (EMPTY LDAP TREE)
NOTE: This will WIPE out an existing ispman installation.
 A. AS ROOT: cp /opt/ispman-someversion/tmp/conf/slapd.conf
/etc/ldap/slapd.conf B. AS ROOT: cp
/opt/ispman-someversion/tmp/conf/schema/* /etc/ldap/schema/ C.
/etc/init.d/slapd restart D. make ldif_install

9. make install_ispman_common
10. make install_ispman_web
11. Setup ispman web access:
  A. AS ROOT: apt-get install apache apache-ssl
  B. Modify /etc/apache-ssl/httpd.conf with
       Include /etc/ispman/apache.conf
  C. Create the file /etc/ispman/apache.conf like so:

/----- /etc/ispman/apache.conf ---
Alias /ispman /opt/ispman/htdocs
<Directory  /opt/ispman/htdocs>
    Options ExecCGI
    AddHandler cgi-script .cgi
    DirectoryIndex index.html index.cgi
    AllowOverride None
</Directory>
\------ end apache.conf --------

  D. /etc/init.d/apache-ssl restart

You should now be able to access ISPMAN at
https://ip.add.re.ss/ispman/ 

If unable to access the website, check /var/log/apache_ssl/error_log and fix
it..

----ISPMAN Web Configuration --
Login using the name ispman with the LDAP password entered above.

Click Configuration, make sure to setup hosts and host groups.

ISPMAN - Apache Configuration
 Apache stop command - /etc/init.d/apache stop
 Webalizer command - /usr/bin/webalizer
 Apache vhost file - /etc/apache/vhosts.conf
   (Must add "Include /etc/apache/vhosts.conf" to apache's httpd.conf)
 Apache start command - /etc/init.d/apache start
 Apache graceful reload command - /etc/init.d/apache reload
 Default vhost IP -- * (Allows it to work on any machine)
 Apache reload command - /etc/init.d/apache reload


ISPMAN - Mail Configuration
 IMAP server - cyrus
 Server Maps command - /usr/sbin/postmap
 SMTP reload command - /etc/init.d/postfix reload
 Map files directory - /etc/postfix
 Mailbox Prefix - user.

DNS Config:
 Named Start Command - /etc/init.d/bind start
 Primary DNS (name) - ns1.domain.com
 ISPMan's DNS data directory -  ispman/
 Primary Mail Server (name) - mail.domain.com
 Named data directory - /var/named  
 Secondary Mail Server (IP) - xxx.xxx.xxx
 DNS Backend - bind8
 Secondary DNS (IP) - xxx.xxx.xxx.xxx
 Reverse Zone directory - rev/
 Header file for named.conf - /opt/ispman/templates/named.conf.header Named
Reload Command - /etc/init.d/bind reload Footer file for named.conf -
/opt/ispman/templates/named.conf.footer Named Stop Command -
/etc/init.d/bind stop Secondary Zone directory - sec/ Named Config File  -
/etc/named.ispman.conf
 Primary DNS (IP) - xxx.xxx.xxx.xxx
 Secondary Mail Server (name) - mail2.domain.com
 Secondary DNS (name) - ns2.domain.com
 Primary Mail Server (IP) - xxx.xxx.xxx.xxx
 Catch all CNAME  - none
 Primary Zone directory - pri/
 Hostmaster's email address - hostmaster.domain.com
 Named User - root 

Set up additional users if desired.

--ISPMAN-AGENT---

1) apt-get install daemontools-installer, when asked DO make the /service
directory  2) mkdir /etc/ispman 
3) edit /etc/ispman/run like so:

/---- /etc/ispman/run ----
#!/bin/sh
exec Starting ispman agent
exec /opt/ispman/bin/ispman-agent nodetach
\----- end file -----

4) ln -s /etc/ispman /service/
5) ln -s /opt/ispman/var/ /var/log/ispman/
6) edit /etc/init.d/ispman-agent like so:

/--------/etc/init.d/ispman-agent----
#!/bin/sh
#     * svc -h /service/yourdaemon: sends HUP
#     * svc -t /service/yourdaemon: sends TERM, and automatically restarts
the #       daemon after it dies #     * svc -d /service/yourdaemon: sends
TERM, and leaves the service down #     * svc -u /service/yourdaemon: brings
the service back up #     * svc -o /service/yourdaemon: runs the service
once daemon="/service/ispman"
process="ispman"
name="ispman-agent"

case "$1" in
    start)
        echo -n "Starting $name:"
        svc -u $daemon
        echo  " started"
        ps aux | grep $process
        ;;
    stop)
        echo -n "Stopping $name:"
        svc -d /service/ispman
        echo  " stopped"
        ps aux | grep $process
        ;;
    restart|force-reload)
        echo -n "Restarting $name:"
        svc -t $daemon
        echo " restarted"
        ;;
    reload)
        echo -n "Reloading $name:"
        svc -h $daemon
        echo " reloaded"
        ;;
    status)
        echo -"Getting Status... Jobs in queue: "
        /opt/ispman/bin/ispman.processes -h $HOSTNAME
        ;;
    *)
        echo 'Usage: /etc/init.d/ispman
{start|stop|restart|force-reload|reload|
status}'
        exit 1
esac

exit 0
\--------/etc/init.d/ispman-agent----

NOTE: I had to edit /opt/ispman/bin/ispman.processes and tell it the
ispman/lib path.

7) chmod +x /etc/init.d/ispman-agent
8) /etc/init.d/ispman-agent start
tail the logs in /var/log/ispman/ to see whats happening.
The biggest problem with agents not completing tasks is that the hostname
does not match. Checking the syslog will show what hostname the agent looks
for. 

9) update-rc.d defaults ispman-agent 99


NOTE: Do above steps sans web configuration stuff for each machine
participating in the net. It should also be possible to just copy
/opt/ispman sans the htdocs dir to each server.

--LDAP setup ---

YOU MUST HAVE A NEWLINE AFTER YOUR ENTRIES OR THIS WON'T WORK. This secures
LDAP from foreign queries. Feel free to add LDAP ACL and iptable rules too.
You need to setup your own replication servers.

1) Edit /etc/hosts.allow adding: 
slapd: XXX.XXX.XXX.XXX 127.0.0.1 : ALLOW


2) Edit /etc/hosts.deny adding:
slapd: ALL : DENY

NOTE: test using ldapsearch locally and from a remote machine not in the
allowed file. 

3) Test it like so (requires ldap-utils package)
   ldapsearch -xvu -LLL -b "o=ispman" ispmanVar=*

--PAM_LDAP setup ---
This basically allows any daemon using PAM for authentication to use LDAP.
Some programs like Cyrus don't authenticate directly from LDAP without
patches. This lets them 'ask' PAM for authentication. PAM then acts as an
'LDAP proxy' finding out authentication information and and returns the
answer in an understandable way.  

1) make sure libpam-ldap is installed
(apt-get install libpam-ldap)
 make configuration readable/writeable by owner only: Yes 
 Make local root Database admin: No 
 Database requires logging in: No 
 Local crypt to use when changing passwords: crypt

2) Edit /etc/pam_ldap.conf like so:
host 127.0.0.1   <--- will differ if the LDAP server is elsewhere.  base
o=ispman 
ldap_version 3
pam_password crypt


--CYRUS/IMAP/POP3D---
This includes setup guides for Cyrus 1.5 which is in the stable branch and
Cyrus2.1 which is official, but is backported. Cyrus 1.5 is easier to setup,
but lacks SSL support and sieve mail sorting. The /var/spool/cyrus directory
layout of 2.xx is designed for large installations. Authentication depends
on different daemons, but thanks to pam support, they both work easily with
an ISPMAN LDAP site.

CYRUS 2.1 instructions 
1) Add these line to /etc/apt/sources.list
  #Cyrus21 Backports
  deb http://people.debian.org/~hmh/woody/ hmh/cyrus/

2) apt-get update 

3) apt-get install cyrus21-pop3d cyrus21-common cyrus21-imapd cyrus21-admin
cyrus21-admin cyrus21-clients cyrus21-doc gawk libcyrus-imap-perl21 libsasl2
libsnmp-base libsnmp4.2 sasl2-bin libsasl2-modules libsasl2 and sasl2-bin

4) Edit the following lines in /etc/imapd.conf like so:

admins: cyrus
popminpoll: 0
allowplaintext: yes
sasl_minimum_layer: 0
sasl_mech_list: plain login
sasl_pwcheck_method: saslauthd
lmtp_downcase_rcpt: yes
tls_ca_file: /etc/ssl/cyrus.pem 
tls_cert_file: /etc/ssl/cyrus.pem 
tls_key_file: /etc/ssl/cyrus.pem

5) Edit /etc/cyrus.conf and allow lmtp localhost, imaps, and pop3s

6) Create SSL key and pem file for cyrus
  A. openssl req -new -nodes -out req.pem -keyout key.pem  
  B. openssl rsa -in key.pem -out new.key.pem
  C. openssl x509 -in req.pem -out ca-cert -req \
     -signkey new.key.pem -days 999 
  D. mv new.key.pem /etc/ssl/cyrus.pem
  E. cat ca-cert >> /etc/ssl/cyrus.pem
  F. chown cyrus.mail /etc/ssl/cyrus.pem
  G. chmod 600 /etc/ssl/cyrus.pem 

7) Edit /etc/pam.d/imap AND /etc/pam.d/pop like so:
auth    sufficient      pam_ldap.so 
account sufficient      pam_ldap.so

8) Add cyrus to the sasl group (adduser cyrus sasl)
 
9)  Now, configure saslauthd to use PAM mode and startup:
   Modify /etc/default/saslauthd so that it reads:
   start=yes
   MECHANISMS="pam"

  NOTE: I've seen configs where saslauthd goes straight to LDAP. 
  The example I followed didn't work, so I stuck with pam. YMMV.

10) Restart saslauthd and cyrus
  /etc/init.d/cyrus21 restart
  /etc/init.d/saslauthd restart

11) Test the setup by doing this:
   #cyradm --user cyrus localhost
   localhost password:  <--- compile time cyrus password
   localhost> lm   <-- lm shows installed mailboxes
   If you don't get a hostname> prompt, check the syslog for errors. Verify
LDAP is running.

   THEN the ultimate: Create a domain and verify connectivity!
   telnet localhost 110
   USER someuser_domain_com
   PASS password
   LIST (you should see all mail waiting.)
 


CYRUS 1.5 SETUP

1) edit /etc/imapd.conf, change the two lines listed like so:
   popminpoll:0 
   admins: cyrus

2) adduser --system cyrus  (may already exist)
3) passwd cyrus  (to whatever you set it up as in ./configure)

4) update-alternatives --config pwcheck 
   choose    2        /usr/sbin/pwcheck_pam

NOTE: Unless you stop pwcheck before this step, restarting it will leave you
with the old pwcheck_standard running. I do a killall pwcheck after this
step for good measure.

5) edit /etc/pam.d/cyrus so it says:
auth            sufficient              /lib/security/pam_ldap.so
account         sufficient              /lib/security/pam_ldap.so

6) test it! sample test for cyrus 1.5:
   #cyradm -u cyrus localhost
   localhost password:  <--- compile time cyrus password
   localhost> lm   <-- lm shows installed mailboxes

   If you get anything but a hostname> prompt, check the syslog and auth.log
for errors. Verify that pwcheck_pam is really running. Permission problems
in /var/lib/cyrus or /var/spool/cyrus can 'block' a cyradm session. If you
are still stuck, try strace'ing a pwcheck agent and see what it spits out. 
     
--BIND 8 SETUP--

1) apt-get install bind
2) Add this line to /etc/named/named.conf:

     include "/etc/named.ispman.conf";

NOTE: The ; at the end is critical, if it is dropped, you'll see a syslog
error like:
   /etc/bind/named.conf:67: parse error near <end of file>

3) Then as root: ln -s /etc/bind/ /var/named
ISPMAN likes to put stuff in /var/named/ispman/ so we make a symlink

4) Reload bind (/etc/init.d/bind reload) and check the logs, it should be
happy. 

--APACHE NOTES--
1) apt-get install squirrelmail apache apache-ssl
2) Edit /etc/apache/httpd.conf adding these lines: (change IPs and Server
Name)

UseCanonicalName Off  
NameVirtualHost * 
Include /etc/apache/vhosts.conf  < --- this is where the agent adds stuff
Include /etc/ispman/apache.conf  < --- this should still be in there

NOTE: With UseCanonicalName Off the server name comes from the contents of
the Host: header in the request.

2) if /etc/apache/vhosts.conf does not exist then (touch
/etc/apache/vhosts.conf) 3) /etc/init.d/apache restart

Check apache's logs, he should be happy. 

NOTE: ISPMAN uses an intermediate file in /etc/apache/vhosts.conf.hash file.
I've had to edit this file manually when a domain just wouldn't die.


--POSTFIX---
NOTE: postfix-snap packages are postfix 2.0 and some config options have
changed, this setup is for plain postfix

1) apt-get install postfix-ldap postfix-tls libsasl-modules-plain

2) Edit /etc/pam.d/smtpd like so:
auth    sufficient      pam_ldap.so 
account sufficient      pam_ldap.so

2) mkdir /etc/postfix/sasl and then create /etc/postfix/sasl/smtpd.conf like
so:  pwcheck_method: pam

3) Edit /etc/postfix/master.cf
Make sure smtpd is NOT chrooted -- This lets it do SMTP Auth.  
WARNING: SMTP Auth is an addon to postfix, it does decrease the overall
security.

4) Create TLS cert and key in /etc/postfix
   A. #openssl req -new -x509 -nodes -out cert.pem 
   B. chown root.postfix *.pem
   C. chmod 640 *.pem  

4) edit /etc/postfix/main.cf like so:

mailbox_transport=cyrus
mydomain = domain.com
myhostname = host.domain.com
program_directory = /usr/lib/postfix
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
# NOTE: myorigin MUST match the maildrop hostname in ISPMAN.
myorigin = /etc/mailname
relayhost = 
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

mydestination = $mydomain, $myhostname, localhost.$mydomain,
/etc/postfix/destination, hash:/etc/postfix/destination_domains
relay_domains = $mydomain, $myhostname, localhost.$mydomain,
/etc/postfix/destination, hash:/etc/postfix/relay_domains  #canonical_maps =
hash:/etc/postfix/canonical
virtual_maps = ldap:ldapvirtual

default_transport = smtp

ldapvirtual_server_host = localhost
ldapvirtual_server_port = 389
ldapvirtual_bind_dn = o=ispman
ldapvirtual_bind = no
ldapvirtual_timeout =

ldapvirtual_search_base = o=ispman
ldapvirtual_query_filter = (|(mailLocalAddress=%s)(mailAlias=%s))
ldapvirtual_result_attribute = mailRoutingAddress,mailForwardingAddress
ldapvirtual_lookup_wildcards = no

#relocated_maps = hash:/etc/postfix/relocated
#smtpd_sender_restrictions = hash:/etc/postfix/access

$transport_maps = hash:/etc/postfix/transport

smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
local_destination_concurrency_limit = 2
default_destination_concurrency_limit = 10
debug_peer_level = 2
debugger_command =
         PATH=/usr/bin:/usr/X11R6/bin

# SMTP Auth Stuff see http://killyridols.net/postfixtlssmtpauth.shtml
smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_sasl_authenticated,
check_relay_domains

#For STARTTLS SMTP
smtpd_tls_cert_file = /etc/postfix/cert.pem
smtpd_tls_key_file = /etc/postfix/privkey.pem
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
tls_daemon_random_source = dev:/dev/urand

5) Test it! telnet localhost 25
If postfix drops the connect, read syslog. Most of my install problems are
with SMTP auth settings, try commenting that out and restarting if postfix
components are dying. Also ensure that your pam files are correct and that
smtpd is not in a chroot environment.

LMTP can speed up stuff, but I didn't do this step, yet....
6) Setup LMTP deliveries (if using cyrus 2.1)

 # addgroup lmtp
 # adduser postfix lmtp
 Fix the socket directory permissions:
        # dpkg-statoverride --force --update --add \
          cyrus lmtp 750 /var/run/cyrus/socket
 Restart Postfix and Cyrus IMAPd
        # /etc/init.d/postfix restart
        # /etc/init.d/cyrus21 restart




--PUREFTPD --
Proftpd doesn't support the ISPMAN LDAP space quotas or denied users so we
run pure-ftpd-ldap.

1) install purftpd-ldap package, setup to run from inetd
  A. edit /etc/apt/sources.list adding:
deb ftp://ftp.debian.org/debian testing main contrib non-free
  B. apt-get update
  C. apt-get install pure-ftpd-ldap libc6 libpam0g libc6-dev locales

2) Edit /etc/pure-ftpd/db/ldap.conf  like so:

LDAPServer localhost
LDAPPort   389
LDAPBaseDN o=ispman
LDAPFilter (&(objectClass=posixAccount)(uid=\L)

3) Edit /etc/inetd.conf like so:
ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/pure-ftpd -l
ldap:/etc/pure- ftpd/db/ldap.conf

4) Create a test domain as per our documentation, make sure to add an FTP
user to use below. Be sure to Commit the Session. 

5) Restart inetd and test:
   /etc/init.d/inetd restart
   ftp localhost 
       USER www.domain.com   
       PASS password      

NOTE: Logs to syslog, verify that it is checking LDAP

NOTE: Search for users like so:
  ldapsearch -xv -LLL -b "o=ispman" '(&(objectClass=posixAccount)(uid=joe))'
</PRE>
</HTML>



-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.