Circuito_Qmail+OpenLDAP

CIRCUITO DE QMAIL COM OPENLDAP

Marcio Garcia Marcenari

[email protected]@thesource.com.br

The Source Consultoria, Desenvolvimento e CapacitaçãoRua Afonso Celso, 457 – Vila Mariana – São Paulo

PABX: 2171-43001 de 19

mailto:[email protected]


ÍndiceQmail com OpenLDAP...........................................................................................................3Instalação dos pacotes..........................................................................................................5Configuração do Qmail........................................................................................................13Configuração dos scripts de inicialização do Qmail............................................................15Configuração da base de usuários do Correio....................................................................18


PABX: 2171-43002 de 19

Qmail com OpenLDAP

• Pré-requisitos:

OpenSSL – Última versão estável: openssl-0.9.7l.tar.gz

http://www.openssl.org

BerkeleyDB – Última versão estável: db-4.5.20.tar.gz

http://www.sleepycat.com

Cyrus-SASL – Última versão estável: cyrus-sasl-2.1.22.tar.gz

http://asg.web.cmu.edu/cyrus/

OpenLDAP – Última versão estável: openldap-stable-20070110.tar.gz

http://www.openldap.org

• Módulos Perl:

DB_FileDigest::SHA1Digest::HMACDigest::BubbleBabbleNet::DNSHTML::TagsetHTML::ParserMail::SPF::QueryIP::CountryRazor2Net::IdentIO::Socket::INET6IO::Socket::SSLTime::HiResDBIArchive::TarIO::ZlibBundle::libnetGetopt::LongLWP::UserAgentHTTP::Date

• Pacotes:


PABX: 2171-43003 de 19

http://www.openldap.org/

http://asg.web.cmu.edu/cyrus/

http://www.sleepycat.com/

http://www.openssl.org/

Ucspi-tcp – Última versão estável: ucspi-tcp-ssl-pid-0.88.tar.gz

http://www.inter7.com

Daemontools – Última versão estável: daemontools-0.76.tar.gz

http://cr.yp.to/daemontools/install.html

Qmail – Última versão estável: qmail-1.03.tar.gz

http://cr.yp.to

Qmail-LDAP – Última versão estável: qmail-ldap-1.03-20060201.patch.gz

http://www.qmail-ldap.org

Simscan – Última versão estável: simscan-1.3.1.tar.gz

http://www.inter7.com

Clamav – Última versão estável: clamav-0.88.7.tar.gz

http://www.clamav.com

SpamAssassin – Última versão estável: Mail-SpamAssassin-3.1.7.tar.bz2

http://spamassassin.apache.org/

Courier-authlib – Última versão estável: courier-authlib-0.59.1.tar.bz2

http://www.courier-mta.org/?download.php~imap

Courier-imap – Última versão estável: courier-imap-4.1.2.tar.bz2

http://www.courier-mta.org/?download.php~imap

Squirrelmail – Última versão estável: squirrelmail-1.4.9a.tar.bz2

http://www.squirrelmail.org

Locales Squirrelmail – Última versão estável: all_locales-1.4.9-20070106.tar.bz2

http://www.squirrelmail.org


PABX: 2171-43004 de 19











http://cr.yp.to/

Instalação dos pacotes

• Ucspi-tcp

# wget -c http://www.inter7.com/devel/ucspi-tcp-ssl-pid-0.88.tar.gz

# tar xzvf ucspi-tcp-ssl-pid-0.88.tar.gz# cd ucspi-tcp-ssl-pid-0.88# make setup check

• Daemontools

# wget -c http://cr.yp.to/daemontools/daemontools-0.76.tar.gz

# mkdir /package# tar xzvf daemontools-0.76.tar.gz -C /package# cd /package/admin/daemontools-0.76/# package/install

• Qmail-LDAP

# wget -c http://cr.yp.to/software/qmail-1.03.tar.gz# wget -c http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

# gunzip qmail-ldap-1.03-20060201.patch.gz# tar xzvf qmail-1.03.tar.gz# cd qmail-1.03# patch -p1 < ../qmail-ldap-1.03-20060201.patch

# groupadd nofiles# useradd -g nofiles -d /var/qmail/alias alias# useradd -g nofiles -d /var/qmail qmaild# useradd -g nofiles -d /var/qmail qmaill# useradd -g nofiles -d /var/qmail qmailp# groupadd qmail# useradd -g qmail -d /var/qmail qmailq# useradd -g qmail -d /var/qmail qmailr# useradd -g qmail -d /var/qmail qmails

# vi Makefile

LDAPFLAGS=-DALTQUEUE -DBIGTODO -DEXTERNAL_TODO -DDASH_EXT -DIGNOREVERISIGN -DQUOTATRASH

-DSMTPEXECCHECK

LDAPLIBS=-L/usr/local/lib -lldap -llber

LDAPINCLUDES=-I/usr/local/include

TLS=-DTLS_REMOTE -DTLS_SMTPD


PABX: 2171-43005 de 19

http://www.nrg4u.com/qmail/qmail-ldap-1.03-20060201.patch.gz

http://www.openssl.org/source/openssl-0.9.7j.tar.gz



TLSINCLUDES=-I/usr/include

TLSLIBS=-L/usr/lib -lssl -lcrypto

OPENSSLBIN=/usr/bin/openssl

MNW=-DMAKE_NETSCAPE_WORK

MDIRMAKE=-DAUTOMAILDIRMAKE

HDIRMAKE=-DAUTOHOMEDIRMAKE

SHADOWLIBS=-lcrypt

DEBUG=-DDEBUG

# make setup check# ./config-fast mail.thesource.com.br# make cert

# cp qmail.schema /usr/local/etc/openldap/schema# chmod 600 /usr/local/etc/openldap/schema/qmail.schema

Onde a opção “config-fast” tem que ser o nome da maquina + domínio, e a opções “make cert” devemos colocar os dados sobre o certificado que será exibido quando utilizarmos POP e SMTP com criptografia. Após colocar suporte aos atributos do Qmail no OpenLDAP, devemos parar e iniciar o OpenLDAP.

• Clamav

# wget -c http://ufpr.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.7.tar.gz

# groupadd clamav# useradd clamav -d clamav -d /home/clamav -s /bin/false -c “Clam Anti-Virus”

# tar xzvf clamav-0.88.7.tar.gz# cd clamav-0.88.7# ./configure# make# make install

# touch /var/log/clamd.log# chmod 600 /var/log/clamd.log# chown clamav: /var/log/clamd.log

# touch /var/log/freshclam.log# chmod 600 /var/log/freshclam.log# chown clamav: /var/log/freshclam.log

# cd /var/lib# mkdir clamav# chown -R clamav: clamav


PABX: 2171-43006 de 19

http://ufpr.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.7.tar.gz

# vi /usr/local/etc/freshclam.conf

DatabaseDirectory /var/lib/clamav

UpdateLogFile /var/log/freshclam.log

LogVerbose

LogSyslog

PidFile /var/run/freshclam.pid

DatabaseOwner clamav

DNSDatabaseInfo current.cvd.clamav.net

DatabaseMirror database.clamav.net

MaxAttempts 5

Checks 24

# freshclam -d

# vi /usr/local/etc/clamd.conf

LogFile /var/log/clamd.log

LogFileMaxSize 0

LogTime

LogClean

LogSyslog

LogVerbose

PidFile /var/run/clamd.pid

TemporaryDirectory /tmp

DatabaseDirectory /var/lib/clamav

LocalSocket /tmp/clamd

FixStaleSocket

MaxConnectionQueueLength 30

StreamMaxLength 20M

StreamMaxPort 32000


PABX: 2171-43007 de 19

MaxThreads 20

ReadTimeout 300

IdleTimeout 60

MaxDirectoryRecursion 20

FollowDirectorySymlinks

FollowFileSymlinks

SelfCheck 600

ExitOnOOM

DisableDefaultScanOptions

ScanPE

DetectBrokenExecutables

ScanOLE2

ScanMail

MailFollowURLs

ScanHTML

ScanArchive

ScanRAR

ArchiveMaxFileSize 15M

ArchiveMaxRecursion 9

ArchiveMaxFiles 1500

ArchiveMaxCompressionRatio 300

ArchiveLimitMemoryUsage

ArchiveBlockEncrypted

ArchiveBlockMax

# clamd

• SpamAssassin


PABX: 2171-43008 de 19

# wget -c http://mirrors.uol.com.br/pub/apache/spamassassin/source/Mail-SpamAssassin-3.1.7.tar.bz2

# tar xjvf Mail-SpamAssassin-3.1.7.tar.bz2# cd Mail-SpamAssassin-3.1.7# perl Makefile.PL# make# make install

# groupadd spamd# useradd spamd -g spamd -s /bin/false

# vi /etc/mail/spamassassin/local.cf

rewrite_header Subject *****SPAM*****

report_safe 1

required_score 5.0

use_bayes 1

bayes_auto_learn 1

bayes_ignore_header X-Bogositybayes_ignore_header X-Spam-Flagbayes_ignore_header X-Spam-Status

# vi /etc/rc.d/rc.spamassassin

#!/bin/sh

# Spamd init script for Linux# August, 2th 2003# Martin Ostlund, nomicon# 30/06/06 - Adaptado por Marcio Garcia - marciogarcia at gmail.com

PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/binNAME=/usr/bin/spamdSNAME=spamassassinDESC="SpamAssassin Mail Filter Daemon"PIDFILE="/var/run/spamd.pid"PNAME="spamd"DOPTIONS="-d --pidfile=$PIDFILE -s /var/log/spamd.log -u spamd -g spamd"

KILL="/bin/kill"KILLALL="/bin/killall"# Defaults - don't touch, edit /etc/spamassassin.confENABLED=1OPTIONS="-m 10"

#test -f /etc/spamassassin.conf && . /etc/spamassassin.conf

test "$ENABLED" != "0" || exit 0


PABX: 2171-43009 de 19

http://mirrors.uol.com.br/pub/apache/spamassassin/source/Mail-SpamAssassin-3.1.7.tar.bz2

http://mirrors.uol.com.br/pub/apache/spamassassin/source/Mail-SpamAssassin-3.1.7.tar.bz2

case "$1" in start) echo -n "Starting $DESC: " $PNAME $OPTIONS $DOPTIONS

rm -f /tmp/clamd clamd

echo "$NAME." ;; stop) echo -n "Stopping $DESC: " $KILL -9 `pidof spamd` /bin/rm -f $PIDFILE echo "$NAME." ;; restart|force-reload) $0 stop $0 start ;; *) ME=/etc/rc.d/$SNAME echo "Usage: $ME {start|stop|restart|force-reload}" >&2 exit 1 ;;esac

exit 0

# chmod +x /etc/rc.d/rc.spamassassin# sa-learn --spam ~/Mail/saved-spam-folder# sa-learn --ham ~/Mail/nonspam-folder

# /etc/rc.d/rc.spamassassin start

• Simscan

# wget -c http://www.inter7.com/simscan/simscan-1.3.1.tar.gz# wget -c http://www.pldaniels.com/ripmime/ripmime-1.4.0.6.tar.gz

# groupadd simscan# useradd simscan -g simscan -d /home/simscan -s /bin/false# usermod -G simscan clamav# usermod -G clamav simscan

# tar xzvf ripmime-1.4.0.6.tar.gz# cd ripmime-1.4.0.6# make# make install

# cd simscan-1.3.1# ./configure --enable-clamav=y

--enable-clamdscan=/usr/local/bin/clamdscan --enable-attach=y --enable-qmaildir=/var/qmail


PABX: 2171-430010 de 19

http://www.pldaniels.com/ripmime/ripmime-1.4.0.6.tar.gz

http://www.inter7.com/simscan/simscan-1.3.1.tar.gz

--enable-qmail-queue=/var/qmail/bin/qmail-queue --enable-ripmime=/usr/local/bin/ripmime --enable-per-domain=y --enable-spam=y --enable-spam-hits=6.0 --enable-spamc=/usr/local/bin/spamc --enable-spam-passthru=y

# make# make install# make install-strip

# cd /var/qmail/control# vi simcontrol

:clam=yes,spam=yes,spam_passthru=yes,attach=.scr:.exe:.com

# /var/qmail/bin/simscanmk -g# /var/qmail/bin/simscanmk

# cd /home# mkdir simscan# chown -R spamd: simscan

• Courier-authlib

# wget -c http://prdownloads.sourceforge.net/courier/courier-authlib-0.59.1.tar.bz2

# tar xjvf courier-authlib-0.59.1.tar.bz2# cd courier-authlib-0.59.1# ./configure# make# make install# make install-migrate# make install-configure

# vi /usr/local/etc/authlib/authdaemonrc

authmodulelist=”authldap”authmodulelistorig=”authldap”daemon=5authdaemonvar=/usr/local/var/runDEBUG_LOGIN=0DEFAULTOPTIONS=””

• Courier-imap

# wget -c http://prdownloads.sourceforge.net/courier/courier-imap-4.1.2.tar.bz2

# tar xjvf courier-imap-4.1.2.tar.bz2# cd courier-imap-4.1.2


PABX: 2171-430011 de 19

http://prdownloads.sourceforge.net/courier/courier-authlib-0.59.1.tar.bz2

http://prdownloads.sourceforge.net/courier/courier-authlib-0.59.1.tar.bz2

# ./configure --disable-root-check# make# make install# make install-configure

# vi /usr/local/etc/authlib/authldaprc

LDAP_SERVER localhostLDAP_PORT 389LDAP_PROTOCOL_VERSION 3LDAP_BASE_DN c=BRLDAP_BIND_DN cn=Master,c=BRLDAP_BINDPW secretLDAP_TIMEOUT 5LDAP_AUTHBIND 1LDAP_MAIL uidLDAP_FILTER (objetClass=qmailUser)LDAP_GLOB_UID vmailLDAP_GLOB_GID vmailLDAP_HOMEDIR mailMessageStoreLDAP_DEFAULTDELIVERY defaulDeliveryLDAP_FULLNAME cnLDAP_CLEARPW clearPasswordLDAP_CRYPTPW userPasswordLDAP_DEREF neverLDAP_TLS 0

# /usr/lib/courier-imap/libexec/imapd.rc start# /usr/local# /usr/local/libexec/courier-authlib/authdaemond &


PABX: 2171-430012 de 19

Configuração do Qmail

• Criando usuário para criação automática da caixa postal do usuário

# groupadd vmail# useradd vmail -g vmail -d /var/vmail -s /bind/false

# cd /var# mkdir vmail# chown vmail: vmail# chmod 700 vmail

• Redirecionamento de mensagens do root, postmaster e mailer-daemon

# cd /var/qmail/alias

# echo [email protected] > .qmail-root# echo [email protected] > .qmail-postmaster# echo [email protected] > .qmail-mailer-daemon

• Configurando o binário sendmail e mailq

# rm /usr/sbin/sendmail# ln -s /var/qmail/bin/sendmail /usr/sbin

# rm /usr/lib/sendmail# ln -s /var/qmail/bin/sendmail /usr/lib

# rm /usr/bin/mailq# ln -s /var/qmail/bin/sendmail /usr/bin/mailq

• Configurando domínios locais do servidor

# cd /var/qmail/control# vi locals

mail.thesource.com.brthesource.com.br

# make

• Configurando domínios remotos que podem efetuar relay

# cd /var/qmail/control# vi rcpthosts


PABX: 2171-430013 de 19




mail.thesource.com.brthesource.com.br

# make

• Configurando os arquivos de controle do Qmail

# cd /var/qmail/control

# id -u vmail > ldapuid# id -g vmail > ldapgid

# echo c=BR > ldapbasedn# echo cn=Master,c=BR > ldaplogin# echo 123456 > ldappassword# echo 127.0.0.1 > ldapserver

# echo qmailUser > ldapobjectclass# echo ./Maildir/ > aliasempty# echo both > ldapdefaultdotmode# echo 0 > ldaplocaldelivery# echo 1 > ldaprebind# echo cert.pem > smtpcert

# echo Sua caixa postal está com 70% de utilização > quotawarning

• Configurando script para criação das caixas postais

# cd /var/qmail/bin# vi dirmaker.sh

#!/bin/shmkdir -m 700 -p $1#EOF

# chmod 755 dirmaker.sh

# cd /var/qmail/control# echo /var/qmail/bin/dirmaker.sh > dirmaker

• Configurando a tabela de relay do Qmail e habilitando o simscan

# cd /var/qmail/control# vi qmail-stmpd.rules

192.1.:allow,RELAYCLIENT=””,QMAILQUEUE=”/var/qmail/bin/simscan”:allow,QMAILQUEUE=”/var/qmail/bin/simscan”


PABX: 2171-430014 de 19

Configuração dos scripts de inicialização do Qmail

• Script de inicialização do qmail-send

# cd /var/qmail/boot# vi qmail/run

#!/bin/shexec 2>&1

QMAIL="/var/qmail"

if [ -e $QMAIL/control/defaultdelivery ]; then ALIASEMPTY=`cat $QMAIL/control/defaultdelivery 2> /dev/null`else ALIASEMPTY=`cat $QMAIL/control/aliasempty 2> /dev/null`fi

ALIASEMPTY=${ALIASEMPTY:="./Maildir/"}PATH="$QMAIL/bin:$PATH"

# limit to prevent memory hogsulimit -c 204800

exec envdir ./env qmail-start "$ALIASEMPTY" splogger qmail

• Script de inicialização do qmail-smtpd

# cd /var/qmail/boot# vi qmail-smtpd/run

#!/bin/shexec 2>&1

QMAIL="/var/qmail"ME="`head -1 $QMAIL/control/me`"CONCURRENCY=${CONCURRENCY:=50}QUSER="qmaild"PATH="$QMAIL/bin:$PATH"

# source the environemt in ./enveval `env - PATH=$PATH envdir ./env awk '\ BEGIN { for (i in ENVIRON) \ if (i != "PATH") { \ printf "export %s=\"%s\"\\n", i, ENVIRON[i] \ } \ }'`

exec \ envuidgid $QUSER \ tcpserver -v -URl $ME -x$QMAIL/control/qmail-smtpd.cdb \ ${CONCURRENCY:+"-c$CONCURRENCY"} ${BACKLOG:+"-b $BACKLOG"} 0 smtp \ $QMAIL/bin/qmail-smtpd


PABX: 2171-430015 de 19

• Script de inicialização do qmail-pop3d

# cd /var/qmail/boot# vi qmail-pop3d/run

#!/bin/shexec 2>&1

QMAIL="/var/qmail"ME="`head -1 $QMAIL/control/me`"ALIASEMPTY=${ALIASEMPTY:="./Maildir/"}PATH="$QMAIL/bin:$PATH"


exec \ tcpserver -v -HRl $ME -x$QMAIL/control/qmail-pop3d.cdb \ ${CONCURRENCY:+"-c$CONCURRENCY"} ${BACKLOG:+"-b$BACKLOG"} 0 pop3 \ $QMAIL/bin/qmail-popup $ME \ $QMAIL/bin/auth_pop \ $QMAIL/bin/qmail-pop3d "$ALIASEMPTY"

• Script de inicialização do qmail-pop3d-ssl

# cd /var/qmail/boot# vi qmail-pop3d-ssl/run

#!/bin/shexec 2>&1

QMAIL="/var/qmail"ME="`head -1 $QMAIL/control/me`"ALIASEMPTY=${ALIASEMPTY:="./Maildir/"}PATH="$QMAIL/bin:$PATH"


# enforce some sane defaultsTLSCERT=${TLSCERT:="$QMAIL/control/cert.pem"}

exec \ tcpserver -v -HRl $ME -x$QMAIL/control/qmail-pop3d.cdb \ ${CONCURRENCY:+"-c$CONCURRENCY"} ${BACKLOG:+"-b$BACKLOG"} \ -s ${TLSCERT:+"-n$TLSCERT"} 0 pop3s \ $QMAIL/bin/qmail-popup $ME \ $QMAIL/bin/auth_pop \ $QMAIL/bin/qmail-pop3d "$ALIASEMPTY"

• Criando os links de inicialização dos scripts


PABX: 2171-430016 de 19

# cd /service

# ln -s /var/qmail/boo/qmail# ln -s /var/qmail/boo/qmail-smtpd# ln -s /var/qmail/boo/qmail-pop3d# ln -s /var/qmail/boo/qmail-pop3d-ssl


PABX: 2171-430017 de 19

Configuração da base de usuários do Correio

• Criando a base de usuários

# vi base.ldif

dn: c=BRobjectClass: countryc: BR

dn: o=TheSource,c=BRobjectClass: organizationo: TheSource

dn: ou=TI,o=TheSource,c=BRobjectClass: organizationalUnitou: TI

dn: uid=admin, ou=TI, o=TheSource, c=BRobjectClass: inetOrgPersonobjectClass: qmailuseruid: admincn: Administrador de Emailssn: Adminmail: [email protected]: /var/vmail/adminmailQuotaSize: 200000000mailQuotaCount: 10000mailSizeMax: 10000000mailHost: mail.thesource.com.bruserPassword: 123456

dn: uid=mgarcia, ou=TI, o=TheSource, c=BRobjectClass: inetOrgPersonobjectClass: qmailuseruid: mgarciacn: Marcio Garcia Marcenarisn: Marcenarimail: [email protected]: /var/vmail/mgarciamailQuotaSize: 200000000mailQuotaCount: 10000mailSizeMax: 10000000mailHost: mail.thesource.com.bruserPassword: 123456

dn: uid=ralf, ou=TI, o=TheSource, c=BRobjectClass: inetOrgPersonobjectClass: qmailuseruid: ralfcn: Ralf Braga Sermatheu


PABX: 2171-430018 de 19



sn: Sermatheumail: [email protected]: /var/vmail/ralfmailQuotaSize: 200000000mailQuotaCount: 10000mailSizeMax: 10000000mailHost: mail.thesource.com.bruserPassword: 123456

• Importando a base de usuários

# ldapadd -x -W -v -D 'cn=Master,c=BR' -f base.ldif

• Consultando a base de usuários

# ldapsearch -x -b c=BR -LLL

Obrigado!

Marcio Garcia [email protected]@thesource.com.br


PABX: 2171-430019 de 19




Circuito_Qmail+OpenLDAP

Documents

Transcript of Circuito_Qmail+OpenLDAP