|
This is my replacement for M$ exchange server. Dovecot runs as either pop3 or imap, the Perl script draws down the aliases from the Active Directory CN, postfix runs as the SMTP server, Squirrel Mail runs as my mail
client and the Squirrel Mail plug-in draws the needed information down from Active directory automatically every time you login and places it in your squirrel mail preferences and winbind authenticates against active directory to synchronize the usernames/passwords between ADS and the Linux box.
Name: Dovecot
HomePage: http://dovecot.org/
Function: Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems, written with security primarily in mind.
Name: Postfix
HomePage: http://www.postfix.org/
Function:
Postfix attempts to be fast, easy to administer, and secure, while at
the same time being sendmail compatible enough to not upset existing
users
Name: Squirrel Mail
Homepage: http://www.squirrelmail.org/
Function: Webmail client, used to check e-mails from anywhere in world, via the internet, like gmail or hotmail
1. Edit the dovecot file dovecot.conf
nano /etc/dovecot.conf dovecot.conf:
2. Make the '/home/MYDOMAIN' directory writable by everyone
chmod a+rwx /home/MYDOMAIN
3. Now edit the dovecot.conf file.
/etc/dovecot.conf dovecot.conf:
auth_userdb = passwd
auth_passdb = pam
default_mail_env = mbox:/home/%D/%u/mail:INBOX=/var/spool/mail/%u
|
4. Set dovecot to start on boot and then start it
chkconfig dovecot on
/etc/init.d/dovecot start
5. Start the apache webserver next,
/etc/init.d/httpd start
6. Make sure that squirrelmail is working properly go to the web address
http://ip-address-of-the-mail-server/webmail/
(if squirrelmail was installed at the installation of fedora this alias should already be made)
5. Now it's time get winbind to authenticate against Active Directory. stop both winbind and samba services
/etc/init.d/smb stop
/etc/init.d/winbind stop
7. Edit Kerberos files to have the right configuration
/etc/krb5.conf
krb5.conf:
[libdefaults]
default_realm = WINDOWS.SERVER.INT
[realms]
WINDOWS.SERVER.INT = {
kdc = mc1.windows.server.int
default_domain = WINDOWS.SERVER.INT
kpasswd_server = mc1.windows.server.int
admin_server = mc1.windows.server.int
}
[domain_realm]
.windows.server.int = WINDOWS.SERVER.INT
|
8. Edit Samba files to have the right configuration
/etc/samba/smb.conf
smb.conf:
workgroup = server
security = ads
realm = WINDOWS.SERVER.INT
encrypt passwords = yes
username map = /etc/samba/smbusers
winbind uid = 10000-20000
winbind gid = 10000-20000
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes
|
9. Now it's time to join the domain
net ads join -U administrator -S mc1
10. Now we need to edit the nsswitch.conf file
nano /etc/nsswitch.conf
from: nsswitch.conf:
passwd: files
shadow: files
group: files
|
to:
nsswitch.conf:
passwd: files winbind
shadow: files winbind
group: files winbind
|
11. Now it's time to start both winbind and samba services
/etc/init.d/smb start
/etc/init.d/winbind start
12. Now hopefully all that went well, to test it out lets try this comand
/usr/bin/wbinfo -g
this should display all the groups in your active directory structure.
13. Now it is time to edit dovecot pam module
nano /etc/pam.d/dovecot
Code.conf:
#%PAM-1.0
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth required pam_listfile.so onerr=fail file=/etc/postfix/usernames item=user sense=allow
auth sufficient pam_winbind.so
account required /lib/security/$ISA/pam_unix.so
account sufficient /lib/security/$ISA/pam_localuser.so
account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account required /lib/security/$ISA/pam_permit.so
password requisite /lib/security/$ISA/pam_cracklib.so retry=3
password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok
password required /lib/security/$ISA/pam_deny.so
session required /lib/security/$ISA/pam_limits.so
session required /lib/security/$ISA/pam_unix.so
auth required /lib/security/$ISA/pam_deny.so
|
14. Once that is done it's time to setup the aliases in postfix and usernames, download the following scripts.
http://www.opensourcehowto.org/uploads/scripts/getadusername_pl.txt
http://www.opensourcehowto.org/uploads/scripts/getadalias_pl.txt
http://www.opensourcehowto.org/uploads/scripts/getadusernameformap_pl.txt
15. Edit the files to suit your network
16. Now add the following in this file
nano /etc/postfix/sync-db
sync-db:
/etc/postfix/getadalias_pl.txt
/etc/postfix/getadusernameforlocalmap_pl.txt
/etc/postfix/getadusername_pl.txt
/usr/sbin/postalias hash:/etc/postfix/ldap-aliases.cf
/usr/sbin/postmap hash:/etc/postfix/usernames_forlocalmaps
|
17. Make cron run this script every 10 minutes, or whenever you want it to.
crontab -e
then place the following information into the file
31 * * * * /etc/postfix/sync-db
18. Make the files executable and then run it
chmod ug+rwx /etc/postfix/getadalias_pl.txt
/etc/postfix/getadalias_pl.txt
chmod ug+rwx /etc/postfix/getadusername_pl.txt
/etc/postfix/getadusername_pl.txt
chmod ug+rwx /etc/postfix/getadusernameforlocalmap_pl.txt
/etc/postfix/getadusernameforlocalmap_pl.txt
chmod ug+rwx /etc/postfix/sync-db
/etc/postfix/sync-db
19. Change your postfix main.cf file to look like this
nano /etc/postfix/main.cf
main.cf:
alias_maps = hash:/etc/aliases, hash:/etc/postfix/ldap-aliases.cf
local_recipient_maps = unix:passwd.byname hash:/etc/postfix/usernames_forlocalmaps
|
20. This requires Net::LDAP to be installed. To install Net::LDAP,
Download it from
http://search.cpan.org/~gbarr/perl-ldap-0.33/lib/Net/LDAP.pod
Install it
21. This script searches your active directory database to returns with the
sAMAccountName and mail attriube, strips out the unnecessary
'@example.com' and then places them in the file that you choose when
editing the script (eg: /etc/postfix/ldap-aliases.cf) in the format of
postfix aliases (aliases: username).
22. Download the 'Retrieve User Data' from the plugins section of the squirrelmail website
http://www.squirrelmail.org/plugin_view.php?id=11
and put the file in the folder
/usr/share/squirrelmail/plugins
23. Unzip the file
gzip -d retrieveuserdata.0.9-1.4.0.tar.gz
tar -xvf retrieveuserdata.0.9-1.4.0.tar
24. The to the folder '/usr/share/squirrelmail/config' and run the program
./conf.pl
23. Choose option 8 'Plugins' and then installed the retrieveuserdata plugin by selecting the number next do it, after it has
been installed choose the save option 's' then quit 'q'
25. Then go back into the plugins folder and into the retrieveuserdata folder
cd /usr/share/squirrelmail/plugins/retrieveuserdata
26. Edit the below part of your 'config.php' file to suit your network settings.
nano config.php
config.php:
$SQRUD_LDAP_FROM_MAIN_CONFIG = 0;
$SQRUD_LDAP_UID = "sAMAccountName";
$SQRUD_LDAP_USERNAME = "displayName";
$SQRUD_LDAP_MAIL = "mail"; // or "mail"
$SQRUD_LDAP_MAIL_ALIASES = "proxyaddresses";
$SQRUD_LDAP_MAIL_ALIAS_PREFIX = "smtp:";
$SQRUD_LDAP_ANONYMOUS_BIND = 0;
// $SQRUD_LDAP_BIND_RDN = "cn=moodleuser,cn=users,dc=fedora,dc=directory,dc=server";
$SQRUD_LDAP_BIND_RDN = "fedora\\SQRUD_UID"; // for Microsoft ADS
$SQRUD_LDAP_SERVER[0] = array(
'host' => 'fedora.directory.server', // hostname, required
'base' => 'dc=fedora,dc=directory,dc=server', // base distinguished name, required
'port' => '389', // port, optional
'charset' => 'utf-8' // charset, optional
|
27. Now we need to change the way squirrel mail delievers it's mail
/usr/share/squirrelmail/config/conf.pl
Choose:
2. Server Settings
Choose:
3. Sendmail or SMTP : SMTP
Choose
SMTP
Choose:
Return 'R' & then
Choose
4. General Options
Then
10. Allow editing of identity
Make Both false/false
28. Now we need to set postfix as the default MTA for the system
'alternatives --config mta'
then select postfix as your mta
29. Now it's time to set all our severs
chkconfig postfix on
/etc/init.d/potfix start
/etc/init.d/sendmail stop
rpm -qa | grep sendmail
sendmail-8.13.1-2
sendmail-cf-8.13.1-2
rpm -e sendmail-8.13.1-2
rpm -e sendmail-cf-8.13.1-2
BookMarking:
cell1
|
|
cell3 |
|
cell4
|
|
Trouble Shooting:
Go to the wiki page
Go to the 'Contact Us ' Forum
Go to the how-to's Support Forum
External Links:
http://flakshack.com/anti-spam/wiki/index.php?page=Automatically+Update+Recipient+Maps+From+Active+Directory |
