Create the Virtual Mail User Account

1. Create a new user, we will call it vmail. Change the Login Shell to /sbin/nologin, this user account should not be used for logging in. Learn how to use the User Manager application here.

2. Take note of the User ID and Home Directory of vmail.

3. Click the Groups tab and now note down the Group ID of vmail. We’ll be needing all of them later.

Configuring Postfix and Dovecot

1. Edit the file /etc/postfix/main.cf and add the lines below.

virtual_transport = dovecot
virtual_mailbox_domains = $mydomain

2. Edit the file /etc/dovecot.conf and add the lines below.

userdb static {
  args = uid=501 gid=501 home=/home/vmail/%u allow_all_users=yes
}

socket listen {
  master {
    path = /var/run/dovecot/auth-master
    mode = 0600
    user = vmail
    group = vmail
  }
}

uid, gid and home should contain the user id, group id and home directory respectively of the vmail user account.

Comment out all the other passdb and userdb sections except for those specified above to ensure that nothing will conflict with our virtual accounts setting.

3. Restart the Postfix or MailScanner service if you have installed it. Do the same for Dovecot. Learn how to start and stop services here.

If you encounter any problems, check the log file at /var/log/maillog.

Configuring SquirrelMail

1. From a Terminal window, type in /usr/share/squirrelmail/config/conf.pl and press Enter. This will launch the SquirrelMail Configuration utility.

If your Terminal window has a white background, make sure that the colors are off by looking for the command Turn color on. If the command is Turn color off, type in C and press Enter to turn the colors off. This will ensure that you will be able to read all of the text.

2. Type in 1 and press Enter to select the Organization Preferences menu.

3. Update the options to suit your needs. For the logo, put it into the /usr/share/squirrelmail/images/ directory. Save your changes when you are done.

4. Try out the result.

Creating an LDAP entry

1. Create a new organizational unit called Services that will hold all your services.

2. Select the Services organizational unit. Right click an empty space in the right pane, select New then click Other.

3. In the New Object window, select ipservice and click OK.

4. Fill in the Full name, ipserviceport and ipserviceprotocol and click the Change button.

5. In the Change Naming Attribute window, check cn and uncheck ipserviceprotocol. Click the OK button to close the Change Naming window and click OK again to close the Property Editor window.

6. You should now have a service entry.

Configuring the Client

1. Edit the file /etc/ldap.conf and update at least the items below with the appropriate values for your environment.

host ldap.acme.local
base dc=acme,dc=local
nss_base_services ou=Services,dc=acme,dc=local?one

2. Edit the file /etc/nsswitch.conf and add ldap in the services entry. This will tell the system to also look in the LDAP server when enumerating the list of service.

3. To test, type in the command below. You should be able to see the entry you added.

getent services

This article describes how to configure Postfix to act as a backup MX server.

Configuring Postfix

1. Edit the file /etc/postfix/main.cf and update the lines below.

mynetworks = 127.0.0.0/8
relay_domains = $mydestination acme.local
smtpd_recipient_restrictions = permit_mynetworks, 
    reject_unauth_destination
transport_maps = hash:/etc/postfix/transport

Replace acme.local with your own domain name.

2. Edit the file /etc/postfix/transport and add the line below.

acme.local :[192.168.3.1]

Replace acme.local with your own domain name and 192.168.3.1 with the hostname or IP address of your primary mail server.

3. Type the line command below to create a transport database file.

postmap /etc/postfix/transport

4. Restart the Postfix or MailScanner service if you have installed it. Learn how to start and stop services here.

5. You should now be able to send mails to your backup mail server and those mails will be automatically forwarded to your primary mail server. See Test Postfix using Telnet.

Backup MX Notes

It is easy to setup a backup mail server but you also need to consider the items below.

• Add DNS MX Record. In order for your backup mail server to be identified over the internet, you need to add a lower priority DNS MX record. A higher number means lower priority.

  Domain	TTL	Priority	Mail Server Name
  acme.local	86400	10	mail.acme.local
  acme.local	86400	20	mail2.acme.local

• Add Antivirus and Antispam Filtering. Make sure to have the same or better virus and spam protection in your backup mail server as you have in your primary mail server. Otherwise, viruses and spams will be entering your inbox through the backdoor.

• Verify Recipient. If possible, you also need to apply the same recipient verification method you used in your primary mail server. This will allow your backup mail server to reject all invalid recipient address instead of having the primary mail server bounce the forwarded emails with invalid recipients. Use the relay_recipient_maps setting in /etc/postfix/main.cf to specify the valid recipients.

• Relay Only. In your /etc/postfix/main.cf, make sure the relay domain is not found in mydestination, virtual_alias_domains and virtual_mailbox_domains. Otherwise, the backup mail server will not forward emails to the primary mail server and will instead store it into its own mailbox.

• Use IP Address. By specifying the hostname or IP address in the transport file, the DNS MX lookup can be eliminated. Specifying the IP address will be even better since this will eliminate the need for any DNS lookup. It will also avoid relay loopback problems if you are using port forwarding in your backup mail server.

• Flush Mail Queue. You can force Postfix to immediately send all the mail in its queue by typing in the command below. This useful after bringing the primary mail server back online to eliminate the waiting period for the backup mail server to resend mails in its queue.

  postfix flush
  

1. The sender uses a Mail User Agent (MUA) to compose an email. An MUA, often referred to as a mail client, is a program that allows a user to compose, send and receive email. See a list of mail clients and how to configure them.

2. The mail is sent to a Mail Transfer Agent (MTA) which is responsible for sending the email to the receipient’s MTA. An MTA transfers mail messages between computers via the SMTP protocol. Postfix, Sendmail, Exim and Qmail are examples of an MTA.

3. The recipient’s MTA receives the email and passes it on to a Mail Delivery Agent (MDA). An MDA manages the user’s mailbox and handles mails for delivery to the MUA using either the POP or IMAP protocol.

   • POP (Post Office Protocol)
     Although most mail clients have an option to Leave a copy on the server, POP is generally used to download all messages from the mailbox, store them on the user’s PC as new messages and delete them from the server.

   • IMAP (Internet Message Access Protocol)
     Allows users to view their mailboxes on the server and to delete mail only when told to do so.

   Mbox and Maildir are two common mailbox formats used in Unix. Dovecot, Cyrus and Courier are examples of an MDA.

4. The recipient uses an MUA to check and retrieve messages from the MDA.

Configuring SSL Connection

1. Make sure SSL is enabled in Active Directory. Learn how to enable LDAP SSL in Active Directory.

2. Export a base-64 encoded SSL certificate from your Active Directory Server.

3. Make sure SSL is enabled in 389 Directory Server. Learn how to enable LDAP SSL in 389 Directory Server.

4. Install the exported SSL certificate into 389 Directory Server.

Testing SSL Connection

1. Type the command below to test if you can do a plain LDAP connection to your Active Directory server. You’ll be asked for the password of the user account you specified in the -D option.

/usr/lib/mozldap/ldapsearch -b "dc=acme,dc=local" 
-h server.acme.local -R 
-D "cn=fds,cn=users,dc=acme,dc=local" 
-w - "objectclass=*"

Replace the value after -b with your search base, the value after -h with your server hostname and the value after -D with the distinguished name of a user account having read/write access to your Active Directory server.

2. Type the command below to test if you can do an SSL enabled LDAP connection to your Active Directory server.

/usr/lib/mozldap/ldapsearch -b "dc=acme,dc=local" 
-h server.acme.local -R 
-D "cn=fds,cn=users,dc=acme,dc=local" 
-w - -Z -P /etc/dirsrv/slapd-mail "objectclass=*"

Replace the value after -P with the settings path of your 389 Directory server.

If the two test above succeeds, you can use SSL connection to synchronize with Active Directory.

Troubleshooting

If the output from the test above contains

• Invalid credentials
  

  Check the distinguished name of the user account after the -D option and the bind password for it. To check the distinguished name, type the command below.

  /usr/lib/mozldap/ldapsearch -b "dc=acme,dc=local" -h server 
  -R -D "ACME\fds" -w - "samaccountname=fds" DN
  

  Replace the value ACME with your own domain and fds with your own user name. It will output the distinguished name of the user name you specified.

• TCP connection reset by peer
  

  Check the host name you specified after -h. If the host name is correct, check the firewall.

• security library: bad database
  

  Make sure SSL is enabled in 389 Directory Server. And check the path you specified after -P.

• Encountered end of file
  

  After configuring SSL in Active Directory, you probably did not reboot your Active Directory server. Reboot your AD server to complete the changes and try the test again.

• Peer’s Certificate has expired
  

  Make sure the system clock is synchronized in the Linux server and the Active Directory server. And the check the certificate, it may indeed be expired.

• Peer’s certificate issuer has been marked as not trusted by the user
  

  Check the trust setting you specified in the certificate of the 389 Directory server. Making connections to other servers should be checked.

1. Click System, select Administration and click Date & Time.

2. In the Date/Time Properties window, click the Network Time Protocol tab.

3. Check Enable Network Time Protocol. Next click Show advanced options and check Synchronize system clock before starting service. Finally, click OK.

You can also do this from the command line, below are the equivalent commands. You need to have root level access to use the commands below.

• /usr/sbin/ntpdate pool.ntp.org
  immediately synchronizes the system clock. Make sure the ntpd service is not running before using this command.
• /sbin/service ntpd start
  starts the ntpd service
• /sbin/service ntpd stop
  stops the ntpd service
• /etc/ntp.conf
  the above is not a command, it is the location of the ntpd configuration file

Installing BIND

The steps below will install the chrooted BIND and the GUI configuration tool.

1. Type in the command below to install BIND.

yum install bind-chroot system-config-bind

2. Start the named service. Learn how to start and stop services.

3. Open the TCP port 53 and UDP port 53. Learn how to configure the firewall.

Configuring BIND

The steps shows how to configure BIND using the GUI configuration tool.

1. Click System, select Administration and click Domain Name System. This will launch the BIND Configuration GUI window.

2. Click Ok to initialize BIND with default values.

3. BIND has now been initialized. We can now create a DNS zone and add DNS records.

Creating a DNS Zone

The steps below will show you how to create a DNS zone named “acme.local”.

1. To create a DNS zone, right click DNS Server, select Add and click Zone.

2. In the New Zone window, click the Ok button under Class.

3. Next, click the Ok button under Origin Type.

4. Provide the name of the zone and click Ok.

5. Review the various settings and click Ok.

6. Click Save and click Yes.

7. You now have a new DNS zone.

Creating DNS Records

The steps below describes how to create some of the most common DNS records.

Creating an A record

An A record maps a hostname to its IPv4 address.

1. Right click the zone you where you want to add an A record, select Add and click A IPv4 Address.

2. Specify the Domain Name and IPv4 Address and click Ok.

3. Click Save and click Yes.

Creating a CNAME record

A CNAME record specifies that a domain name is an alias of another domain name.

1. Right click the zone you where you want to add a CNAME record, select Add and click CNAME Alias.

2. Specify the Domain Name and Canonical Name (target domain name) and click Ok.

3. Click Save and click Yes.

Creating an MX record

An MX record specifies how Internet e-mail should be routed using SMTP.

1. Right click the zone you where you want to add an MX record, select Add and click MX Mail Exchange.

2. Specify the Mail Server Name and click Ok.

3. Click Save and click Yes.

Testing BIND

To test your BIND setup, you can use the nslookup and dig utility.

1. Type the command below in a terminal window to use nslookup

nslookup mail.acme.local localhost

Replace mail.acme.local with the domain you want to check. If your DNS server is not on localhost then change it.

2. Type in the command below to query any records using dig.

dig @localhost acme.local ANY

Replace acme.local with your own domain. If your DNS server is not on localhost then change it.

Installing JXplorer

1. Install the Java Runtime Environment.

2. Download the JXplorer deploy bz2 archive at http://sourceforge.net/projects/jxplorer/files/

3. Double click the downloaded file to launch the Archive Manager.

4. Click the Extract button to launch the Extract window.

5. Change the destination folder by clicking on Desktop. In the popup menu, select Other….

6. Click the notepad button and in the Location field type in /opt/ and click Open.

7. Click the Extract button to start extracting

8. Type in the commands below in a terminal window to give the proper permission to JXplorer.

Starting JXplorer

1. Type in the commands below in a terminal window to launch JXplorer.

cd /opt/jxplorer
./jxplorer.sh

2. In JXplorer, click the connect button located in the upper left of the window.

3. Fill in the connection information and click Ok.

4. That’s it, it’s working.