How to Build LDAP SAMBA to Primary Domain Controller (PDC)

How to Build LDAP SAMBA to Primary Domain Controller (PDC)

Step 1: DNS Service

A. Install

#cat /etc/hosts

    # Do not remove the following line, or various programs
    # that require network functionality will fail.
    192.168.44.150             server.hbn.local              server
    127.0.0.1           localhost.localdomain                localhost
    ::1                     localhost6.localdomain6             localhost6

#yum install -y bind-chroot
#chmod 755 -R /var/named/
#cp /usr/share/doc/bind-*/sample/var/named/named.local /var/named/chroot/var/named/
#cp /usr/share/doc/bind-*/sample/var/named/named.root /var/named/chroot/var/named/
#cp /usr/share/doc/bind-*/sample/var/named/localhost.zone /var/named/chroot/var/named/
#touch /var/named/chroot/etc/named.conf
#chkconfig --level 35 named on
#service named start

B. Configuration

#vim /var/named/chroot/etc/named.conf

options {
        directory "/var/named";

        forwarders {203.162.0.181; 203.162.0.11; 210.245.0.11; 210.245.0.58; 208.67.222.222; 208.67.220.220; 8.8.8.8; 8.8.4.4;};
};

zone "." IN {
        type hint;
        file "named.root";
};

zone "localhost" IN {
        type master;
        file "localhost.zone";
};

zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
};

zone "44.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.44.0.db";
};

zone "hbn.local" {
        type master;
        file "hbn.local";
};

 » save and quit

# cd /var/named/chroot/var/named/
#vim 192.168.44.0.db

$TTL    86400
@       IN      SOA     hbn.local. root.hbn.local.  (
                                      1997022700 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      3600000    ; Expire
                                      86400 )    ; Minimum
        IN      NS      ns1.hbn.local.
100           IN      PTR     dns.hbn.local.
250            IN        PTR        winxp.hbn.local.

#vim hbn.local
$TTL 14400
@       IN      SOA     root.hbn.local.      hostmaster.hbn.local. (
                                                2009102800
                                                14400
                                                3600
                                                1209600
                                                86400 )

       IN      NS      hbn.local.
       IN      NS      hbn.local.

ftp             IN      A       192.168.44.150
hbn.local.      IN      A       192.168.44.150
localhost       IN      A       127.0.0.1
mail            IN      A       192.168.44.150
pop             IN      A       192.168.44.150
smtp            IN      A       192.168.44.150
www             IN      A       192.168.44.150
dns             IN      A       192.168.44.150
ldap            IN      A       192.168.44.150
winxp           IN      A       192.168.44.250
hbn.local.      IN      MX      10 mail

hbn.local.    14400   IN      TXT     "v=spf1 a mx ip4:192.168.44.150 ~all"

# vim /etc/resolv.conf

search hbn.local
nameserver 192.168.44.150
nameserver 192.168.44.2

C. Test

# nslookup

> hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   hbn.local
Address: 192.168.44.150

> dns.hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   dns.hbn.local
Address: 192.168.44.150

> winxp.hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   winxp.hbn.local
Address: 192.168.44.250

> ldap.hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   ldap.hbn.local
Address: 192.168.44.150

> exit

Step 2: PDC with LDAP - Samba

A. Install

Add Dag repository

#wget http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt
#rpm --import RPM-GPG-KEY.dag.txt
#rm -f RPM-GPG-KEY.dag.txt
#vim /etc/yum.repos.d/dag.repo

[dag]
name=Dag RPM Repository for Red Hat Enterprise Linux
baseurl=http://apt.sw.be/redhat/el5/en/$basearch/dag/
gpgcheck=1
enabled=0

#yum --enablerepo=dag install -y openldap openldap-clients openldap-devel openldap-servers openldap-clients compat-openldap python-ldap ldapjdk php-ldap nss_ldap samba samba-common samba-client perl-Crypt-SmbHash perl-Digest-SHA1 perl-Jcode perl-Unicode-Map perl-Unicode-Map8 perl-Unicode-MapUTF8 perl-Unicode-String smbldap-tools


#cp /usr/share/doc/samba-3.0.33/LDAP/samba.schema /etc/openldap/schema/
# cd /etc/openldap/
# vim slapd.conf

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/samba.schema

» Allow LDAPv2 client connections.  This is NOT the default.

allow bind_v2

loglevel -1

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

#######################################################################
#                                 ldbm and/or bdb database definitions                             #
#######################################################################

» Indices to maintain for this database

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index sambaSID,sambaPrimaryGroupSID,sambaDomainName     eq

database        bdb
suffix          "dc=hbn,dc=local"
rootdn          "cn=Manager,dc=hbn,dc=local"

rootpw          123456

# rootpw  {crypt}ijFYNcSNctBYg

directory       /var/lib/ldap

» Access control List information

access to attrs="userPassword,sambaLMPassword,sambaNTPassword"
        by selfwrite
        by anonymous auth
» users can authenticate and change their password

access to attrs="userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,
sambaPwdMustChange"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=nssldap,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by anonymous auth
        by self write
        by * none

» some attributes need to be readable anonymously so that 'id user' can answer correctly

access to attrs=objectClass,entry,homeDirectory,uid,uidNumber,gidNumber,memberUid
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * read

» somme attributes can be writable by users themselves

access to attrs=description,telephoneNumber,roomNumber,homePhone,loginShell,gecos,cn,sn,givenname
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by self write
        by * read

» some attributes need to be writable for samba

access to attrs=cn,sambaLMPassword,sambaNTPassword,sambaPwdLastSet,sambaLogonTime,
sambaLogoffTime,sambaKickoffTime,sambaPwdCanChange,sambaPwdMustChange,
sambaAcctFlags,displayName,sambaHomePath,sambaHomeDrive,sambaLogonScript,
sambaProfilePath,description,sambaUserWorkstations,sambaPrimaryGroupSID,sambaDomainName,
sambaMungedDial,sambaBadPasswordCount,sambaBadPasswordTime,sambaPasswordHistory,
sambaLogonHours,sambaSID,sambaSIDList,sambaTrustFlags,sambaGroupType,sambaNextRid,
sambaNextGroupRid,sambaNextUserRid,sambaAlgorithmicRidBase,sambaShareName,
sambaOptionName,sambaBoolOption,sambaIntegerOption,sambaStringOption,sambaStringListoption
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by self read
        by * none

» samba need to be able to create the samba domain account

access to dn.base="dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

» samba need to be able to create new users account

access to dn="ou=Users,dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

» samba need to be able to create new groups account

access to dn="ou=Groups,dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

» samba need to be able to create new computers account

access to dn="ou=Computers,dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

access to *
        by self read
        by * none

» save and quit

#chmod 640 slapd.conf
# vim ldap.conf

BASE    dc=hbn, dc=local
URI ldap://127.0.0.1/
TLS_CACERTDIR /etc/openldap/cacerts

#cp DB_CONFIG.example /var/lib/ldap/
#cd /var/lib/ldap/
#mv DB_CONFIG.example DB_CONFIG

# /etc/init.d/ldap start
Checking configuration files for slapd:  config file testing succeeded
[  OK  ]
Starting slapd: [  OK  ]
# /etc/init.d/nscd start
Starting nscd: [  OK  ]
# chkconfig --level 35 nscd on

# setup

» run Authentication Configuration
» select Cache Information

Use LDAP
Use MD5 Passwords
Use Shadow Passwords
Use LDAP Authentication

» Press the Next button

don't select Use TLS option
Server: ldap://127.0.0.1/
Base DN: dc=hbn,dc=local

» Press OK and exit

# vim /etc/ldap.conf

host 127.0.0.1

base dc=hbn,dc=local

rootbinddn cn=manager,dc=hbn,dc=local

timelimit 120

bind_timelimit 120

idle_timelimit 3600

nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm

ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5

#net getlocalsid
SID for domain SERVER is: S-1-5-21-3926925045-1584093657-3115473201

# vim /etc/ldap.secret
123456

# chmod 600 /etc/ldap.secret

smbldap-tools configuration

# cd /etc/smbldap-tools/

# vim smbldap_bind.conf

slaveDN="cn=Manager,dc=hbn,dc=local"
slavePw="123456"
masterDN="cn=Manager,dc=hbn,dc=local"
masterPw="123456"

# vim smbldap.conf

######################

# General Configuration   #

######################

SID="S-1-5-21-3926925045-1584093657-3115473201"
sambaDomain="hbn.local"

####################
# LDAP Configuration #
####################

slaveLDAP="127.0.0.1"

# Slave LDAP port
slavePort="389"

# Master LDAP server: needed for write operations
masterLDAP="127.0.0.1"

# Master LDAP port

masterPort="389"
suffix="dc=hbn,dc=local"
usersdn="ou=Users,${suffix}"
computersdn="ou=Computers,${suffix}"
groupsdn="ou=Groups,${suffix}"
idmapdn="ou=Idmap,${suffix}"
sambaUnixIdPooldn="sambaDomainName=hbn.local,${suffix}"
scope="sub"
hash_encrypt="SSHA"
crypt_salt_format="%s"
ldapTLS="0"
and
userSmbHome="\\PDC-SRV\%U"
userProfile="\\PDC-SRV\profiles\%U"

                                                       ####################
                                                       #      Samba config      #
                                                       ####################
#vim /etc/samba/smb.conf

[global]
workgroup = hbn.local
netbios name = HBN
enable privileges = yes
#interfaces = 192.168.1.131
username map = /etc/samba/smbusers

server string = samba-ldap-pdc
security = user
encrypt passwords = Yes
admin users = root
#min passwd length = 3
obey pam restrictions = No

ldap passwd sync = Yes

log level = 0
syslog = 0
log file = /var/log/samba/log.%m
max log size = 100000

#time server = Yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
mangling method = hash2
Dos charset = 850
Unix charset = ISO8859-1

#guest account = root

logon script = logon.bat
logon drive =
logon home =
logon path =

domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
wins support = Yes

passdb backend = ldapsam:ldap://127.0.0.1

ldap admin dn = cn=Manager,dc=hbn,dc=local

ldap suffix = dc=hbn,dc=local
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
idmap backend = ldap://127.0.0.1
idmap uid = 10000-20000
idmap gid = 10000-20000
#ldap ssl = start_tls
add user script = /usr/sbin/smbldap-useradd -a '%u'
delete user script = /usr/sbin/smbldap-userdel '%u'
add group script = /usr/sbin/smbldap-groupadd -p '%g'
delete group script = /usr/sbin/smbldap-groupdel '%g'
add user to group script = /usr/sbin/smbldap-groupmod -m '%u''%g'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
add machine script = /usr/sbin/smbldap-useradd -w '%u'

#logon script = STARTUP.BAT

[homes]

comment = Home Directories
valid users = %U
read only = No
create mask = 0664
directory mask = 0775
browseable = No

[profiles]

path = /home/samba/profiles
read only = No
create mask = 0600
directory mask = 0700
browseable = No
guest ok = Yes
profile acls = Yes
csc policy = disable
force user = %U
valid users = %U @"Domain Admins"

[netlogon]
path = /home/samba/netlogon/
browseable = No
read only = yes

» save and quit
# mkdir /home/samba
# mkdir /home/samba/netlogon
# mkdir /home/samba/profiles
# chmod 1777 /home/samba/profiles
#smbpasswd -w 123456

» Setting stored password for "cn=Manager,dc=hbn,dc=local" in secrets.tdb

# smbldap-populate

Populating LDAP directory for domain hbn.local (S-1-5-21-3926925045-1584093657-3115473201)
(using builtin directory structure)

adding new entry: dc=hbn,dc=local
adding new entry: ou=Users,dc=hbn,dc=local
adding new entry: ou=Groups,dc=hbn,dc=local
adding new entry: ou=Computers,dc=hbn,dc=local
adding new entry: ou=Idmap,dc=hbn,dc=local
adding new entry: uid=root,ou=Users,dc=hbn,dc=local
adding new entry: uid=nobody,ou=Users,dc=hbn,dc=local
adding new entry: cn=Domain Admins,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Domain Users,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Domain Guests,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Domain Computers,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Administrators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Account Operators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Print Operators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Backup Operators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Replicators,ou=Groups,dc=hbn,dc=local
adding new entry: sambaDomainName=hbn.local,dc=hbn,dc=local

Please provide a password for the domain root:
Changing UNIX and samba passwords for root
New password:
Retype new password:

# vim dsa.ldif

dn: ou=DSA,dc=hbn,dc=local
objectClass: top
objectClass: organizationalUnit
ou: DSA
description: security accounts for LDAP clients


dn: cn=samba,ou=DSA,dc=hbn,dc=local
objectclass: organizationalRole
objectClass: top
objectClass: simpleSecurityObject
userPassword: sambasecretpwd
cn: samba


dn: cn=nssldap,ou=DSA,dc=hbn,dc=local
objectclass: organizationalRole
objectClass: top
objectClass: simpleSecurityObject
userPassword: nssldapsecretpwd
cn: nssldap


dn: cn=smbtools,ou=DSA,dc=hbn,dc=local
objectclass: organizationalRole
objectClass: top
objectClass: simpleSecurityObject
userPassword: smbtoolssecretpwd
cn: smbtools

# ldapadd -x -h localhost -D "cn=Manager,dc=hbn,dc=local" -f dsa.ldif -W

Enter LDAP Password: 

adding new entry "ou=DSA,dc=hbn,dc=local"

adding new entry "cn=samba,ou=DSA,dc=hbn,dc=local"

adding new entry "cn=nssldap,ou=DSA,dc=hbn,dc=local"

adding new entry "cn=smbtools,ou=DSA,dc=hbn,dc=local"

#ldappasswd -x -h localhost -D "cn=Manager,dc=hbn,dc=local" -s password -W
cn=samba,ou=DSA,dc=hbn,dc=local

# /etc/init.d/smb start
Starting SMB services: [  OK  ]
Starting NMB services: [  OK  ]

Now create a samba user account for UNIX and SAMBA

# smbldap-useradd -a -m namhb
# smbldap-passwd namhb
Changing UNIX and samba passwords for namhb
New password:
Retype new password:

Now create a machine trust account
# smbldap-useradd -w winxp

PostFix Mail Server How to Record All Incoming & Outgoing Mails To Seperate Email Addresses

In this post I am going to explain how to record/archive all the incoming and outgoing emails from a postfix system to two different email addresses.

I have a CentOS 6.3 x86_64 Minimal install system. In CentOS 6, postfix is installed and will be running by default.

Pre-requesites:
1) Working DNS Server : Incase you dont know how to configure, please look at this link to configure BIND DNS Serverhttp://easylinuxtutorials.blogspot.in/2011/11/setting-up-dns-server-in-rhel-6.html

2) Postfix must be installed. Incase its not installed then
[root@mail ~]# yum install postfix -y

Edit the Postfix Configuration file
[root@mail ~] # vim /etc/postfix/main.cf
myhostname = mail.example.com 
mydomain = example.com 
myorigin = $mydomain 
inet_interfaces = $myhostname, localhost
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 192.168.124.0/24, 127.0.0.0/8
mynetworks_style = subnet
sender_bcc_maps = hash:/etc/postfix/outgoing 
recipient_bcc_maps = hash:/etc/postfix/incoming

Create two users inmails and outmails and assign passwords for them
[root@mail ~]# useradd inmails
[root@mail ~]# echo "redhat" | passwd --stdin inmails 
[root@mail ~]# useradd outmails
[root@mail ~]# echo "redhat" | passwd --stdin outmails 

Create two file inside the postfix configuration directory
[root@mail ~]# vim /etc/postfix/incoming
@example.com          inmails@example.com

[root@mail ~]# vim /etc/postfix/outgoing
@example.com          outmails@example.com

Create the postfix lookup table using the postmap command. Postmap is utility program that will convert/etc/postfix/incoming to /etc/postfix/incoming.db in Berkley DB format, so that Postfix can access the data faster.
[root@mail ~]# postmap /etc/postfix/incoming
[root@mail ~]# postmap /etc/postfix/outgoing

Restart the postfix service and make service available during startup
[root@mail ~]# service postfix restart

Test the configuration by sending a mail to any user on the system it will recorded in inmails user mailbox and outmails user mailbox as well.

Implementing Password Policies in OpenLDAP Server In Linux

In this post I am going to show you how to configure password policies in OpenLDAP server. The ppolicy overlay module provides some better functionalities for enforcing password policies within our OpenLDAP Server domain.

ppolicy module and schema is by installed by default with openldap-servers package in CentOS 6.4

Copy the below text into /etc/openldap/slapd.conf at the end of the file 
[root@ldap1 ~]# vim /etc/openldap/slapd.conf
# Uncomment the module in the modules section
moduleload ppolicy.la  
# Password Policy Configuration
overlay ppolicy
ppolicy_default "cn=default,ou=Policies,dc=example,dc=com"
ppolicy_use_lockout
ppolicy_hash_cleartext

# ACL Entry for Password Policies
access to attrs=userPassword
        by self write
        by anonymous auth
        by * none
access to *
        by self write
        by * read

Convert the slapd.conf to cn=config format and re-initialize the slapd.d folder
[root@ldap1 ~]# rm -rf /etc/openldap/slapd.d/* 
[root@ldap1 ~]# slaptest -u 
[root@ldap1 ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/

Change the permissions on the /etc/openldap/slapd.d/ to ldap
[root@ldap1 ~]# chown -R ldap. /etc/openldap/slapd.d/  

Restart the slapd service
[root@ldap1 ~]# service slapd restart 

Create a LDIF file with the details as below
[root@ldap1 ~]# vim pwdpolicy.ldif
# Creates a Policies OU (Organizational Unit)
dn: ou=Policies,dc=example,dc=com
objectClass: organizationalUnit
ou: Policies

# Creates a Policy object in Policies OU (Organizational Unit)
dn: cn=default,ou=Policies,dc=example,dc=com
objectClass: top
objectClass: device
objectClass: pwdPolicy
cn: default
pwdAttribute: userPassword
pwdMaxAge: 3888000
pwdExpireWarning: 604800
pwdInHistory: 3
pwdCheckQuality: 1
pwdMinLength: 8
pwdMaxFailure: 5
pwdLockout: TRUE
pwdLockoutDuration: 86400
pwdGraceAuthNLimit: 0
pwdFailureCountInterval: 0
pwdMustChange: TRUE
pwdAllowUserChange: TRUE
pwdSafeModify: FALSE 

Add the ldif file created to the DIT using ldapadd command
[root@ldap1 ~]# ldapadd -x -D "cn=manager,dc=example,dc=com" -wredhat -f pwdpolicy.ldif

Password policy is turned on for all accounts

The above definition of password policy as below
pwdMaxAge: Number of days users password is valid for i.e 3888000 seconds (45 days)
pwdExpireWarning: No. of days before to warn the user (7 days)
pwdInHistory: No. of password that are kept in history which can't be used continously
pwdCheckQuality: If it is 0, we can use plain passwords, if it is 1 then password should be complex i.e. combination of numbers and alpahbets and special characters
pwdMinLength: Defines the minimum number of characters for setting the password. It can't be less than 8 characters here
pwdMaxFailure: If user tries to enter incorrect password for 5 times then his/her account will be locked
pwdLockoutDuration: Defines the time the account will be locked ie. 1 day. This setting will be valid only if pwdLockout is set to TRUE

For more information and settings on password policy please refer to this link below
http://www.zytrax.com/books/ldap/ch6/ppolicy.html

Localy Setup Mail Server using Postfix, Dovecot and Squirrel Mail in Linux

Postfix is a free open source mail transfer agent (MTA). It is easy to administer, fast and as well as the secure MTA. It’s an alternative to Sendmail, which is the default MTA for RHEL.

Well, let us see how to setup a basic local mail server using Postfix, Dovecot and Squirrelmail On CentOS 6.5, although it should work on RHEL, Scientific Linux 6.x series.

For this tutorial, I use CentOS 6.5 32 bit minimal installation, with SELinux disabled. My test box details are given below.

OS : CentOS 6.5 32 bit Minimal Installation (fresh installation)
IP Address : 192.168.1.101/24
Hostname: server.unixmen.local

Prerequisites

1. Remove default MTA sendmail first if it’s already installed. Sendmail will not be installed by default in minimal installation, so you can skip this step.

# yum remove sendmail

2. Setup DNS server and add the Mail server MX records in the forward and reverse zone files. To install and configure DNS server, navigate to this link. And you’ll need to contact your ISP to point your external static IP to your mail domain.

3. Add hostname entries in /etc/hosts file as shown below:

# vi /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.101   server.unixmen.local      server

4. I disabled SELinux to reduce complexity in postfix configuration.

If you want to keep SELinux on, enter the following command in Terminal:

# togglesebool httpd_can_network_connect

Note: I didn’t check it and disabled SELinux completely. It was suggested by one of theunixmen regular reader Mr. Bob. I appreciate and thank him for the helpful tip.

5. Install EPEL Repository:

We will use Squirrelmail for webmail client. Squirrelmail will not be found on CentOS officialrepositories, so let us enable EPEL repository. Follow the below link to install and enable EPEL repository.

- Install EPEL Repository On CentOS / RHEL / Scientific Linux 6

6. Allow the Apache default port 80 through your firewall/router:

# vi /etc/sysconfig/iptables

[...]
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
[...]

Install Postfix

Let us install postfix package using the command:

# yum install postfix -y

Configuring Postfix

Edit /etc/postfix/main.cf,

# vi /etc/postfix/main.cf

find and edit the following lines:

## Line no 75 - Uncomment and set your mail server FQDN ##
myhostname = server.unixmen.local

## Line 83 - Uncomment and Set domain name ##
mydomain = unixmen.local

## Line 99 - Uncomment ##
myorigin = $mydomain

## Line 116 - Set ipv4 ##
inet_interfaces = all

## Line 119 - Change to all ##
inet_protocols = all

## Line 164 - Comment ##

#mydestination = $myhostname, localhost.$mydomain, localhost,

## Line 165 - Uncomment ##\
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

## Line 264 - Uncomment and add IP range ##
mynetworks = 192.168.1.0/24, 127.0.0.0/8

## Line 419 - Uncomment ##
home_mailbox = Maildir/

Save and exit the file. Start/restart Postfix service now:

# service postfix restart
# chkconfig postfix on

Testing Postfix mail server

First, create a test user called “SK“.

# useradd sk
# passwd sk

Access the server via Telnet and enter the commands manually shown in red colored text.

# telnet localhost smtp

Trying ::1...
Connected to localhost.
Escape character is '^]'.
220 server.unixmen.local ESMTP Postfix
ehlo localhost     ## type this command ##
250-server.unixmen.local
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:<sk>     ## Type this - mail sender address##
250 2.1.0 Ok
rcpt to:<sk>     ## Type this - mail receiver address ##
250 2.1.5 Ok
data     ## Type this to input email message ##
354 End data with <CR><LF>.<CR><LF>
welcome to unixmen mail server     ## Enter the boddy of the email ##.
     ## type dot (.) to complete message ##
250 2.0.0 Ok: queued as B822221522
quit     ## type this to quit from mail ##
221 2.0.0 Bye
Connection closed by foreign host.

Now navigate to the user “sk“ mail directory and check for the new mail:

# ls /home/sk/Maildir/new/

Sample output:

1390215275.Vfd00Ie04f8M357080.server.unixmen.local

A new mail is received to the user “sk“. To read the mail, enter the following command:

# cat /home/sk/Maildir/new/1390215275.Vfd00Ie04f8M357080.server.unixmen.local 

Sample output:

Return-Path: <sk@unixmen.local>
X-Original-To: sk
Delivered-To: sk@unixmen.local
Received: from localhost (localhost [IPv6:::1])
    by server.unixmen.local (Postfix) with ESMTP id B822221522
    for <sk>; Mon, 20 Jan 2014 16:23:54 +0530 (IST)
Message-Id: <20140120105404.B822221522@server.unixmen.local>
Date: Mon, 20 Jan 2014 16:23:54 +0530 (IST)
From: sk@unixmen.local
To: undisclosed-recipients:;

welcome to unixmen mail server

Installing Dovecot

Dovecot is an open source IMAP and POP3 mail server for Unix/Linux systems. To install:

# yum install dovecot

Configuring Dovecot

Edit the file /etc/dovecot/dovecot.conf file,

# vi /etc/dovecot/dovecot.conf

Uncomment the following line:

## Line 20 - umcomment ##
protocols = imap pop3 lmtp

Edit file /etc/dovecot/conf.d/10-mail.conf file

# vi /etc/dovecot/conf.d/10-mail.conf 

Make the changes as shown below:

## Line 24 - uncomment ##
mail_location = maildir:~/Maildir

Edit /etc/dovecot/conf.d/10-auth.conf

# vi /etc/dovecot/conf.d/10-auth.conf 

And make the changes as shown below:

## line 9 - uncomment##
disable_plaintext_auth = yes

## Line 97 - Add a letter "login" ##
auth_mechanisms = plain login

Edit file /etc/dovecot/conf.d/10-master.conf,

# vi /etc/dovecot/conf.d/10-master.conf 

Make changes as shown below:

## Line 83, 84 - Uncomment and add "postfix"
#mode = 0600
   user = postfix
   group = postfix

Start Dovecot service:

# service dovecot start
# chkconfig dovecot on

Testing Dovecot

It’s time to test Dovecot configuration. Enter the following command in Terminal:

# telnet localhost pop3

Enter the commands manually marked in red color:

Trying ::1...
Connected to localhost.
Escape character is '^]'.
+OK Dovecot ready.
user sk     ## log in as user sk ##
+OK
pass centos     ## input user password ##
+OK Logged in.
retr 1
+OK 439 octets
Return-Path: <sk@unixmen.local>
X-Original-To: sk
Delivered-To: sk@unixmen.local
Received: from localhost (localhost [IPv6:::1])
    by server.unixmen.local (Postfix) with ESMTP id B822221522
    for <sk>; Mon, 20 Jan 2014 16:23:54 +0530 (IST)
Message-Id: <20140120105404.B822221522@server.unixmen.local>
Date: Mon, 20 Jan 2014 16:23:54 +0530 (IST)
From: sk@unixmen.local
To: undisclosed-recipients:;

welcome to unixmen mail server
.
quit
+OK Logging out.
Connection closed by foreign host.

As you see in the above, Dovecot is working!

Working with mail in command modes little bit difficult for us. So we will install a webmail client called Squirrelmail to send/receive emails via a web browser.

Installing Squirrelmail

Make sure that you’ve installed and enabled EPEL repository. Now install Squirrelmail using the following command:

# yum install squirrelmail -y

Configuring Squirrelmail

Navigate to /usr/share/squirrelmail/config/ directory and run the command conf.pl:

# cd /usr/share/squirrelmail/config/
# ./conf.pl

The following wizard will open. Enter choice “1″ to set your organization details:

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> 1

The following wizard will open. Enter “1″ again to modify your organization details:

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Organization Preferences
1.  Organization Name      : SquirrelMail
2.  Organization Logo      : ../images/sm_logo.png
3.  Org. Logo Width/Height : (308/111)
4.  Organization Title     : SquirrelMail $version
5.  Signout Page           : 
6.  Top Frame              : _top
7.  Provider link          : http://squirrelmail.org/
8.  Provider name          : SquirrelMail

R   Return to Main Menu
C   Turn color off
S   Save data
Q   Quit

Command >> 1

Set your Organization name and press Enter:

We have tried to make the name SquirrelMail as transparent as
possible.  If you set up an organization name, most places where
SquirrelMail would take credit will be credited to your organization.

If your Organization Name includes a '$', please precede it with a \. 
Other '$' will be considered the beginning of a variable that
must be defined before the $org_name is printed.
$version, for example, is included by default, and will print the
string representing the current SquirrelMail version.

[SquirrelMail]: Unixmen

By this way, setup all the details such as organization title, logo, provider name in the above wizard. Once you done, press “S” to save changes and press “R” to return back to your main menu:

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Organization Preferences
1.  Organization Name      : Unixmen
2.  Organization Logo      : ../images/sm_logo.png
3.  Org. Logo Width/Height : (308/111)
4.  Organization Title     : SquirrelMail $version
5.  Signout Page           : 
6.  Top Frame              : _top
7.  Provider link          : http://squirrelmail.org/
8.  Provider name          : Unixmen Mail

R   Return to Main Menu
C   Turn color off
S   Save data
Q   Quit

Command >> s

Now enter “2″ to setup mail Server settings such as domain name and mail agent etc.:

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> 2

Enter “1″, Enter your mail domain (ex. unixmen. local) and press Enter key.

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Server Settings

General
-------
1.  Domain                 : localhost
2.  Invert Time            : false
3.  Sendmail or SMTP       : Sendmail

A.  Update IMAP Settings   : localhost:143 (uw)
B.  Change Sendmail Config : /usr/sbin/sendmail

R   Return to Main Menu
C   Turn color off
S   Save data
Q   Quit

Command >> 1
The domain name is the suffix at the end of all email addresses.  If
for example, your email address is jdoe@example.com, then your domain
would be example.com.

[localhost]: unixmen.local

Enter “3″ and change from sendmail to Postfix MTA (i.e. SMTP):

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Server Settings

General
-------
1.  Domain                 : unixmen.local
2.  Invert Time            : false
3.  Sendmail or SMTP       : Sendmail

A.  Update IMAP Settings   : localhost:143 (uw)
B.  Change Sendmail Config : /usr/sbin/sendmail

R   Return to Main Menu
C   Turn color off
S   Save data
Q   Quit

Command >> 3

Enter “2″ to switch from sendmail MTA to postfix.

You now need to choose the method that you will use for sending
messages in SquirrelMail.  You can either connect to an SMTP server
or use sendmail directly.

  1.  Sendmail
  2.  SMTP
Your choice [1/2] [1]: 2

Now enter “S” followed by “Q” to save and exit Squirrelmail configuration.

Create a squirrelmail vhost in apache config file:

# vi /etc/httpd/conf/httpd.conf 

Add the following lines at the end:

Alias /squirrelmail /usr/share/squirrelmail
<Directory /usr/share/squirrelmail>
    Options Indexes FollowSymLinks
    RewriteEngine On
    AllowOverride All
    DirectoryIndex index.php
    Order allow,deny
    Allow from all
</Directory>

Restart the Apache service:

# service httpd restart

Create users

Create some users for testing. In my case i create two users called “senthil“ and “kumar“respectively.

# useradd senthil
# useradd kumar
# passwd senthil
# passwd kumar

Access Webmail

Now navigate to http://ip-address/webmail or http://domain-name/webmail from your browser. The following screen should appear. Enter the username and password of the user.

Now you’ll be able to access the user senthil mail box. Let us compose a test mail from user“senthil“ to user “kumar“. Click on the Compose link on the top. Enter the recipient mail id (ex. kumar@unixmen.local), subject and body of the mail and click Send.

Now log out from user “senthil“ and log in to user “kumar“ mail and check for any new mail.

Hurrah! We have got a new mail from senthil@unixmen.local mail id. To read the mail, click on it. You’ll now be able to read, reply, delete or compose a new mail.

That’s it for now. We’ve successfully configured a local mail server that will serve in/out mails within a local area network. But i want to configure a public mail server to send and receive mails to outside of our LAN, what should i do? That’s not that difficult either.

You should configure mail server with a public IP and request your ISP to put the MX record of your mail server into their DNS server and you’re done! Everything will be same as idescribed above.