Scalix mit Debian Etch

Vorbereitung

Ich habe Scalix in einer XEN-DomU installiert. Das ist natürlich optional. Ausserdem verwendet Scalix sendmail anstatt Exim als smtp-daemon. Analog zur Exim Installation habe ich sendmail in einer Dual-sendmail Konfiguration zusammen mit amavisd-new installiert, welche spamassassin und clamav als Spam- und Virenscanner integriert.

Etch Installation in XEN DomU

Ich starte mit der Installation auf einer frischen Etch-Installation unter XEN. Der Einfachheit halber benutze ich die xen-tools.

apt-get install xen-tools
vi /etc/xen-tools/xen-tools.conf
#
# ...
lvm = vg
debootstrap = 1
#
##
#  Disk and Sizing options.
##
#
size   = 4Gb      # Disk image size.
memory = 128Mb    # Memory size
swap   = 128Mb    # Swap size
# noswap = 1      # Don't use swap at all for the new system.
fs     = ext3     # use the EXT3 filesystem for the disk image.
dist   = etch     # Default distribution to install.
image  = sparse   # Specify sparse vs. full disk images.
dhcp = 1
#
# Default kernel and ramdisk to use for the virtual servers
#
kernel = /boot/vmlinuz-2.6.18-4-xen-686
initrd = /boot/initrd.img-2.6.18-4-xen-686
#
# The default mirror for debootstrap which can be used to install
# Debian Sid, Sarge, and Etch.
#
mirror = http://ftp.de.debian.org/debian/
# ...

Etch-DomU Image erstellen und anschliessend starten

xen-create-image --hostname=scx
vi /etc/xen/scx.cfg
xm create -c /etc/xen/scx.cfg
...

vi /etc/network/interfaces
  post-up ethtool -K eth0 tx off
# uncomment ethtool
# post-up ethtool -K eth0 tx off

Zusätzliche Pakete installieren

Jetzt die für Scalix zusätzlich notwendigen Pakete installieren:

• Apache, Sendmail
• Postgres
• Kerberos
• SASL2
• diverse Libraries
• Sun Java
• gawk, wget, elinks, ethtool, less, host
• libmilter0 (ab 11.4.2, wird aber nicht unbedingt verwendet)

apt-get install -u apache2 sendmail sendmail-doc
apt-get install -u postgresql
apt-get install -u krb5-config krb5-doc krb5-user libkadm55 libkrb53
apt-get install -u libsasl2-modules libsasl2-gssapi-mit sasl2-bin libssl0.9.7
apt-get install -u libxml2 libglib2.0-0 libstdc++2.10-glibc2.2 libstdc++5
apt-get install -u sun-java5-jre
apt-get install -u gawk elinks wget w3m less ethtool host bzip2
apt-get install -u libmilter0

Folgendes habe ich anschliessend angepasst (siehe unten):

• Sendmail-Dual Konfiguration
• Smarthost, MasqueradeAs
• Amavisd-new, Clamav, Spamassassin integrieren

Ich fange mit Sendmail, Amavisd-new, Spamassassin und Clamav an.

Sendmail unter Debian Etch

Unter Debian ist standardmässig Exim als Maildaemon installiert. Scalix verwendet und konfiguriert sendmail.

Hier beschreibe ich meine sendmail Installation unter Debian Etch zusammen mit amavisd-new, clamav und spamassassin.

Wenn die Email-Konfiguration mit sendmail funktioniert, kann Scalix installiert werden. Scalix passt die sendmail Konfiguration so an, dass Emails an den Mail-Server Scalix ausgeliefert werden.

Scalix Installation

Sourcen laden

Sourcen laden (82MB) und unter /usr/src auspacken:

cd /usr/src
wget http://downloads.scalix.com/.community/11.0.4/scalix-11.0.4-GA-debian-intel.tgz
tar xvzf scalix-11.0.4-GA-debian-intel.tgz

Installation

Das Pakage von 11.0.4 war bei mir korrupt, in einem Tomcat-Paket ist ein Syntaxfehler. Den behebe ich zuerst:

cd /usr/src/scalix-debian-11.0.4-GA/software/scalix_server
mkdir -p new/DEBIAN old
mv scalix-tomcat_5.5.16-263_all.deb old 
dpkg -x old/scalix-tomcat_5.5.16-263_all.deb new
dpkg -e old/scalix-tomcat_5.5.16-263_all.deb new/DEBIAN

vi new/DEBIAN/postinst
# ... Zeile 21 die überflüssige ')' entfernen
    /opt/scalix-tomcat/bin/sxtomcat-create-instance ""
# ...

dpkg -b new scalix-tomcat_5.5.16-263_all_patched.deb

Jetzt kann man die Scalix-Pakete installieren (update siehe auch hier):

/usr/src/scx-install.sh

#!/bin/bash

set -e

# Admin password (sxadmin)
admpwd=geheim

# JAVA Memory usage (ca. 50% of RAM)
java_mem=128

# default configuration variables
host=$(hostname)
mnode=$host
ldappwd=$admpwd
dbpwd=$admpwd
ldomain=$(hostname -d)
fqdn=$(hostname -f)
short=${host:0:1}${host: -1:1}
ip=`ifconfig eth0|grep 'inet addr:' | cut -d: -f2 | cut -d\  -f1`

base=/var/opt/scalix/${short}
tomcatport=80

# optional: ask user or comment out
# --------
echo -n "Name of your mailnode [$mnode] ? "
read a ; [ -n "$a" ] && mnode=$a

echo -n "Admin password for Scalix admin user (sxadmin) [$admpwd] ? "
read a ; [ -n "$a" ] && admpwd=$a

echo -n "Please enter a password for the ldap query user [same as sxadmin] ? "
read a ; [ -n "$a" ] && ldappwd=$a

echo -n "Please enter a password for the db user [same as sxadmin] ? "
read a ; [ -n "$a" ] && dbpwd=$a

echo -n "Please enter the external ip address of your Scalix box [$ip]? "
read a ; [ -n "$a" ] && ip=$a


# Update and install required packages
#scalix11downloadurl="http://downloads.scalix.com/.community/11.4.2/scalix-11.4.2-GA-debian-intel.bin"
#scalix11targz="scalix-11.4.2-GA-debian-intel.bin"
scalix11dir="scalix-debian-11.4.2-GA/software/scalix_server"

# Remove sendmail startup links
# This disables outgoing mail
# /etc/init.d/sendmail stop
# update-rc.d -f sendmail remove

# Download Scalix 11
# cd /tmp/
# wget -N $scalix11downloadurl

# Extract and install packages
# sh ./$scalix11targz

[ -e $scalix11dir ] && cd $scalix11dir

cat << EOF

>>>> Step 0: check for old Scalix installation

EOF
sleep 2

# Scalix already installed, remove ?
if [ -d $base ]; then
    echo "Scalix directory found: $base"
    echo "Remove Scalix Installation (not the datastore!) [n] ? "
    read a
    if [ "x$a" == "x" -o "x$a" == "xn" ]; then
      echo "leaving old Scalix installion (files) untouched"
    else
      for f in `ls -1 scalix-*.deb | cut -d_ -f1`; do
        scalix_files="$scalix_files $f"
      done
      aptitude purge $scalix_files   # sun-java5-jre postgresql
      echo ""
      echo "delete scalix files ($base, but save the Data-Store!) [y] ? "
      read a
      if [ "x$a" == "x" -o "x$a" == "xy" ]; then
          if [ -d /var/opt/scalix/s.bak ]; then
              mv /var/opt/scalix/s.bak /var/opt/scalix/s.bak.$$
          fi
          mv /var/opt/scalix/$short/s /var/opt/scalix/s.bak
          ls -l /var/opt/scalix/
          du -sk /var/opt/scalix/s.bak*
          echo ""
          echo "delete all scalix files [y] ?"
          read a
          if [ "x$a" == "x" -o "x$a" == "xy" ]; then
              scalix_files="$base /opt/scalix* /etc/opt/scalix* /etc/init.d/scalix*"
              rm -rf $scalix_files
          fi
      fi
    fi
fi

cat << EOF

>>>> Step 1: install Scalix-server

EOF
sleep 2
echo "continue installation [y] ? "
read a ; [ -z "$a" -o "x$a" == "xy" ] || exit 0

aptitude update
aptitude upgrade
aptitude install apache2 libapache2-mod-jk gawk krb5-config krb5-doc krb5-user libkadm55 libkrb53 \
       libglib2.0-0 libstdc++2.10-glibc2.2 libxml2 sgml-base xml-core postgresql libsasl2-modules \
       libsasl2-gssapi-mit sendmail elinks w3m sun-java5-jre libssl0.9.7 libstdc++5 wget libmilter0

dpkg -i scalix-libical_*.deb scalix-chardet_*.deb scalix-iconv-extras_*.deb
dpkg -i scalix-server_*.deb

export PATH=/opt/scalix/bin:$PATH

# Setup mailnode
ommakeom

sxconfig --set -t general.usrl_cn_rule='G S'
sxconfig --set -t general.usrl_authid_rule='l@'
sxconfig --set -t orniasys.name_part_1='"C" <S>' -t orniasys.domain_part_1="$ldomain"

omaddmn -m $mnode

omrc -n

omaddu -n sxadmin/$mnode --class limited -c admin -p "$admpwd" sxadmin
omconfenu -n "sxadmin/$mnode"
omlimit -u "sxadmin/$mnode" -o -i 0 -m 0

omaddu -n sxqueryadmin/$mnode --class limited -c admin -p $ldappwd sxqueryadmin@$fqdn

omaddpdl -l ScalixUserAdmins/$mnode
omaddpdl -l ScalixUserAttributesAdmins/$mnode
omaddpdl -l ScalixGroupAdmins/$mnode
omaddpdl -l ScalixAdmins/$mnode

cat >>/var/opt/scalix/${short}/s/sys/general.cfg <<EOF
#
# The CDA service (used for "type down" in some clients) is more
# efficient if it can check the directory change log before attempting
# to update the access tables that it uses.   One slow machines, it may
# also be worth uncommenting the CDA_CHECKTIME tweak to reduce the check
# interval from five minutes to an hour.
#
CDA_USE_CHANGE_LOG=TRUE
# CDA_CHECKTIME=60
#
# These tweaks limit the number and rate of IMAP connections to the
# server. The IMAP_CONNECTION_LIMIT simply restricts the total number of
# connections to the server. Note that many IMAP clients have several
# connections for each IMAP session. The IMAP_CONNRATE_LIMIT restricts
# the rate at which clients can connect to the server, in this case, at
# most 10 connections per second. If clients try to connect faster
# than that, the IMAP server simply slows down the rate at which it will
# accept new connections.
#
IMAP_CONNECTION_LIMIT=500
IMAP_CONNRATE_LIMIT=10
#
# The IMAP_IDLE_TIMEOUT tweak is the maximum time an IMAP connection
# will wait for a command before terminating the connection. The default
# setting, and the minimum required setting, is 30 minutes. Some
# clients "refresh" their connection once every thirty minutes
# exactly -- but if they are a little bit late, the server drops their
# connection. Setting a timeout of 31 minutes avoids this problem.
#
IMAP_IDLE_TIMEOUT=31
#
# This tweak arranges for Local Delivery to automatically create a
# message store for users created without one.
# Users added with the bulk-add mechanism used by the
# wizard do not have a message store. So setting this tweak allows
# them to receive mail before they are initially signed on.
#
LD_CREATE_MESSAGE_STORE=TRUE
#
# These three tweaks allow users to sign on using an alias. Only
# system-defined aliases are permitted and it the alias name is ignored
# for the purposes of message creation and so on.
#
# Note that changing these settings normally requires restarting Scalix.
#
UAL_SIGNON_ALIAS=YES
UAL_SIGNON_ALIAS_CONFIG=SYS
UAL_USE_SIGNON_ALIAS=FALSE

EOF
chmod 444 /var/opt/scalix/${short}/s/sys/general.cfg

omon -s all

cat << EOF

>>>> Step 2: install Scalix packages

EOF
sleep 2

dpkg -i scalix-postgres_*.deb scalix-tomcat_*.deb scalix-tomcat-connector_*.deb \
        scalix-mobile_*.deb scalix-platform_*.deb scalix-res_*.deb scalix-sac_*.deb \
        scalix-sis_*.deb scalix-swa_*.deb

file=/etc/opt/scalix-tomcat/scalix-tomcat.conf
if [ -e $file ]; then
    sed -e "s;Xms256;Xms${java_mem};g" \
        -e "s;Xmx256;Xmx${java_mem};g" \
        $file > $file.neu
    mv $file.neu $file
fi

# Setup DB
/opt/scalix-postgres/bin/sxpsql-setpwd $dbpwd
/opt/scalix-postgres/bin/sxpsql-whitelist 127.0.0.1 $ip

cat << EOF

>>>> Step 3: configure Scalix

EOF
sleep 2

# Configure Scalix
base=/var/opt/scalix/${short}
files="$base/webmail/swa.properties \
       $base/caa/scalix.res/config/ubermanager.properties \
       $base/res/config/res.properties \
       $base/platform/platform.properties \
       $base/mobile/mobile.properties \
       $base/sis/sis.properties"

for file in $files; do
  sed \
    -e "s;%LOCALDOMAIN%;$ldomain;g" \
    -e "s;%LOCALHOST%;$fqdn;g" \
    -e "s;%IMAPHOST%;$fqdn;g" \
    -e "s;%SMTPHOST%;$fqdn;g" \
    -e "s;%DBHOST%;$fqdn:5733;g" \
    -e "s;%DBPASSWD%;$dbpwd;g" \
    -e "s;%LDAPPORT%;389;g" \
    -e "s;http://%PLATFORMURL%:8080/api;http://$fqdn/api;g" \
    -e "s;%PLATFORMURL%;http://$fqdn/api;g" \
    -e "s;swa.platform.enabled=false;swa.platform.enabled=true;g" \
    -e "s;__SECURED_MODE__;false;g" \
    -e "s;ubermanager/__FQHN_HOST__@__KERBEROS_REALM__;;g" \
    -e "s;__KERBEROS_REALM__;;g" \
    -e "s;__FQHN_FOR_KDC_HOST__;;g" \
    -e "s;__FQHN_QUERY_SERVER_NAME__;$fqdn;g" \
    -e "s;__UBERMGR_USE_EXTERNAL_AUTH__;false;g" \
    -e "s;__UBERMGR_ALLOW_EXTERNAL_AUTH__;false;g" \
    -e "s;__UBERMGR_MAXLIST_SIZE__;100;g" \
    -e "s;__UBERMGR_MAIL_DOMAINS_LIST__;$ldomain;g" \
    -e "s;__UBERMGR_EXTERNAL_DOMAIN_AUTH_LIST__;;g" \
    -e "s;__CONFIGURED__;true;g" \
    -e "s;__FQHN_FOR_UBERMANAGER__;$fqdn;g" \
    -e "s;__TOMCAT_PORT__;$tomcatport;g" \
    -e "s;localhost;$fqdn;g" \
    -e "s;%SIS-LANGUAGE%;German;g" \
    -e "s;%INDEX-WHITELIST%;$fqdn;g" \
    -e "s;%SEARCH-WHITELIST%;$fqdn;g" \
    -e "s;%INDEXADMIN-WHITELIST%;$fqdn;g" \
    $file > $file.neu
  mv $file.neu $file
done

# some (optional) GERMAN settings
for file in ${config_files}; do
  sed \
      -e "s;ubermanager.console.defaultCountry=US;ubermanager.console.defaultCountry=DE;g" \
      -e "s;ubermanager.console.defaultLanguage=AMERICAN;ubermanager.console.defaultLanguage=GERMAN;g" \
      -e "s;swa.user.locale=en_US;swa.user.locale=de_DE;g" \
      -e "s;swa.user.preferredDateTimeFormat=1;swa.user.preferredDateTimeFormat=2;g" \
      -e "s;swa.user.dateSeparatorChar=/;swa.user.dateSeparatorChar=.;g" \
      -e "s;swa.user.weekStart=0;swa.user.weekStart=1;g" \
      -e "s;swa.user.defaultCalendarView=0;swa.user.defaultCalendarView=2;g" \
      ${file} > ${file}.new
    mv $file.new $file
done

# Write Ldappassword to psdata
cd ${base}/caa/scalix.res/config
echo "$ldappwd" > psdata
chown root:root psdata
chmod 400 psdata
cd -

cat << EOF

>>>> Step 4: setup apache, restart Scalix(-tomcat)

EOF
sleep 2

# Restart Tomcat
/etc/init.d/scalix-tomcat restart

# Setup Apache
[ -e /etc/apache2/conf.d/scalix-web-client.conf ] || \
    ln -s /opt/scalix/global/httpd/scalix-web-client.conf /etc/apache2/conf.d

cat << EOF > /etc/apache2/conf.d/scalix-access.conf
<Location />
        Allow from all
</Location>
EOF

files="/etc/opt/scalix-tomcat/connector/ajp/instance-$mnode.conf \
       /etc/opt/scalix-tomcat/connector/jk/instance-$mnode.conf"
for file in $files; do
  if [ -e $file ]; then
    sed -e 's;<VirtualHost;#<VirtualHost;g' \
        -e 's;</VirtualHost;#</VirtualHost;g' \
        $file > $file.neu
    mv $file.neu $file
  fi
done

/etc/init.d/apache2 restart

cat << EOT
#####################################################
# You should now be able to access scalix at:
# http://$fqdn/sac
# http://$fqdn/webmail
#####################################################
EOT

if [ -e /var/opt/scalix/s.bak ]; then
cat << EOT

# restore your old scalix data-store with:
# - stop scalix             > for f in /etc/rc1.d/*scalix*; do $f stop; done
# - restore the data-store  > mv /var/opt/scalix/s.bak $base/s
# - and start scalix again  > for f in /etc/rc2.d/*scalix*; do $f start; done

EOT
fi

Jetzt sollte man sich in o.g. URL als sxadmin und dem vorher definierten Password einloggen können. Als sxadmin kann man in der Scalix Admin Console (SAC) neue User anlegen.

Zuerst sollte man dem Scalix Mailserver zusätzlich die richtige (externe) Mail-Domain beibringen. Das trägt man unter "Einstellungen - Administration - Lokale Domains" ein. Bei mir sind 2 Einträge vorhanden

• neobiker.de
• Zuhause.xx

Um Ressourcen zu sparen, kann man den Speicherbedarf des Tomcat etwas zügeln (das ist in oberen skript bereits eingebaut):

/etc/opt/scalix-tomcat/scalix-tomcat.conf

# Configuration file for Scalix Tomcat

# The directory where Java is installed
# (determined from /usr/bin/java managed by update-alternatives
# by default, change to hardcoded path if needed):
JAVA_HOME="`/opt/scalix-tomcat/bin/determine-java-home`"

# Additional arguments to be passed to Java:
JAVA_OPTS="-server -Xms40m -Xmx40m"

# Maximum number of file descriptors
ULIMIT_NUM_FILES="1000"

Webmail per DMZ-Proxy und SSL-Zugriff

Gesicherten Zugriff auf den Webmail Client von Scalix realisierte ich über einen Apache-Server in meiner DMZ. Hierzu installiert man das scalix-tomcat-connector Paket in der DMZ. In der Firewall muss Port 8009 von der DMZ zum Scalix-Server freigeschaltet werden.

dpkg -i scalix-tomcat-connector_11.0.4.25_all.deb

Standardmässig verwende ich SSL, das erzwinge ich mit einer Rewriting Regel in der Standardkonfiguration /etc/apache2/sites-enabled/000-default

NameVirtualHost *:80
<VirtualHost *:80>
...
        <IfModule mod_rewrite.c>
          <IfModule mod_ssl.c>
            <Location /webmail>
              RewriteEngine on
              RewriteCond %{HTTPS} !^on$ [NC]
              RewriteRule . https://%{HTTP_HOST}%{REQUEST_URI}  [L]
            </Location>
          </IfModule>
        </IfModule>
...

</VirtualHost>

/etc/apache2/sites-enabled/000-default-ssl

NameVirtualHost *:443
<VirtualHost *:443>
        ServerName www-dmz.neobiker.de
        ServerAdmin webmaster@neobiker.de
        DocumentRoot /var/www/

        SSLEngine on
        # meine eigenen Certifikate meiner Server-CA
        SSLCertificateFile /etc/ssl/certs/dmz1_wwwCert.pem
        SSLCertificateKeyFile /etc/ssl/private/dmz1_www-Key.pem
        #SSLCertificateFile /etc/apache2/ssl/apache.pem
        #SSLCertificateKeyFile /etc/apache2/ssl/apache.pem

        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>

        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride AuthConfig
                Order allow,deny
                allow from all
                # This directive allows us to have apache2's default start page
                # in /apache2-default/, but still have / go to the right place
                RedirectMatch ^/$ /apache2-default/
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/access.log combined

        <IfModule mod_proxy_ajp.c>
                Include /etc/opt/scalix-tomcat/connector/ajp/app-scx.*.conf
        </IfModule>

</VirtualHost>

Die Scalix-Proxy Konfiguration: /etc/opt/scalix-tomcat/connector/ajp/app-scx.*.conf

        ProxyPass /sac ajp://scx.neobiker.lan:8009/sac

/etc/opt/scalix-tomcat/connector/ajp/app-scx.*.conf

        ProxyPass /webmail ajp://scx.neobiker.lan:8009/webmail

Unter Etch wird das Apache Modul mod_jk nicht mehr benötigt, da es von mod_proxy_ajp abgelöst wurde. Da ich letzteres Modul selber in der SSL-Konfiguration includiere, kommentiere ich es hier aus: /etc/apache2/conf.d/scalix-tomcat-connector.conf

# ---------------------------------------------------------------------------
# Configure on-the-fly deflate compression of the pages:
# ---------------------------------------------------------------------------

<Location />
  AddOutputFilterByType DEFLATE text/xml text/html text/css
  AddOutputFilterByType DEFLATE application/x-javascript
</Location>

# ---------------------------------------------------------------------------
# mod_proxy_ajp connector configuration
# ---------------------------------------------------------------------------

#<IfModule mod_proxy_ajp.c>
#  Include /etc/opt/scalix-tomcat/connector/ajp/instance-*.conf
#</IfModule>

# ---------------------------------------------------------------------------
# mod_jk connector configuration (part common to all platforms)
# ---------------------------------------------------------------------------

# Setup JK connector needed to run Tomcat under Apache server:

<IfModule mod_jk.c>

# Set the jk log level [debug/error/info]
JkLogLevel          info
# Select the log format
JkLogStampFormat   "[%a %b %d %H:%M:%S %Y] "
# JkOptions indicate to send SSL KEY SIZE,
JkOptions          +ForwardKeySize +ForwardURICompat -ForwardDirectories
# JkRequestLogFormat set the request format
JkRequestLogFormat "%w %V %T"

Include /etc/opt/scalix-tomcat/connector/jk/instance-*.conf
Include /etc/opt/scalix-tomcat/connector/jk/workers.conf

</IfModule>

# ---------------------------------------------------------------------------
# mod_jk connector configuration (part specific to Debian)
# ---------------------------------------------------------------------------

<IfModule mod_jk.c>
# Where to put jk logs
# Update this path to match your logs directory location
# (put mod_jk.log next to access_log)
JkLogFile     /var/log/apache2/mod_jk.log
</IfModule>

Quellen

[1] Scalix Wiki: Manuelle Installation unter Etch

[2] Linux Magazin Online: Mail Server