Postserver - med certifikat mm - Revision history

192.168.0.250 at 19:56, 23 April 2011

2011-04-23T19:56:11Z

← Older revision		Revision as of 19:56, 23 April 2011
Line 42:		Line 42:
	</pre>		</pre>

	Herefter kan du tage ssh private og public nøgler fra post01~~.wwi~~.dk		Herefter kan du tage ssh private og public nøgler fra post01.dk

	Dem skal du ligge i .ssh i /root/		Dem skal du ligge i .ssh i /root/
Line 48:		Line 48:
	cd		cd
	mkdir .ssh		mkdir .ssh
	scp -rp post01~~.wwi~~.dk:~/.ssh/ .		scp -rp post01.dk:~/.ssh/ .
	</pre>		</pre>

Line 57:		Line 57:
	mkdir baseinstall		mkdir baseinstall
	cd baseinstall		cd baseinstall
	svn co svn+ssh://svn@svn~~.wwi~~.dk/mailsetup/baseinstall .		svn co svn+ssh://svn@svn.dk/mailsetup/baseinstall .
	dpkg --set-selections < installed.txt		dpkg --set-selections < installed.txt
	apt-get dselect-upgrade		apt-get dselect-upgrade
Line 81:		Line 81:
	Organization Name (eg, company) [Internet Widgits Pty Ltd]:WorldWeb Interactive A/S		Organization Name (eg, company) [Internet Widgits Pty Ltd]:WorldWeb Interactive A/S
	Organizational Unit Name (eg, section) []:System		Organizational Unit Name (eg, section) []:System
	Common Name (eg, YOUR name) []:hostname~~.wwi~~.dk		Common Name (eg, YOUR name) []:hostname.dk
	Email Address []:sysadm@~~wwi.~~dk		Email Address []:sysadm@dk

	</pre>		</pre>
Line 95:		Line 95:
	cd /etc/exim4/		cd /etc/exim4/
	rm -rf conf.d		rm -rf conf.d
	svn co svn+ssh://svn@svn~~.wwi~~.dk/mailsetup/post .		svn co svn+ssh://svn@svn.dk/mailsetup/post .
	</pre>		</pre>

	Editer i update-exim4.conf.conf		Editer i update-exim4.conf.conf
	<pre>		<pre>
	dc_other_hostnames='postXX~~.wwi~~.dk'		dc_other_hostnames='postXX.dk'
	</pre>		</pre>

Line 124:		Line 124:
	cd /etc/courier/		cd /etc/courier/
	rm -rf *		rm -rf *
	svn co svn+ssh://svn@svn~~.wwi~~.dk/mailsetup/courier		svn co svn+ssh://svn@svn.dk/mailsetup/courier
	</pre>		</pre>

Line 150:		Line 150:
	mkdir /var/www/.ssh/		mkdir /var/www/.ssh/
	mkdir /var/www/squirrelmail/		mkdir /var/www/squirrelmail/
	scp -rp mailadmin~~.wwi~~.dk:/var/www/.ssh/* /var/www/.ssh/		scp -rp mailadmin.dk:/var/www/.ssh/* /var/www/.ssh/
	chown www-data: -R /var/www/.ssh/		chown www-data: -R /var/www/.ssh/
	chown www-data: -R /var/www/squirrelmail/		chown www-data: -R /var/www/squirrelmail/
Line 158:		Line 158:
	<pre>		<pre>
	su - www-data		su - www-data
	svn co svn+ssh://svn@svn~~.wwi~~.dk/mailsetup/squirrelmail		svn co svn+ssh://svn@svn.dk/mailsetup/squirrelmail
	</pre>		</pre>

Line 184:		Line 184:
	<VirtualHost *:80>		<VirtualHost *:80>
	RewriteEngine On		RewriteEngine On
	RewriteCond %{SERVER_NAME} !post01~~.wwi~~.dk		RewriteCond %{SERVER_NAME} !post01.dk
	RewriteRule ^(.*)$ https://post01~~.wwi~~.dk$1 [L,R]		RewriteRule ^(.*)$ https://post01.dk$1 [L,R]

	RewriteCond %{SERVER_PORT} !^443$		RewriteCond %{SERVER_PORT} !^443$
	RewriteRule ^(.*)$ https://post01~~.wwi~~.dk$1 [L,R]		RewriteRule ^(.*)$ https://post01.dk$1 [L,R]

	..		..
Line 205:		Line 205:
	RewriteEngine On		RewriteEngine On
	RewriteCond %{SERVER_PORT} !^443$		RewriteCond %{SERVER_PORT} !^443$
	RewriteRule ^(.*)$ https://post01~~.wwi~~.dk/$1 [L,R]		RewriteRule ^(.*)$ https://post01.dk/$1 [L,R]
	ServerAdmin webmaster@~~wwi.~~dk		ServerAdmin webmaster@dk
	ServerName post01~~.wwi~~.dk		ServerName post01.dk

	SSLEngine on		SSLEngine on
Line 249:		Line 249:

	=== mailadmin ===		=== mailadmin ===
	For at mailadmin virker som den skal. Skal vi have key auth til root fra mailadmin~~.wwi~~.dk<br>		For at mailadmin virker som den skal. Skal vi have key auth til root fra mailadmin.dk<br>
	edit /root/.ssh/authorized_keys		edit /root/.ssh/authorized_keys
	<pre>		<pre>
	ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAnzEs1SVZhvmaXeO3LiYO4U2q2pppdI57/cnK0ccW7fT1J36fT+4od15isppxc3HilvosY/e9kOEwQTPciEa+NffQ9O5QCroXUyweEZN7HFKFU509drUFrjLgxiAXwbEoQmpysJzPKerqZOzri/Et+kCybvHx4HipshqVHHEQNGvt2b9jk8T7Plia1u2zP941zFh0L5v4QW+UiNO7Zcx4xAXfIjsCOTiw+y0rMop8J3SCrP7jOYRRY8zvCQ7pwS7XINw88LicMuVjgLh1hvZrUB6OnUZaLDA2sh2wFo+rGpeyVYCkU3gjZo04CIfnht56g0yTxALHn+UTX67Ac46AlQ== admin@mailadmin~~.wwi~~.dk		ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAnzEs1SVZhvmaXeO3LiYO4U2q2pppdI57/cnK0ccW7fT1J36fT+4od15isppxc3HilvosY/e9kOEwQTPciEa+NffQ9O5QCroXUyweEZN7HFKFU509drUFrjLgxiAXwbEoQmpysJzPKerqZOzri/Et+kCybvHx4HipshqVHHEQNGvt2b9jk8T7Plia1u2zP941zFh0L5v4QW+UiNO7Zcx4xAXfIjsCOTiw+y0rMop8J3SCrP7jOYRRY8zvCQ7pwS7XINw88LicMuVjgLh1hvZrUB6OnUZaLDA2sh2wFo+rGpeyVYCkU3gjZo04CIfnht56g0yTxALHn+UTX67Ac46AlQ== admin@mailadmin.dk
	</pre>		</pre>

Line 259:		Line 259:
	<pre>		<pre>
	mkdir /usr/local/sbin/log		mkdir /usr/local/sbin/log
	svn co svn+ssh://svn@svn~~.wwi~~.dk/mailsetup/scripts /usr/local/sbin/		svn co svn+ssh://svn@svn.dk/mailsetup/scripts /usr/local/sbin/
	</pre>		</pre>

192.168.0.250: /* mailname filen */

2011-04-23T19:54:33Z

mailname filen

← Older revision		Revision as of 19:54, 23 April 2011
Line 31:		Line 31:
	Filen skal have hele domain navnet		Filen skal have hele domain navnet
	<pre>		<pre>
	postXX~~.wwi~~.dk		postXX.dk
	</pre>		</pre>

192.168.0.250: /* host filen */

2011-04-23T19:54:22Z

host filen

← Older revision		Revision as of 19:54, 23 April 2011
Line 25:		Line 25:
	Første linje i host filen skal indeholde:		Første linje i host filen skal indeholde:
	<pre>		<pre>
	127.0.0.1 postXX~~.wwi~~.dk localhost		127.0.0.1 postXX.dk localhost
	</pre>		</pre>

80.166.222.82 at 07:15, 14 October 2008

2008-10-14T07:15:02Z

New page

[[Category:Linux]]

=== Standard installation ===
Start med at gå installationen af en Xen Klient maskine igennem [[InstallXenClientServer]]

==== Tilføjelser ====
===== mail partition =====
Lav en mail partition
<pre>
evmsn
tilføj en maildir partition i stil med dem der findes
</pre>

Tilføj denne partition i fstab
<pre>
/dev/hda3 /var/maildir ext3 defaults,noatime 0 0
</pre>

Tilføj biblioteket til var
<pre>
mkdir /var/maildir
</pre>

===== host filen =====
Første linje i host filen skal indeholde:
<pre>
127.0.0.1 postXX.wwi.dk localhost
</pre>

===== mailname filen =====
Filen skal have hele domain navnet
<pre>
postXX.wwi.dk
</pre>

Når det er gjort så kan du jo gå i gang med at installerer de programmer der skal være på den og konfigurerer dem.

=== Installation af programmer ===
Du skal starte med at installerer subversion. Den skal du bruge til at hente konfigurationrene fra repositoriet med.
<pre>
apt-get install subversion
</pre>

Herefter kan du tage ssh private og public nøgler fra post01.wwi.dk

Dem skal du ligge i .ssh i /root/
<pre>
cd
mkdir .ssh
scp -rp post01.wwi.dk:~/.ssh/ .
</pre>

Nu kan vi så gå i gang med at hente konfigurations filerne fra subversion.

<pre>
cd
mkdir baseinstall
cd baseinstall
svn co svn+ssh://svn@svn.wwi.dk/mailsetup/baseinstall .
dpkg --set-selections < installed.txt
apt-get dselect-upgrade
</pre>

Så har vi fået installeret de programmer der skal ligge på serveren.

=== Konfiguration af programmer ===

==== ssl certifikater ====
Bestil et certifikat på https://products.geotrust.com/geocenter/reseller/logon.do<br>
key fil
<pre>
openssl genrsa -out /etc/ssl/private/hostname.key 1024
</pre>
csr fil
<pre>
openssl req -new -key /etc/ssl/private/hostname.key -out /etc/ssl/hostname.csr
-----
Country Name (2 letter code) [AU]:DK
State or Province Name (full name) [Some-State]:N/A
Locality Name (eg, city) []:Kolding
Organization Name (eg, company) [Internet Widgits Pty Ltd]:WorldWeb Interactive A/S
Organizational Unit Name (eg, section) []:System
Common Name (eg, YOUR name) []:hostname.wwi.dk
Email Address []:sysadm@wwi.dk

</pre>
Gem din crt fil i
<pre>
/etc/ssl/private/hostname.crt
</pre>

==== exim4 ====
De filer svn brokker sig over svn ikke kan overskrive skal bare fjernes.
<pre>
cd /etc/exim4/
rm -rf conf.d
svn co svn+ssh://svn@svn.wwi.dk/mailsetup/post .
</pre>

Editer i update-exim4.conf.conf
<pre>
dc_other_hostnames='postXX.wwi.dk'
</pre>

Opdater exim konfig
<pre>
update-exim4.conf
</pre>

Opdater exim certifikaterne
<pre>
cp /etc/ssl/private/hostname.key /etc/exim4/exim.key
cp /etc/ssl/private/hostname.crt /etc/exim4/exim.crt
</pre>

Genstart exim4
<pre>
/etc/init.d/exim4 restart
</pre>

==== courier ====
Så er det courier's tur.
<pre>
cd /etc/courier/
rm -rf *
svn co svn+ssh://svn@svn.wwi.dk/mailsetup/courier
</pre>

Så skal vi lige have lavet nogle pem filer til imap og pop3
<pre>
cat /etc/ssl/private/hostname.key /etc/ssl/private/hostname.crt > hostname.pem
openssl gendh >> hostname.pem
cp hostname.pem imapd.pem
cp hostname.pem pop3d.pem
</pre>

Genstart server og deamon
<pre>
/etc/init.d/courier-authdaemon restart
/etc/init.d/courier-imap restart
/etc/init.d/courier-imap-ssl restart
/etc/init.d/courier-pop restart
/etc/init.d/courier-pop-ssl restart
</pre>

=== apache2 ===
==== Squirrelmail ====
Vi skal lige have lavet de bibs der skal bruges
<pre>
mkdir /var/www/.ssh/
mkdir /var/www/squirrelmail/
scp -rp mailadmin.wwi.dk:/var/www/.ssh/* /var/www/.ssh/
chown www-data: -R /var/www/.ssh/
chown www-data: -R /var/www/squirrelmail/
</pre>

Så er det tid til co af squirrelmail fra svn
<pre>
su - www-data
svn co svn+ssh://svn@svn.wwi.dk/mailsetup/squirrelmail
</pre>

==== apache2 config ====
Vi skal lige have ssl support i apache2<br>
<pre>
mkdir -p /etc/apache2/ssl.crt
mkdir -p /etc/apache2/ssl.key
cp /etc/ssl/private/hostname.crt /etc/apache2/ssl.crt/
cp /etc/ssl/private/hostname.key /etc/apache2/ssl.key/
a2enmod ssl
</pre>

Sidst skal vi lige tilføje
<pre>
Listen 443
</pre>
til /etc/apache2/ports.conf

Vi skal lige have apache til at redirecte alt http til https gå til squirrelmail bib som default.<br>
Starter i /etc/apache2/site-avaliable/default
<pre>
NameVirtualHost *:80
NameVirtualHost *:443
<VirtualHost *:80>
RewriteEngine On
RewriteCond %{SERVER_NAME} !post01.wwi.dk
RewriteRule ^(.*)$ https://post01.wwi.dk$1 [L,R]

RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://post01.wwi.dk$1 [L,R]

..
..
..
RedirectMatch ^/$ /squirrelmail/
..
..
..
</VirtualHost>
</pre>

Og laver et webmail site
<pre>
<VirtualHost *:443>
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://post01.wwi.dk/$1 [L,R]
ServerAdmin webmaster@wwi.dk
ServerName post01.wwi.dk

SSLEngine on
SSLCertificateFile /etc/apache2/ssl.crt/post01.crt
SSLCertificateKeyFile /etc/apache2/ssl.key/post01.key
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM

DocumentRoot /var/www/squirrelmail
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>

ErrorLog /var/log/apache2/error.log

# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn

CustomLog /var/log/apache2/access.log combined
ServerSignature On
</VirtualHost>
</pre>

Aktiverer webmail sitet
<pre>
a2ensite webmail
</pre>

Vi skal også lige have rewrite modulet enabled
<pre>
a2enmod rewrite
</pre>

Så kan vi reloade apache og vi er done med serveren.
<pre>
apache2ctl configtest
apache2ctl graceful
</pre>

=== mailadmin ===
For at mailadmin virker som den skal. Skal vi have key auth til root fra mailadmin.wwi.dk<br>
edit /root/.ssh/authorized_keys
<pre>
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAnzEs1SVZhvmaXeO3LiYO4U2q2pppdI57/cnK0ccW7fT1J36fT+4od15isppxc3HilvosY/e9kOEwQTPciEa+NffQ9O5QCroXUyweEZN7HFKFU509drUFrjLgxiAXwbEoQmpysJzPKerqZOzri/Et+kCybvHx4HipshqVHHEQNGvt2b9jk8T7Plia1u2zP941zFh0L5v4QW+UiNO7Zcx4xAXfIjsCOTiw+y0rMop8J3SCrP7jOYRRY8zvCQ7pwS7XINw88LicMuVjgLh1hvZrUB6OnUZaLDA2sh2wFo+rGpeyVYCkU3gjZo04CIfnht56g0yTxALHn+UTX67Ac46AlQ== admin@mailadmin.wwi.dk
</pre>

=== scripts/sudo mm ===
Kopier alle perl/bash scripts over til serveren:
<pre>
mkdir /usr/local/sbin/log
svn co svn+ssh://svn@svn.wwi.dk/mailsetup/scripts /usr/local/sbin/
</pre>

Tilføj så brugeren kan eksekvere med root-access:
<pre>

# Cmnd alias specification
Cmnd_Alias MAILCMD=/usr/local/sbin/createmaildir.sh

# # User privilege specification
root ALL=(ALL) ALL
Debian-exim ALL=(ALL) NOPASSWD:MAILCMD
</pre>

=== PHP ændring ===
Det er nødvendigt at sætte php memory execution op til 32MB fra default 8MB, ellers virker squirrelmail ikke.

= Overvågning/backup mm =
Tilføj normal procedure vedr. overvågning og backup