iRedMail   //  Document Index

Upgrade iRedMail from 0.9.6 to 0.9.7

ChangeLog

• Mar 22, 2017: New backup script for SOGo.
• Mar 16, 2017: Fixed: Avoid possible backdooring mysqldump backups
• Mar 8, 2017: [RHEL/CentOS][Nginx] Fix incorrect session.save_path in php-fpm pool config file.
• Feb 9, 2017: Fixed improper Fail2ban filter for Dovecot.

General (All backends should apply these steps)

Update /etc/iredmail-release with new iRedMail version number

iRedMail stores the release version in /etc/iredmail-release after installation, it's recommended to update this file after you upgraded iRedMail, so that you can know which version of iRedMail you're running. For example:

0.9.7

Upgrade Roundcube webmail to the latest stable release (1.2.4)

Roundcube 1.2.4 fixes a security issue, all users are encouraged to upgrade it as soon as possible. For more details about this release, please check Roundcube release note.

Please follow Roundcube official tutorial to upgrade Roundcube webmail to the latest stable release immediately:

• How to upgrade Roundcube.

Fixed: incorrect session.save_path in php-fpm pool config file on RHEL/CentOS

iRedMail-0.9.6 doesn't set path for session.save_path parameter in php-fpm pool config file /etc/php-fpm.d/www.conf, please fix it with steps below:

• Open file /etc/php-fpm.d/www.conf, find line:

php_value[session.save_path] = "/var/lib/php/session"

• The directory name should be sessions (ends with s), not session. So please change it to:

php_value[session.save_path] = "/var/lib/php/sessions"

• Restarting php-fpm service is required:

service php-fpm restart

Fixed: Improper Fail2ban filter which causes incorrect ban

Please open file /etc/fail2ban/filter.d/dovecot.iredmail.conf, remove line below:

            \(no auth attempts in .* rip=<HOST>

Then restart or reload Fail2ban service.

NEW: New backup script for SOGo

iRedMail has script /var/vmail/backup/backup_mysql.sh (or backup_pgsql.sh) to backup SOGo database by dumping whole database to a plain SQL file as backup. It's not ideal because:

• it's hard to restore single user's data with a plain SQL file.
• if SOGo changes some SQL structure, it's hard to restore all data.

This new script does backup with sogo-tool backup command to avoid issues mentioned above, you can restore a single user's data or all users data with sogo-tool restore.

Please follow steps below to setup this daily cron job.

• Download backup script. We store it under /var/vmail/backup, if you prefer a different directory, feel free to change the directory name used in commands below:

cd /var/vmail/backup/
wget https://bitbucket.org/zhb/iredmail/raw/default/iRedMail/tools/backup_sogo.sh
chmod +x backup_sogo.sh

• This script will create new directory under /var/vmail/backup like below to store backup files:

/var/vmail/backup
            |- sogo/
                |- 2017/                # <- year
                    |- 03/              # <- month
                        |- 22.tar.bz2   # <- day (file name is: <day>.tar.bz2)

If you prefer a different backup root directory, please open
`backup_sogo.sh`, update variable `BACKUP_ROOTDIR` with the new directory.

• Open file backup_sogo.sh, modify

• Run command crontab -e -u root to setup root user's cron job. Add content below as new job:

# SOGo: backup all users' data at 3:05AM everyday.
5   3   *   *   *   bash /var/vmail/backup/backup_sogo.sh

OpenLDAP backend special

Fixed: Avoid possible backdooring mysqldump backups

For more details about this backdooring mysqldump backup issue, please read blog post:

• [CVE-2016-5483] Backdooring mysqldump backups.

Steps to fix it:

• Open the daily MySQL backup script, it's /var/vmail/backup/backup_mysql.sh by default. if you use different storage directory during iRedMail installation, you can find the base directory with command postconf virtual_mailbox_base.

• Find variable name CMD_MYSQLDUMP like below:

export CMD_MYSQLDUMP="mysqldump ..."

• Make sure it has argument --skip-comments like below:

export CMD_MYSQLDUMP="mysqldump ... --skip-comments"

• Save your change. That's it.

MySQL/MariaDB backend special

Fixed: Avoid possible backdooring mysqldump backups

For more details about this backdooring mysqldump backup issue, please read blog post:

• [CVE-2016-5483] Backdooring mysqldump backups.

Steps to fix it:

• Open the daily MySQL backup script, it's /var/vmail/backup/backup_mysql.sh by default. if you use different storage directory during iRedMail installation, you can find the base directory with command postconf virtual_mailbox_base.

• Find variable name CMD_MYSQLDUMP like below:

export CMD_MYSQLDUMP="mysqldump ..."

• Make sure it has argument --skip-comments like below:

export CMD_MYSQLDUMP="mysqldump ... --skip-comments"

• Save your change. That's it.