Upgrade iRedMail from 0.4.0 to 0.5.0

Upgrade iRedMail from 0.4.0 to 0.5.0
- Issues Fixed & Notify
- Improvements and Updates

We provide remote upgrade service, check the price and contact us.

NOTE: Horde webmail was removed. Users want to migrate to Roundcube webmail please go to our online support forum for help.

Issues Fixed & Notify

LDAP backend only: Remove unnecessary ldap lookup in postfix (2009.07.26):

Remove ldap_virtual_mailbox_maps.cf in Postfix virtual_mailbox_maps.

# OLD setting
#virtual_mailbox_maps = ldap:/etc/postfix/ldap_accounts.cf, ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf

# NEW setting
virtual_mailbox_maps = ldap:/etc/postfix/ldap_accounts.cf

Fixed: incorrect file permission on sa-update cron job

# chmod 0644 /etc/cron.d/sa-update

Fixed: different timezone in log file

Copy /etc/localtime to /var/spool/postfix/etc/ solves this issue:

# cp /etc/localtime /var/spool/postfix/etc/

Reference: Confusing timestamp in /var/log/secure (UTC time instead of localtime)

OpenLDAP backend only: Use the latest iRedMail LDAP schema file

`userPassword` and `accountStatus` are optional for objectclass `mailAdmin` (2008.03.25).

Please use the newest schema file to replace the old one:

Backup old schema file (we assume you backup it to /opt/backup/ directory):

# cp /etc/openldap/schema/iredmail.schema /opt/backup/

Use new version to replace the old one:

# cd /tmp/
# wget http://iredmail.googlecode.com/svn/trunk/iRedMail/samples/iredmail.schema
# rm -f /etc/openldap/schema/iredmail.schema
# mv /tmp/iredmail.schema /etc/openldap/schema/
# /etc/init.d/ldap restart

attribute `domainStatus` is deprecated.

Add new attribute accountStatus for each mail domain with phpLDAPadmin or other LDAP admin tool.
Change below files to use accountStatus instead.
- /etc/postfix/ldap_virtual_mailbox_domains.cf
- /etc/postfix/ldap_relay_domains.cf
- /etc/postfix/ldap_transport_maps.cf
- /etc/postfix/ldap_recipient_bcc_maps_domain.cf
- /etc/postfix/ldap_sender_bcc_maps_domain.cf
Send mail to exist mail user and make sure accountStatus works for you.
Delete attribute domainStatus in each domain.

Fixed incorrect OpenLDAP ACL (2009.03.23)

Edit /etc/openldap/slapd.conf, add several lines like below:

#
# Allow users to access their own domain subtree.
#
access to dn.regex="domainName=([^,]+),o=domains,dc=iredmail,dc=org$"
    by anonymous                    auth
    by self                         write
    by dn.exact="cn=vmail,dc=iredmail,dc=org"   read
    by dn.exact="cn=vmailadmin,dc=iredmail,dc=org"  write
    by dn.regex="mail=[^,]+,ou=Users,domainName=$1,o=domains,dc=iredmail,dc=org$" read
    by dn.regex="mail=[^,]+@$1,o=domainAdmins,dc=iredmail,dc=org$" read     # <-- Add this line.
    by users                        none

#
# Enable vmail/vmailadmin. 
#
access to dn.subtree="o=domains,dc=iredmail,dc=org"
    by anonymous                    auth
    by self                         write
    by dn.exact="cn=vmail,dc=iredmail,dc=org"   read
    by dn.exact="cn=vmailadmin,dc=iredmail,dc=org"  write
    by dn.regex="mail=[^,]+,domainName=$1,o=domains,dc=iredmail,dc=org$" read
    by users                        read

########################################################
################# Add below lines ######################
########################################################
access to dn.subtree="o=domainAdmins,dc=iredmail,dc=org"
    by anonymous                    auth
    by self                         write
    by dn.exact="cn=vmail,dc=iredmail,dc=org"  read
    by dn.exact="cn=vmailadmin,dc=iredmail,dc=org"  write
    by users                        none

Fixed incorrect pysieved config file ownership. 2009.03.18

# chown vmail:vmail /etc/pysieved.ini
# /etc/init.d/pysieved restart

Improvements and Updates

Apache

Add /var/www/html/robots.txt file to disallow search engines. Content:

User-agent: *
Disallow: /mail
Disallow: /webmail
Disallow: /roundcube
Disallow: /phpldapadmin
Disallow: /ldap
Disallow: /mysql
Disallow: /phpmyadmin
Disallow: /awstats

PHP

Set disable_functions in /etc/php.ini. Thanks david(at)knapp(dot)org.

disable_functions = show_source, system, shell_exec, passthru, exec, phpinfo, proc_open

MySQL backend special

Add column to set mail storage base directory. Warning: Please replace /home/vmail below to fit your environment.

# mysql -uroot -p vmail
mysql> ALTER TABLE mailbox ADD COLUMN storagebasedirectory VARCHAR(255) DEFAULT '/home/vmail';

Alter vmail.enablesieve to vmail.enablemanagesieve:

# mysql -uroot -p vmail
mysql> ALTER TABLE mailbox CHANGE COLUMN enablesieve enablemanagesieve TINYINT(1);

Due to this change, you have to add one more parameter in /etc/pysieved.ini:

[Dovecot]
service = managesieve

Add new columns in vmail.mailbox table:

# mysql -uroot -p vmail
mysql> ALTER TABLE mailbox ADD COLUMN employeeid VARCHAR(255) DEFAULT NULL;
mysql> ALTER TABLE mailbox ADD COLUMN lastlogindate DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00';
mysql> ALTER TABLE mailbox ADD COLUMN lastloginprotocol CHAR(255) NOT NULL DEFAULT '';

OpenLDAP backend special

Add one enabledService=forward in mail forwarding address lookup: /etc/postfix/ldap_virtual_alias_maps.cf.

query_filter    = (&(mail=%s)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=forward))

Index more LDAP attributes in /etc/openldap/slapd.conf:

index domainAdmin,domainGlobalAdmin,domainBackupMX    eq,pres
index listAllowedUser,accessPolicy eq,pres
index memberOfGroup eq,pres

After added above line, please stop openldap and run slapindex in database directory:

# /etc/init.d/ldap stop
# cd /var/lib/ldap/iredmail.org/
# slapindex
# chown ldap:ldap *
# /etc/init.d/ldap start

Postfix

LDAP backend only: Mail group/list implemented of LDAP is changed.
- objectClass mailUser has a new attribute: memberOfGroup, used to store group name (a valid email address).
- Mail group lookup maps in postfix must be changed too. modify your /etc/postfix/main.cf:

virtual_alias_maps =
    ldap:/etc/postfix/ldap_virtual_alias_maps.cf,
    ldap:/etc/postfix/ldap_virtual_group_maps.cf    # Add this lookup file.

Create /etc/postfix/ldap_virtual_group_maps.cf:

server_host     = 127.0.0.1
server_port     = 389
version         = 3
bind            = yes
start_tls       = no
bind_dn         = cn=vmail,dc=iredmail,dc=org
bind_pw         = KrxIkebDaRWb81yHdetBPt0UXC6NVZ
search_base     = domainName=%d,o=domains,dc=iredmail,dc=org
scope           = sub
query_filter    = (&(memberOfGroup=%s)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=deliver))
result_attribute= mail
debuglevel      = 0

Remove (objectClass=mailList) in query_filter line in /etc/postfix/ldap_virtual_alias_maps.cf:

#query_filter    = (&(mail=%s)(accountStatus=active)(enabledService=mail)(enabledService=deliver)(|(objectClass=mailList)(objectClass=mailAlias)(&(objectClass=mailUser)(enabledService=forward))))
query_filter    = (&(mail=%s)(accountStatus=active)(enabledService=mail)(enabledService=deliver)(|(objectClass=mailAlias)(&(objectClass=mailUser)(enabledService=forward))))

LDAP backend only: Add bcc control in bcc lookup. Warning: Do NOT forget to add enabledService=senderbcc and enabledService=recipientbcc for all domains/users allowed bcc feature.

File: /etc/postfix/ldap_sender_bcc_maps_domain.cf.

query_filter    = (&(domainName=%d)(objectClass=mailDomain)(domainStatus=active)(enabledService=mail)(enabledService=senderbcc))

File: /etc/postfix/ldap_recipient_bcc_maps_domain.cf.

query_filter    = (&(domainName=%d)(objectClass=mailDomain)(domainStatus=active)(enabledService=mail)(enabledService=recipientbcc))

File: /etc/postfix/ldap_sender_bcc_maps_user.cf.

query_filter    = (&(mail=%s)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=senderbcc))

File: /etc/postfix/ldap_recipient_bcc_maps_user.cf.

query_filter    = (&(mail=%s)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=recipientbcc))

Add backup mx control in domain lookup file:
- For MySQL backend: /etc/postfix/mysql_virtual_mailbox_domains.cf

query       = SELECT domain FROM domain WHERE domain='%s' AND backupmx='0' AND active='1' AND expired >= NOW()

* For OpenLDAP backend: /etc/postfix/ldap_virtual_mailbox_domains.cf

query_filter    = (&(objectClass=mailDomain)(domainName=%s)(!(domainBackupMX=yes))(domainStatus=active)(enabledService=mail))

* LDAP backend only: Add group mail and alias support for openldap backend, you have to change virtual alias lookup file: /etc/postfix/ldap_virtual_alias_maps.cf.

search_base     = domainName=%d,o=domains,dc=iredmail,dc=org
scope           = sub
query_filter    = (&(mail=%s)(accountStatus=active)(enabledService=mail)(enabledService=deliver)(|(objectClass=mailList)(objectClass=mailAlias)(&(objectClass=mailUser)(enabledService=forward))))
result_attribute= mailForwardingAddress

Dovecot

mail_location setting changed in file: /etc/dovecot.conf.

mail_location = maildir:/%Lh/:INDEX=/%Lh/

and dovecot-mysql.conf (if you use MySQL as backend) should be changed too:

user_query = SELECT CONCAT(storagebasedirectory, '/', maildir) AS home, \

and dovecot-ldap.conf (if you use OpenLDAP as backend) should be changed too:

user_attrs      = =sieve_dir=/home/vmail/sieve/%Ld/%Ln/,storageBaseDirectory=home,mailMessageStore=mail=maildir:~/%$/Maildir/,mailQuota=quota_rule=*:bytes=%$

Roundcube webmail

Change global ldap address book filter in /var/www/roundcubemail-x.y.z/config/main.inc.php. It will search mail user/group/alias for you while typing mail address in recipient field.

    'filter'        => "(&(accountStatus=active)(enabledService=mail)(enabledService=deliver)(|(&(objectClass=mailList)(hasMember=yes))(objectClass=mailAlias)(objectClass=mailUser)))", // Search mail users, lists, aliases.

New settings in /var/www/roundcubemail-x.y.z/config/main.inc.php:
log_driver syslog
syslog_id roundcube syslog_facility LOG_MAIL mime_param_folding 1 identities_level 3 quota_zero_as_unlimited TRUE
LDAP backend only: Replace 'gn' by 'givenName' in global LDAP address book. (2009.03.15)

# File: /var/www/roundcubemail-x.y.z-stable/config/main.inc.php

    'search_fields' => array('mail', 'cn', 'givenName', 'sn'),  // fields to search in
    'firstname_field' => 'givenName',  // this field represents the contact's first name

Disclaimer

iRedMail-0.5.0 supports automatically adding a disclaimer to all outgoing emails with Amavisd-new + alterMIME.

Install altermime from iRedMail yum repository:
- For i386:

# yum install altermime.i386

* For x86_64:

# yum install altermime.x86_64

Create directory to store disclaimer files if not exist:

# mkdir -p /etc/postfix/disclaimer/

In /etc/amavisd.conf, add allow_disclaimers in $policy_bank{'MYNET'}:

$policy_bank{'MYNETS'} = {   # mail originating from @mynetworks
  [ ... skip other settings here ...]
  allow_disclaimers => 1,  # enables disclaimer insertion if available
};

Add disclaimer settings before the last line:

# ------------ Disclaimer Setting ---------------
$altermime = '/usr/bin/altermime';
$defang_maps_by_ccat{+CC_CATCHALL} = [ 'disclaimer' ];

# Disclaimer in plain text formart.
@altermime_args_disclaimer = qw(--disclaimer=/etc/postfix/disclaimer/_OPTION_.txt);

@disclaimer_options_bysender_maps = ({
    # Per-domain disclaimer setting: /etc/postfix/disclaimer/host1.iredmail.org.txt
    #'host1.iredmail.org' => 'host1.iredmail.org',

    # Sub-domain disclaimer setting: /etc/postfix/disclaimer/iredmail.org.txt
    #'.iredmail.org'      => 'iredmail.org',

    # Per-user disclaimer setting: /etc/postfix/disclaimer/boss.iredmail.org.txt
    #'boss@iredmail.org'  => 'boss.iredmail.org',

    # Catch-all disclaimer setting: /etc/postfix/disclaimer/default.txt
    '.' => 'default',
},);
# ------------ End Disclaimer Setting ---------------

Create an testing disclaimer file:

# echo 'Testing disclaimer.' > /etc/postfix/disclaimer/default.txt

Restart amavisd and send mail from your webmail or Outlook/Thunderbird:

# /etc/init.d/amavisd restart

All documents are available in BitBucket repository, and published under Creative Commons license. You can download the latest version for offline reading. If you found something wrong, please do contact us to fix it.