DO NOT APPLY THIS UPGRADE TUTORIAL
This document is still a DRAFT, do NOT apply it.
Paid Remote Upgrade Support
We offer remote upgrade support if you don't want to get your hands dirty, check the details and contact us.
domain.maillists
forwardings.is_maillist
vmail.maillists
postfix-pregreet
.maddr.email_raw
to store mail address without address extension.b.barracudacentral.org
/etc/iredmail-release
with new iRedMail version numberiRedMail stores the release version in /etc/iredmail-release
after
installation, it's recommended to update this file after you upgraded iRedMail,
so that you can know which version of iRedMail you're running. For example:
0.9.7
Please follow below tutorial to upgrade iRedAPD to the latest stable release: Upgrade iRedAPD to the latest stable release
SOGo backup script /var/vmail/backup/backup_sogo.sh
shipped in iRedMail-0.9.7
and earlier releases contains 3 issues:
sogo-tool
on FreeBSD. This issue causes our script
didn't backup any sogo data on FreeBSD at all.To fix them, please download the latest version and override the one on your system:
Attention
Script backup_sogo.sh
uses /var/vmail/backup
to store backup files by
default, if you use a different directory, please edit this file and modify
parameter BACKUP_ROOTDIR=
to use the correct one.
cd /var/vmail/backup/
wget https://bitbucket.org/zhb/iredmail/raw/default/iRedMail/tools/backup_sogo.sh
chown root backup_sogo.sh
chmod 0400 backup_sogo.sh
postfix-pregreet
Attention
This is not applicable to OpenBSD because we don't have Fail2ban running on OpenBSD.
Quote from Postfix website:
The SMTP protocol is a classic example of a protocol where the server speaks before the client. postscreen(8) detects zombies that are in a hurry and that speak before their turn.
Many spammers are in a hurry to transfer message to your server, we'd like to block them due to not follow RFC.
During mail server maintenance, we found many spammers from China mainland
cannot pass this pregreet test and all of them use ylmf-pc
as HELO hostname.
it's very possible that they're running an illegal Windows XP system which were
installed with a malware Windows XP ISO image.
Steps to create this new Fail2ban jail:
/etc/fail2ban/filter.d/postfix-pregreet.conf
with content
below:[Definition]
# Block clients which cannot pass Postfix postscreen pregreet test.
# FYI: http://www.postfix.org/POSTSCREEN_README.html#pregreet
#
# The SMTP protocol is a classic example of a protocol where the server speaks
# before the client. postscreen(8) detects zombies that are in a hurry and that
# speak before their turn.
failregex = postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+:
# while setting up new account, Thunderbird doesn't wait for server connection
# greeting/banner, this causes Thunderbird cannot pass the Postfix pregreet
# test and caught by `failregex` rules listed above (the rule contains
# 'PREGREET' line).
# FYI: https://bugzilla.mozilla.org/show_bug.cgi?id=538809#c41
ignoreregex = postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+: (EHLO|HELO) we-guess.mozilla.org
Create new file /etc/fail2ban/jail.d/postfix-pregreet.local
with content
below:
Attention
Please make sure you're using correct Postfix log file in logpath =
parameter. On RHEL/CentOS/FreeBSD, it's /var/log/maillog
. On
Debian/Ubuntu, it's /var/log/mail.log
.
[postfix-pregreet-iredmail]
enabled = true
filter = postfix-pregreet.iredmail
logpath = /var/log/maillog
maxretry = 1
action = iptables-multiports[name=postfix, port="25", protocol=tcp]
Attention
This is only applicable to Nginx.
With default iRedMail settings, Nginx snippet file /etc/nginx/templates/iredadmin.tmpl
(on Linux/OpenBSD) or /usr/local/etc/nginx/templates/iredadmin.tmpl
(on FreeBSD)
hard-codes static file types like below:
location ~ ^/iredadmin/static/(.*)\.(png|jpg|gif|css|js) {
alias /var/www/iredadmin/static/$1.$2;
}
Note: The path in alias
directive is different on different Linux/BSD distributions.
Please replace it by:
location ~ ^/iredadmin/static/(.*) { # Remove file types
alias /var/www/iredadmin/static/$1; # Remove '.$2'
}
Reloading or restarting Nginx service is required.
b.barracudacentral.org
Postfix config file generated by iRedMail enables DNSBL service for postscreen service like below:
postscreen_dnsbl_sites =
zen.spamhaus.org=127.0.0.[2..11]*3
b.barracudacentral.org=127.0.0.[2..11]*2
but site b.barracudacentral.org
returns only domain 127.0.0.2
(instead of
a range from 127.0.0.2
to 127.0.0.11
), so we should change the
b.barracudacentral.org=127.0.0.[2..11]*2
line to:
postscreen_dnsbl_sites =
zen.spamhaus.org=127.0.0.[2..11]*3
b.barracudacentral.org=127.0.0.2*2
Reloading or restarting Postfix is required.
If you may need to get more info of (locally) delivered mail messages,
Dovecot setting deliver_log_format
can log extra mail subject, sender, and
message size in mail deliver log. Please append this setting in Dovecot config
file dovecot.conf
, then restart or reload Dovecot service.
On Linux/OpenBSD, it's /etc/dovecot/dovecot.conf
On FreeBSD, it's /usr/local/etc/dovecot/dovecot.conf
deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, %$
Please open OpenLDAP config file slapd.conf
:
/etc/openldap/slapd.conf
/etc/ldap/slapd.conf
/usr/local/etc/openldap/slapd.conf
/etc/openldap/slapd.conf
.ldapd(8)
as LDAP server, no need to fix ACL
issue (access to dn.subtree=
), but still need to index new
attributes.find lines below:
access to dn.subtree="o=domains,dc=xxx,dc=xxx"
by anonymous auth
by self write
by dn.exact="cn=vmail,dc=xxx,dc=xxx" read
by dn.exact="cn=vmailadmin,dc=xxx,dc=xxx" write
by users none
Replace the last line by users none
by:
by users read
slapd.conf
:index member,uniqueMember eq,pres
index mailingListID eq
Attention
For OpenBSD ldapd(8)
server, please add lines below inside the
namespace xxx {}
block:
index member index uniqueMember index mailingListID
iRedMail-0.9.8 introduces 1 new LDAP attribute for mailing list account:
mailingListID
: used to store a server-wide unique id, currently is used
for mailing list subscription/unsubscription (a.k.a. newsletter).Download the latest iRedMail LDAP schema file
cd /tmp
wget https://bitbucket.org/zhb/iredmail/raw/default/iRedMail/samples/iredmail/iredmail.schema
cd /etc/openldap/schema/
cp iredmail.schema iredmail.schema.bak
cp -f /tmp/iredmail.schema /etc/openldap/schema/
cd /tmp
wget https://bitbucket.org/zhb/iredmail/raw/default/iRedMail/samples/iredmail/iredmail.schema
cd /etc/ldap/schema/
cp iredmail.schema iredmail.schema.bak
cp -f /tmp/iredmail.schema /etc/ldap/schema/
cd /tmp
wget https://bitbucket.org/zhb/iredmail/raw/default/iRedMail/samples/iredmail/iredmail.schema
cd /usr/local/etc/openldap/schema/
cp iredmail.schema iredmail.schema.bak
cp -f /tmp/iredmail.schema /usr/local/etc/openldap/schema/
On OpenBSD:
Note: if you're running ldapd as LDAP server, the schema directory is
/etc/ldap
, and service name isldapd
.
cd /tmp
ftp https://bitbucket.org/zhb/iredmail/raw/default/iRedMail/samples/iredmail/iredmail.schema
cd /etc/openldap/schema/
cp iredmail.schema iredmail.schema.bak
cp -f /tmp/iredmail.schema /etc/openldap/schema/
maddr.email_raw
to store mail address without address extensionMany sender/recipient addresses contain address extension like
user+extension@domain.com
, this is annoying if we try to get top 10
senders/recipients from Amavisd SQL database, because address
user+ext1@domain.com
and user+ext2@domain.com
are considered as different
user. To avoid this issue, we create a SQL trigger to store email address
without address extension in a new column maddr.email_raw
. Please follow
steps below to apply the SQL structure change.
cd /tmp/
wget https://bitbucket.org/zhb/iredmail/raw/default/extra/update/0.9.8/amavisd.mysql
$ mysql amavisd
mysql> SOURCE /tmp/amavisd.mysql;
Attention
With this change, user can only see other users in same domain. If this is NOT what you expect, you should NOT apply this change.
SOGo is configured by iRedMail to query all users on server while performing account search (e.g. global address book, meeting attendees), this may be not what you expect if you host multiple mail domains and they should not see others on same server. Please follow steps below to fix it.
/etc/sogo/sogo.conf
(Linux/OpenBSD) or
/usr/local/etc/sogo/sogo.conf
(FreeBSD), find lines like below: {
// Used for global address book
type = ldap;
id = global_addressbook;
canAuthenticate = NO;
isAddressBook = YES;
displayName = "Global Address Book";
displayName =
line: bindAsCurrentUser = YES;
Dovecot is IMAP/POP3/Managesieve server, also a SASL auth server for Postfix. If mail domain is disabled, users under this domain are not able to use IMAP/POP3/Managesieve services, but there's a bug in Dovecot SQL query configured by iRedMail, it doesn't check domain status while performing smtp sasl auth. Please follow steps below to fix it.
/etc/dovecot/dovecot-mysql.conf
(Linux/OpenBSD) or
/usr/local/etc/dovecot/dovecot-mysql.conf
(FreeBSD), find the
password_query
line like below:password_query = SELECT password, allow_nets FROM mailbox WHERE username='%u' AND enable%Ls%Lc=1 AND active=1
password_query = SELECT mailbox.password, mailbox.allow_nets \
FROM mailbox,domain \
WHERE mailbox.username='%u' \
AND mailbox.`enable%Ls%Lc`=1 \
AND mailbox.active=1 \
AND mailbox.domain=domain.domain \
AND domain.backupmx=0 \
AND domain.active=1
There're 2 Postfix SQL queries configured by iRedMail are improper, they won't return per-user bcc address. Please follow steps below to fix it:
/etc/postfix/mysql/recipient_bcc_maps_user.cf
(Linux/OpenBSD) or
/usr/local/etc/postfix/mysql/recipient_bcc_maps_user.cf
(FreeBSD),
REPLACE the query =
line by lines below:query = SELECT recipient_bcc_user.bcc_address
FROM recipient_bcc_user,domain,alias_domain
WHERE recipient_bcc_user.username='%s'
AND recipient_bcc_user.domain='%d'
AND ((recipient_bcc_user.domain=domain.domain)
OR (recipient_bcc_user.domain=alias_domain.alias_domain AND domain.domain = alias_domain.target_domain))
AND domain.backupmx=0
AND domain.active=1
AND recipient_bcc_user.active=1
/etc/postfix/mysql/sender_bcc_maps_user.cf
(Linux/OpenBSD) or
/usr/local/etc/postfix/mysql/sender_bcc_maps_user.cf
(FreeBSD),
REPLACE the query =
line by lines below:query = SELECT sender_bcc_user.bcc_address
FROM sender_bcc_user,domain,alias_domain
WHERE sender_bcc_user.username='%s'
AND sender_bcc_user.domain='%d'
AND ((sender_bcc_user.domain=domain.domain)
OR (sender_bcc_user.domain=alias_domain.alias_domain AND domain.domain = alias_domain.target_domain))
AND domain.backupmx=0
AND domain.active=1
AND sender_bcc_user.active=1
maddr.email_raw
to store mail address without address extensionMany sender/recipient addresses contain address extension like
user+extension@domain.com
, this is annoying if we try to get top 10
senders/recipients from Amavisd SQL database, because address
user+ext1@domain.com
and user+ext2@domain.com
should be considered as same
user, but it's not. To avoid this issue, we create a SQL trigger to store email
address without address extension in a new column maddr.email_raw
. Steps:
cd /tmp/
wget https://bitbucket.org/zhb/iredmail/raw/default/extra/update/0.9.8/amavisd.mysql
# mysql amavisd
sql> SOURCE /tmp/amavisd.mysql;
Dovecot is IMAP/POP3/Managesieve server, also a SASL auth server for Postfix. If mail domain is disabled, users under this domain are not able to use IMAP/POP3/Managesieve services, but there's a bug in Dovecot SQL query configured by iRedMail, it doesn't check domain status while performing smtp sasl auth. Please follow steps below to fix it.
/etc/dovecot/dovecot-pgsql.conf
(Linux/OpenBSD) or
/usr/local/etc/dovecot/dovecot-pgsql.conf
(FreeBSD), find the
password_query
line like below:password_query = SELECT password, allow_nets FROM mailbox WHERE username='%u' AND enable%Ls%Lc=1 AND active=1
password_query = SELECT mailbox.password, mailbox.allow_nets \
FROM mailbox,domain \
WHERE mailbox.username='%u' \
AND mailbox."enable%Ls%Lc"=1 \
AND mailbox.active=1 \
AND mailbox.domain=domain.domain \
AND domain.backupmx=0 \
AND domain.active=1
There're 2 Postfix SQL queries configured by iRedMail are improper, they won't return per-user bcc address. Please follow steps below to fix it:
/etc/postfix/pgsql/recipient_bcc_maps_user.cf
(Linux/OpenBSD) or
/usr/local/etc/postfix/pgsql/recipient_bcc_maps_user.cf
(FreeBSD),
REPLACE the query =
line by lines below:query = SELECT recipient_bcc_user.bcc_address
FROM recipient_bcc_user,domain,alias_domain
WHERE recipient_bcc_user.username='%s'
AND recipient_bcc_user.domain='%d'
AND ((recipient_bcc_user.domain=domain.domain)
OR (recipient_bcc_user.domain=alias_domain.alias_domain AND domain.domain = alias_domain.target_domain))
AND domain.backupmx=0
AND domain.active=1
AND recipient_bcc_user.active=1
/etc/postfix/pgsql/sender_bcc_maps_user.cf
, REPLACE the
query =
line by lines below:query = SELECT sender_bcc_user.bcc_address
FROM sender_bcc_user,domain,alias_domain
WHERE sender_bcc_user.username='%s'
AND sender_bcc_user.domain='%d'
AND ((sender_bcc_user.domain=domain.domain)
OR (sender_bcc_user.domain=alias_domain.alias_domain AND domain.domain = alias_domain.target_domain))
AND domain.backupmx=0
AND domain.active=1
AND sender_bcc_user.active=1
maddr.email_raw
to store mail address without address extensionMany sender/recipient addresses contain address extension like
user+extension@domain.com
, this is annoying if we try to get top 10
senders/recipients from Amavisd SQL database, because address
user+ext1@domain.com
and user+ext2@domain.com
should be considered as same
user, but it's not. To avoid this issue, we create a SQL trigger to store email
address without address extension in a new column maddr.email_raw
. Steps:
cd /tmp/
wget https://bitbucket.org/zhb/iredmail/raw/default/extra/update/0.9.8/amavisd.pgsql
# su - postgres
$ psql -U amavisd -d vmail
sql> \i /tmp/amavisd.pgsql