elmau
/
iredmail-doc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
iredmail-doc/html/backup.restore.html

281 lines
12 KiB
HTML
Raw Blame History

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Backup and restore</title>
<link rel="stylesheet" type="text/css" href="./css/markdown.css" />
</head>
<body>
<div id="navigation">
<a href="/index.html" target="_blank">
<img alt="iRedMail web site"
src="./images/logo-iredmail.png"
style="vertical-align: middle; height: 30px;"
/>&nbsp;
<span>iRedMail</span>
</a>
&nbsp;&nbsp;//&nbsp;&nbsp;<a href="./index.html">Document Index</a></div><h1 id="backup-and-restore">Backup and restore</h1>
<div class="toc">
<ul>
<li><a href="#backup-and-restore">Backup and restore</a><ul>
<li><a href="#backup">Backup</a><ul>
<li><a href="#backup-mail-accounts">Backup mail accounts</a></li>
<li><a href="#backup-additional-data-manually">Backup additional data manually</a></li>
</ul>
</li>
<li><a href="#restore">Restore</a><ul>
<li><a href="#how-to-restore-sql-databases">How to restore SQL databases</a></li>
<li><a href="#how-to-restore-ldap-backup">How to restore LDAP backup</a></li>
</ul>
</li>
</ul>
</li>
</ul>
</div>
<h2 id="backup">Backup</h2>
<h3 id="backup-mail-accounts">Backup mail accounts</h3>
<p>Mail accounts are stored in SQL/LDAP database. iRedMail provides shell scripts
to backup SQL/LDAP databases, you can find them in downloaded iRedMail release,
or find them in <a href="https://bitbucket.org/zhb/iredmail/src/default/iRedMail/tools/">iRedMail source code repository</a>:</p>
<ul>
<li><code>iRedMail-[VERSION]/tools/backup_openldap.sh</code>: used to backup OpenLDAP data.</li>
<li><code>iRedMail-[VERSION]/tools/backup_mysql.sh</code>: used to backup MySQL/MariaDB databases.</li>
<li><code>iRedMail-[VERSION]/tools/backup_pgsql.sh</code>: used to backup PostgreSQL databases.</li>
</ul>
<p>iRedMail will setup a daily cron job to run backup script(s) during
installation, so what you need to do is checking whether or not they're
defined as cron jobs with below commands:</p>
<pre><code># crontab -l -u root
</code></pre>
<p>Sample output on an iRedMail server with OpenLDAP backend:</p>
<pre><code># iRedMail: Backup OpenLDAP data every day on 03:01 AM
1 3 * * * /bin/bash /var/vmail/backup/backup_openldap.sh
# iRedMail: Backup MySQL databases every day on 03:10 AM
10 3 * * * /bin/bash /var/vmail/backup/backup_mysql.sh
</code></pre>
<p>Notes:</p>
<ul>
<li>Backup files are stored under directory defined in parameter <code>BACKUP_ROOTDIR</code>
in backup scripts, default is <code>/var/vmail/backup</code>.</li>
<li>SQL backup is plain SQL file, LDAP backup is plain LDIF file.</li>
<li>Backup files are compressed with <code>bzip2</code> by default, you can decompress them
with command <code>bunzip2</code>. for example, <code>bunzip2 file_name.bz2</code>.</li>
<li>It's ok to run the backup scripts manually.</li>
</ul>
<h3 id="backup-additional-data-manually">Backup additional data manually</h3>
<ul>
<li>
<p>DKIM keys. They're stored under <code>/var/lib/dkim/</code> by default. If you don't
backup them, it's ok to generate new keys and you must update DNS record
(<code>dkim._domainkey.[YOUR_MAIL_DOMAIN]</code>) with new DKIM key. Refer to another
document to generate DKIM key and update DNS record:
<a href="./sign.dkim.signature.for.new.domain.html">Sign DKIM signature on outgoing emails for new mail domain</a>.</p>
</li>
<li>
<p>OpenLDAP backend:</p>
<ul>
<li>If you enabled additional LDAP schema files in OpenLDAP, you should
backup them, copy them to new server and enable them. Otherwise you
cannot import backup LDIF file due to missing required LDAP attributes.</li>
</ul>
</li>
</ul>
<h2 id="restore">Restore</h2>
<h3 id="how-to-restore-sql-databases">How to restore SQL databases</h3>
<p>You can simply restore plain SQL files backed up by above backup scripts.</p>
<blockquote>
<p>If you're restoring on a <strong>NEW</strong> iRedMail server, do <em>NOT</em>
restore the database which is named <code>mysql</code> exported from old server, it
contains SQL usernames and passwords used in many components (e.g. Postfix,
Dovecot, Roundcube webmail) on old server. New iRedMail server already has
the same SQL accounts with different passwords, so please do not restore
<code>mysql</code> database, otherwise almost all services won't work due to incorrect
SQL credentials.</p>
</blockquote>
<h3 id="how-to-restore-ldap-backup">How to restore LDAP backup</h3>
<p>Backup script runs command <code>slapcat</code> to dump whole LDAP tree as a backup, it
must be so restored with command <code>slapadd</code>.</p>
<p>Below example shows how to restore a LDAP backup on RHEL/CentOS 6.x, files and
directories may be different on other Linux/BSD distributions, you can find
the correct ones in this tutorial:
<a href="./file.locations.html#openldap">Locations of configuration and log files of major components</a>.</p>
<ul>
<li>
<p>LDAP backups are stored under <code>/var/vmail/backup/ldap/[YEAR]/[MONTH]</code> by
default, for example, <code>/var/vmail/backup/ldap/2015/05/</code>. And it's compressed
with <code>bzip2</code> command to save disk space. we must decompress it first.</p>
</li>
<li>
<p>Go to the backup directory, find the latest backup. here we use backup file
<code>2015-05-10-03:01:01.ldif.bz2</code> for example.</p>
</li>
</ul>
<pre><code># cd /var/vmail/backup/ldap/2015/05/
# bunzip2 2015-05-10-03:01:01.ldif.bz2
# ls -l 2015-05-10-03:01:01.ldif
-rw-r--r-- 1 root root 7352 May 10 03:01 2015-05-10-03:01:01.ldif
</code></pre>
<ul>
<li>
<p>Find passwords for <code>cn=vmail,dc=xx,dc=xx</code> and <code>cn=vmailadmin,dc=xx,dc=xx</code>
in the root directory of iRedMail installation directory on <strong>NEW</strong> iRedMail
server. for example, <code>/root/iRedMail-0.9.0/iRedMail.tips</code>. Notes:</p>
<ul>
<li>They're plain passwords, not hashed or encrypted.</li>
<li>You can also find <code>cn=vmail</code>'s password in Postfix config files under
<code>/etc/postfix/mysql</code> (MySQL/MariaDB backend) or
<code>/etc/postfix/pgsql</code> (PostgreSQL backend).</li>
<li>You can also find <code>cn=vmailadmin</code>'s password in
<a href="./file.locations.html#iredadmin">iRedAdmin config file</a>.</li>
</ul>
</li>
</ul>
<p>Below is sample copy in file <code>iRedMail.tips</code>.</p>
<pre><code>OpenLDAP:
...
* LDAP bind dn (read-only): cn=vmail,dc=example,dc=com, password: py2BQwM0zoRM5nciK68AlP8dyu2Mq6
* LDAP admin dn (used for iRedAdmin): cn=vmailadmin,dc=example,dc=com, password: 9wr0mHeVYz2uaxSAGBLucVkOgYPSBB
</code></pre>
<ul>
<li>Now hash them with command <code>slappasswd</code>:</li>
</ul>
<pre><code># slappasswd -h '{ssha}' -s 'py2BQwM0zoRM5nciK68AlP8dyu2Mq6' # &lt;- cn=vmail's password
{SSHA}eJEO2yGVryVw+mZ/Qd2HMSyrl6u9WDhd
# slappasswd -h '{ssha}' -s '9wr0mHeVYz2uaxSAGBLucVkOgYPSBB' # &lt;- cn=vmailadmin's password
{SSHA}lWt6zjOOUq+2WUmiAea2FXLB4oHMYvIb
</code></pre>
<ul>
<li>
<p>Open the backup file <code>2015-05-10-03:01:01.ldif</code> with your favourite text
editor, find <code>usePassword</code> line of <code>cn=vmail</code> and <code>cn=vmailadmin</code>.
<strong>Important notes</strong>:</p>
<ul>
<li>A line that begins with a SPACE denotes that the characters following the
space are part of the previous line.</li>
<li>There're two colons after <code>userPassword</code> string (<code>userPassword::</code>).</li>
</ul>
</li>
</ul>
<p>Below is a sample copy in <code>2015-05-10-03:01:01.ldif</code>:</p>
<pre><code>dn: cn=vmail,dc=iredmail,dc=org
...
userPassword:: e1NTSEF7F8AwbjVqeER1R1dXVmREN1RJU8NtdnFHN0hnekdWYzVHSG9iWEE9PQ= # &lt;- remove this line
= # &lt;- remove this line
...
dn: cn=vmailadmin,dc=iredmail,dc=org
userPassword:: e1NTSEF9alZi8E12dS9FNllaMktteFh7YkZham1mM3Jqc21cdEFsZjJIeEE9PQ= # &lt;- remove this line
= # &lt;- remove this line
...
</code></pre>
<p>Replace these two <code>userPassword</code> lines by the newly generated ssha passwords,
save your change, exit your text editor.</p>
<pre><code>dn: cn=vmail,dc=iredmail,dc=org
...
userPassword: {SSHA}eJEO2yGVryVw+mZ/Qd2HMSyrl6u9WDhd
...
dn: cn=vmailadmin,dc=iredmail,dc=org
userPassword: {SSHA}lWt6zjOOUq+2WUmiAea2FXLB4oHMYvIb
...
</code></pre>
<p><strong>Important note</strong>: There's only <strong>ONE</strong> colon after <code>userPassword</code> string
(<code>userPassword:</code>).</p>
<ul>
<li>OpenLDAP service must be stopped while restoring backup. So we stop it first:</li>
</ul>
<pre><code># /etc/init.d/ldap stop
</code></pre>
<ul>
<li>
<p>If you enabled additional LDAP schema files on old server, you <code>MUST</code> copy
these schema files to new server, and enable them in OpenLDAP on new server,
also add new indexes for attributes defined in these additional LDAP schema
files if necessary. Otherwise you may not be able to import backup LDIF file
due to missing required attributes.</p>
</li>
<li>
<p>Remove all files under OpenLDAP data directory defined in LDAP config file
<code>slapd.conf</code> except one file (<code>DB_CONFIG</code>). For example:</p>
</li>
</ul>
<pre><code># File: /etc/openldap/slapd.conf
...
database bdb
suffix dc=iredmail,dc=org
directory /var/lib/ldap/iredmail.org
...
</code></pre>
<p>So you should remove all files under directory <code>/var/lib/ldap/iredmail.org</code>
except <code>/var/lib/ldap/iredmail.org/DB_CONFIG</code>.</p>
<pre><code># cd /var/lib/ldap/iredmail.org/
# mv DB_CONFIG ~
# rm -rf /var/lib/ldap/iredmail.org/*
# mv ~/DB_CONFIG .
</code></pre>
<ul>
<li>Start OpenLDAP service immediately, then stop it again. it will help create
necessary files required by backend db (<code>dbd</code> in our case, <code>database dbd</code>).</li>
</ul>
<pre><code># /etc/init.d/slapd start
# /etc/init.d/slapd stop
</code></pre>
<ul>
<li>Make sure OpenLDAP server is <strong>NOT</strong> running, then restore backup LDIF file
with command <code>slapadd</code>.</li>
</ul>
<pre><code># slapadd -f /etc/openldap/slapd.conf -l /path/to/backup/backup.ldif
</code></pre>
<ul>
<li>It's OK to start OpenLDAP server now. It may report errors like below:</li>
</ul>
<pre><code># /etc/init.d/slapd start
Stopping slapd: [ OK ]
/var/lib/ldap/iredmail.org/mailMessageStore.bdb is not owned[WARNING]&quot;
/var/lib/ldap/iredmail.org/objectClass.bdb is not owned by &quot;[WARNING]
/var/lib/ldap/iredmail.org/mtaTransport.bdb is not owned by [WARNING]
/var/lib/ldap/iredmail.org/cn.bdb is not owned by &quot;ldap&quot; [WARNING]
/var/lib/ldap/iredmail.org/domainName.bdb is not owned by &quot;l[WARNING]
/var/lib/ldap/iredmail.org/ou.bdb is not owned by &quot;ldap&quot; [WARNING]
/var/lib/ldap/iredmail.org/uid.bdb is not owned by &quot;ldap&quot; [WARNING]
/var/lib/ldap/iredmail.org/enabledService.bdb is not owned b[WARNING]
/var/lib/ldap/iredmail.org/homeDirectory.bdb is not owned by[WARNING]
/var/lib/ldap/iredmail.org/domainGlobalAdmin.bdb is not owne[WARNING]p&quot;
/var/lib/ldap/iredmail.org/sn.bdb is not owned by &quot;ldap&quot; [WARNING]
/var/lib/ldap/iredmail.org/mail.bdb is not owned by &quot;ldap&quot; [WARNING]
/var/lib/ldap/iredmail.org/accountStatus.bdb is not owned by[WARNING]
/var/lib/ldap/iredmail.org/givenName.bdb is not owned by &quot;ld[WARNING]
Checking configuration files for slapd: config file testing succeeded
[ OK ]
Starting slapd: [ OK ]
</code></pre>
<p>If you see above warning about improper file ownership, please set correct file
owner on newly created bdb files immediately, then restart OpenLDAP service:</p>
<pre><code># chown ldap:ldap /var/lib/ldap/iredmail.org/*.bdb
# /etc/init.d/ldap restart
</code></pre><p style="text-align: center; color: grey;">All documents are available in <a href="https://bitbucket.org/zhb/iredmail-docs/src">BitBucket repository</a>, and published under <a href="http://creativecommons.org/licenses/by-nd/3.0/us/" target="_blank">Creative Commons</a> license. If you found something wrong, please do <a href="http://www.iredmail.org/contact.html">contact us</a> to fix it.<script>
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-3293801-21', 'auto');
ga('send', 'pageview');
</script>
</body></html>
Reference in New Issue View Git Blame Copy Permalink