COURIER IMAP + COURIERPASSD for Qmail

Size: px

Start display at page:

Download "COURIER IMAP + COURIERPASSD for Qmail"

Letitia Ryan
6 years ago
Views:

1 COURIER IMAP + COURIERPASSD for Qmail Courier-imap is (was, until now) the preferred IMAP server to install, because it has built in support for the vchkpw mail user setup that Vpopmail utilizes. (Not true for courier-authlib and newer). In short, Courier IMAP works with Vpopmail and virtual domains. In addition to installing Courier-imap, we're going to install Courierpassd. Courierpassd is a utility that allows users to change their mailbox passwords remotely. Note: In May 2008 the developer of courier-imap decided to drop support for vpopmail. This support is not there in courier-authlib and newer.similarly courier-imap does not work, if it doesn't find at least courier-authlib So you need to down-grade both. Reference link: ml You must have gdbm-devel installed. 1 / 36

2 yum -y install gdbm-devel libtool-ltdl-devel libtool-ltdl postgresql-devel expect We are going to use latest releases from Courierpassd is available at: QMR provides courier-authlib-0.55.tar.bz2. Latest is courier-authlib tar.bz2. Also QMR package provides courier-imap tar.bz2. Whereas the latest is courier-imap tar.bz2. Also QMR provides courierpassd rc1, whereas latest is courierpassd tar.gz. Note: The exercise below was done using the latest courier-authlib and courier-imap versions, which you will see further below, failed miserably. The reader following the 2 / 36

3 QMR guide (and this whole series of howtos) is warned again to not get tempted by the newer versions. The latest I could use for courier-authlib was and the latest I could use for courier-imap was So the steps below are equally valid of both old and new versions. cd /downloads/qmailnew wget wget wget I am going to build RPMs of these Courier-* files, after putting in the necessary config parameters. The RPM need to be built as ordinary user, for example, kamran. Courier-authlib: 3 / 36

4 This needs user kamran to be specified in visudo. kamran ALL=NOPASSWD: ALL After giving it sudo rights, perform the following steps as user Kamran:- su - kamran [kamran@www qmailnew]$ cp /downloads/qmailnew/courier* /home/kamran/ cd /home/kamran tar xjf courier-authlib tar.bz2 cd courier-authlib / 36

5 Added the following in the.spec file in the configure section. --with-authvchkpw --without-authldap --disable-root-check --with-ssl --with-redhat QMR suggests "--with-authchangepwdir=/usr/local/libexec/authlib" to be passed to the configure script. But I could not find it in courier-authlib (Later discovered that support for vchkpw is no more there in newer versions of courier-authlib!) Note: The following exercise will be useless with courier-authlib So please use an older version of courier-authlib (older than ), to do the install. The following steps were done using newer version and are provided for the sake of completion only. [kamran@www courier-authlib ]$ vi courier-authlib.spec 5 / 36

6 %configure --with-authvchkpw --without-authldap --disable-root-check --with-ssl --with-redhat cd.. mv courier-authlib tar.bz2 courier-authlib tar.bz2.orig ~]$ tar cjf courier-authlib tar.bz2 courier-authlib Courier-authlib can be built and installed using sudo: $ sudo rpmbuild -ta courier-authlib tar.bz2 6 / 36

7 cd /usr/src/redhat/rpms/x86_64/ $ sudo rpm -ivh courier-authlib x86_64.rpm courier-authlib-devel x86_64.rpm courier-authlib-mysql x86_64.rpm Time to compile/generate RPM for courier-imap as well. Pass the same arguments to its %configure section as well.. cd /home/kamran tar xjf courier-imap tar.bz2 cd courier-imap vi courier-imap.spec 7 / 36

8 %configure --with-authvchkpw --without-authldap --disable-root-check --with-ssl --with-redhat %{?xflags: %{xflags}} cd.. mv courier-imap tar.bz2 courier-imap tar.bz2.orig tar cjf courier-imap tar.bz2 courier-imap / 36

9 Time to build the RPM for courier-imap. Note: You cannot build courier-imap as sudo. You will get the following error: ============================= Do not run make check as root ============================= make[2]: *** [check-am] Error 1 make[2]: Leaving directory `/usr/src/redhat/build/courier-imap-4.3.1/imap' make[1]: *** [check] Error 2 make[1]: Leaving directory `/usr/src/redhat/build/courier-imap-4.3.1/imap' 9 / 36

10 make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.6589 (%build) So we need to setup a RPM environment in the /home/kamran directory. As user kamran:- mkdir $HOME/rpm/{SOURCES,SPECS,BUILD,SRPMS,RPMS} -p mkdir $HOME/rpm/RPMS/{i386,noarch,x86_64} echo "%_topdir $HOME/rpm" >> $HOME/.rpmmacros 10 / 36

11 Next, $ rpmbuild -ta courier-imap tar.bz2.... Wrote: /home/kamran/rpm/srpms/courier-imap src.rpm Wrote: /home/kamran/rpm/rpms/x86_64/courier-imap x86_64.rpm Wrote: /home/kamran/rpm/rpms/x86_64/courier-imap-debuginfo x86_64.rpm Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp umask cd /home/kamran/rpm/build 11 / 36

12 + cd courier-imap rm -rf /var/tmp/courier-imap buildroot + exit 0 [kamran@www ~]$ cd $HOME/rpm/RPMS/x86_64 sudo rpm -ivh courier-imap x86_64.rpm exit # exit back to root user again 12 / 36

13 Now, run the following to generate the IMAP certificate:- /usr/lib/courier-imap/sbin/mkimapdcert qmailnew]# /usr/lib/courier-imap/sbin/mkimapdcert Generating a 1024 bit RSA private key writing new private key to '/usr/lib/courier-imap/share/imapd.pem' semi-random bytes loaded 13 / 36

14 Generating DH parameters, 512 bit long safe prime, generator 2 This is going to take a long time *++*++*++*++*++* subject= /C=US/ST=NY/L=New York/O=Courier Mail Server/OU=Automatically-generated IMAP SSL key/cn=localhost/ address=postmaster@example.com notbefore=jun 26 16:02: GMT notafter=jun 26 16:02: GMT SHA1 Fingerprint=7A:F6:90:FA:02:2B:45:7F:CF:59:EB:2C:8E:8F:48:03:8C:61:4F:FE [root@www qmailnew]# vi /usr/lib/courier-imap/etc/imapd.cnf 14 / 36

15 change an administrative address The file: /usr/lib/courier-imap/etc/imapd Make sure that the following configuration exists: IMAPDSTART=YES ~]# grep ^IMAPDSTART /usr/lib/courier-imap/etc/imapd IMAPDSTART=YES The file: /usr/lib/courier-imap/etc/imapd-ssl 15 / 36

16 Make sure that the following configuration exists: IMAPDSSLSTART=YES Make sure that the following configuration exists: TLS_CERTFILE=/usr/lib/courier-imap/share/imapd.pem ~]# egrep '^TLS_CERTFILE ^IMAPDSSLSTART' /usr/lib/courier-imap/etc/imapd-ssl IMAPDSSLSTART=YES TLS_CERTFILE=/usr/lib/courier-imap/share/imapd.pem IMAPDSSLSTART=YES IMAPDSTARTTLS=YES IMAP_TLS_REQUIRED=0 vi /etc/authlib/authdaemonrc 16 / 36

17 Around like 27, you should see the "authmodulelist" setting. Make sure that "authvchkpw" is the only module listed. Like so: authmodulelist="authvchkpw" # authmodulelist="authuserdb authpam authpgsql authmysql authcustom authpipe" Save and exit the file. Note: You will not see authvchkpw already in the module list because it was removed in courier-authlib and newer. Ideally you should stop here, if this is the case, and download an older version (0.60.2). And perform all the steps again. The init.d files would now already be in place, because of RPM installation we did. 17 / 36

18 ~]# ls /etc/init.d/courier-* /etc/init.d/courier-authlib /etc/init.d/courier-imap Start the courier-authlib service ~]# /etc/init.d/courier-authlib start Starting Courier authentication services: authdaemond chkconfig --level 35 courier-authlib on 18 / 36

19 You should see the authdaemond process, as shown below. ~]# ps aux grep auth root ? S 19:16 0:00 /usr/sbin/courierlogger -pid=/var/spool/authdaemon/pid -start /usr/libexec/courier-authlib/authdaemond root ? S 19:16 0:00 /usr/libexec/courier-authlib/authdaemond root ? S 19:16 0:00 /usr/libexec/courier-authlib/authdaemond root ? S 19:16 0:00 /usr/libexec/courier-authlib/authdaemond root ? S 19:16 0:00 /usr/libexec/courier-authlib/authdaemond root ? S 19:16 0:00 /usr/libexec/courier-authlib/authdaemond 19 / 36

20 root ? S 19:16 0:00 /usr/libexec/courier-authlib/authdaemond root pts/0 S+ 19:16 0:00 grep auth And the following output in MAILLOG. [root@www ~]# tail -f /var/log/maillog... Jun 26 19:16:09 www authdaemond: modules="authvchkpw", daemons=5 Jun 26 19:16:09 www authdaemond: Installing libauthvchkpw Jun 26 19:16:09 www authdaemond: libauthvchkpw.so: cannot open shared object file: No such file or directory 20 / 36

21 Note: See the problem! This is because support for authvchkpasswd in versions and higher is no more there. I need to use the older again. In short, I downloaded an older version and successfully installed courier-authlib After performing all of above steps, my /var/log/maillog shows:- [root@www ~]# tail -f /var/log/maillog... Jun 26 19:58:00 www authdaemond: modules="authvchkpw", daemons=5 Jun 26 19:58:00 www authdaemond: Installing libauthvchkpw Jun 26 19:58:00 www authdaemond: Installation complete: authvchkpw 21 / 36

22 To install older versions of courier-authlib and courier-imap, remove the newer versions first: /etc/init.d/courier-authlib stop rpm -qa grep courier qmailnew]# rpm -qa grep courier courier-imap courier-authlib-devel courier-authlib courier-authlib-mysql / 36

23 qmailnew]# rpm -e courier-imap courier-authlib-devel courier-authlib courier-authlib-mysql /usr/lib/courier-imap/libexec/imapd.rc: line 55: /usr/sbin/courierlogger: No such file or directory /usr/lib/courier-imap/libexec/imapd-ssl.rc: line 56: /usr/sbin/courierlogger: No such file or directory /usr/lib/courier-imap/libexec/pop3d.rc: line 47: /usr/sbin/courierlogger: No such file or directory /usr/lib/courier-imap/libexec/pop3d-ssl.rc: line 51: /usr/sbin/courierlogger: No such file or directory warning: /usr/lib/courier-imap/etc/imapd.cnf saved as /usr/lib/courier-imap/etc/imapd.cnf.rpmsave qmailnew]# rpm -qa grep courier qmailnew]# 23 / 36

24 As evident from the command issued above, nothing related to courier is left on my system. I have RPMS on my older server. I will just rebuild them. cp /data/backup/downloads/qmailnew/courier* /downloads/qmailnew/ [Do all the installation steps here] Start Courier IMAP service: service courier-imap start chkconfig --level 35 courier-imap on 24 / 36

25 qmailnew]# nmap localhost Starting Nmap 4.11 ( ) at :01 AST Interesting ports on localhost.localdomain ( ): Not shown: 1669 closed ports PORT STATE SERVICE 22/tcp open ssh 53/tcp open domain 80/tcp open http 25 / 36

26 110/tcp open pop3 143/tcp open imap 199/tcp open smux 443/tcp open https 953/tcp open rndc 993/tcp open imaps 995/tcp open pop3s 3306/tcp open mysql Nmap finished: 1 IP address (1 host up) scanned in seconds [root@www qmailnew]# 26 / 36

27 IMPORTANT: QMAIL has it's own POP3 daemon. And this courier POP3 and POP3S WILL conflict with it. So disable POP3 and POP3S in Courier. Note: This is from QMR and I do not agree. Basically you will have to maintain two mechanisms to manage which will be difficult for you. It is rather better to disable qmail-pop3d and use pop3 and imap, both, from courier. Anyway, in this howto it is done as per QMR guide. In my next howto, this issue is being taken care of. Also In next howto, Courier is being replaced by DoveCot. vi /usr/lib/courier-imap/etc/pop3d... POP3DSTART=NO 27 / 36

28 vi /usr/lib/courier-imap/etc/pop3d-ssl... POP3DSSLSTART=NO ~]# service courier-imap stop Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl ~]# service courier-imap start 28 / 36

29 Starting Courier-IMAP server: imap imap-ssl Or may be rename the files: cd /usr/lib/courier-imap/etc/ mv pop3d pop3d.disabled mv pop3d-ssl pop3d-ssl.disabled qmail-scanner-2.04]# service courier-imap stop Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl 29 / 36

30 qmail-scanner-2.04]# service courier-imap start Starting Courier-IMAP server: imap imap-ssl COURIERPASSD: ~]# find / -name courierauthconfig /home/akhan/rpm/build/courier-authlib /courierauthconfig /usr/bin/courierauthconfig [root@www ~]# find / -name courierauth.h /home/akhan/rpm/build/courier-authlib /courierauth.h 30 / 36

31 /home/akhan/downloads/courier-authlib /courierauth.h /usr/include/courierauth.h /downloads/qmailrocks/courier-authlib-0.55/courierauth.h ~]# cd /downloads/qmailnew tar xzf courierpassd tar.gz cd /downloads/qmailnew/courierpassd /configure make && make install 31 / 36

32 echo "courierpassd 106/tcp #for /etc/xinetd.d/courierpassd" >> /etc/services echo "courierpassd 106/tcp #for /etc/xinetd.d/courierpassd" >> /usr/share/nmap/nmap-services Add this to xinetd. You must have xinet rpm installed on the system. cat > /etc/xinetd.d/courierpassd << EOF service courierpassd { port = / 36

33 socket_type = stream protocol = tcp user = root server = /usr/local/sbin/courierpassd server_args = -s imap wait = no only_from = instances = 4 disable = no } EOF 33 / 36

34 service xinetd restart courierpassd-1.1.2]# nmap localhost PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 106/tcp open pop3pw > courierpassd 34 / 36

35 110/tcp open pop3 143/tcp open imap 199/tcp open snmp 443/tcp open https 993/tcp open imaps 995/tcp open pop3s 3306/tcp open mysql Nmap finished: 1 IP address (1 host up) scanned in seconds 35 / 36

36 Courier finished! 36 / 36

Written by Muhammad Kamran Azeem Tuesday, 04 August :42 - Last Updated Sunday, 26 December :33

Written by Muhammad Kamran Azeem Tuesday, 04 August :42 - Last Updated Sunday, 26 December :33 AUTORESPONDER: autorespond-2.0.4.tar.gz is a part of QmailAdmin project. It is needed if you later want to compile with the auto-responding facility. The tarball is provided by the QMR package. This is