I ran into a minor issue while updating my vCenter Server to version 5.5 tonight. Below is screenshot of the error:
Simply add the permissions to the database to fix it:
use MSDB
go
sp_addrolemember @rolename = 'db_owner', @membername = 'vpxuser'
go
GRANT EXECUTE ON msdb.dbo.sp_add_category TO vpxuser
go
GRANT SELECT on msdb.dbo.sysjobsteps to vpxuser
go
GRANT SELECT ON msdb.dbo.sysjobs to vpxuser
Thursday, October 17, 2013
Tuesday, September 3, 2013
VMware ESXi - Changing Round Robin IOP limit
Get the current setting for each storage device:
for i in `fdisk -l | grep 'Disk /dev/disks/t10' | cut -f4 -d'/' | cut -f1 -d':'`; do esxcli storage nmp psp roundrobin deviceconfig get -d=$i | grep -A 1
Device:; done
Set all storage devices to 1 IOP per path:
for i in `fdisk -l | grep 'Disk /dev/disks/t10' | cut -f4 -d'/' | cut -f1 -d':'`; do esxcli storage nmp psp roundrobin deviceconfig set -t=iops -I=1 -d=$i; done
for i in `fdisk -l | grep 'Disk /dev/disks/t10' | cut -f4 -d'/' | cut -f1 -d':'`; do esxcli storage nmp psp roundrobin deviceconfig get -d=$i | grep -A 1
Device:; done
for i in `fdisk -l | grep 'Disk /dev/disks/t10' | cut -f4 -d'/' | cut -f1 -d':'`; do esxcli storage nmp psp roundrobin deviceconfig set -t=iops -I=1 -d=$i; done
FreeNAS - Replacing a Failed Disk
Tonight I had to replace a disk in my FreeNAS box that was completely dead, as in, not detected by the BIOS. Below are the steps to replace a completely failed disk. The FreeNAS docs have an article on replacing a failed disk but it does not cover replacing a disk that is no longer detected by the system. You can read that article here.
A zpool status shows the disk as unavailable:
[root@freenas] ~# zpool status -v zpool0
pool: zpool0
state: DEGRADED
status: One or more devices could not be opened. Sufficient replicas exist for
the pool to continue functioning in a degraded state.
action: Attach the missing device and online it using 'zpool online'.
see: http://illumos.org/msg/ZFS-8000-2Q
scan: scrub repaired 0 in 6h31m with 0 errors on Sun Jul 28 06:31:27 2013
config:
NAME STATE READ WRITE CKSUM
zpool0 DEGRADED 0 0 0
mirror-0 DEGRADED 0 0 0
3282272283788900661 UNAVAIL 0 0 0 was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db
gptid/398a9808-fec4-11d5-a8b2-001f2961db70 ONLINE 0 0 0
mirror-1 ONLINE 0 0 0
gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
errors: No known data errors
Next I took a screenshot of all my disks via the webGUI and noted the serial numbers for the disks in the pool. The failed disk will not show up in the list so we can use that to identify which physical disk we need to pull. Next shutdown the server and start pulling one disk at a time until you find the one with the serial number that is not in your list of serial numbers. When you find it, pull it out and replace it with your new one noting the serial number of the new disk. Next power on the system and login via SSH.
Next, offline the failed disk:
[root@freenas] ~# zpool offline zpool0 /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70
Check the status of the disk to ensure it's offline:
[root@freenas] ~# zpool status -v zpool0
pool: zpool0
state: DEGRADED
status: One or more devices has been taken offline by the administrator.
Sufficient replicas exist for the pool to continue functioning in a
degraded state.
action: Online the device using 'zpool online' or replace the device with
'zpool replace'.
scan: scrub repaired 0 in 6h31m with 0 errors on Sun Jul 28 06:31:27 2013
config:
NAME STATE READ WRITE CKSUM
zpool0 DEGRADED 0 0 0
mirror-0 DEGRADED 0 0 0
3282272283788900661 OFFLINE 0 0 0 was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db
gptid/398a9808-fec4-11d5-a8b2-001f2961db70 ONLINE 0 0 0
mirror-1 ONLINE 0 0 0
gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
errors: No known data errors
Now replace the disk in the pool with your new disk. You can use the webGUI to get the block device name, looking for the serial number of the new device you noted above:
[root@freenas] ~# zpool replace zpool0 /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70 /dev/ada2
Now just online the disk and ensure its says the new disk is resilvering:
[root@freenas] ~# zpool online zpool0 /dev/ada2
[root@freenas] ~# zpool status -v zpool0
pool: zpool0
state: DEGRADED
status: One or more devices is currently being resilvered. The pool will
continue to function, possibly in a degraded state.
action: Wait for the resilver to complete.
scan: resilver in progress since Tue Sep 3 21:32:02 2013
28.1M scanned out of 3.53T at 1.17M/s, (scan is slow, no estimated time)
15.4M resilvered, 0.00% done
config:
NAME STATE READ WRITE CKSUM
zpool0 DEGRADED 0 0 0
mirror-0 DEGRADED 0 0 0
replacing-0 DEGRADED 0 0 0
3282272283788900661 OFFLINE 0 0 0 was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70
ada2 ONLINE 0 0 0 (resilvering)
gptid/398a9808-fec4-11d5-a8b2-001f2961db70 ONLINE 0 0 0
mirror-1 ONLINE 0 0 0
gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
errors: No known data errors
A zpool status shows the disk as unavailable:
[root@freenas] ~# zpool status -v zpool0
pool: zpool0
state: DEGRADED
status: One or more devices could not be opened. Sufficient replicas exist for
the pool to continue functioning in a degraded state.
action: Attach the missing device and online it using 'zpool online'.
see: http://illumos.org/msg/ZFS-8000-2Q
scan: scrub repaired 0 in 6h31m with 0 errors on Sun Jul 28 06:31:27 2013
config:
NAME STATE READ WRITE CKSUM
zpool0 DEGRADED 0 0 0
mirror-0 DEGRADED 0 0 0
3282272283788900661 UNAVAIL 0 0 0 was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db
gptid/398a9808-fec4-11d5-a8b2-001f2961db70 ONLINE 0 0 0
mirror-1 ONLINE 0 0 0
gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
errors: No known data errors
Next I took a screenshot of all my disks via the webGUI and noted the serial numbers for the disks in the pool. The failed disk will not show up in the list so we can use that to identify which physical disk we need to pull. Next shutdown the server and start pulling one disk at a time until you find the one with the serial number that is not in your list of serial numbers. When you find it, pull it out and replace it with your new one noting the serial number of the new disk. Next power on the system and login via SSH.
Next, offline the failed disk:
[root@freenas] ~# zpool offline zpool0 /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70
Check the status of the disk to ensure it's offline:
[root@freenas] ~# zpool status -v zpool0
pool: zpool0
state: DEGRADED
status: One or more devices has been taken offline by the administrator.
Sufficient replicas exist for the pool to continue functioning in a
degraded state.
action: Online the device using 'zpool online' or replace the device with
'zpool replace'.
scan: scrub repaired 0 in 6h31m with 0 errors on Sun Jul 28 06:31:27 2013
config:
NAME STATE READ WRITE CKSUM
zpool0 DEGRADED 0 0 0
mirror-0 DEGRADED 0 0 0
3282272283788900661 OFFLINE 0 0 0 was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db
gptid/398a9808-fec4-11d5-a8b2-001f2961db70 ONLINE 0 0 0
mirror-1 ONLINE 0 0 0
gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
errors: No known data errors
Now replace the disk in the pool with your new disk. You can use the webGUI to get the block device name, looking for the serial number of the new device you noted above:
[root@freenas] ~# zpool replace zpool0 /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70 /dev/ada2
Now just online the disk and ensure its says the new disk is resilvering:
[root@freenas] ~# zpool online zpool0 /dev/ada2
[root@freenas] ~# zpool status -v zpool0
pool: zpool0
state: DEGRADED
status: One or more devices is currently being resilvered. The pool will
continue to function, possibly in a degraded state.
action: Wait for the resilver to complete.
scan: resilver in progress since Tue Sep 3 21:32:02 2013
28.1M scanned out of 3.53T at 1.17M/s, (scan is slow, no estimated time)
15.4M resilvered, 0.00% done
config:
NAME STATE READ WRITE CKSUM
zpool0 DEGRADED 0 0 0
mirror-0 DEGRADED 0 0 0
replacing-0 DEGRADED 0 0 0
3282272283788900661 OFFLINE 0 0 0 was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70
ada2 ONLINE 0 0 0 (resilvering)
gptid/398a9808-fec4-11d5-a8b2-001f2961db70 ONLINE 0 0 0
mirror-1 ONLINE 0 0 0
gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70 ONLINE 0 0 0
errors: No known data errors
Friday, April 5, 2013
Run ZNC IRC Bouncer as a Service
Below is a simple init script that will run your ZNC server as a service. Create a new file in /etc/init.d/ called znc and paste the following code in it.
#!/bin/bash
### BEGIN INIT INFO
# Provides: znc
# Required-Start: $local_fs $syslog $network
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start ZNC at boot time
# Description: Enable ZNC provided by /etc/init.d/znc.
### END INIT INFO
PID=`pidof znc`
case "$1" in
start)
if [[ $PID != "" ]]; then
echo "ZNC is already running"
exit 1
else
echo "Starting ZNC"
sudo -u ubuntu znc > /dev/null 2>&1
fi
;;
stop)
if [[ $PID != "" ]]; then
echo "Stopping ZNC"
kill -9 $PID > /dev/null 2>&1
else
echo "ZNC is not running"
exit 1
fi
;;
restart|reload)
if [[ $PID != '' ]]; then
echo "Stopping ZNC"
kill -9 $PID > /dev/null 2>&1
echo "Starting ZNC"
sudo -u ubuntu znc > /dev/null 2>&1
else
echo "ZNC is not running"
exit 1
fi
;;
status)
if [[ $PID != "" ]]; then
echo "ZNC is running"
else
echo "ZNC is not running"
fi
;;
*)
echo "Usage: $0 {start|stop|restart|reload|status}"
exit 2
;;
esac
After you've created the file you need to make it executable:
chmod +x /etc/init.d/znc
Then to add it to your runlevels run:
sudo update-rc.d znc defaults
Edit:
Apparently I should have read the docs. In the ZNC wiki are instructions for doing this. Ah well...
http://wiki.znc.in/Running_ZNC_as_a_system_daemon
#!/bin/bash
### BEGIN INIT INFO
# Provides: znc
# Required-Start: $local_fs $syslog $network
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start ZNC at boot time
# Description: Enable ZNC provided by /etc/init.d/znc.
### END INIT INFO
PID=`pidof znc`
case "$1" in
start)
if [[ $PID != "" ]]; then
echo "ZNC is already running"
exit 1
else
echo "Starting ZNC"
sudo -u ubuntu znc > /dev/null 2>&1
fi
;;
stop)
if [[ $PID != "" ]]; then
echo "Stopping ZNC"
kill -9 $PID > /dev/null 2>&1
else
echo "ZNC is not running"
exit 1
fi
;;
restart|reload)
if [[ $PID != '' ]]; then
echo "Stopping ZNC"
kill -9 $PID > /dev/null 2>&1
echo "Starting ZNC"
sudo -u ubuntu znc > /dev/null 2>&1
else
echo "ZNC is not running"
exit 1
fi
;;
status)
if [[ $PID != "" ]]; then
echo "ZNC is running"
else
echo "ZNC is not running"
fi
;;
*)
echo "Usage: $0 {start|stop|restart|reload|status}"
exit 2
;;
esac
chmod +x /etc/init.d/znc
Then to add it to your runlevels run:
sudo update-rc.d znc defaults
Edit:
Apparently I should have read the docs. In the ZNC wiki are instructions for doing this. Ah well...
http://wiki.znc.in/Running_ZNC_as_a_system_daemon
Wednesday, February 13, 2013
Setting up Zarafa on Debian
This is just my personal documentation on the process I use. I had this in a text file and didn't want to lose it so I figured I'd post it here. If it helps someone out, great.
1 - Install OS - Choose SSH and Web Server during tasksel package selection
Make sure to enable the extra repos
2 - Configure networking
nano /etc/network/interfaces
nano /etc/resolv.conf
3 - Install MySQL
apt-get install mysql-server
4 - Create MySQL user
mysql -u root -p
CREATE USER 'zarafa'@'localhost' IDENTIFIED BY 'password';
4 - Test PHP/Apache
echo '<?php echo phpinfo(); ?>' >>/var/www/index.php
* Be sure to delete this file after successfully testing that PHP is working :: rm /var/www/index.php
5 - Install Zarafa Common Package
dpkg -i zarafa-common_7.1.2-39121_amd64.deb
6 - Install Dependencies
apt-get install libboost-system1.42.0 libboost-filesystem1.42.0 libicu44
7 - Install Zarafa Server
./install.sh
8 - Test Zarafa WebAccess
http://<ip address>/webaccess/
9 - Grant priveleges (documentation was wrong)
mysql -u root -p
GRANT alter, alter routine, create, create routine, delete, drop, index, insert, lock tables, select, update ON zarafa.* TO 'zarafa'@'localhost' IDENTIFIED BY 'password';
10 - Restart Zarafa Server
/etc/init.d/zarafa-server restart
13 - Create Public Store
zarafa-admin -s
* If you the message 'The server is not running, or not accessable through file:///var/run/zarafa.' try restarting the Zarafa Server
14 - Verify Public Store was created successfully
zarafa-admin -s
* Should tell you: 'Unable to create store, public already exists'
15 - Create OU in AD for Zarafa users
16 - Install ADS plugin on DC
* Make sure the user is part of the Schema Admins group
* Right click, Run as Administrator
* View the Properties of a user and verify the Zarafa tab is available in AD Users and Computer snap-in
17 - Change user store in server.cfg to use LDAP (Need to work on using LDAPS for LDAP over SSL)
nano /etc/zarafa/server.cfg
user_plugin = ldap
18 - Verify the user plugin path is set correctly for x86_64 systems
plugin_path = /usr/lib64/zarafa
19 - Create AD user that Zarafa will use to bind to the LDAP database (need to figure out the least priveleged permissions for this to work)
Create the user in the same OU or Container that the rest of the Zarafa users will be in
20 - Configure Zarafa to use ADS for user store
nano /etc/zarafa/ldap.active-directory.cfg
21 - Configure AD user for LDAP bind (Must be in LDAP DN format)
nano /etc/zarafa/ldap.active-directory.cfg
ldap_bind_user = cn=Zarafa,ou=ZarafaUsers,dc=domain,dc=local
* Make sure none of the CN's in the DN contain spaces
ldap_bind_passwd = password
22 - Set the LDAP search base
ldap_search_base = ou=ZarafaUsers,dc=domain,dc=local
23 - Rename the LDAP config.
mv /etc/zarafa/ldap.active-directory.cfg /etc/zarafa/ldap.cfg
24 - Restart Zarafa Server
/etc/init.d/zarafa-server restart
25 - Test that you can authenticate to Zarafa webaccess with an AD account
26 - Install Postfix
apt-get install postfix postfix-ldap
* Choose Internet Site during setup
27 - Add MX record to DNS server
28 - Postfix main.cf config
http://doc.zarafa.com/7.1/Administrator_Manual/en-US/html-single/#_MTAIntegration
nano /etc/postfix/main.cf
echo 'virtual_mailbox_domains = domain.local' >> /etc/postfix/main.cf
echo 'virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf' >> /etc/postfix/main.cf
echo 'virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf, ldap:/etc/postfix/ldap-groups.cf' >> /etc/postfix/main.cf
echo 'virtual_transport = lmtp:127.0.0.1:2003' >> /etc/postfix/main.cf
29 - Configure Postfix for LDAP authentication
touch /etc/postfix/ldap-users.cf
nano ldap-users.cf
server_host = 192.168.0.100
search_base = ou=Users,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
scope = sub
query_filter = (&(objectClass=user)(mail=%s))
result_attribute = mail
touch /etc/postfix/ldap-groups.cf
server_host = 192.168.0.100
search_base = ou=groups,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
query_filter = (&(objectclass=group)(mail=%s))
leaf_result_attribute = mail
special_result_attribute = member
touch /etc/postfix/ldap-aliases.cf
server_host = 192.168.0.100
search_base = ou=Users,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
scope = sub
query_filter = (&(objectClass=user)(otherMailbox=%s))
result_attribute = mail
30 - Restart services for changes to take effect
/etc/init.d/postfix restart
/etc/init.d/zarafa-dagent restart
31 - Configure the Dagent to start at boot time
update-rc.d zarafa-dagent defaults
## Hardening Zarafa ##
32 - Configure Zarafa to run as non-root
addgroup --system zarafa
adduser --system --home /dev/null --no-create-home \
--ingroup zarafa \
--disabled-password --gecos 'Zarafa services' \
--shell /bin/false zarafa
chown -R zarafa:zarafa /var/log/zarafa
chmod -R 710 /var/log/zarafa/
33 - Setup Certificate CA for SSL
mkdir /etc/zarafa/ssl
chmod -R 700 /etc/zarafa/ssl
cd /etc/zarafa/ssl
sh /usr/share/doc/zarafa/ssl-certificates.sh server
* Organizational Unit names must be different
* No public key is needed
nano /etc/zarafa/server.cfg
* Configure SSL settings
cp /etc/zarafa/ssl/demoCA/cacert.pem /etc/zarafa/ssl
chown -R zarafa:zarafa /etc/zarafa/ssl/
34 - Restart Zarafa
/etc/init.d/zarafa-server restart
1 - Install OS - Choose SSH and Web Server during tasksel package selection
Make sure to enable the extra repos
2 - Configure networking
nano /etc/network/interfaces
nano /etc/resolv.conf
3 - Install MySQL
apt-get install mysql-server
4 - Create MySQL user
mysql -u root -p
CREATE USER 'zarafa'@'localhost' IDENTIFIED BY 'password';
4 - Test PHP/Apache
echo '<?php echo phpinfo(); ?>' >>/var/www/index.php
* Be sure to delete this file after successfully testing that PHP is working :: rm /var/www/index.php
5 - Install Zarafa Common Package
dpkg -i zarafa-common_7.1.2-39121_amd64.deb
6 - Install Dependencies
apt-get install libboost-system1.42.0 libboost-filesystem1.42.0 libicu44
7 - Install Zarafa Server
./install.sh
8 - Test Zarafa WebAccess
http://<ip address>/webaccess/
9 - Grant priveleges (documentation was wrong)
mysql -u root -p
GRANT alter, alter routine, create, create routine, delete, drop, index, insert, lock tables, select, update ON zarafa.* TO 'zarafa'@'localhost' IDENTIFIED BY 'password';
10 - Restart Zarafa Server
/etc/init.d/zarafa-server restart
13 - Create Public Store
zarafa-admin -s
* If you the message 'The server is not running, or not accessable through file:///var/run/zarafa.' try restarting the Zarafa Server
14 - Verify Public Store was created successfully
zarafa-admin -s
* Should tell you: 'Unable to create store, public already exists'
15 - Create OU in AD for Zarafa users
16 - Install ADS plugin on DC
* Make sure the user is part of the Schema Admins group
* Right click, Run as Administrator
* View the Properties of a user and verify the Zarafa tab is available in AD Users and Computer snap-in
17 - Change user store in server.cfg to use LDAP (Need to work on using LDAPS for LDAP over SSL)
nano /etc/zarafa/server.cfg
user_plugin = ldap
18 - Verify the user plugin path is set correctly for x86_64 systems
plugin_path = /usr/lib64/zarafa
19 - Create AD user that Zarafa will use to bind to the LDAP database (need to figure out the least priveleged permissions for this to work)
Create the user in the same OU or Container that the rest of the Zarafa users will be in
20 - Configure Zarafa to use ADS for user store
nano /etc/zarafa/ldap.active-directory.cfg
21 - Configure AD user for LDAP bind (Must be in LDAP DN format)
nano /etc/zarafa/ldap.active-directory.cfg
ldap_bind_user = cn=Zarafa,ou=ZarafaUsers,dc=domain,dc=local
* Make sure none of the CN's in the DN contain spaces
ldap_bind_passwd = password
22 - Set the LDAP search base
ldap_search_base = ou=ZarafaUsers,dc=domain,dc=local
23 - Rename the LDAP config.
mv /etc/zarafa/ldap.active-directory.cfg /etc/zarafa/ldap.cfg
24 - Restart Zarafa Server
/etc/init.d/zarafa-server restart
25 - Test that you can authenticate to Zarafa webaccess with an AD account
26 - Install Postfix
apt-get install postfix postfix-ldap
* Choose Internet Site during setup
27 - Add MX record to DNS server
28 - Postfix main.cf config
http://doc.zarafa.com/7.1/Administrator_Manual/en-US/html-single/#_MTAIntegration
nano /etc/postfix/main.cf
echo 'virtual_mailbox_domains = domain.local' >> /etc/postfix/main.cf
echo 'virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf' >> /etc/postfix/main.cf
echo 'virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf, ldap:/etc/postfix/ldap-groups.cf' >> /etc/postfix/main.cf
echo 'virtual_transport = lmtp:127.0.0.1:2003' >> /etc/postfix/main.cf
29 - Configure Postfix for LDAP authentication
touch /etc/postfix/ldap-users.cf
nano ldap-users.cf
server_host = 192.168.0.100
search_base = ou=Users,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
scope = sub
query_filter = (&(objectClass=user)(mail=%s))
result_attribute = mail
touch /etc/postfix/ldap-groups.cf
server_host = 192.168.0.100
search_base = ou=groups,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
query_filter = (&(objectclass=group)(mail=%s))
leaf_result_attribute = mail
special_result_attribute = member
touch /etc/postfix/ldap-aliases.cf
server_host = 192.168.0.100
search_base = ou=Users,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
scope = sub
query_filter = (&(objectClass=user)(otherMailbox=%s))
result_attribute = mail
30 - Restart services for changes to take effect
/etc/init.d/postfix restart
/etc/init.d/zarafa-dagent restart
31 - Configure the Dagent to start at boot time
update-rc.d zarafa-dagent defaults
## Hardening Zarafa ##
32 - Configure Zarafa to run as non-root
addgroup --system zarafa
adduser --system --home /dev/null --no-create-home \
--ingroup zarafa \
--disabled-password --gecos 'Zarafa services' \
--shell /bin/false zarafa
chown -R zarafa:zarafa /var/log/zarafa
chmod -R 710 /var/log/zarafa/
33 - Setup Certificate CA for SSL
mkdir /etc/zarafa/ssl
chmod -R 700 /etc/zarafa/ssl
cd /etc/zarafa/ssl
sh /usr/share/doc/zarafa/ssl-certificates.sh server
* Organizational Unit names must be different
* No public key is needed
nano /etc/zarafa/server.cfg
* Configure SSL settings
cp /etc/zarafa/ssl/demoCA/cacert.pem /etc/zarafa/ssl
chown -R zarafa:zarafa /etc/zarafa/ssl/
34 - Restart Zarafa
/etc/init.d/zarafa-server restart
Subscribe to:
Posts (Atom)