Установка пакетов

yum -y update
yum -y install wget epel-release 
cd /etc/yum.repos.d
wget http://obs.kolabsys.com/repositories/Kolab:/3.4/CentOS_7/Kolab:3.4.repo
wget http://obs.kolabsys.com/repositories/Kolab:/3.4:/Updates/CentOS_7/Kolab:3.4:Updates.repo

gpg --keyserver pgp.mit.edu --recv-key 0x446D5A45
gpg --export --armor devel@lists.kolab.org > devel.asc
rpm --import devel.asc
rm devel.asc

yum -y install kolab

Установка Kolab

echo "mail.example.org" > /etc/hostname

adduser dirsrv

setup-kolab

Please supply a password for the LDAP administrator user 'admin', used to login
to the graphical console of 389 Directory server.

Administrator password [sQnPqqaKInB2ObB]: 

Please supply a password for the LDAP Directory Manager user, which is the
administrator user you will be using to at least initially log in to the Web
Admin, and that Kolab uses to perform administrative tasks.

Directory Manager password [ohLY9kxxinHGOGE]: 

Please choose the system user and group the service should use to run under.
These should be existing, unprivileged, local system POSIX accounts with no
shell.

User [dirsrv]: 
Group [dirsrv]: 

This setup procedure plans to set up Kolab Groupware for the following domain
name space. This domain name is obtained from the reverse DNS entry on your
network interface. Please confirm this is the appropriate domain name space.

example.org [Y/n]: y

The standard root dn we composed for you follows. Please confirm this is the root
dn you wish to use.

dc=example,dc=org [Y/n]: y

Setup is now going to set up the 389 Directory Server. This may take a little
while (during which period there is no output and no progress indication).

Shutting down dirsrv: 
    mail...                                                [  OK  ]
Starting dirsrv: 
    mail...                                                [  OK  ]

Please supply a Cyrus Administrator password. This password is used by Kolab to
execute administrative tasks in Cyrus IMAP. You may also need the password
yourself to troubleshoot Cyrus IMAP and/or perform other administrative tasks
against Cyrus IMAP directly.

Cyrus Administrator password [0DIMW-CLUKmsNEU]: 

Please supply a Kolab Service account password. This account is used by various
services such as Postfix, and Roundcube, as anonymous binds to the LDAP server
will not be allowed.

Kolab Service password [dDGgUZAue2Y-LTW]: 
Shutting down postfix:                                     [FAILED]
Starting postfix:                                          [  OK  ]
Shutting down amavisd: The amavisd daemon is apparently not running, no PID file /var/run/amavisd/amavisd.pid
                                                           [FAILED]

Starting amavisd:                                          [  OK  ]

Stopping clamd.amavisd:                                    [FAILED]
Starting clamd.amavisd: LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************
                                                           [  OK  ]
Stopping wallaced:                                         [FAILED]
Starting wallaced:                                         [  OK  ]
Stopping mysqld:                                           [  OK  ]
Initializing MySQL database:  Installing MySQL system tables...
OK
Filling help tables...
OK

To start mysqld at boot time you have to copy
support-files/mysql.server to the right place for your system

PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL root USER !
To do so, start the server, then issue the following commands:

/usr/bin/mysqladmin -u root password 'new-password'
/usr/bin/mysqladmin -u root -h mail.example.org password 'new-password'

Alternatively you can run:
/usr/bin/mysql_secure_installation

which will also give you the option of removing the test
databases and anonymous user created by default.  This is
strongly recommended for production servers.

See the manual for more instructions.

You can start the MySQL daemon with:
cd /usr ; /usr/bin/mysqld_safe &

You can test the MySQL daemon with mysql-test-run.pl
cd /usr/mysql-test ; perl mysql-test-run.pl

Please report any problems with the /usr/bin/mysqlbug script!

                                                           [  OK  ]
Starting mysqld:                                           [  OK  ]
What MySQL server are we setting up?
 - 1: Existing MySQL server (with root password already set).
 - 2: New MySQL server (needs to be initialized).
Choice: 2

Please supply a root password for MySQL. This password will be the administrative
user for this MySQL server, and it should be kept a secret. After this setup
process has completed, Kolab is going to discard and forget about this password,
but you will need it for administrative tasks in MySQL.

MySQL root password [lhBkALCvQpocaiT]: 

Please supply a password for the MySQL user 'kolab'. This password will be used
by Kolab services, such as the Web Administration Panel.

MySQL kolab password [47rxdTc-vIk3WJ8]: 

Please supply the timezone PHP should be using. You have to use a Continent or
Country / City locality name like 'Europe/Berlin', but not just 'CEST'.

Timezone ID [UTC]: Europe/Moscow

Please supply a password for the MySQL user 'roundcube'. This password will be
used by the Roundcube webmail interface.

MySQL roundcube password [o_yUViK4oRy7SX2]: 
Stopping httpd:                                            [FAILED]
Starting httpd:                                            [  OK  ]
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
Stopping kolab-saslauthd:                                  [FAILED]
Starting kolab-saslauthd:                                  [  OK  ]
Shutting down cyrus-imapd:                                 [FAILED]
Starting cyrus-imapd:                                      [  OK  ]
Stopping kolabd:                                           [FAILED]
Starting kolabd:                                           [  OK  ]

Редактируем конфиг

Локаль

default_locale = en_US

Генерация uid'ов и имен ящиков

primary_mail = %(surname)s@%(domain)s

secondary_mail = { 
    0: {
    "{0}.{1}@{2}": "format('%(givenname)s'[0:1].capitalize(), '%(surname)s', '%(domain)s')"
    },  
    1: {
    "{0}@{1}": "format('%(uid)s', '%(domain)s')"
    },  
    2: {
    "{0}@{1}": "format('%(givenname)s.%(surname)s', '%(domain)s')"
    }   
    } 

daemon_rcpt_policy = False

Хранение почты

autocreate_folders = { 
    'Archive': {
    'quota': 0,
    },  
    'Calendar': {
    'annotations': {
    '/private/vendor/kolab/folder-type': "event.default",
    '/shared/vendor/kolab/folder-type': "event",
    }, 
...

echo "partition-default: /var/spool/imap" >> /etc/imapd.conf
echo "partition-archive: /var/spool/imap-archive" >> /etc/imapd.conf

...
    'Archive': {
    'quota': 0,
    'partition': 'archive'
    },  
...

Мультидоменная конфигурация

Настройка SSL

yum -y install  mod_ssl 

# Cоздадим цепочки для наших сертификатов

cat /etc/pki/tls/certs/mail.example.org.crt /etc/pki/tls/private/mail.example.org.key /etc/pki/tls/certs/sub.class1.server.ca.pem > /etc/pki/tls/private/mail.example.org.bundle.pem
cat /etc/pki/tls/certs/mail.example.org.crt /etc/pki/tls/certs/sub.class1.server.ca.pem > /etc/pki/tls/certs/mail.example.org.bundle.pem
cat /etc/pki/tls/certs/sub.class1.server.ca.pem > /etc/pki/tls/certs/mail.example.org.ca-chain.pem

# Настроим права
chown -R root:mail /etc/pki/tls/private
chmod 600 /etc/pki/tls/private/mail.example.org.key
chmod 750 /etc/pki/tls/private
chmod 640 /etc/pki/tls/private/*

# Добавим сертификат центра сертификации в системное хранилище
cat /etc/pki/tls/certs/sub.class1.server.ca.pem >> /etc/pki/tls/certs/ca-bundle.crt

# Настроим сертификаты в apache
sed -i -e '/SSLCertificateFile \/etc\/pki/c\SSLCertificateFile /etc/pki/tls/certs/mail.example.org.crt' /etc/httpd/conf.d/ssl.conf
sed -i -e '/SSLCertificateKeyFile \/etc\/pki/c\SSLCertificateKeyFile /etc/pki/tls/private/mail.example.org.key' /etc/httpd/conf.d/ssl.conf
sed -i -e '/SSLCertificateChainFile \/etc\/pki/c\SSLCertificateChainFile /etc/pki/tls/certs/mail.example.org.ca-chain.pem' /etc/httpd/conf.d/ssl.conf
        
# Настроим редирект на HTTPS по умолчанию
cat >> /etc/httpd/conf/httpd.conf << EOF 

<VirtualHost _default_:80>
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}\$1 [R=301,L]
</VirtualHost>
EOF

#  Настроим сертификаты в cyrus-imap
sed -r -i     -e 's|^tls_server_cert:.*|tls_server_cert: /etc/pki/tls/certs/mail.example.org.crt|g'     -e 's|^tls_server_key:.*|tls_server_key: /etc/pki/tls/private/mail.example.org.key|g'     -e 's|^tls_server_ca_file:.*|tls_server_ca_file: /etc/pki/tls/certs/mail.example.org.ca-chain.pem|g'     /etc/imapd.conf
        
# Настроим сертификаты в Postfix
postconf -e smtpd_tls_key_file=/etc/pki/tls/private/mail.example.org.key
postconf -e smtpd_tls_cert_file=/etc/pki/tls/certs/mail.example.org.crt
postconf -e smtpd_tls_CAfile=/etc/pki/tls/certs/mail.example.org.ca-chain.pem
        
# Укажем kolab-cli новую ссылку на api
sed -r -i       -e '/api_url/d'       -e "s#\[kolab_wap\]#[kolab_wap]\napi_url = https://$(hostname -f)/kolab-webadmin/api#g"       /etc/kolab/kolab.conf
          
# Настроим Roundcube
sed -i -e 's/http:/https:/' /etc/roundcubemail/libkolab.inc.php
sed -i -e 's/http:/https:/' /etc/roundcubemail/kolab_files.inc.php
sed -i -e '/^?>/d' /etc/roundcubemail/config.inc.php

# Расскажем iRony о новых ссылках для DAV-протоколов
cat >> /etc/roundcubemail/config.inc.php << EOF
# caldav/webdav
\$config['calendar_caldav_url']             = "https://%h/iRony/calendars/%u/%i";
\$config['kolab_addressbook_carddav_url']   = 'https://%h/iRony/addressbooks/%u/%i';
EOF

# Укажем Rouncdcube принудительно работать по HTTPS
cat >> /etc/roundcubemail/config.inc.php << EOF
# Force https redirect for http requests
\$config['force_https'] = true;
EOF

DKIM и SPF

Настройка доставки спама с Amavis

# отключим добавление ***spam*** в тему письма
sed -i '/^[^#]*$sa_spam_subject_tag/s/^/#/' /etc/amavisd/amavisd.conf
# включим использование префикса spam+ для доставки почты
sed -i '/^# $recipient_delimiter/s/^# //' /etc/amavisd/amavisd.conf
# разрешим доставку спама
sed -i 's/^\($final_spam_destiny.*= \).*/\1D_PASS;/' /etc/amavisd/amavisd.conf

0 4 * * *  kolab sam user/%/Spam@example.org anyone p

Защита от брутфорса с Fail2ban

yum -y install  fail2ban

cat > /etc/fail2ban/filter.d/kolab-cyrus.conf << EOF
[Definition]
failregex = (imaps|pop3s)\[[0-9]*\]: badlogin: \[<HOST>\] (plain|PLAIN|login|plaintext) .*
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/kolab-postfix.conf << EOF
[Definition]
failregex = postfix\/submission\/smtpd\[[0-9]*\]: warning: unknown\[<HOST>\]: SASL (PLAIN|LOGIN) authentication failed: authentication failure
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/kolab-roundcube.conf << EOF
[Definition]
failregex = <.*> Failed login for .* from <HOST> in session .*
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/kolab-irony.conf << EOF
[Definition]
failregex = <.*> Failed login for .* from <HOST> in session .*
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/kolab-chwala.conf << EOF
[Definition]
failregex = <.*> Failed login for .* from <HOST> in session .*
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/kolab-syncroton.conf << EOF
[Definition]
failregex = <.*> Failed login for .* from <HOST> in session .*
ignoreregex =
EOF

cat >> /etc/fail2ban/jail.conf << EOF

[kolab-cyrus]
enabled = true
filter  = kolab-cyrus
action  = iptables-multiport[name=cyrus-imap,port="143,993,110,995,4190"]
logpath = /var/log/maillog
maxretry = 5

[kolab-postfix]
enabled = true
filter  = kolab-postfix
action  = iptables-multiport[name=kolab-postfix,port="25,587"]
logpath = /var/log/maillog
maxretry = 5

[kolab-roundcube]
enabled = true
filter  = kolab-roundcube
action  = iptables-multiport[name=kolab-roundcube, port="http,https"]
logpath = /var/log/roundcubemail/userlogins
maxretry = 5

[kolab-irony]
enabled = true
filter  = kolab-irony
action  = iptables-multiport[name=kolab-irony,port="http,https"]
logpath = /var/log/iRony/userlogins
maxretry = 5

[kolab-chwala]
enabled = true
filter  = kolab-chwala
action  = iptables-multiport[name=kolab-chwala,port="http,https"]
logpath = /var/log/chwala/userlogins
maxretry = 5

[kolab-syncroton]
enabled = true
filter  = kolab-syncroton
action  = iptables-multiport[name=kolab-syncroton,port="http,https"]
logpath = /var/log/kolab-syncroton/userlogins
maxretry = 5
EOF

Настроим Roundcube

Тема по умолчанию

sed -i "s/\$config\['skin'\] = '.*';/\$config\['skin'\] = 'larry';/g" /etc/roundcubemail/config.inc.php

Плагин zipdownload

git clone https://github.com/roundcube/roundcubemail/ --depth 1 /tmp/roundcube
mv /tmp/roundcube/plugins/zipdownload/ /usr/share/roundcubemail/plugins/
rm -rf /tmp/roundcube/

sed -i "/'contextmenu',/a \            'zipdownload'," /etc/roundcubemail/config.inc.php

yum -y install php-devel zlib-devel pcre-devel gcc
pecl install zip

Kolab ActiveSync Server

Заключение

sed -i -e 's/<Directory \/>/<Directory \/>\n    RedirectMatch \^\/$ \/webmail\//g' /etc/httpd/conf/httpd.conf

Docker образ