Integration/PureFTPd.iRedMail.with.OpenLDAP/Debian
From iRedMail
(Difference between revisions)
Shake.chen (Talk | contribs) (→Restart OpenLDAP and PureFTPD Service) |
Shake.chen (Talk | contribs) (→Add LDAP FTP attributes and values for new user) |
||
| Line 149: | Line 149: | ||
adding new entry "mail=user1@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" | adding new entry "mail=user1@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" | ||
adding new entry "mail=user2@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" | adding new entry "mail=user2@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" | ||
| + | </pre>}} | ||
| + | |||
| + | |||
| + | =Config iptables= | ||
| + | |||
| + | By default the iredmail mail have not open 21 port,If you use the ftp client test, you need open the 20 and 21 port. | ||
| + | |||
| + | * Open /etc/default/iptables and set correct values: | ||
| + | {{cfg|/etc/default/iptables |<pre> | ||
| + | # http/https, smtp/smtps, pop3/pop3s, imap/imaps, ssh | ||
| + | -A INPUT -p tcp -m multiport --dport 80,443,25,465,110,995,143,993,587,465,22,20,21 -j ACCEPT # <-- Add 20 21 | ||
| + | |||
| + | </pre>}} | ||
| + | |||
| + | *Restart the iptables service | ||
| + | |||
| + | {{cmd|<pre> | ||
| + | #/etc/init.d/iptables restart | ||
</pre>}} | </pre>}} | ||
Revision as of 03:35, 29 March 2010
Contents |
Install Pure-FTPd
Install PureFTPD
| Terminal: |
#apt-get install pure-ftpd-ldap |
Find vmail user password
For security reason, we only need to use the vmail user to search ldap, not suggest use the admin to search.
vmail password was random create duiring iredmail install.you can find the password in /etc/postfix/ldap_virtual_mailbox_domains.cf
- Open /etc/postfix/ldap_virtual_mailbox_domains.cf :
| File: /etc/postfix/ldap_virtual_mailbox_domains.cf |
bind_dn = cn=vmail,dc=example,dc=com bind_pw = kZ6uB29mViWKWI9lOH3cGnF7z3Dw3B #cn=vmail password |
Config PureFTPD
- Configure PureFTPd as a standalone daemon (it is currently controlled by inetd)
Open /etc/default/pure-ftpd-common and set correct values:
| File: /etc/default/pure-ftpd-common |
#STANDALONE_OR_INETD=inetd STANDALONE_OR_INETD=standalone #change to standalone |
Open /etc/inetd.conf and comment out the ftp line::
| File: /etc/inetd.conf |
#ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/pure-ftpd-wrapper |
- Make PureFTPd chroot every virtual user in his home directory so he will not be able to browse directories and files outside his home directory.
| Terminal: |
echo "yes" > /etc/pure-ftpd/conf/ChrootEveryone |
- Make PureFTPd create a user's home directory when the user logs in and the home directory does not exist yet.
| Terminal: |
echo "yes" > /etc/pure-ftpd/conf/CreateHomeDir |
- Make that PureFTPd doesn't look up host names which can significantly speed up connections and reduce bandwidth usage.
| Terminal: |
echo "yes" > /etc/pure-ftpd/conf/DontResolve |
Config the LDAP setting for PureFTPD
- Open /etc/pure-ftpd/db/ldap.conf and change the value :
| File: /etc/pure-ftpd/db/ldap.conf |
LDAPServer localhost LDAPPort 389 LDAPBaseDN o=domains,dc=example,dc=com LDAPBindDN cn=vmail,dc=example,dc=com LDAPBindPW kZ6uB29mViWKWI9lOH3cGnF7z3Dw3B #cn=vmail password LDAPDefaultUID 1000 # <- UID of 'vmail' user. LDAPDefaultGID 1000 # <- GID of 'vmail' user. LDAPFilter (&(objectClass=PureFTPdUser)(mail=\L)(FTPStatus=enabled)) LDAPHomeDir FTPHomeDir # <- This is new attribute, we will add it LDAPVersion 3 |
Config OpenLDAP
- Get the schema modify by iredmail
| Terminal: |
#wget http://iredmail.googlecode.com/svn/trunk/extra/pureftpd.schema -P /etc/ldap/schema/ |
- Open /etc/ldap/slapd.conf :include pureftpd.schema after iredmail.schema and Add index for attributes defined in pureftpd.schema:
| File: /etc/ldap/slapd.conf |
include /etc/ldap/schema/iredmail.schema include /etc/ldap/schema/pureftpd.schema # <-- Add this line. # Default index. # index objectClass eq,pres index ou,cn,mail,surname,givenname,telephoneNumber eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # <-- Add the below #Index for FTP attrs. index FTPQuotaFiles,FTPQuotaMBytes eq,pres index FTPUploadRatio,FTPDownloadRatio eq,pres index FTPUploadBandwidth,FTPDownloadBandwidth eq,pres index FTPStatus,FTPuid,FTPgid,FTPHomeDir eq,pres |
Create FTP Home Dir
FTP data are all stored in /home/ftp/ directory.Create /home/ftp/, owner must be 'root' user.
| Terminal: |
#mkdir /home/ftp/ #ls -dl /home/ftp drwxr-xr-x 2 root root 4096 Oct 3 16:53 /home/ftp |
Restart OpenLDAP and PureFTPD Service
Make sure pure-ftpd is running:
| Terminal: |
#/etc/init.d/slapd restart #/etc/init.d/pure-ftpd-ldap restart # netstat -ntlp | grep pure-ftpd tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 12548/pure-ftpd (SE tcp6 0 0 :::21 :::* LISTEN 12548/pure-ftpd (SE |
Add LDAP FTP attributes and values for new user
use the iredmail tools quick create the user include the PureFTP attributes and values.
- Open /iRedMail-x.y.z/tools/create_mail_user_OpenLDAP.sh and set correct values:
| File: /iRedMail-x.y.z/tools/create_mail_user_OpenLDAP.sh |
LDAP_SUFFIX="dc=example,dc=com" # <- Change the LDAP suffix BINDPW='passwd' # <- The user cn=manager,dc=example,dc=com password PUREFTPD_INTEGRATION='YES' # <- Change form NO to YES,enable the pureftp inteegration |
- Run the script create a user user1 and user2. by default, the default password is same with user name.
| Terminal: |
#bash create_mail_user_OpenLDAP.sh example.com user1 user2 adding new entry "ou=Users,domainName=example.com,o=domains,dc=example,dc=com" ldapadd: Already exists (68) adding new entry "ou=Groups,domainName=example.com,o=domains,dc=example,dc=com" ldapadd: Already exists (68) adding new entry "ou=Aliases,domainName=example.com,o=domains,dc=example,dc=com" ldapadd: Already exists (68) adding new entry "mail=user1@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" adding new entry "mail=user2@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" |
Config iptables
By default the iredmail mail have not open 21 port,If you use the ftp client test, you need open the 20 and 21 port.
- Open /etc/default/iptables and set correct values:
| File: /etc/default/iptables |
# http/https, smtp/smtps, pop3/pop3s, imap/imaps, ssh -A INPUT -p tcp -m multiport --dport 80,443,25,465,110,995,143,993,587,465,22,20,21 -j ACCEPT # <-- Add 20 21 |
- Restart the iptables service
| Terminal: |
#/etc/init.d/iptables restart |
